From 82a7d7a9778a6047b2ec53fba9fd086a47e93c5a Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Tue, 29 Oct 2013 22:44:01 -0700
Subject: [PATCH 0001/1265] no semver2 so travis stops crying

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 845b22e6b06..31cb004999d 100644
--- a/package.json
+++ b/package.json
@@ -43,7 +43,7 @@
     "should": "2",
     "connect-redis": "*",
     "marked": "*",
-    "supertest": "0.8.1 - 1"
+    "supertest": ">= 0.8.1 < 1"
   },
   "keywords": [
     "express",

From 55d1a4f96463c114bb13d9dcc9fa1866ef6eb0b0 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 30 Oct 2013 20:34:16 -0700
Subject: [PATCH 0002/1265] always send ETag when content-length > 0

closes #1780
---
 lib/response.js  |  2 +-
 test/res.send.js | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/lib/response.js b/lib/response.js
index b0816b33cce..6be9ded66ba 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -132,7 +132,7 @@ res.send = function(body){
 
   // ETag support
   // TODO: W/ support
-  if (app.settings.etag && len > 1024 && 'GET' == req.method) {
+  if (app.settings.etag && len && 'GET' == req.method) {
     if (!this.get('ETag')) {
       this.set('ETag', etag(body));
     }
diff --git a/test/res.send.js b/test/res.send.js
index 52e3c5b4d82..8f631593428 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -321,6 +321,21 @@ describe('res', function(){
 
   describe('"etag" setting', function(){
     describe('when enabled', function(){
+      it('should send ETag even when content-length < 1024', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          res.send('kajdslfkasdf');
+        });
+
+        request(app)
+        .get('/')
+        .end(function(err, res){
+          res.headers.should.have.property('etag');
+          done();
+        });
+      })
+
       it('should send ETag ', function(done){
         var app = express();
 

From 2e197e2b98823e0f332c1c76e410379458c84242 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 30 Oct 2013 20:37:01 -0700
Subject: [PATCH 0003/1265] be less picky with ENOENT errors in tests

closes #1580
---
 test/res.sendfile.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/res.sendfile.js b/test/res.sendfile.js
index 5193770dbed..30c2ebe00d9 100644
--- a/test/res.sendfile.js
+++ b/test/res.sendfile.js
@@ -51,7 +51,7 @@ describe('res', function(){
       .get('/')
       .end(function(err, res){
         assert(1 == calls, 'called too many times');
-        res.text.should.equal("ENOENT, stat 'test/fixtures/nope.html'");
+        res.text.should.startWith("ENOENT, stat");
         res.statusCode.should.equal(200);
         done();
       });

From a66d6bb0341b34204549ce966e94951c8281b21d Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 30 Oct 2013 20:51:10 -0700
Subject: [PATCH 0004/1265] pin dev deps to semver compatible versions

---
 .travis.yml  |  2 ++
 package.json | 18 +++++++++---------
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index cc4dba29d95..09bd249bdaf 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -2,3 +2,5 @@ language: node_js
 node_js:
   - "0.8"
   - "0.10"
+before_install:
+  - "npm update -g npm"
\ No newline at end of file
diff --git a/package.json b/package.json
index 31cb004999d..6dc90424341 100644
--- a/package.json
+++ b/package.json
@@ -32,18 +32,18 @@
     "methods": "0.1.0",
     "send": "0.1.4",
     "cookie-signature": "1.0.1",
-    "debug": "*"
+    "debug": "0.7.3 - 1"
   },
   "devDependencies": {
-    "ejs": "*",
-    "mocha": "*",
+    "ejs": "0.8.4 - 1",
+    "mocha": "^1.13.0",
     "jade": "0.30.0",
-    "hjs": "*",
-    "stylus": "*",
-    "should": "2",
-    "connect-redis": "*",
-    "marked": "*",
-    "supertest": ">= 0.8.1 < 1"
+    "hjs": "0.0.6 - 1",
+    "stylus": "0.39.1 - 1",
+    "should": "^2.0.2",
+    "connect-redis": "^1.4.5",
+    "marked": "0.2.9 - 1",
+    "supertest": "0.8.1 - 1"
   },
   "keywords": [
     "express",

From 6e3f3887e9367543e9adb72af279bdad19e863d4 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 30 Oct 2013 20:55:11 -0700
Subject: [PATCH 0005/1265] pin deps using semver1

somebody is going to complain that they can't install stuff because
they haven't upgraded npm
---
 .travis.yml  |  4 +---
 package.json | 20 ++++++++++----------
 2 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 09bd249bdaf..a12e3f0fdeb 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,6 +1,4 @@
 language: node_js
 node_js:
   - "0.8"
-  - "0.10"
-before_install:
-  - "npm update -g npm"
\ No newline at end of file
+  - "0.10"
\ No newline at end of file
diff --git a/package.json b/package.json
index 6dc90424341..21ac882628a 100644
--- a/package.json
+++ b/package.json
@@ -32,18 +32,18 @@
     "methods": "0.1.0",
     "send": "0.1.4",
     "cookie-signature": "1.0.1",
-    "debug": "0.7.3 - 1"
+    "debug": ">= 0.7.3 < 1"
   },
   "devDependencies": {
-    "ejs": "0.8.4 - 1",
-    "mocha": "^1.13.0",
+    "ejs": ">= 0.8.4 < 1",
+    "mocha": ">= 1.13.0 < 2",
     "jade": "0.30.0",
-    "hjs": "0.0.6 - 1",
-    "stylus": "0.39.1 - 1",
-    "should": "^2.0.2",
-    "connect-redis": "^1.4.5",
-    "marked": "0.2.9 - 1",
-    "supertest": "0.8.1 - 1"
+    "hjs": ">= 0.0.6 < 1",
+    "stylus": ">= 0.39.1 < 1",
+    "should": ">= 2.0.2 < 3",
+    "connect-redis": ">= 1.4.5 < 2",
+    "marked": ">= 0.2.9 < 1",
+    "supertest": ">= 0.8.1 < 1"
   },
   "keywords": [
     "express",
@@ -66,6 +66,6 @@
     "test": "make test"
   },
   "engines": {
-    "node": "*"
+    "node": ">= 0.8.0"
   }
 }

From 661914781ed5c66f99b389320d99cb175a2c665f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Lal?= <kapouer@melix.org>
Date: Sat, 2 Nov 2013 00:39:32 +0100
Subject: [PATCH 0006/1265] semicolons

---
 lib/response.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index 6be9ded66ba..cb322448310 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -643,11 +643,11 @@ res.location = function(url){
 
   // relative
   if (!~url.indexOf('://') && 0 != url.indexOf('//')) {
-    var path
+    var path;
 
     // relative to path
     if ('.' == url[0]) {
-      path = req.originalUrl.split('?')[0]
+      path = req.originalUrl.split('?')[0];
       url =  path + ('/' == path[path.length - 1] ? '' : '/') + url;
       // relative to mount-point
     } else if ('/' != url[0]) {

From b7a38af41d517a25e2161b3800609fdb0b9ef899 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Lal?= <kapouer@melix.org>
Date: Sat, 2 Nov 2013 01:28:07 +0100
Subject: [PATCH 0007/1265] Use url.resolve to compute location header of
 relative paths

---
 lib/response.js | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index cb322448310..e160c06a0d4 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -14,6 +14,7 @@ var http = require('http')
   , cookie = require('cookie')
   , send = require('send')
   , mime = connect.mime
+  , resolve = require('url').resolve
   , basename = path.basename
   , extname = path.extname;
 
@@ -633,7 +634,8 @@ res.cookie = function(name, val, options){
 
 res.location = function(url){
   var app = this.app
-    , req = this.req;
+    , req = this.req
+    , path;
 
   // setup redirect map
   var map = { back: req.get('Referrer') || '/' };
@@ -643,12 +645,11 @@ res.location = function(url){
 
   // relative
   if (!~url.indexOf('://') && 0 != url.indexOf('//')) {
-    var path;
-
     // relative to path
     if ('.' == url[0]) {
       path = req.originalUrl.split('?')[0];
-      url =  path + ('/' == path[path.length - 1] ? '' : '/') + url;
+      path = path + ('/' == path[path.length - 1] ? '' : '/');
+      url = resolve(path, url);
       // relative to mount-point
     } else if ('/' != url[0]) {
       path = app.path();

From 9c0de236456069fbc5cd9dc8c19d98c19913b698 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Lal?= <kapouer@melix.org>
Date: Sat, 2 Nov 2013 01:29:04 +0100
Subject: [PATCH 0008/1265] Update tests expectancy of location headers

---
 test/res.location.js |  4 ++--
 test/res.redirect.js | 10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/test/res.location.js b/test/res.location.js
index 3f7a9dac06d..e4fad6acdbf 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -64,7 +64,7 @@ describe('res', function(){
         request(app)
         .get('/post/1')
         .end(function(err, res){
-          res.headers.should.have.property('location', '/post/1/./edit');
+          res.headers.should.have.property('location', '/post/1/edit');
           done();
         })
       })
@@ -81,7 +81,7 @@ describe('res', function(){
         request(app)
         .get('/post/1')
         .end(function(err, res){
-          res.headers.should.have.property('location', '/post/1/../new');
+          res.headers.should.have.property('location', '/post/new');
           done();
         })
       })
diff --git a/test/res.redirect.js b/test/res.redirect.js
index 735e3d870ee..4640719c7f3 100644
--- a/test/res.redirect.js
+++ b/test/res.redirect.js
@@ -210,17 +210,17 @@ describe('res', function(){
       request(root)
       .get('/depth1')
       .end(function(err, res){
-        res.headers.should.have.property('location', '/depth1/./index');
+        res.headers.should.have.property('location', '/depth1/index');
 
         request(root)
         .get('/depth1/depth2')
         .end(function(err, res){
-          res.headers.should.have.property('location', '/depth1/depth2/./index');
+          res.headers.should.have.property('location', '/depth1/depth2/index');
 
           request(root)
           .get('/depth1/depth2/depth3')
           .end(function(err, res){
-            res.headers.should.have.property('location', '/depth1/depth2/depth3/./index');
+            res.headers.should.have.property('location', '/depth1/depth2/depth3/index');
             done();
           })
         })
@@ -231,11 +231,11 @@ describe('res', function(){
       request(root)
       .get('/depth2')
       .end(function(err, res){
-        res.headers.should.have.property('location', '/depth2/./index');
+        res.headers.should.have.property('location', '/depth2/index');
         request(root)
         .get('/depth3')
         .end(function(err, res){
-          res.headers.should.have.property('location', '/depth3/./index');
+          res.headers.should.have.property('location', '/depth3/index');
           done();
         })
       })

From c9865b821dae889f62ae986660d4f6ffaca4c06d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Lal?= <kapouer@melix.org>
Date: Sat, 2 Nov 2013 01:29:47 +0100
Subject: [PATCH 0009/1265] Test location with leading ./ and containing ..

---
 test/res.location.js | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/test/res.location.js b/test/res.location.js
index e4fad6acdbf..b9810d312b0 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -86,6 +86,23 @@ describe('res', function(){
         })
       })
     })
+
+    describe('with leading ./ and containing ..', function(){
+      it('should construct path-relative urls', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          res.location('./skip/../../new').end();
+        });
+
+        request(app)
+        .get('/post/1')
+        .end(function(err, res){
+          res.headers.should.have.property('location', '/post/new');
+          done();
+        })
+      })
+    })
     
     describe('without leading /', function(){
       it('should construct mount-point relative urls', function(done){

From 373fa55981c88a4ad38181aead00120262f5c0af Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Sat, 9 Nov 2013 19:08:25 -0800
Subject: [PATCH 0010/1265] fix markdown example test

marked 0.2.10 adds ids to header elements now.
---
 test/acceptance/markdown.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/acceptance/markdown.js b/test/acceptance/markdown.js
index 667e73a8c10..d086992b2f5 100644
--- a/test/acceptance/markdown.js
+++ b/test/acceptance/markdown.js
@@ -7,7 +7,7 @@ describe('markdown', function(){
     it('should respond with html', function(done){
       request(app)
         .get('/')
-        .expect(/<h1>Markdown Example<\/h1>/,done)
+        .expect(/<h1[^>]*>Markdown Example<\/h1>/,done)
     })
   })
 

From cada9f61c805ed63dd01321383a45ffb8d6ecb5a Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sat, 9 Nov 2013 22:23:48 -0500
Subject: [PATCH 0011/1265] pin devDependencies using ~

If tests are passing and everything works, don't let things change out
from under us as much. Really we should do hard pinning, but will be a
bit lenient for now.
---
 package.json | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/package.json b/package.json
index 21ac882628a..3871764e022 100644
--- a/package.json
+++ b/package.json
@@ -35,15 +35,15 @@
     "debug": ">= 0.7.3 < 1"
   },
   "devDependencies": {
-    "ejs": ">= 0.8.4 < 1",
-    "mocha": ">= 1.13.0 < 2",
-    "jade": "0.30.0",
-    "hjs": ">= 0.0.6 < 1",
-    "stylus": ">= 0.39.1 < 1",
-    "should": ">= 2.0.2 < 3",
-    "connect-redis": ">= 1.4.5 < 2",
-    "marked": ">= 0.2.9 < 1",
-    "supertest": ">= 0.8.1 < 1"
+    "ejs": "~0.8.4",
+    "mocha": "~1.14.0",
+    "jade": "~0.30.0",
+    "hjs": "~0.0.6",
+    "stylus": "~0.40.0",
+    "should": "~2.0.2",
+    "connect-redis": "~1.4.5",
+    "marked": "~0.2.10",
+    "supertest": "~0.8.1"
   },
   "keywords": [
     "express",

From 89e7264e53beee9c243efcb54ceb1a20d80d59d2 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sat, 9 Nov 2013 22:30:39 -0500
Subject: [PATCH 0012/1265] pin marked devDep to protect out tests

marked has shown that it cannot be trusted with patch level changes!
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 3871764e022..2ead4ec324c 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
     "stylus": "~0.40.0",
     "should": "~2.0.2",
     "connect-redis": "~1.4.5",
-    "marked": "~0.2.10",
+    "marked": "0.2.10",
     "supertest": "~0.8.1"
   },
   "keywords": [

From f47c0d9774e1be00ec3316f496a5c1d297cc3343 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Tue, 16 Jul 2013 09:46:35 -0700
Subject: [PATCH 0013/1265] add Router.all() method

Similar to app.all() but specifically for attaching handlers to all
methods under a standalone router. This is useful for isolating routers
that require "middleware" like features for all routes managed by the
router.
---
 lib/router/index.js |  9 +++++++++
 test/Router.js      | 18 ++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/lib/router/index.js b/lib/router/index.js
index 12f112d4f06..e17ff740109 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -302,6 +302,15 @@ Router.prototype.route = function(method, path, callbacks){
   return this;
 };
 
+Router.prototype.all = function(path) {
+  var self = this;
+  var args = [].slice.call(arguments);
+  methods.forEach(function(method){
+      self.route.apply(self, [method].concat(args));
+  });
+  return this;
+};
+
 methods.forEach(function(method){
   Router.prototype[method] = function(path){
     var args = [method].concat([].slice.call(arguments));
diff --git a/test/Router.js b/test/Router.js
index a2ddd68064f..5bb49753220 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -2,6 +2,7 @@
 var express = require('../')
   , Router = express.Router
   , request = require('./support/http')
+  , methods = require('methods')
   , assert = require('assert');
 
 describe('Router', function(){
@@ -100,4 +101,21 @@ describe('Router', function(){
       router.route('get', '/foo', function(){}, function(){});
     })
   })
+
+  describe('.all', function() {
+    it('should support using .all to capture all http verbs', function() {
+      var router = new Router();
+
+      router.all('/foo', function(){});
+
+      var url = '/foo?bar=baz';
+
+      methods.forEach(function testMethod(method) {
+        var route = router.match(method, url);
+        route.constructor.name.should.equal('Route');
+        route.method.should.equal(method);
+        route.path.should.equal('/foo');
+      });
+    })
+  })
 })

From 1684a8792a5caf894d6e1b1b4d59b6d0cdaa6dc9 Mon Sep 17 00:00:00 2001
From: Rick Yakubowski <ryakubowski@gmail.com>
Date: Thu, 21 Nov 2013 14:01:56 -0500
Subject: [PATCH 0014/1265] Removed Buffer call with 'binary' encoding option
 in auth example.

According to the Node.js documentation for Buffer objects regarding the
'binary' encoding option:

"This encoding method is deprecated and should be avoided in favor of
Buffer objects where possible. This encoding will be removed in future
versions of Node."

Simply calling toString() with a 'base64' argument on the hash seems to
accomplish the same thing; this makes the code compatible with current
documentation as well as being a bit easier to follow.
---
 examples/auth/pass.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/examples/auth/pass.js b/examples/auth/pass.js
index d0ba2b20ae6..0779c814bd6 100644
--- a/examples/auth/pass.js
+++ b/examples/auth/pass.js
@@ -32,7 +32,7 @@ var iterations = 12000;
 exports.hash = function (pwd, salt, fn) {
   if (3 == arguments.length) {
     crypto.pbkdf2(pwd, salt, iterations, len, function(err, hash){
-      fn(err, (new Buffer(hash, 'binary')).toString('base64'));
+      fn(err, hash.toString('base64'));
     });
   } else {
     fn = salt;
@@ -41,8 +41,8 @@ exports.hash = function (pwd, salt, fn) {
       salt = salt.toString('base64');
       crypto.pbkdf2(pwd, salt, iterations, len, function(err, hash){
         if (err) return fn(err);
-        fn(null, salt, (new Buffer(hash, 'binary')).toString('base64'));
+        fn(null, salt, hash.toString('base64'));
       });
     });
   }
-};
\ No newline at end of file
+};

From 2f2a652bc9420f2d05ddfe914048cfe5c327d7c7 Mon Sep 17 00:00:00 2001
From: Michael Ficarra <github@michael.ficarra.me>
Date: Tue, 26 Nov 2013 13:11:15 -0600
Subject: [PATCH 0015/1265] fixes #1826: res.redirect('toString') fails with
 500

Removed the unused map and corrected the doc comment.
---
 lib/response.js | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index e160c06a0d4..25c49eedf2b 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -605,8 +605,7 @@ res.cookie = function(name, val, options){
 /**
  * Set the location header to `url`.
  *
- * The given `url` can also be the name of a mapped url, for
- * example by default express supports "back" which redirects
+ * The given `url` can also be "back", which redirects
  * to the _Referrer_ or _Referer_ headers or "/".
  *
  * Examples:
@@ -637,11 +636,8 @@ res.location = function(url){
     , req = this.req
     , path;
 
-  // setup redirect map
-  var map = { back: req.get('Referrer') || '/' };
-
-  // perform redirect
-  url = map[url] || url;
+  // "back" is an alias for the referrer
+  if(url === 'back') url = req.get('Referrer') || '/';
 
   // relative
   if (!~url.indexOf('://') && 0 != url.indexOf('//')) {

From 8a7a695836e6c2fe1145ad100a6eaae6235722e4 Mon Sep 17 00:00:00 2001
From: TJ Holowaychuk <tj@vision-media.ca>
Date: Tue, 26 Nov 2013 11:12:56 -0800
Subject: [PATCH 0016/1265] ocd

---
 lib/response.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/response.js b/lib/response.js
index 25c49eedf2b..31c79c0d5b5 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -637,7 +637,7 @@ res.location = function(url){
     , path;
 
   // "back" is an alias for the referrer
-  if(url === 'back') url = req.get('Referrer') || '/';
+  if ('back' == url) url = req.get('Referrer') || '/';
 
   // relative
   if (!~url.indexOf('://') && 0 != url.indexOf('//')) {

From a71d264d45ab6773443bdebc9f6c314b1e99a4d8 Mon Sep 17 00:00:00 2001
From: TJ Holowaychuk <tj@vision-media.ca>
Date: Tue, 26 Nov 2013 23:39:08 -0800
Subject: [PATCH 0017/1265] fix weird variable name in example

---
 examples/content-negotiation/index.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/content-negotiation/index.js b/examples/content-negotiation/index.js
index bb234984bc2..d3c0430f24f 100644
--- a/examples/content-negotiation/index.js
+++ b/examples/content-negotiation/index.js
@@ -28,8 +28,8 @@ app.get('/', function(req, res){
 // this to add a layer of abstraction
 // and make things a bit more declarative:
 
-function format(requestHandlerName) {
-  var requestHandler = require(requestHandlerName);
+function format(path) {
+  var requestHandler = require(path);
   return function(req, res){
     res.format(requestHandler);
   }

From edd39fb194eddd7baf414f2c85828474009f6662 Mon Sep 17 00:00:00 2001
From: TJ Holowaychuk <tj@vision-media.ca>
Date: Tue, 26 Nov 2013 23:39:35 -0800
Subject: [PATCH 0018/1265] fix weird variable name in example

---
 examples/content-negotiation/index.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/content-negotiation/index.js b/examples/content-negotiation/index.js
index d3c0430f24f..db5ac863121 100644
--- a/examples/content-negotiation/index.js
+++ b/examples/content-negotiation/index.js
@@ -29,9 +29,9 @@ app.get('/', function(req, res){
 // and make things a bit more declarative:
 
 function format(path) {
-  var requestHandler = require(path);
+  var obj = require(path);
   return function(req, res){
-    res.format(requestHandler);
+    res.format(obj);
   }
 }
 

From 863160ae499b056ac7ade9737ca049fa5f5cb357 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 27 Nov 2013 15:54:41 -0800
Subject: [PATCH 0019/1265] 3.4.5

---
 History.md   | 9 +++++++++
 package.json | 4 ++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index d784c26cf2b..a631c324d8a 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,12 @@
+3.4.5 / 2013-11-27
+==================
+
+ * update connect
+ * res.location: remove leading ./ #1802 @kapouer
+ * res.redirect: fix `res.redirect('toString') #1829 @michaelficarra
+ * res.send: always send ETag when content-length > 0
+ * router: add Router.all() method
+
 3.4.4 / 2013-10-29
 ==================
 
diff --git a/package.json b/package.json
index 2ead4ec324c..dedea10c238 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.4.4",
+  "version": "3.4.5",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {
@@ -22,7 +22,7 @@
     }
   ],
   "dependencies": {
-    "connect": "2.11.0",
+    "connect": "2.11.1",
     "commander": "1.3.2",
     "range-parser": "0.0.4",
     "mkdirp": "0.3.5",

From c6c71abf4d4d6b10e040d0ee9e09ce304b172fff Mon Sep 17 00:00:00 2001
From: TJ Holowaychuk <tj@vision-media.ca>
Date: Wed, 27 Nov 2013 19:46:39 -0800
Subject: [PATCH 0020/1265] change req.params to an object instead of an array

---
 lib/router/route.js | 7 ++++---
 test/app.router.js  | 8 ++++----
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/lib/router/route.js b/lib/router/route.js
index 4334c88e450..a976aab02c6 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -49,8 +49,9 @@ function Route(method, path, callbacks, options) {
 
 Route.prototype.match = function(path){
   var keys = this.keys
-    , params = this.params = []
-    , m = this.regexp.exec(path);
+    , params = this.params = {}
+    , m = this.regexp.exec(path)
+    , n = 0;
 
   if (!m) return false;
 
@@ -64,7 +65,7 @@ Route.prototype.match = function(path){
     if (key) {
       params[key.name] = val;
     } else {
-      params.push(val);
+      params[n++] = val;
     }
   }
 
diff --git a/test/app.router.js b/test/app.router.js
index 65c98c728c6..90f0315655c 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -126,8 +126,8 @@ describe('app.router', function(){
       var app = express();
 
       app.get(/^\/user\/([0-9]+)\/(view|edit)?$/, function(req, res){
-        var id = req.params.shift()
-          , op = req.params.shift();
+        var id = req.params[0]
+          , op = req.params[1];
         res.end(op + 'ing user ' + id);
       });
 
@@ -302,8 +302,8 @@ describe('app.router', function(){
       var app = express();
 
       app.get('/api/*.*', function(req, res){
-        var resource = req.params.shift()
-          , format = req.params.shift();
+        var resource = req.params[0]
+          , format = req.params[1];
         res.end(resource + ' as ' + format);
       });
 

From 606f68de021139778ca935541a9e65fcc0d1abff Mon Sep 17 00:00:00 2001
From: Ben Lewis <bennlewis@gmail.com>
Date: Thu, 28 Nov 2013 06:36:21 -0700
Subject: [PATCH 0021/1265] Grammar and punctuation fixes [ci skip]

---
 Readme.md | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/Readme.md b/Readme.md
index 44d47feeb51..e1e3f7e9862 100644
--- a/Readme.md
+++ b/Readme.md
@@ -50,14 +50,14 @@ app.listen(3000);
 
 ## Philosophy
 
-  The Express philosophy is to provide small, robust tooling for HTTP servers. Making
+  The Express philosophy is to provide small, robust tooling for HTTP servers, making
   it a great solution for single page applications, web sites, hybrids, or public
   HTTP APIs.
 
-  Built on Connect you can use _only_ what you need, and nothing more, applications
+  Built on Connect, you can use _only_ what you need, and nothing more. Applications
   can be as big or as small as you like, even a single file. Express does
   not force you to use any specific ORM or template engine. With support for over
-  14 template engines via [Consolidate.js](http://github.com/visionmedia/consolidate.js)
+  14 template engines via [Consolidate.js](http://github.com/visionmedia/consolidate.js),
   you can quickly craft your perfect framework.
 
 ## More Information
@@ -72,27 +72,27 @@ app.listen(3000);
 
 ## Viewing Examples
 
-Clone the Express repo, then install the dev dependencies to install all the example / test suite deps:
+Clone the Express repo, then install the dev dependencies to install all the example / test suite dependencies:
 
     $ git clone git://github.com/visionmedia/express.git --depth 1
     $ cd express
     $ npm install
 
-then run whichever tests you want:
+Then run whichever tests you want:
 
     $ node examples/content-negotiation
 
-You can also view live examples here
+You can also view live examples here:
 
 <a href="https://runnable.com/express" target="_blank"><img src="https://runnable.com/external/styles/assets/runnablebtn.png" style="width:67px;height:25px;"></a>
 
 ## Running Tests
 
-To run the test suite first invoke the following command within the repo, installing the development dependencies:
+To run the test suite, first invoke the following command within the repo, installing the development dependencies:
 
     $ npm install
 
-then run the tests:
+Then run the tests:
 
     $ make test
 

From 7724fc6af7b7ff636f7ae284a05d3d8500fc84d0 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Sun, 1 Dec 2013 12:21:08 -0800
Subject: [PATCH 0022/1265] 3.4.6

---
 History.md   | 5 +++++
 package.json | 4 ++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index a631c324d8a..be0b1981148 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+3.4.6 / 2013-12-01
+==================
+
+ * update connect (raw-body)
+
 3.4.5 / 2013-11-27
 ==================
 
diff --git a/package.json b/package.json
index dedea10c238..d0b1744ea49 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.4.5",
+  "version": "3.4.6",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {
@@ -22,7 +22,7 @@
     }
   ],
   "dependencies": {
-    "connect": "2.11.1",
+    "connect": "2.11.2",
     "commander": "1.3.2",
     "range-parser": "0.0.4",
     "mkdirp": "0.3.5",

From 2e68ddbae9cec2d0b22f48f35ef4da964f51949e Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Tue, 10 Dec 2013 23:52:48 -0800
Subject: [PATCH 0023/1265] expose connect.middleware using
 Object.getOwnPropertyDescriptor()

closes #1853. no tests, but it should be fine.
---
 lib/express.js | 8 ++------
 package.json   | 1 +
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/lib/express.js b/lib/express.js
index c204849e2c6..4f61cdbd4d7 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -2,6 +2,7 @@
  * Module dependencies.
  */
 
+var merge = require('merge-descriptors');
 var connect = require('connect')
   , proto = require('./application')
   , Route = require('./router/route')
@@ -43,12 +44,7 @@ function createApplication() {
  * for example `express.logger` etc.
  */
 
-for (var key in connect.middleware) {
-  Object.defineProperty(
-      exports
-    , key
-    , Object.getOwnPropertyDescriptor(connect.middleware, key));
-}
+merge(exports, connect.middleware);
 
 /**
  * Error on createServer().
diff --git a/package.json b/package.json
index d0b1744ea49..648f51940f2 100644
--- a/package.json
+++ b/package.json
@@ -32,6 +32,7 @@
     "methods": "0.1.0",
     "send": "0.1.4",
     "cookie-signature": "1.0.1",
+    "merge-descriptors": "0.0.1",
     "debug": ">= 0.7.3 < 1"
   },
   "devDependencies": {

From 7c6882234e44234ac048f6c8f44f75a1a6a9be88 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Tue, 10 Dec 2013 23:54:07 -0800
Subject: [PATCH 0024/1265] bump connect, mocha, and should

---
 package.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index 648f51940f2..b107c06b1f8 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
     }
   ],
   "dependencies": {
-    "connect": "2.11.2",
+    "connect": "2.12.0",
     "commander": "1.3.2",
     "range-parser": "0.0.4",
     "mkdirp": "0.3.5",
@@ -37,11 +37,11 @@
   },
   "devDependencies": {
     "ejs": "~0.8.4",
-    "mocha": "~1.14.0",
+    "mocha": "~1.15.1",
     "jade": "~0.30.0",
     "hjs": "~0.0.6",
     "stylus": "~0.40.0",
-    "should": "~2.0.2",
+    "should": "~2.1.1",
     "connect-redis": "~1.4.5",
     "marked": "0.2.10",
     "supertest": "~0.8.1"

From 34c83d7d29d3acb718cac56aa4361c3a320fd80d Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Tue, 10 Dec 2013 23:57:39 -0800
Subject: [PATCH 0025/1265] 3.4.7

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index be0b1981148..82ece29e8d7 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+3.4.7 / 2013-12-10
+==================
+
+ * update connect
+
 3.4.6 / 2013-12-01
 ==================
 
diff --git a/package.json b/package.json
index b107c06b1f8..7fd89cb7489 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.4.6",
+  "version": "3.4.7",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From 7b0dca0f9c7eb0c79fbc4e487a06357ab35347e7 Mon Sep 17 00:00:00 2001
From: Alex Kocharin <alex@kocharin.ru>
Date: Thu, 12 Dec 2013 02:49:16 +0400
Subject: [PATCH 0026/1265] throw 400 in case of malformed paths

---
 lib/router/route.js | 12 ++++++---
 lib/utils.js        | 19 --------------
 test/app.router.js  | 60 ++++++++++++++++++++++++++++++++-------------
 3 files changed, 52 insertions(+), 39 deletions(-)

diff --git a/lib/router/route.js b/lib/router/route.js
index 4334c88e450..d7ec88d2ea3 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -57,9 +57,15 @@ Route.prototype.match = function(path){
   for (var i = 1, len = m.length; i < len; ++i) {
     var key = keys[i - 1];
 
-    var val = 'string' == typeof m[i]
-      ? utils.decode(m[i])
-      : m[i];
+    try {
+      var val = 'string' == typeof m[i]
+        ? decodeURIComponent(m[i])
+        : m[i];
+    } catch(e) {
+      var err = new Error("Failed to decode param '" + m[i] + "'");
+      err.status = 400;
+      throw err;
+    }
 
     if (key) {
       params[key.name] = val;
diff --git a/lib/utils.js b/lib/utils.js
index f19061bc273..b30873a8ac7 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -312,22 +312,3 @@ exports.pathRegexp = function(path, keys, sensitive, strict) {
     .replace(/\*/g, '(.*)');
   return new RegExp('^' + path + '$', sensitive ? '' : 'i');
 }
-
-
-/**
- * Decodes a URI component. Returns
- * the original string if the component
- * is malformed.
- *
- * @param  {String} str
- * @return {String}
- * @api private
- */
-
-exports.decode = function(str) {
-  try {
-    return decodeURIComponent(str);
-  } catch (e) {
-    return str;
-  }
-}
diff --git a/test/app.router.js b/test/app.router.js
index 65c98c728c6..c2bd082c720 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -27,28 +27,54 @@ describe('app.router', function(){
     });
   })
 
-  it('should decode params', function(done){
-    var app = express();
+  describe('decode querystring', function(){
+    it('should decode correct params', function(done){
+      var app = express();
 
-    app.get('/:name', function(req, res, next){
-      res.send(req.params.name);
-    });
+      app.get('/:name', function(req, res, next){
+        res.send(req.params.name);
+      });
 
-    request(app)
-    .get('/foo%2Fbar')
-    .expect('foo/bar', done);
-  })
+      request(app)
+      .get('/foo%2Fbar')
+      .expect('foo/bar', done);
+    })
 
-  it('should accept params in malformed paths', function(done) {
-    var app = express();
+    it('should not accept params in malformed paths', function(done) {
+      var app = express();
 
-    app.get('/:name', function(req, res, next){
-      res.send(req.params.name);
-    });
+      app.get('/:name', function(req, res, next){
+        res.send(req.params.name);
+      });
 
-    request(app)
-    .get('/%foobar')
-    .expect('%foobar', done);
+      request(app)
+      .get('/%foobar')
+      .expect(400, done);
+    })
+
+    it('should not decode spaces', function(done) {
+      var app = express();
+
+      app.get('/:name', function(req, res, next){
+        res.send(req.params.name);
+      });
+
+      request(app)
+      .get('/foo+bar')
+      .expect('foo+bar', done);
+    })
+
+    it('should work with unicode', function(done) {
+      var app = express();
+
+      app.get('/:name', function(req, res, next){
+        res.send(req.params.name);
+      });
+
+      request(app)
+      .get('/%ce%b1')
+      .expect('\u03b1', done);
+    })
   })
 
   it('should be .use()able', function(done){

From a0c1ac7b454b7ab4161f63ed1f5ca2c40eebe4bb Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Wed, 18 Dec 2013 10:16:56 -0500
Subject: [PATCH 0027/1265] add license field to package.json

close #1862
---
 package.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 7fd89cb7489..4f84768965d 100644
--- a/package.json
+++ b/package.json
@@ -68,5 +68,6 @@
   },
   "engines": {
     "node": ">= 0.8.0"
-  }
+  },
+  "license": "MIT"
 }

From 85834fd146392dafb98211dc89472fe3ed2f329d Mon Sep 17 00:00:00 2001
From: Matt Copperwaite <mattcopp+git@gmail.com>
Date: Fri, 20 Dec 2013 11:39:31 +0000
Subject: [PATCH 0028/1265] Error message now describes where the view was not
 able to be found. Useful for debugging.

---
 lib/application.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/application.js b/lib/application.js
index d5806f0be26..865e1e02b1d 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -490,7 +490,7 @@ app.render = function(name, options, fn){
     });
 
     if (!view.path) {
-      var err = new Error('Failed to lookup view "' + name + '"');
+      var err = new Error('Failed to lookup view "' + name + '" in views directory "' + view.root + '"');
       err.view = view;
       return fn(err);
     }

From 9a45f7bd3d46c4278561c8bc6f254ce272ac0046 Mon Sep 17 00:00:00 2001
From: TJ Holowaychuk <tj@vision-media.ca>
Date: Fri, 20 Dec 2013 19:34:59 -0800
Subject: [PATCH 0029/1265] add new benchmarks (to match koa)

---
 Makefile                 |  6 +++---
 benchmarks/Makefile      | 13 +++++++++++++
 benchmarks/middleware.js | 23 +++++++++++++++++++++++
 benchmarks/run           | 16 ++++++++++++++++
 support/bench            | 32 --------------------------------
 5 files changed, 55 insertions(+), 35 deletions(-)
 create mode 100644 benchmarks/Makefile
 create mode 100644 benchmarks/middleware.js
 create mode 100755 benchmarks/run
 delete mode 100755 support/bench

diff --git a/Makefile b/Makefile
index d0cb2a017b2..a1f33a70292 100644
--- a/Makefile
+++ b/Makefile
@@ -24,11 +24,11 @@ test-cov: lib-cov
 lib-cov:
 	@jscoverage lib lib-cov
 
-benchmark:
-	@./support/bench
+bench:
+	@$(MAKE) -C benchmarks
 
 clean:
 	rm -f coverage.html
 	rm -fr lib-cov
 
-.PHONY: test test-unit test-acceptance benchmark clean
+.PHONY: test test-unit test-acceptance bench clean
diff --git a/benchmarks/Makefile b/benchmarks/Makefile
new file mode 100644
index 00000000000..baf0d6fce92
--- /dev/null
+++ b/benchmarks/Makefile
@@ -0,0 +1,13 @@
+
+all:
+	@./run 1 middleware
+	@./run 5 middleware
+	@./run 10 middleware
+	@./run 15 middleware
+	@./run 20 middleware
+	@./run 30 middleware
+	@./run 50 middleware
+	@./run 100 middleware
+	@echo
+
+.PHONY: all
diff --git a/benchmarks/middleware.js b/benchmarks/middleware.js
new file mode 100644
index 00000000000..3aa7a8b4ac7
--- /dev/null
+++ b/benchmarks/middleware.js
@@ -0,0 +1,23 @@
+
+var http = require('http');
+var express = require('..');
+var app = express();
+
+// number of middleware
+
+var n = parseInt(process.env.MW || '1', 10);
+console.log('  %s middleware', n);
+
+while (n--) {
+  app.use(function(req, res, next){
+    next();
+  });
+}
+
+var body = new Buffer('Hello World');
+
+app.use(function(req, res, next){
+  res.send(body);
+});
+
+app.listen(3333);
diff --git a/benchmarks/run b/benchmarks/run
new file mode 100755
index 00000000000..fc84f27f1ec
--- /dev/null
+++ b/benchmarks/run
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+echo
+MW=$1 node --harmony-generators $2 &
+pid=$!
+
+sleep 2
+
+wrk 'http://localhost:3333/?foo[bar]=baz' \
+  -d 3 \
+  -c 50 \
+  -t 4 \
+  | grep 'Requests/sec' \
+  | awk '{ print "  " $2 }'
+
+kill $pid
diff --git a/support/bench b/support/bench
deleted file mode 100755
index 207c18199b5..00000000000
--- a/support/bench
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-
-NODE_ENV=production node ./support/app &
-pid=$!
-
-bench() {
-  ab -n 5000 -c 50 -k -q http://127.0.0.1:8000$1 \
-    | grep "Requests per" \
-    | cut -d ' ' -f 7 \
-    | xargs echo "$2:"
-}
-
-bench_conditional() {
-  ab -n 5000 -c 50 -H "If-None-Match: $3" -k -q http://127.0.0.1:8000$1 \
-    | grep "Requests per" \
-    | cut -d ' ' -f 7 \
-    | xargs echo "$2:"
-}
-
-sleep .5
-bench / "Hello World"
-bench /blog "Mounted Hello World"
-bench /blog/admin "Mounted 2 Hello World"
-bench /middleware "Middleware"
-bench /match "Router"
-bench /render "Render"
-bench /json "JSON tiny"
-bench /json/15 "JSON small"
-bench /json/50 "JSON medium"
-bench /json/150 "JSON large"
-
-kill -9 $pid
\ No newline at end of file

From e9851672eb77232b1a92a6ee4a282cc69465480c Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Fri, 20 Dec 2013 21:15:17 -0800
Subject: [PATCH 0030/1265] bench: remove --harmony-generators flag

---
 benchmarks/run | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/benchmarks/run b/benchmarks/run
index fc84f27f1ec..5a8c1956beb 100755
--- a/benchmarks/run
+++ b/benchmarks/run
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
 echo
-MW=$1 node --harmony-generators $2 &
+MW=$1 node $2 &
 pid=$!
 
 sleep 2

From fcbe53ddb5fd64063d8d65c3faf8a4c2e7dd5237 Mon Sep 17 00:00:00 2001
From: Matt Copperwaite <mattcopp+git@gmail.com>
Date: Sat, 21 Dec 2013 17:34:59 +0000
Subject: [PATCH 0031/1265] Added appropriate test for more descriptive render
 error

---
 test/app.render.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/app.render.js b/test/app.render.js
index 4f79e163e3f..a9586c77c68 100644
--- a/test/app.render.js
+++ b/test/app.render.js
@@ -59,7 +59,7 @@ describe('app', function(){
         var app = express();
         app.set('views', __dirname + '/fixtures');
         app.render('rawr.jade', function(err){
-          err.message.should.equal('Failed to lookup view "rawr.jade"');
+          err.message.should.equal('Failed to lookup view "rawr.jade" in views directory "' + __dirname + '/fixtures"');
           done();
         });
       })

From 3baca251f0888fa66cb23be1b1bb301ff4341f0a Mon Sep 17 00:00:00 2001
From: TJ Holowaychuk <tj@vision-media.ca>
Date: Sun, 22 Dec 2013 08:57:04 -0800
Subject: [PATCH 0032/1265] use 8 threads for benchmarks

---
 benchmarks/run | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/benchmarks/run b/benchmarks/run
index 5a8c1956beb..93b5bc52ff2 100755
--- a/benchmarks/run
+++ b/benchmarks/run
@@ -9,7 +9,7 @@ sleep 2
 wrk 'http://localhost:3333/?foo[bar]=baz' \
   -d 3 \
   -c 50 \
-  -t 4 \
+  -t 8 \
   | grep 'Requests/sec' \
   | awk '{ print "  " $2 }'
 

From 00a3b01f391f472e895934f6ccad65c9f59a34a8 Mon Sep 17 00:00:00 2001
From: yosssi <yoshida.keiji.84@gmail.com>
Date: Mon, 23 Dec 2013 22:13:05 +0900
Subject: [PATCH 0033/1265] Changed `doctype 5` to `doctype html` on the
 example file because the former was deprecated on Jade version 1.0.0.

---
 examples/view-locals/layout.jade | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/view-locals/layout.jade b/examples/view-locals/layout.jade
index a800c9791e6..5616cfaf7c2 100644
--- a/examples/view-locals/layout.jade
+++ b/examples/view-locals/layout.jade
@@ -1,4 +1,4 @@
-doctype 5
+doctype html
 html
   head
     title= title

From cfd93b752936087a58c8d0616bbae3cd699e42fc Mon Sep 17 00:00:00 2001
From: Bent Cardan <bent@shakelaw.com>
Date: Mon, 23 Dec 2013 13:03:21 -0500
Subject: [PATCH 0034/1265] update express jade layout generator

update doctype
---
 bin/express | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/express b/bin/express
index 69b65d98080..cb979288397 100755
--- a/bin/express
+++ b/bin/express
@@ -74,7 +74,7 @@ var users = [
  */
 
 var jadeLayout = [
-    'doctype 5'
+    'doctype html'
   , 'html'
   , '  head'
   , '    title= title'

From 476f8deb07d48aac146a94262ea65b7991d840be Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Fri, 3 Jan 2014 02:33:00 -0800
Subject: [PATCH 0035/1265] remove binary

---
 History.md   |   5 +
 bin/express  | 423 ---------------------------------------------------
 package.json |   6 -
 3 files changed, 5 insertions(+), 429 deletions(-)
 delete mode 100755 bin/express

diff --git a/History.md b/History.md
index 82ece29e8d7..47559cf35d0 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+4.0.0 /
+==================
+
+ * remove binary (moved to [express-generator](https://github.com/expressjs/generator))
+
 3.4.7 / 2013-12-10
 ==================
 
diff --git a/bin/express b/bin/express
deleted file mode 100755
index cb979288397..00000000000
--- a/bin/express
+++ /dev/null
@@ -1,423 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Module dependencies.
- */
-
-var program = require('commander')
-  , mkdirp = require('mkdirp')
-  , pkg = require('../package.json')
-  , version = pkg.version
-  , os = require('os')
-  , fs = require('fs');
-
-// CLI
-
-program
-  .version(version)
-  .usage('[options] [dir]')
-  .option('-s, --sessions', 'add session support')
-  .option('-e, --ejs', 'add ejs engine support (defaults to jade)')
-  .option('-J, --jshtml', 'add jshtml engine support (defaults to jade)')
-  .option('-H, --hogan', 'add hogan.js engine support')
-  .option('-c, --css <engine>', 'add stylesheet <engine> support (less|stylus) (defaults to plain css)')
-  .option('-f, --force', 'force on non-empty directory')
-  .parse(process.argv);
-
-// Path
-
-var path = program.args.shift() || '.';
-
-// end-of-line code
-
-var eol = os.EOL
-
-// Template engine
-
-program.template = 'jade';
-if (program.ejs) program.template = 'ejs';
-if (program.jshtml) program.template = 'jshtml';
-if (program.hogan) program.template = 'hjs';
-
-/**
- * Routes index template.
- */
-
-var index = [
-    ''
-  , '/*'
-  , ' * GET home page.'
-  , ' */'
-  , ''
-  , 'exports.index = function(req, res){'
-  , '  res.render(\'index\', { title: \'Express\' });'
-  , '};'
-].join(eol);
-
-/**
- * Routes users template.
- */
-
-var users = [
-    ''
-  , '/*'
-  , ' * GET users listing.'
-  , ' */'
-  , ''
-  , 'exports.list = function(req, res){'
-  , '  res.send("respond with a resource");'
-  , '};'
-].join(eol);
-
-/**
- * Jade layout template.
- */
-
-var jadeLayout = [
-    'doctype html'
-  , 'html'
-  , '  head'
-  , '    title= title'
-  , '    link(rel=\'stylesheet\', href=\'/stylesheets/style.css\')'
-  , '  body'
-  , '    block content'
-].join(eol);
-
-/**
- * Jade index template.
- */
-
-var jadeIndex = [
-    'extends layout'
-  , ''
-  , 'block content'
-  , '  h1= title'
-  , '  p Welcome to #{title}'
-].join(eol);
-
-/**
- * EJS index template.
- */
-
-var ejsIndex = [
-    '<!DOCTYPE html>'
-  , '<html>'
-  , '  <head>'
-  , '    <title><%= title %></title>'
-  , '    <link rel=\'stylesheet\' href=\'/stylesheets/style.css\' />'
-  , '  </head>'
-  , '  <body>'
-  , '    <h1><%= title %></h1>'
-  , '    <p>Welcome to <%= title %></p>'
-  , '  </body>'
-  , '</html>'
-].join(eol);
-
-/**
- * JSHTML layout template.
- */
-
-var jshtmlLayout = [
-    '<!DOCTYPE html>'
-  , '<html>'
-  , '  <head>'
-  , '    <title> @write(title) </title>'
-  , '    <link rel=\'stylesheet\' href=\'/stylesheets/style.css\' />'
-  , '  </head>'
-  , '  <body>'
-  , '    @write(body)'
-  , '  </body>'
-  , '</html>'
-].join(eol);
-
-/**
- * JSHTML index template.
- */
-
-var jshtmlIndex = [
-    '<h1>@write(title)</h1>'
-  , '<p>Welcome to @write(title)</p>'
-].join(eol);
-
-/**
- * Hogan.js index template.
- */
-var hoganIndex = [
-    '<!DOCTYPE html>'
-  , '<html>'
-  , '  <head>'
-  , '    <title>{{ title }}</title>'
-  , '    <link rel=\'stylesheet\' href=\'/stylesheets/style.css\' />'
-  , '  </head>'
-  , '  <body>'
-  , '    <h1>{{ title }}</h1>'
-  , '    <p>Welcome to {{ title }}</p>'
-  , '  </body>'
-  , '</html>'
-].join(eol);
-
-/**
- * Default css template.
- */
-
-var css = [
-    'body {'
-  , '  padding: 50px;'
-  , '  font: 14px "Lucida Grande", Helvetica, Arial, sans-serif;'
-  , '}'
-  , ''
-  , 'a {'
-  , '  color: #00B7FF;'
-  , '}'
-].join(eol);
-
-/**
- * Default less template.
- */
-
-var less = [
-    'body {'
-  , '  padding: 50px;'
-  , '  font: 14px "Lucida Grande", Helvetica, Arial, sans-serif;'
-  , '}'
-  , ''
-  , 'a {'
-  , '  color: #00B7FF;'
-  , '}'
-].join(eol);
-
-/**
- * Default stylus template.
- */
-
-var stylus = [
-    'body'
-  , '  padding: 50px'
-  , '  font: 14px "Lucida Grande", Helvetica, Arial, sans-serif'
-  , 'a'
-  , '  color: #00B7FF'
-].join(eol);
-
-/**
- * App template.
- */
-
-var app = [
-    ''
-  , '/**'
-  , ' * Module dependencies.'
-  , ' */'
-  , ''
-  , 'var express = require(\'express\');'
-  , 'var routes = require(\'./routes\');'
-  , 'var user = require(\'./routes/user\');'
-  , 'var http = require(\'http\');'
-  , 'var path = require(\'path\');'
-  , ''
-  , 'var app = express();'
-  , ''
-  , '// all environments'
-  , 'app.set(\'port\', process.env.PORT || 3000);'
-  , 'app.set(\'views\', path.join(__dirname, \'views\'));'
-  , 'app.set(\'view engine\', \':TEMPLATE\');'
-  , 'app.use(express.favicon());'
-  , 'app.use(express.logger(\'dev\'));'
-  , 'app.use(express.json());'
-  , 'app.use(express.urlencoded());'
-  , 'app.use(express.methodOverride());{sess}'
-  , 'app.use(app.router);{css}'
-  , 'app.use(express.static(path.join(__dirname, \'public\')));'
-  , ''
-  , '// development only'
-  , 'if (\'development\' == app.get(\'env\')) {'
-  , '  app.use(express.errorHandler());'
-  , '}'
-  , ''
-  , 'app.get(\'/\', routes.index);'
-  , 'app.get(\'/users\', user.list);'
-  , ''
-  , 'http.createServer(app).listen(app.get(\'port\'), function(){'
-  , '  console.log(\'Express server listening on port \' + app.get(\'port\'));'
-  , '});'
-  , ''
-].join(eol);
-
-// Generate application
-
-(function createApplication(path) {
-  emptyDirectory(path, function(empty){
-    if (empty || program.force) {
-      createApplicationAt(path);
-    } else {
-      program.confirm('destination is not empty, continue? ', function(ok){
-        if (ok) {
-          process.stdin.destroy();
-          createApplicationAt(path);
-        } else {
-          abort('aborting');
-        }
-      });
-    }
-  });
-})(path);
-
-/**
- * Create application at the given directory `path`.
- *
- * @param {String} path
- */
-
-function createApplicationAt(path) {
-  console.log();
-  process.on('exit', function(){
-    console.log();
-    console.log('   install dependencies:');
-    console.log('     $ cd %s && npm install', path);
-    console.log();
-    console.log('   run the app:');
-    console.log('     $ node app');
-    console.log();
-  });
-
-  mkdir(path, function(){
-    mkdir(path + '/public');
-    mkdir(path + '/public/javascripts');
-    mkdir(path + '/public/images');
-    mkdir(path + '/public/stylesheets', function(){
-      switch (program.css) {
-        case 'less':
-          write(path + '/public/stylesheets/style.less', less);
-          break;
-        case 'stylus':
-          write(path + '/public/stylesheets/style.styl', stylus);
-          break;
-        default:
-          write(path + '/public/stylesheets/style.css', css);
-      }
-    });
-
-    mkdir(path + '/routes', function(){
-      write(path + '/routes/index.js', index);
-      write(path + '/routes/user.js', users);
-    });
-
-    mkdir(path + '/views', function(){
-      switch (program.template) {
-        case 'ejs':
-          write(path + '/views/index.ejs', ejsIndex);
-          break;
-        case 'jade':
-          write(path + '/views/layout.jade', jadeLayout);
-          write(path + '/views/index.jade', jadeIndex);
-          break;
-        case 'jshtml':
-          write(path + '/views/layout.jshtml', jshtmlLayout);
-          write(path + '/views/index.jshtml', jshtmlIndex);
-          break;
-        case 'hjs':
-          write(path + '/views/index.hjs', hoganIndex);
-          break;
-
-      }
-    });
-
-    // CSS Engine support
-    switch (program.css) {
-      case 'less':
-        app = app.replace('{css}', eol + 'app.use(require(\'less-middleware\')({ src: path.join(__dirname, \'public\') }));');
-        break;
-      case 'stylus':
-        app = app.replace('{css}', eol + 'app.use(require(\'stylus\').middleware(path.join(__dirname, \'public\')));');
-        break;
-      default:
-        app = app.replace('{css}', '');
-    }
-
-    // Session support
-    app = app.replace('{sess}', program.sessions
-      ? eol + 'app.use(express.cookieParser(\'your secret here\'));' + eol + 'app.use(express.session());'
-      : '');
-
-    // Template support
-    app = app.replace(':TEMPLATE', program.template);
-
-    // package.json
-    var pkg = {
-        name: 'application-name'
-      , version: '0.0.1'
-      , private: true
-      , scripts: { start: 'node app.js' }
-      , dependencies: {
-        express: version
-      }
-    }
-
-    if (program.template) pkg.dependencies[program.template] = '*';
-
-    // CSS Engine support
-    switch (program.css) {
-      case 'less':
-        pkg.dependencies['less-middleware'] = '*';
-        break;
-      default:
-        if (program.css) {
-          pkg.dependencies[program.css] = '*';
-        }
-    }
-
-    write(path + '/package.json', JSON.stringify(pkg, null, 2));
-    write(path + '/app.js', app);
-  });
-}
-
-/**
- * Check if the given directory `path` is empty.
- *
- * @param {String} path
- * @param {Function} fn
- */
-
-function emptyDirectory(path, fn) {
-  fs.readdir(path, function(err, files){
-    if (err && 'ENOENT' != err.code) throw err;
-    fn(!files || !files.length);
-  });
-}
-
-/**
- * echo str > path.
- *
- * @param {String} path
- * @param {String} str
- */
-
-function write(path, str) {
-  fs.writeFile(path, str);
-  console.log('   \x1b[36mcreate\x1b[0m : ' + path);
-}
-
-/**
- * Mkdir -p.
- *
- * @param {String} path
- * @param {Function} fn
- */
-
-function mkdir(path, fn) {
-  mkdirp(path, 0755, function(err){
-    if (err) throw err;
-    console.log('   \033[36mcreate\033[0m : ' + path);
-    fn && fn();
-  });
-}
-
-/**
- * Exit with the given `str`.
- *
- * @param {String} str
- */
-
-function abort(str) {
-  console.error(str);
-  process.exit(1);
-}
diff --git a/package.json b/package.json
index 4f84768965d..d928c75bf1d 100644
--- a/package.json
+++ b/package.json
@@ -23,9 +23,7 @@
   ],
   "dependencies": {
     "connect": "2.12.0",
-    "commander": "1.3.2",
     "range-parser": "0.0.4",
-    "mkdirp": "0.3.5",
     "cookie": "0.1.0",
     "buffer-crc32": "0.2.1",
     "fresh": "0.2.0",
@@ -58,10 +56,6 @@
     "api"
   ],
   "repository": "git://github.com/visionmedia/express",
-  "main": "index",
-  "bin": {
-    "express": "./bin/express"
-  },
   "scripts": {
     "prepublish": "npm prune",
     "test": "make test"

From cec0c06a70c874298761282984573475293c0071 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Fri, 3 Jan 2014 02:50:09 -0800
Subject: [PATCH 0036/1265] refactor req.is and req.accepts*

---
 History.md                    |  10 ++
 lib/request.js                | 146 ++++++-----------------------
 lib/utils.js                  | 121 ------------------------
 package.json                  |   2 +
 test/req.accepted.js          |  37 --------
 test/req.acceptedCharsets.js  |  37 --------
 test/req.acceptedEncodings.js |  37 --------
 test/req.acceptedLanguages.js |  37 --------
 test/req.accepts.js           |  13 ---
 test/req.acceptsCharset.js    |   6 +-
 test/req.is.js                |  21 +++--
 test/utils.js                 | 171 ----------------------------------
 12 files changed, 53 insertions(+), 585 deletions(-)
 delete mode 100644 test/req.accepted.js
 delete mode 100644 test/req.acceptedCharsets.js
 delete mode 100644 test/req.acceptedEncodings.js
 delete mode 100644 test/req.acceptedLanguages.js

diff --git a/History.md b/History.md
index 47559cf35d0..2a9c83420d7 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,16 @@
 ==================
 
  * remove binary (moved to [express-generator](https://github.com/expressjs/generator))
+ * refactor
+   - `req.accepts*` with [accepts](https://github.com/expressjs/accepts)
+   - `req.is` with [type-is](https://github.com/expressjs/type-is)
+ * change
+   - `req.accepts[x]` -> `req.accepts[x]s`
+ * remove
+   - `req.acceptedEncodings`
+   - `req.accepted`
+   - `req.acceptedLanguages`
+   - `req.acceptedCharsets`
 
 3.4.7 / 2013-12-10
 ==================
diff --git a/lib/request.js b/lib/request.js
index 3d41617ebdf..062014e7d38 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -3,6 +3,8 @@
  * Module dependencies.
  */
 
+var accepts = require('accepts');
+var typeis = require('type-is');
 var http = require('http')
   , utils = require('./utils')
   , connect = require('connect')
@@ -56,6 +58,8 @@ req.header = function(name){
 };
 
 /**
+ * To do: update docs.
+ *
  * Check if the given `type(s)` is acceptable, returning
  * the best match when true, otherwise `undefined`, in which
  * case you should respond with 406 "Not Acceptable".
@@ -99,9 +103,9 @@ req.header = function(name){
  * @api public
  */
 
-req.accepts = function(type){
-  var args = arguments.length > 1 ? [].slice.apply(arguments) : type;
-  return utils.accepts(args, this.get('Accept'));
+req.accepts = function(){
+  var accept = accepts(this);
+  return accept.types.apply(accept, arguments);
 };
 
 /**
@@ -112,11 +116,15 @@ req.accepts = function(type){
  * @api public
  */
 
-req.acceptsEncoding = function(encoding){
-  return !! ~this.acceptedEncodings.indexOf(encoding);
+req.acceptsEncoding = // backwards compatibility
+req.acceptsEncodings = function(){
+  var accept = accepts(this);
+  return accept.encodings.apply(accept, arguments);
 };
 
 /**
+ * To do: update docs.
+ *
  * Check if the given `charset` is acceptable,
  * otherwise you should respond with 406 "Not Acceptable".
  *
@@ -125,14 +133,15 @@ req.acceptsEncoding = function(encoding){
  * @api public
  */
 
-req.acceptsCharset = function(charset){
-  var accepted = this.acceptedCharsets;
-  return accepted.length
-    ? !! ~accepted.indexOf(charset)
-    : true;
+req.acceptsCharset = // backwards compatibility
+req.acceptsCharsets = function(){
+  var accept = accepts(this);
+  return accept.charsets.apply(accept, arguments);
 };
 
 /**
+ * To do: update docs.
+ *
  * Check if the given `lang` is acceptable,
  * otherwise you should respond with 406 "Not Acceptable".
  *
@@ -141,11 +150,10 @@ req.acceptsCharset = function(charset){
  * @api public
  */
 
-req.acceptsLanguage = function(lang){
-  var accepted = this.acceptedLanguages;
-  return accepted.length
-    ? !! ~accepted.indexOf(lang)
-    : true;
+req.acceptsLanguage = // backwards compatibility
+req.acceptsLanguages = function(lang){
+  var accept = accepts(this);
+  return accept.languages.apply(accept, arguments);
 };
 
 /**
@@ -174,98 +182,6 @@ req.range = function(size){
   return parseRange(size, range);
 };
 
-/**
- * Return an array of encodings.
- *
- * Examples:
- *
- *     ['gzip', 'deflate']
- *
- * @return {Array}
- * @api public
- */
-
-req.__defineGetter__('acceptedEncodings', function(){
-  var accept = this.get('Accept-Encoding');
-  return accept
-    ? accept.trim().split(/ *, */)
-    : [];
-});
-
-/**
- * Return an array of Accepted media types
- * ordered from highest quality to lowest.
- *
- * Examples:
- *
- *     [ { value: 'application/json',
- *         quality: 1,
- *         type: 'application',
- *         subtype: 'json' },
- *       { value: 'text/html',
- *         quality: 0.5,
- *         type: 'text',
- *         subtype: 'html' } ]
- *
- * @return {Array}
- * @api public
- */
-
-req.__defineGetter__('accepted', function(){
-  var accept = this.get('Accept');
-  return accept
-    ? utils.parseAccept(accept)
-    : [];
-});
-
-/**
- * Return an array of Accepted languages
- * ordered from highest quality to lowest.
- *
- * Examples:
- *
- *     Accept-Language: en;q=.5, en-us
- *     ['en-us', 'en']
- *
- * @return {Array}
- * @api public
- */
-
-req.__defineGetter__('acceptedLanguages', function(){
-  var accept = this.get('Accept-Language');
-  return accept
-    ? utils
-      .parseParams(accept)
-      .map(function(obj){
-        return obj.value;
-      })
-    : [];
-});
-
-/**
- * Return an array of Accepted charsets
- * ordered from highest quality to lowest.
- *
- * Examples:
- *
- *     Accept-Charset: iso-8859-5;q=.2, unicode-1-1;q=0.8
- *     ['unicode-1-1', 'iso-8859-5']
- *
- * @return {Array}
- * @api public
- */
-
-req.__defineGetter__('acceptedCharsets', function(){
-  var accept = this.get('Accept-Charset');
-  return accept
-    ? utils
-      .parseParams(accept)
-      .map(function(obj){
-        return obj.value;
-      })
-    : [];
-});
-
 /**
  * Return the value of param `name` when present or `defaultValue`.
  *
@@ -319,19 +235,9 @@ req.param = function(name, defaultValue){
  * @api public
  */
 
-req.is = function(type){
-  var ct = this.get('Content-Type');
-  if (!ct) return false;
-  ct = ct.split(';')[0];
-  if (!~type.indexOf('/')) type = mime.lookup(type);
-  if (~type.indexOf('*')) {
-    type = type.split('/');
-    ct = ct.split('/');
-    if ('*' == type[0] && type[1] == ct[1]) return true;
-    if ('*' == type[1] && type[0] == ct[0]) return true;
-    return false;
-  }
-  return !! ~ct.indexOf(type);
+req.is = function(types){
+  if (!Array.isArray(types)) types = [].slice.call(arguments);
+  return typeis(this, types);
 };
 
 /**
diff --git a/lib/utils.js b/lib/utils.js
index b30873a8ac7..139cf1c1562 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -110,127 +110,6 @@ exports.normalizeTypes = function(types){
   return ret;
 };
 
-/**
- * Return the acceptable type in `types`, if any.
- *
- * @param {Array} types
- * @param {String} str
- * @return {String}
- * @api private
- */
-
-exports.acceptsArray = function(types, str){
-  // accept anything when Accept is not present
-  if (!str) return types[0];
-
-  // parse
-  var accepted = exports.parseAccept(str)
-    , normalized = exports.normalizeTypes(types)
-    , len = accepted.length;
-
-  for (var i = 0; i < len; ++i) {
-    for (var j = 0, jlen = types.length; j < jlen; ++j) {
-      if (exports.accept(normalized[j], accepted[i])) {
-        return types[j];
-      }
-    }
-  }
-};
-
-/**
- * Check if `type(s)` are acceptable based on
- * the given `str`.
- *
- * @param {String|Array} type(s)
- * @param {String} str
- * @return {Boolean|String}
- * @api private
- */
-
-exports.accepts = function(type, str){
-  if ('string' == typeof type) type = type.split(/ *, */);
-  return exports.acceptsArray(type, str);
-};
-
-/**
- * Check if `type` array is acceptable for `other`.
- *
- * @param {Object} type
- * @param {Object} other
- * @return {Boolean}
- * @api private
- */
-
-exports.accept = function(type, other){
-  var t = type.value.split('/');
-  return (t[0] == other.type || '*' == other.type)
-    && (t[1] == other.subtype || '*' == other.subtype)
-    && paramsEqual(type.params, other.params);
-};
-
-/**
- * Check if accept params are equal.
- *
- * @param {Object} a
- * @param {Object} b
- * @return {Boolean}
- * @api private
- */
-
-function paramsEqual(a, b){
-  return !Object.keys(a).some(function(k) {
-    return a[k] != b[k];
-  });
-}
-
-/**
- * Parse accept `str`, returning
- * an array objects containing
- * `.type` and `.subtype` along
- * with the values provided by
- * `parseQuality()`.
- *
- * @param {Type} name
- * @return {Type}
- * @api private
- */
-
-exports.parseAccept = function(str){
-  return exports
-    .parseParams(str)
-    .map(function(obj){
-      var parts = obj.value.split('/');
-      obj.type = parts[0];
-      obj.subtype = parts[1];
-      return obj;
-    });
-};
-
-/**
- * Parse quality `str`, returning an
- * array of objects with `.value`,
- * `.quality` and optional `.params`
- *
- * @param {String} str
- * @return {Array}
- * @api private
- */
-
-exports.parseParams = function(str){
-  return str
-    .split(/ *, */)
-    .map(acceptParams)
-    .filter(function(obj){
-      return obj.quality;
-    })
-    .sort(function(a, b){
-      if (a.quality === b.quality) {
-        return a.originalIndex - b.originalIndex;
-      } else {
-        return b.quality - a.quality;
-      }
-    });
-};
 
 /**
  * Parse accept params `str` returning an
diff --git a/package.json b/package.json
index d928c75bf1d..bd55647739f 100644
--- a/package.json
+++ b/package.json
@@ -23,6 +23,8 @@
   ],
   "dependencies": {
     "connect": "2.12.0",
+    "accepts": "1.0.0",
+    "type-is": "1.0.0",
     "range-parser": "0.0.4",
     "cookie": "0.1.0",
     "buffer-crc32": "0.2.1",
diff --git a/test/req.accepted.js b/test/req.accepted.js
deleted file mode 100644
index 79f122a8020..00000000000
--- a/test/req.accepted.js
+++ /dev/null
@@ -1,37 +0,0 @@
-
-var express = require('../')
-  , request = require('./support/http');
-
-describe('req', function(){
-  describe('.accepted', function(){
-    it('should return an array of accepted media types', function(done){
-      var app = express();
-
-      app.use(function(req, res){
-        req.accepted[0].value.should.equal('application/json');
-        req.accepted[1].value.should.equal('text/html');
-        res.end();
-      });
-
-      request(app)
-      .get('/')
-      .set('Accept', 'text/html;q=.5, application/json')
-      .expect(200, done);
-    })
-
-    describe('when Accept is not present', function(){
-      it('should default to []', function(done){
-        var app = express();
-
-        app.use(function(req, res){
-          req.accepted.should.have.length(0);
-          res.end();
-        });
-
-        request(app)
-        .get('/')
-        .expect(200, done);
-      })
-    })
-  })
-})
diff --git a/test/req.acceptedCharsets.js b/test/req.acceptedCharsets.js
deleted file mode 100644
index 2bc3e0d94e4..00000000000
--- a/test/req.acceptedCharsets.js
+++ /dev/null
@@ -1,37 +0,0 @@
-
-var express = require('../')
-  , request = require('./support/http');
-
-describe('req', function(){
-  describe('.acceptedCharsets', function(){
-    it('should return an array of accepted charsets', function(done){
-      var app = express();
-
-      app.use(function(req, res){
-        req.acceptedCharsets[0].should.equal('unicode-1-1');
-        req.acceptedCharsets[1].should.equal('iso-8859-5');
-        res.end();
-      });
-
-      request(app)
-      .get('/')
-      .set('Accept-Charset', 'iso-8859-5;q=.2, unicode-1-1;q=0.8')
-      .expect(200, done);
-    })
-
-    describe('when Accept-Charset is not present', function(){
-      it('should default to []', function(done){
-        var app = express();
-
-        app.use(function(req, res){
-          req.acceptedCharsets.should.have.length(0);
-          res.end();
-        });
-
-        request(app)
-        .get('/')
-        .expect(200, done);
-      })
-    })
-  })
-})
diff --git a/test/req.acceptedEncodings.js b/test/req.acceptedEncodings.js
deleted file mode 100644
index 50ac9c2d7eb..00000000000
--- a/test/req.acceptedEncodings.js
+++ /dev/null
@@ -1,37 +0,0 @@
-
-var express = require('../')
-  , request = require('./support/http');
-
-describe('req', function(){
-  describe('.acceptedEncodings', function(){
-    it('should return an array of accepted encodings', function(done){
-      var app = express();
-
-      app.use(function(req, res){
-        req.acceptedEncodings.should.eql(['gzip', 'deflate']);
-        res.end();
-      });
-
-      request(app)
-      .get('/')
-      .set('Accept-Encoding', ' gzip, deflate')
-      .expect(200, done);
-    })
-
-    describe('when Accept-Encoding is not present', function(){
-      it('should default to []', function(done){
-        var app = express();
-
-        app.use(function(req, res){
-          req.acceptedEncodings.should.have.length(0);
-          res.end();
-        });
-
-        request(app)
-        .get('/')
-        .set('Accept-Encoding', '')
-        .expect(200, done);
-      })
-    })
-  })
-})
diff --git a/test/req.acceptedLanguages.js b/test/req.acceptedLanguages.js
deleted file mode 100644
index 9325d955696..00000000000
--- a/test/req.acceptedLanguages.js
+++ /dev/null
@@ -1,37 +0,0 @@
-
-var express = require('../')
-  , request = require('./support/http');
-
-describe('req', function(){
-  describe('.acceptedLanguages', function(){
-    it('should return an array of accepted languages', function(done){
-      var app = express();
-
-      app.use(function(req, res){
-        req.acceptedLanguages[0].should.equal('en-us');
-        req.acceptedLanguages[1].should.equal('en');
-        res.end();
-      });
-
-      request(app)
-      .get('/')
-      .set('Accept-Language', 'en;q=.5, en-us')
-      .expect(200, done);
-    })
-
-    describe('when Accept-Language is not present', function(){
-      it('should default to []', function(done){
-        var app = express();
-
-        app.use(function(req, res){
-          req.acceptedLanguages.should.have.length(0);
-          res.end();
-        });
-
-        request(app)
-        .get('/')
-        .expect(200, done);
-      })
-    })
-  })
-})
diff --git a/test/req.accepts.js b/test/req.accepts.js
index a8fc13b55d9..aeaf2258e56 100644
--- a/test/req.accepts.js
+++ b/test/req.accepts.js
@@ -43,19 +43,6 @@ describe('req', function(){
     })
   })
 
-  it('should accept a comma-delimited list of types', function(done){
-    var app = express();
-
-    app.use(function(req, res, next){
-      res.end(req.accepts('json, html'));
-    });
-
-    request(app)
-    .get('/')
-    .set('Accept', 'text/html')
-    .expect('html', done);
-  })
-
   it('should accept an argument list of type names', function(done){
     var app = express();
 
diff --git a/test/req.acceptsCharset.js b/test/req.acceptsCharset.js
index 1db237d4c60..4b18a4c8675 100644
--- a/test/req.acceptsCharset.js
+++ b/test/req.acceptsCharset.js
@@ -9,7 +9,7 @@ describe('req', function(){
         var app = express();
 
         app.use(function(req, res, next){
-          res.end(req.acceptsCharset('utf-8') ? 'yes' : 'no');
+          res.end(req.acceptsCharsets('utf-8') ? 'yes' : 'no');
         });
 
         request(app)
@@ -23,7 +23,7 @@ describe('req', function(){
         var app = express();
 
         app.use(function(req, res, next){
-          res.end(req.acceptsCharset('utf-8') ? 'yes' : 'no');
+          res.end(req.acceptsCharsets('utf-8') ? 'yes' : 'no');
         });
 
         request(app)
@@ -36,7 +36,7 @@ describe('req', function(){
         var app = express();
 
         app.use(function(req, res, next){
-          res.end(req.acceptsCharset('utf-8') ? 'yes' : 'no');
+          res.end(req.acceptsCharsets('utf-8') ? 'yes' : 'no');
         });
 
         request(app)
diff --git a/test/req.is.js b/test/req.is.js
index b51e6c81e44..5a4c336b186 100644
--- a/test/req.is.js
+++ b/test/req.is.js
@@ -4,8 +4,11 @@ var express = require('../')
 
 function req(ct) {
   var req = {
-      headers: { 'content-type': ct }
-    , __proto__: express.request
+    headers: {
+      'content-type': ct,
+      'transfer-encoding': 'chunked'
+    },
+    __proto__: express.request
   };
 
   return req;
@@ -15,7 +18,7 @@ describe('req.is()', function(){
   it('should ignore charset', function(){
     req('application/json; charset=utf-8')
     .is('json')
-    .should.be.true;
+    .should.equal('json');
   })
 
   describe('when content-type is not present', function(){
@@ -30,7 +33,7 @@ describe('req.is()', function(){
     it('should lookup the mime type', function(){
       req('application/json')
       .is('json')
-      .should.be.true;
+      .should.equal('json');
 
       req('text/html')
       .is('json')
@@ -42,7 +45,7 @@ describe('req.is()', function(){
     it('should match', function(){
       req('application/json')
       .is('application/json')
-      .should.be.true;
+      .should.equal('application/json');
 
       req('image/jpeg')
       .is('application/json')
@@ -54,7 +57,7 @@ describe('req.is()', function(){
     it('should match', function(){
       req('application/json')
       .is('*/json')
-      .should.be.true;
+      .should.equal('application/json');
 
       req('image/jpeg')
       .is('*/json')
@@ -65,7 +68,7 @@ describe('req.is()', function(){
       it('should match', function(){
         req('text/html; charset=utf-8')
         .is('*/html')
-        .should.be.true;
+        .should.equal('text/html');
 
         req('text/plain; charset=utf-8')
         .is('*/html')
@@ -78,7 +81,7 @@ describe('req.is()', function(){
     it('should match', function(){
       req('image/png')
       .is('image/*')
-      .should.be.true;
+      .should.equal('image/png');
 
       req('text/html')
       .is('image/*')
@@ -89,7 +92,7 @@ describe('req.is()', function(){
       it('should match', function(){
         req('text/html; charset=utf-8')
         .is('text/*')
-        .should.be.true;
+        .should.equal('text/html');
 
         req('something/html; charset=utf-8')
         .is('text/*')
diff --git a/test/utils.js b/test/utils.js
index 649ad12ab9b..e6b826dd833 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -48,174 +48,3 @@ describe('utils.escape(html)', function(){
       .should.equal('&lt;script&gt;foo &amp; &quot;bar&quot;')
   })
 })
-
-describe('utils.parseParams(str)', function(){
-  it('should default quality to 1', function(){
-    utils.parseParams('text/html')
-      .should.eql([{ value: 'text/html', quality: 1, params: {}, originalIndex: 0 }]);
-  })
-
-  it('should parse qvalues', function(){
-    utils.parseParams('text/html; q=0.5')
-      .should.eql([{ value: 'text/html', quality: 0.5, params: {}, originalIndex: 0 }]);
-
-    utils.parseParams('text/html; q=.2')
-      .should.eql([{ value: 'text/html', quality: 0.2, params: {}, originalIndex: 0 }]);
-  })
-
-  it('should parse accept parameters', function(){
-    utils.parseParams('application/json; ver=2.0')
-      .should.eql([{ value: 'application/json', quality: 1, params: {ver: "2.0"}, originalIndex: 0 }]);
-
-    utils.parseParams('text/html; q=0.5; level=2')
-      .should.eql([{ value: 'text/html', quality: 0.5, params: {level: "2"}, originalIndex: 0 }]);
-    utils.parseParams('text/html;q=.2;ver=beta')
-      .should.eql([{ value: 'text/html', quality: 0.2, params: {ver: "beta"}, originalIndex: 0 }]);
-  })
-
-  it('should work with messed up whitespace', function(){
-    utils.parseParams('text/html   ;  q =   .2')
-      .should.eql([{ value: 'text/html', quality: 0.2, params: {}, originalIndex: 0 }]);
-  })
-
-  it('should work with multiples', function(){
-    var str = 'da, en;q=.5, en-gb;q=.8';
-    var arr = utils.parseParams(str);
-    arr[0].value.should.equal('da');
-    arr[1].value.should.equal('en-gb');
-    arr[2].value.should.equal('en');
-  })
-
-  it('should work with long lists', function(){
-    var str = 'en, nl, fr, de, ja, it, es, pt, pt-PT, da, fi, nb, sv, ko, zh-Hans, zh-Hant, ru, pl';
-    var arr = utils.parseParams(str).map(function(o){ return o.value });
-    arr.should.eql(str.split(', '));
-  })
-
-  it('should sort by quality', function(){
-    var str = 'text/plain;q=.2, application/json, text/html;q=0.5';
-    var arr = utils.parseParams(str);
-    arr[0].value.should.equal('application/json');
-    arr[1].value.should.equal('text/html');
-    arr[2].value.should.equal('text/plain');
-  })
-
-  it('should exclude those with a quality of 0', function(){
-    var str = 'text/plain;q=.2, application/json, text/html;q=0';
-    var arr = utils.parseParams(str);
-    arr.should.have.length(2);
-  })
-})
-
-describe('utils.parseAccept(str)', function(){
-  it('should provide .type', function(){
-    var arr = utils.parseAccept('text/html');
-    arr[0].type.should.equal('text');
-  })
-
-  it('should provide .subtype', function(){
-    var arr = utils.parseAccept('text/html');
-    arr[0].subtype.should.equal('html');
-  })
-})
-
-describe('utils.accepts(type, str)', function(){
-  describe('when a string is not given', function(){
-    it('should return the value', function(){
-      utils.accepts('text/html')
-        .should.equal('text/html');
-    })
-  })
-
-  describe('when a string is empty', function(){
-    it('should return the value', function(){
-      utils.accepts('text/html', '')
-        .should.equal('text/html');
-    })
-  })
-
-  describe('when */* is given', function(){
-    it('should return the value', function(){
-      utils.accepts('text/html', 'text/plain, */*')
-        .should.equal('text/html');
-    })
-  })
-
-  describe('when an array is given', function(){
-    it('should return the best match', function(){
-      utils.accepts(['html', 'json'], 'text/plain, application/json')
-        .should.equal('json');
-
-      utils.accepts(['html', 'application/json'], 'text/plain, application/json')
-        .should.equal('application/json');
-
-      utils.accepts(['text/html', 'application/json'], 'application/json;q=.5, text/html')
-        .should.equal('text/html');
-    })
-  })
-
-  describe('when a comma-delimited list is give', function(){
-    it('should behave like an array', function(){
-      utils.accepts('html, json', 'text/plain, application/json')
-        .should.equal('json');
-
-      utils.accepts('html, application/json', 'text/plain, application/json')
-        .should.equal('application/json');
-
-      utils.accepts('text/html, application/json', 'application/json;q=.5, text/html')
-        .should.equal('text/html');
-    })
-  })
-
-  describe('when accepting type/subtype', function(){
-    it('should return the value when present', function(){
-      utils.accepts('text/html', 'text/plain, text/html')
-        .should.equal('text/html');
-    })
-
-    it('should return undefined otherwise', function(){
-      assert(null == utils.accepts('text/html', 'text/plain, application/json'));
-    })
-  })
-
-  describe('when accepting */subtype', function(){
-    it('should return the value when present', function(){
-      utils.accepts('text/html', 'text/*')
-        .should.equal('text/html');
-    })
-
-    it('should return undefined otherwise', function(){
-      assert(null == utils.accepts('text/html', 'image/*'));
-    })
-  })
-
-  describe('when accepting type/*', function(){
-    it('should return the value when present', function(){
-      utils.accepts('text/html', '*/html')
-        .should.equal('text/html');
-    })
-
-    it('should return undefined otherwise', function(){
-      assert(null == utils.accepts('text/html', '*/json'));
-    })
-  })
-
-  describe('when an extension is given', function(){
-    it('should return the value when present', function(){
-      utils.accepts('html', 'text/html, application/json')
-        .should.equal('html');
-    })
-
-    it('should return undefined otherwise', function(){
-      assert(null == utils.accepts('html', 'text/plain, application/json'));
-    })
-
-    it('should support *', function(){
-      utils.accepts('html', 'text/*')
-        .should.equal('html');
-
-      utils.accepts('html', '*/html')
-        .should.equal('html');
-    })
-  })
-})

From 26c0be4c4e45276334b8e9afc2e26b3773f443cc Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Fri, 3 Jan 2014 02:57:24 -0800
Subject: [PATCH 0037/1265] improve history.md

---
 History.md | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/History.md b/History.md
index 2a9c83420d7..8f410e9bb88 100644
--- a/History.md
+++ b/History.md
@@ -1,17 +1,14 @@
 4.0.0 /
 ==================
 
- * remove binary (moved to [express-generator](https://github.com/expressjs/generator))
- * refactor
+ * remove:
+   - express(1) - moved to [express-generator](https://github.com/expressjs/generator)
+   - `req.accepted*` - use `req.accepts*()` instead
+ * change:
+   - `req.accepts*` -> `req.accepts*s` - i.e. `req.acceptsEncoding` -> `req.acceptsEncodings`
+ * refactor:
    - `req.accepts*` with [accepts](https://github.com/expressjs/accepts)
    - `req.is` with [type-is](https://github.com/expressjs/type-is)
- * change
-   - `req.accepts[x]` -> `req.accepts[x]s`
- * remove
-   - `req.acceptedEncodings`
-   - `req.accepted`
-   - `req.acceptedLanguages`
-   - `req.acceptedCharsets`
 
 3.4.7 / 2013-12-10
 ==================

From 7018d3d0e61a70a8720d6871af48191b0d6307ff Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Fri, 3 Jan 2014 03:00:48 -0800
Subject: [PATCH 0038/1265] history: req.params

---
 History.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/History.md b/History.md
index 8f410e9bb88..e345f051db2 100644
--- a/History.md
+++ b/History.md
@@ -6,6 +6,7 @@
    - `req.accepted*` - use `req.accepts*()` instead
  * change:
    - `req.accepts*` -> `req.accepts*s` - i.e. `req.acceptsEncoding` -> `req.acceptsEncodings`
+   - `req.params` is now an object instead of an array
  * refactor:
    - `req.accepts*` with [accepts](https://github.com/expressjs/accepts)
    - `req.is` with [type-is](https://github.com/expressjs/type-is)

From a36eeb96f3d9836a7205d54bcfea2e8a124781a7 Mon Sep 17 00:00:00 2001
From: Veselin Todorov <veselin@veselin.bg>
Date: Fri, 3 Jan 2014 19:47:57 +0200
Subject: [PATCH 0039/1265] update the tests to show a difference between
 `send(null)` and `send(undefiend)`

---
 test/res.send.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/test/res.send.js b/test/res.send.js
index 8f631593428..9de7cbd3bb4 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -14,6 +14,7 @@ describe('res', function(){
 
       request(app)
       .get('/')
+      .expect('Content-Length', '0')
       .expect('', done);
     })
   })
@@ -28,7 +29,10 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('', done);
+      .expect('', function(req, res){
+        res.header.should.not.have.property('content-length');
+        done();
+      });
     })
   })
 

From 951c70496b7d6e6c1938ab326b37e5f2445485af Mon Sep 17 00:00:00 2001
From: Oliver Salzburg <oliver.salzburg@gmail.com>
Date: Sat, 4 Jan 2014 17:50:27 +0100
Subject: [PATCH 0040/1265] Value parameter of app.set() should be typed
 optional Object

---
 lib/application.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/application.js b/lib/application.js
index 865e1e02b1d..6cae2183110 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -242,7 +242,7 @@ app.param = function(name, fn){
  * Mounted servers inherit their parent server's settings.
  *
  * @param {String} setting
- * @param {String} val
+ * @param {Object} [val]
  * @return {Server} for chaining
  * @api public
  */

From 28af21baeb7e8c77ea618b106ae3d0893875de4e Mon Sep 17 00:00:00 2001
From: Oliver Salzburg <oliver.salzburg@gmail.com>
Date: Sat, 4 Jan 2014 22:05:19 +0100
Subject: [PATCH 0041/1265] Value parameter of app.set() is now typed optional
 mixed

---
 lib/application.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/application.js b/lib/application.js
index 6cae2183110..076607573e3 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -242,7 +242,7 @@ app.param = function(name, fn){
  * Mounted servers inherit their parent server's settings.
  *
  * @param {String} setting
- * @param {Object} [val]
+ * @param {*} [val]
  * @return {Server} for chaining
  * @api public
  */

From 38996b30b1df2924655f153a06022d7845fcb6e8 Mon Sep 17 00:00:00 2001
From: Matheus Azzi <matheuslazzi@gmail.com>
Date: Sun, 5 Jan 2014 01:14:38 -0200
Subject: [PATCH 0042/1265] Update layout.jade

---
 examples/jade/views/layout.jade | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/jade/views/layout.jade b/examples/jade/views/layout.jade
index 614d674a483..300cdc78473 100644
--- a/examples/jade/views/layout.jade
+++ b/examples/jade/views/layout.jade
@@ -1,5 +1,5 @@
-!!! 5
+doctype html
 html
   include header
   body
-    block content
\ No newline at end of file
+    block content

From 8c3f153dd464aeac054521650fb7fd52e54e0522 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sat, 11 Jan 2014 10:52:38 -0500
Subject: [PATCH 0043/1265] remove use of app.configure for view cache setting

---
 lib/application.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/application.js b/lib/application.js
index 076607573e3..c40ae4a6fbe 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -86,9 +86,9 @@ app.defaultConfiguration = function(){
     this.set('json spaces', 2);
   });
 
-  this.configure('production', function(){
+  if (this.get('env') === 'production') {
     this.enable('view cache');
-  });
+  };
 };
 
 /**

From 8c059469fd1e009211cdf3aafa925e941eea4b00 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sat, 11 Jan 2014 10:42:15 -0500
Subject: [PATCH 0044/1265] No 'json spaces' by default

Json rendering can be handled by user tools or overridden in their own
app to behave as desired. Minimizes the use of magic env settings.
---
 lib/application.js |  4 ----
 test/res.json.js   | 13 +++----------
 test/res.jsonp.js  |  9 +--------
 3 files changed, 4 insertions(+), 22 deletions(-)

diff --git a/lib/application.js b/lib/application.js
index c40ae4a6fbe..2aae86db7d7 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -82,10 +82,6 @@ app.defaultConfiguration = function(){
   this.set('views', process.cwd() + '/views');
   this.set('jsonp callback name', 'callback');
 
-  this.configure('development', function(){
-    this.set('json spaces', 2);
-  });
-
   if (this.get('env') === 'production') {
     this.enable('view cache');
   };
diff --git a/test/res.json.js b/test/res.json.js
index b439f244bcb..5712fc3e63f 100644
--- a/test/res.json.js
+++ b/test/res.json.js
@@ -52,7 +52,7 @@ describe('res', function(){
         })
       })
     })
-    
+
     describe('when given an object', function(){
       it('should respond with json', function(done){
         var app = express();
@@ -95,14 +95,7 @@ describe('res', function(){
     })
 
     describe('"json spaces" setting', function(){
-      it('should default to 2 in development', function(){
-        process.env.NODE_ENV = 'development';
-        var app = express();
-        app.get('json spaces').should.equal(2);
-        process.env.NODE_ENV = 'test';
-      })
-
-      it('should be undefined otherwise', function(){
+      it('should be undefined by default', function(){
         var app = express();
         assert(undefined === app.get('json spaces'));
       })
@@ -125,7 +118,7 @@ describe('res', function(){
       })
     })
   })
-  
+
   describe('.json(status, object)', function(){
     it('should respond with json and set the .statusCode', function(done){
       var app = express();
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 76f07c1fc1f..9f7769e38a6 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -181,14 +181,7 @@ describe('res', function(){
     })
 
     describe('"json spaces" setting', function(){
-      it('should default to 2 in development', function(){
-        process.env.NODE_ENV = 'development';
-        var app = express();
-        app.get('json spaces').should.equal(2);
-        process.env.NODE_ENV = 'test';
-      })
-
-      it('should be undefined otherwise', function(){
+      it('should be undefined by default', function(){
         var app = express();
         assert(undefined === app.get('json spaces'));
       })

From 7282b50ad0dbd9553ac8170d7eeda5a5f5992c8d Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sat, 11 Jan 2014 10:42:33 -0500
Subject: [PATCH 0045/1265] remove app.configure()

---
 lib/application.js | 54 --------------------------
 test/config.env.js | 96 ----------------------------------------------
 2 files changed, 150 deletions(-)
 delete mode 100644 test/config.env.js

diff --git a/lib/application.js b/lib/application.js
index 2aae86db7d7..d306e817f9a 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -334,60 +334,6 @@ app.disable = function(setting){
   return this.set(setting, false);
 };
 
-/**
- * Configure callback for zero or more envs,
- * when no `env` is specified that callback will
- * be invoked for all environments. Any combination
- * can be used multiple times, in any order desired.
- *
- * Examples:
- *
- *    app.configure(function(){
- *      // executed for all envs
- *    });
- *
- *    app.configure('stage', function(){
- *      // executed staging env
- *    });
- *
- *    app.configure('stage', 'production', function(){
- *      // executed for stage and production
- *    });
- *
- * Note:
- *
- *  These callbacks are invoked immediately, and
- *  are effectively sugar for the following:
- *
- *     var env = process.env.NODE_ENV || 'development';
- *
- *      switch (env) {
- *        case 'development':
- *          ...
- *          break;
- *        case 'stage':
- *          ...
- *          break;
- *        case 'production':
- *          ...
- *          break;
- *      }
- *
- * @param {String} env...
- * @param {Function} fn
- * @return {app} for chaining
- * @api public
- */
-
-app.configure = function(env, fn){
-  var envs = 'all'
-    , args = [].slice.call(arguments);
-  fn = args.pop();
-  if (args.length) envs = args;
-  if ('all' == envs || ~envs.indexOf(this.settings.env)) fn.call(this);
-  return this;
-};
-
 /**
  * Delegate `.VERB(...)` calls to `router.VERB(...)`.
  */
diff --git a/test/config.env.js b/test/config.env.js
deleted file mode 100644
index fd5d1c31b1b..00000000000
--- a/test/config.env.js
+++ /dev/null
@@ -1,96 +0,0 @@
-
-var express = require('../');
-
-describe('config', function(){
-  describe('.configure()', function(){
-    describe('when no env is given', function(){
-      it('should always execute', function(){
-        var app = express();
-        var calls = [];
-
-        app.configure(function(){
-          calls.push('all');
-        });
-
-        app.configure('test', function(){
-          calls.push('test');
-        });
-
-        app.configure('test', function(){
-          calls.push('test 2');
-        });
-
-        calls.should.eql(['all', 'test', 'test 2'])
-      })
-    })
-
-    describe('when an env is given', function(){
-      it('should only execute the matching env', function(){
-        var app = express();
-        var calls = [];
-
-        app.set('env', 'development');
-
-        app.configure('development', function(){
-          calls.push('dev');
-        });
-
-        app.configure('test', function(){
-          calls.push('test');
-        });
-
-        calls.should.eql(['dev']);
-      })
-    })
-    
-    describe('when several envs are given', function(){
-      it('should execute when matching one', function(){
-        var app = express();
-        var calls = [];
-
-        app.set('env', 'development');
-
-        app.configure('development', function(){
-          calls.push('dev');
-        });
-
-        app.configure('test', 'development', function(){
-          calls.push('dev 2');
-        });
-        
-        app.configure('development', 'test', function(){
-          calls.push('dev 3');
-        });
-        
-        app.configure('test', function(){
-          calls.push('dev 3');
-        });
-
-        calls.should.eql(['dev', 'dev 2', 'dev 3']);
-      })
-    })
-
-    it('should execute in order as defined', function(){
-      var app = express();
-      var calls = [];
-
-      app.configure(function(){
-        calls.push('all');
-      });
-      
-      app.configure('test', function(){
-        calls.push('test');
-      });
-
-      app.configure(function(){
-        calls.push('all 2');
-      });
-
-      app.configure('test', function(){
-        calls.push('test 2');
-      });
-
-      calls.should.eql(['all', 'test', 'all 2', 'test 2'])
-    })
-  })
-})
\ No newline at end of file

From dff22e9d095c5f9e848fada72e60cd801c6815ca Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sat, 11 Jan 2014 10:45:31 -0500
Subject: [PATCH 0046/1265] update history file with configure changes

---
 History.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/History.md b/History.md
index e345f051db2..f8c6bfd8364 100644
--- a/History.md
+++ b/History.md
@@ -4,9 +4,11 @@
  * remove:
    - express(1) - moved to [express-generator](https://github.com/expressjs/generator)
    - `req.accepted*` - use `req.accepts*()` instead
+   - `app.configure` - use logic in your own app code
  * change:
    - `req.accepts*` -> `req.accepts*s` - i.e. `req.acceptsEncoding` -> `req.acceptsEncodings`
    - `req.params` is now an object instead of an array
+   - `json spaces` no longer enabled by default in development
  * refactor:
    - `req.accepts*` with [accepts](https://github.com/expressjs/accepts)
    - `req.is` with [type-is](https://github.com/expressjs/type-is)

From a3b5f6d07f880298a92164fe7f0519d736524dcf Mon Sep 17 00:00:00 2001
From: Doug Patti <douglas.patti@gmail.com>
Date: Thu, 2 Jan 2014 13:05:23 -0500
Subject: [PATCH 0047/1265] prevent incorrect automatic OPTIONS responses

The router has automatic handling of OPTIONS based on the registered
routes, but if you make an OPTIONS request for an endpoint that does
not exist, then it will still return a 200 with nothing allowed.
Instead, we can let the request move on down the middleware chain. This
has two benefits: first, if the route was not defined and no other
middleware handles it, it will return with a 404. Secondly, if multiple
routers are used and a later one has the route or a custom OPTIONS
defined, the first router will not respond incorrectly.
---
 lib/router/index.js |  5 +++--
 test/app.options.js | 24 ++++++++++++++++++++++++
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/lib/router/index.js b/lib/router/index.js
index e17ff740109..cd2f2693787 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -104,7 +104,7 @@ Router.prototype._dispatch = function(req, res, next){
     req.route = route = self.matchRequest(req, i);
 
     // implied OPTIONS
-    if (!route && 'OPTIONS' == req.method) return self._options(req, res);
+    if (!route && 'OPTIONS' == req.method) return self._options(req, res, next);
 
     // no route
     if (!route) return next(err);
@@ -181,9 +181,10 @@ Router.prototype._dispatch = function(req, res, next){
  * @api private
  */
 
-Router.prototype._options = function(req, res){
+Router.prototype._options = function(req, res, next){
   var path = parse(req).pathname
     , body = this._optionsFor(path).join(',');
+  if (!body) return next();
   res.set('Allow', body).send(body);
 };
 
diff --git a/test/app.options.js b/test/app.options.js
index 836a3463c23..a6f7b65fb16 100644
--- a/test/app.options.js
+++ b/test/app.options.js
@@ -15,6 +15,30 @@ describe('OPTIONS', function(){
     .expect('GET,PUT')
     .expect('Allow', 'GET,PUT', done);
   })
+
+  it('should not respond if the path is not defined', function(done){
+    var app = express();
+
+    app.get('/users', function(req, res){});
+
+    request(app)
+    .options('/other')
+    .expect(404, done);
+  })
+
+  it('should forward requests down the middleware chain', function(done){
+    var app = express();
+    var router = new express.Router();
+
+    router.get('/users', function(req, res){});
+    app.use(router.middleware);
+    app.get('/other', function(req, res){});
+
+    request(app)
+    .options('/other')
+    .expect('GET')
+    .expect('Allow', 'GET', done);
+  })
 })
 
 describe('app.options()', function(){

From e465624fd02bc27824249e3c673151055dac4c39 Mon Sep 17 00:00:00 2001
From: Matheus Azzi <matheuslazzi@gmail.com>
Date: Sun, 5 Jan 2014 01:14:38 -0200
Subject: [PATCH 0048/1265] Update layout.jade

---
 examples/jade/views/layout.jade | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/jade/views/layout.jade b/examples/jade/views/layout.jade
index 614d674a483..300cdc78473 100644
--- a/examples/jade/views/layout.jade
+++ b/examples/jade/views/layout.jade
@@ -1,5 +1,5 @@
-!!! 5
+doctype html
 html
   include header
   body
-    block content
\ No newline at end of file
+    block content

From 1d97599f8b2f4ea6be0b7082ac1d9d93c8d00665 Mon Sep 17 00:00:00 2001
From: Doug Patti <douglas.patti@gmail.com>
Date: Thu, 2 Jan 2014 13:05:23 -0500
Subject: [PATCH 0049/1265] prevent incorrect automatic OPTIONS responses

The router has automatic handling of OPTIONS based on the registered
routes, but if you make an OPTIONS request for an endpoint that does
not exist, then it will still return a 200 with nothing allowed.
Instead, we can let the request move on down the middleware chain. This
has two benefits: first, if the route was not defined and no other
middleware handles it, it will return with a 404. Secondly, if multiple
routers are used and a later one has the route or a custom OPTIONS
defined, the first router will not respond incorrectly.
---
 lib/router/index.js |  5 +++--
 test/app.options.js | 24 ++++++++++++++++++++++++
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/lib/router/index.js b/lib/router/index.js
index e17ff740109..cd2f2693787 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -104,7 +104,7 @@ Router.prototype._dispatch = function(req, res, next){
     req.route = route = self.matchRequest(req, i);
 
     // implied OPTIONS
-    if (!route && 'OPTIONS' == req.method) return self._options(req, res);
+    if (!route && 'OPTIONS' == req.method) return self._options(req, res, next);
 
     // no route
     if (!route) return next(err);
@@ -181,9 +181,10 @@ Router.prototype._dispatch = function(req, res, next){
  * @api private
  */
 
-Router.prototype._options = function(req, res){
+Router.prototype._options = function(req, res, next){
   var path = parse(req).pathname
     , body = this._optionsFor(path).join(',');
+  if (!body) return next();
   res.set('Allow', body).send(body);
 };
 
diff --git a/test/app.options.js b/test/app.options.js
index 836a3463c23..a6f7b65fb16 100644
--- a/test/app.options.js
+++ b/test/app.options.js
@@ -15,6 +15,30 @@ describe('OPTIONS', function(){
     .expect('GET,PUT')
     .expect('Allow', 'GET,PUT', done);
   })
+
+  it('should not respond if the path is not defined', function(done){
+    var app = express();
+
+    app.get('/users', function(req, res){});
+
+    request(app)
+    .options('/other')
+    .expect(404, done);
+  })
+
+  it('should forward requests down the middleware chain', function(done){
+    var app = express();
+    var router = new express.Router();
+
+    router.get('/users', function(req, res){});
+    app.use(router.middleware);
+    app.get('/other', function(req, res){});
+
+    request(app)
+    .options('/other')
+    .expect('GET')
+    .expect('Allow', 'GET', done);
+  })
 })
 
 describe('app.options()', function(){

From ff23423d34d9d7f829d160aeb91b5c939ab4a4e1 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Mon, 13 Jan 2014 20:50:51 -0800
Subject: [PATCH 0050/1265] 3.4.8

---
 History.md   | 22 ++++++++++++++++++++++
 package.json |  2 +-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 82ece29e8d7..9d53bef43a3 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,25 @@
+4.0.0 /
+==================
+
+ * remove:
+   - express(1) - moved to [express-generator](https://github.com/expressjs/generator)
+   - `req.accepted*` - use `req.accepts*()` instead
+   - `app.configure` - use logic in your own app code
+ * change:
+   - `req.accepts*` -> `req.accepts*s` - i.e. `req.acceptsEncoding` -> `req.acceptsEncodings`
+   - `req.params` is now an object instead of an array
+   - `json spaces` no longer enabled by default in development
+ * refactor:
+   - `req.accepts*` with [accepts](https://github.com/expressjs/accepts)
+   - `req.is` with [type-is](https://github.com/expressjs/type-is)
+
+3.4.8 / 2014-01-13
+==================
+
+ * prevent incorrect automatic OPTIONS responses #1868 @dpatti
+ * update binary and examples for jade 1.0 #1876 @yossi, #1877 @reqshark, #1892 @matheusazzi
+ * throw 400 in case of malformed paths @rlidwka
+
 3.4.7 / 2013-12-10
 ==================
 
diff --git a/package.json b/package.json
index 4f84768965d..926e9d37e64 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.4.7",
+  "version": "3.4.8",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From fd6439bb36c9d39dc05067310edaf770dc5bb262 Mon Sep 17 00:00:00 2001
From: Haoliang Gao <sakura9515@gmail.com>
Date: Sun, 19 Jan 2014 23:53:48 +0800
Subject: [PATCH 0051/1265] delete semicolon

---
 lib/application.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/application.js b/lib/application.js
index d306e817f9a..9d7639e353f 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -84,7 +84,7 @@ app.defaultConfiguration = function(){
 
   if (this.get('env') === 'production') {
     this.enable('view cache');
-  };
+  }
 };
 
 /**

From f56a5f01c46677320cb9efa09800af13de1790d9 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sun, 19 Jan 2014 14:05:12 -0500
Subject: [PATCH 0052/1265] remove deprecated express.createServer() method

This has been warning about deprecation for a long time. Use `express()`
to instantiate an express app.
---
 History.md     |  1 +
 lib/express.js | 15 ---------------
 2 files changed, 1 insertion(+), 15 deletions(-)

diff --git a/History.md b/History.md
index f8c6bfd8364..ad94194c51b 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@
    - express(1) - moved to [express-generator](https://github.com/expressjs/generator)
    - `req.accepted*` - use `req.accepts*()` instead
    - `app.configure` - use logic in your own app code
+   - `express.createServer()` - it has been deprecated for a long time. Use `express()`
  * change:
    - `req.accepts*` -> `req.accepts*s` - i.e. `req.acceptsEncoding` -> `req.acceptsEncodings`
    - `req.params` is now an object instead of an array
diff --git a/lib/express.js b/lib/express.js
index 4f61cdbd4d7..0f9f8dcf4e2 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -46,21 +46,6 @@ function createApplication() {
 
 merge(exports, connect.middleware);
 
-/**
- * Error on createServer().
- */
-
-exports.createServer = function(){
-  console.warn('Warning: express.createServer() is deprecated, express');
-  console.warn('applications no longer inherit from http.Server,');
-  console.warn('please use:');
-  console.warn('');
-  console.warn('  var express = require("express");');
-  console.warn('  var app = express();');
-  console.warn('');
-  return createApplication();
-};
-
 /**
  * Expose the prototypes.
  */

From 718e68ffae3875c9d294471a1e1683fffc2e28e0 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Fri, 24 Jan 2014 19:16:37 -0500
Subject: [PATCH 0053/1265] use utils-merge module to mixin object properties

---
 lib/application.js | 7 ++++---
 lib/express.js     | 9 +++++----
 lib/response.js    | 5 +++--
 package.json       | 1 +
 test/res.cookie.js | 4 ++--
 5 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/lib/application.js b/lib/application.js
index 9d7639e353f..fadc409beb7 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -3,6 +3,7 @@
  */
 
 var connect = require('connect')
+  , mixin = require('utils-merge')
   , Router = require('./router')
   , methods = require('methods')
   , middleware = require('./middleware')
@@ -407,13 +408,13 @@ app.render = function(name, options, fn){
   }
 
   // merge app.locals
-  utils.merge(opts, this.locals);
+  mixin(opts, this.locals);
 
   // merge options._locals
-  if (options._locals) utils.merge(opts, options._locals);
+  if (options._locals) mixin(opts, options._locals);
 
   // merge options
-  utils.merge(opts, options);
+  mixin(opts, options);
 
   // set .cache unless explicitly provided
   opts.cache = null == opts.cache
diff --git a/lib/express.js b/lib/express.js
index 0f9f8dcf4e2..2f0217162c7 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -2,14 +2,15 @@
  * Module dependencies.
  */
 
-var merge = require('merge-descriptors');
 var connect = require('connect')
-  , proto = require('./application')
+  , merge = require('merge-descriptors')
+  , mixin = require('utils-merge')
+
+var proto = require('./application')
   , Route = require('./router/route')
   , Router = require('./router')
   , req = require('./request')
   , res = require('./response')
-  , utils = connect.utils;
 
 /**
  * Expose `createApplication()`.
@@ -32,7 +33,7 @@ exports.mime = connect.mime;
 
 function createApplication() {
   var app = connect();
-  utils.merge(app, proto);
+  mixin(app, proto);
   app.request = { __proto__: req, app: app };
   app.response = { __proto__: res, app: app };
   app.init();
diff --git a/lib/response.js b/lib/response.js
index 31c79c0d5b5..f175ddd874a 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -5,6 +5,7 @@
 var http = require('http')
   , path = require('path')
   , connect = require('connect')
+  , mixin = require('utils-merge')
   , utils = connect.utils
   , sign = require('cookie-signature').sign
   , normalizeType = require('./utils').normalizeType
@@ -557,7 +558,7 @@ res.get = function(field){
 res.clearCookie = function(name, options){
   var opts = { expires: new Date(1), path: '/' };
   return this.cookie(name, '', options
-    ? utils.merge(opts, options)
+    ? mixin(opts, options)
     : opts);
 };
 
@@ -585,7 +586,7 @@ res.clearCookie = function(name, options){
  */
 
 res.cookie = function(name, val, options){
-  options = utils.merge({}, options);
+  options = mixin({}, options);
   var secret = this.req.secret;
   var signed = options.signed;
   if (signed && !secret) throw new Error('connect.cookieParser("secret") required for signed cookies');
diff --git a/package.json b/package.json
index bd55647739f..ab1a8cb8c60 100644
--- a/package.json
+++ b/package.json
@@ -33,6 +33,7 @@
     "send": "0.1.4",
     "cookie-signature": "1.0.1",
     "merge-descriptors": "0.0.1",
+    "utils-merge": "1.0.0",
     "debug": ">= 0.7.3 < 1"
   },
   "devDependencies": {
diff --git a/test/res.cookie.js b/test/res.cookie.js
index d671def31a7..d60635e0e72 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -1,7 +1,7 @@
 
 var express = require('../')
   , request = require('./support/http')
-  , utils = require('connect').utils
+  , mixin = require('utils-merge')
   , cookie = require('cookie');
 
 describe('res', function(){
@@ -114,7 +114,7 @@ describe('res', function(){
         var app = express();
 
         var options = { maxAge: 1000 };
-        var optionsCopy = utils.merge({}, options);
+        var optionsCopy = mixin({}, options);
 
         app.use(function(req, res){
           res.cookie('name', 'tobi', options)

From 63c6a9c5ad6e7f6b93433c6917e611dcda593887 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Fri, 24 Jan 2014 19:21:21 -0500
Subject: [PATCH 0054/1265] use escape-html module to escape html

Another util bites the dust.
---
 lib/response.js |  4 ++--
 lib/utils.js    | 16 ----------------
 package.json    |  1 +
 test/utils.js   |  7 -------
 4 files changed, 3 insertions(+), 25 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index f175ddd874a..97a2ac2b494 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -6,7 +6,7 @@ var http = require('http')
   , path = require('path')
   , connect = require('connect')
   , mixin = require('utils-merge')
-  , utils = connect.utils
+  , escapeHtml = require('escape-html')
   , sign = require('cookie-signature').sign
   , normalizeType = require('./utils').normalizeType
   , normalizeTypes = require('./utils').normalizeTypes
@@ -706,7 +706,7 @@ res.redirect = function(url){
     },
 
     html: function(){
-      var u = utils.escape(url);
+      var u = escapeHtml(url);
       body = '<p>' + statusCodes[status] + '. Redirecting to <a href="' + u + '">' + u + '</a></p>';
     },
 
diff --git a/lib/utils.js b/lib/utils.js
index 139cf1c1562..6379b076821 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -137,22 +137,6 @@ function acceptParams(str, index) {
   return ret;
 }
 
-/**
- * Escape special characters in the given string of html.
- *
- * @param  {String} html
- * @return {String}
- * @api private
- */
-
-exports.escape = function(html) {
-  return String(html)
-    .replace(/&/g, '&amp;')
-    .replace(/"/g, '&quot;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;');
-};
-
 /**
  * Normalize the given path string,
  * returning a regular expression.
diff --git a/package.json b/package.json
index ab1a8cb8c60..25fef7a9f20 100644
--- a/package.json
+++ b/package.json
@@ -34,6 +34,7 @@
     "cookie-signature": "1.0.1",
     "merge-descriptors": "0.0.1",
     "utils-merge": "1.0.0",
+    "escape-html": "1.0.1",
     "debug": ">= 0.7.3 < 1"
   },
   "devDependencies": {
diff --git a/test/utils.js b/test/utils.js
index e6b826dd833..ce2a7be2a8c 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -41,10 +41,3 @@ describe('utils.flatten(arr)', function(){
       .should.eql(['one', 'two', 'three', 'four', 'five']);
   })
 })
-
-describe('utils.escape(html)', function(){
-  it('should escape html entities', function(){
-    utils.escape('<script>foo & "bar"')
-      .should.equal('&lt;script&gt;foo &amp; &quot;bar&quot;')
-  })
-})

From 337ab24899098b108319e028b00c6cf02b40ff68 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Fri, 24 Jan 2014 19:31:32 -0500
Subject: [PATCH 0055/1265] remove unused require

---
 lib/application.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/application.js b/lib/application.js
index fadc409beb7..6aa3911039e 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -10,7 +10,6 @@ var connect = require('connect')
   , debug = require('debug')('express:application')
   , locals = require('./utils').locals
   , View = require('./view')
-  , utils = connect.utils
   , http = require('http');
 
 /**

From 4983c38298d1c6dad1a8a09241cf8beee66beb7e Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Fri, 24 Jan 2014 19:49:45 -0500
Subject: [PATCH 0056/1265] change res.locals to a plain js object.

Anyone who wants something fancier should use modules.

- fixes annoyance with not being able to set 'name' property on locals
---
 History.md              |  1 +
 lib/application.js      |  3 +--
 lib/middleware.js       |  2 +-
 lib/utils.js            | 19 -------------------
 test/app.locals.js      |  4 ++--
 test/fixtures/name.jade |  1 +
 test/res.locals.js      |  7 ++-----
 test/res.render.js      | 15 +++++++++++++++
 8 files changed, 23 insertions(+), 29 deletions(-)
 create mode 100644 test/fixtures/name.jade

diff --git a/History.md b/History.md
index ad94194c51b..b64a6a6a133 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,7 @@
    - `req.accepts*` -> `req.accepts*s` - i.e. `req.acceptsEncoding` -> `req.acceptsEncodings`
    - `req.params` is now an object instead of an array
    - `json spaces` no longer enabled by default in development
+   - `res.locals` is no longer a function. It is a plain js object. Treat it as such.
  * refactor:
    - `req.accepts*` with [accepts](https://github.com/expressjs/accepts)
    - `req.is` with [type-is](https://github.com/expressjs/type-is)
diff --git a/lib/application.js b/lib/application.js
index 6aa3911039e..b0c2de60c5d 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -8,7 +8,6 @@ var connect = require('connect')
   , methods = require('methods')
   , middleware = require('./middleware')
   , debug = require('debug')('express:application')
-  , locals = require('./utils').locals
   , View = require('./view')
   , http = require('http');
 
@@ -72,7 +71,7 @@ app.defaultConfiguration = function(){
   });
 
   // setup locals
-  this.locals = locals(this);
+  this.locals = Object.create(null);
 
   // default locals
   this.locals.settings = this.settings;
diff --git a/lib/middleware.js b/lib/middleware.js
index e07dd4cd59e..625719d1838 100644
--- a/lib/middleware.js
+++ b/lib/middleware.js
@@ -25,7 +25,7 @@ exports.init = function(app){
     req.__proto__ = app.request;
     res.__proto__ = app.response;
 
-    res.locals = res.locals || utils.locals(res);
+    res.locals = res.locals || Object.create(null);
 
     next();
   }
diff --git a/lib/utils.js b/lib/utils.js
index 6379b076821..2de05b5d153 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -24,25 +24,6 @@ exports.etag = function(body){
   return '"' + crc32.signed(body) + '"';
 };
 
-/**
- * Make `locals()` bound to the given `obj`.
- *
- * This is used for `app.locals` and `res.locals`.
- *
- * @param {Object} obj
- * @return {Function}
- * @api private
- */
-
-exports.locals = function(){
-  function locals(obj){
-    for (var key in obj) locals[key] = obj[key];
-    return obj;
-  };
-
-  return locals;
-};
-
 /**
  * Check if `path` looks absolute.
  *
diff --git a/test/app.locals.js b/test/app.locals.js
index 58ccb854aa3..9f5fc1f2fed 100644
--- a/test/app.locals.js
+++ b/test/app.locals.js
@@ -7,8 +7,8 @@ describe('app', function(){
     it('should merge locals', function(){
       var app = express();
       Object.keys(app.locals).should.eql(['settings']);
-      app.locals({ user: 'tobi', age: 1 });
-      app.locals({ age: 2 });
+      app.locals.user = 'tobi';
+      app.locals.age = 2;
       Object.keys(app.locals).should.eql(['settings', 'user', 'age']);
       app.locals.user.should.equal('tobi');
       app.locals.age.should.equal(2);
diff --git a/test/fixtures/name.jade b/test/fixtures/name.jade
new file mode 100644
index 00000000000..ede3527a79e
--- /dev/null
+++ b/test/fixtures/name.jade
@@ -0,0 +1 @@
+p= name
diff --git a/test/res.locals.js b/test/res.locals.js
index 6cc4049f3fd..8861bac70fe 100644
--- a/test/res.locals.js
+++ b/test/res.locals.js
@@ -3,15 +3,12 @@ var express = require('../')
   , request = require('./support/http');
 
 describe('res', function(){
-  describe('.locals(obj)', function(){
-    it('should merge locals', function(done){
+  describe('.locals', function(){
+    it('should be empty by default', function(done){
       var app = express();
 
       app.use(function(req, res){
         Object.keys(res.locals).should.eql([]);
-        res.locals({ user: 'tobi', age: 1 });
-        res.locals.user.should.equal('tobi');
-        res.locals.age.should.equal(1);
         res.end();
       });
 
diff --git a/test/res.render.js b/test/res.render.js
index a865929ffed..11c01aa1752 100644
--- a/test/res.render.js
+++ b/test/res.render.js
@@ -47,6 +47,21 @@ describe('res', function(){
       .get('/')
       .expect('<p>tobi</p>', done);
     })
+
+    it('should expose app.locals with `name` property', function(done){
+      var app = express();
+
+      app.set('views', __dirname + '/fixtures');
+      app.locals.name = 'tobi';
+
+      app.use(function(req, res){
+        res.render('name.jade');
+      });
+
+      request(app)
+      .get('/')
+      .expect('<p>tobi</p>', done);
+    })
   
     it('should support index.<engine>', function(done){
       var app = express();

From 0ddd761904a7a8dd4bfac5a669b8745c476a7097 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Wed, 29 Jan 2014 10:00:11 -0500
Subject: [PATCH 0057/1265] update range parser to 1.0.0

- License

see #1912
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 25fef7a9f20..ad1b537319f 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "connect": "2.12.0",
     "accepts": "1.0.0",
     "type-is": "1.0.0",
-    "range-parser": "0.0.4",
+    "range-parser": "1.0.0",
     "cookie": "0.1.0",
     "buffer-crc32": "0.2.1",
     "fresh": "0.2.0",

From a5f7dcee0420e82ebc797858f4c291349e8bd4d1 Mon Sep 17 00:00:00 2001
From: TJ Holowaychuk <tj@vision-media.ca>
Date: Wed, 29 Jan 2014 12:17:16 -0800
Subject: [PATCH 0058/1265] update node-fresh

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ad1b537319f..f54612486bc 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
     "range-parser": "1.0.0",
     "cookie": "0.1.0",
     "buffer-crc32": "0.2.1",
-    "fresh": "0.2.0",
+    "fresh": "0.2.1",
     "methods": "0.1.0",
     "send": "0.1.4",
     "cookie-signature": "1.0.1",

From a02dd201e6379fc65d995b2e814848fb5c75c6ff Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Wed, 29 Jan 2014 19:58:53 -0500
Subject: [PATCH 0059/1265] update send to 0.2.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f54612486bc..16d73696fc8 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "buffer-crc32": "0.2.1",
     "fresh": "0.2.1",
     "methods": "0.1.0",
-    "send": "0.1.4",
+    "send": "0.2.0",
     "cookie-signature": "1.0.1",
     "merge-descriptors": "0.0.1",
     "utils-merge": "1.0.0",

From 08cbc442f5490adc1135b3b16766b779b251726a Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Wed, 29 Jan 2014 20:00:23 -0500
Subject: [PATCH 0060/1265] update cookie-signature to 1.0.3

Fix for timing attack
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 16d73696fc8..3b92504d663 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,7 @@
     "fresh": "0.2.1",
     "methods": "0.1.0",
     "send": "0.2.0",
-    "cookie-signature": "1.0.1",
+    "cookie-signature": "1.0.3",
     "merge-descriptors": "0.0.1",
     "utils-merge": "1.0.0",
     "escape-html": "1.0.1",

From 4bf9cfd4779c614d05c9c0983ee4a7427df38216 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Wed, 29 Jan 2014 20:01:10 -0500
Subject: [PATCH 0061/1265] update merge-descriptors

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 3b92504d663..be686aaebce 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,7 @@
     "methods": "0.1.0",
     "send": "0.2.0",
     "cookie-signature": "1.0.3",
-    "merge-descriptors": "0.0.1",
+    "merge-descriptors": "0.0.2",
     "utils-merge": "1.0.0",
     "escape-html": "1.0.1",
     "debug": ">= 0.7.3 < 1"

From 8aff64f89a107673724367b7b0d5346c1776d821 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Wed, 29 Jan 2014 20:06:38 -0500
Subject: [PATCH 0062/1265] backport dependency updates

- range parser 1.0.0
- fresh 0.2.1
- send 0.2.0
- cookie-signature 1.0.3
- merge-descriptors 0.0.2
---
 package.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 926e9d37e64..2d2624480d4 100644
--- a/package.json
+++ b/package.json
@@ -24,15 +24,15 @@
   "dependencies": {
     "connect": "2.12.0",
     "commander": "1.3.2",
-    "range-parser": "0.0.4",
+    "range-parser": "1.0.0",
     "mkdirp": "0.3.5",
     "cookie": "0.1.0",
     "buffer-crc32": "0.2.1",
-    "fresh": "0.2.0",
+    "fresh": "0.2.1",
     "methods": "0.1.0",
-    "send": "0.1.4",
-    "cookie-signature": "1.0.1",
-    "merge-descriptors": "0.0.1",
+    "send": "0.2.0",
+    "cookie-signature": "1.0.3",
+    "merge-descriptors": "0.0.2",
     "debug": ">= 0.7.3 < 1"
   },
   "devDependencies": {

From f41d09a3cf0592b65a1359495b65d3d7cf949c50 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sat, 25 Jan 2014 17:57:25 -0500
Subject: [PATCH 0063/1265] remove app.router and refactor middleware
 processing

This is an overhaul of middleware processing, Router and Route. Connect is no
longer used to process the middleware stack. This functionality has been
split into two parts: middleware stack and default error response.

The entry point for request processing is the `app.handle` method. It
sets up the default error response handle (to run in the event of no
other error handler) and then triggers the app router (instance of
Router) to handle the request.

The app router `handle` function contains the middleware dispatch layer
previously in the connect codebase. This layer handle the logic for
dispatching `.use` calls (stripping paths if needed). The app contains a
base router `app._router`. New routes can be created and `.use`d on this
router to organize routes into files.

Routers now have the following methods `.use`, `.all`, `.param` which
are all public.

Additionally, Routers have a `.route(path)` method which returns a new
instance of Route for the requested path. Route(s) are isolated
middleware stacks and contain methods for the HTTP verbs as well as an
`.all` method to act similar to middleware. These methods are chainable
to easily describe requirements for a route.

  var route = Router.route('/foo'); // or 'app.route('/foo')'

  route
  .all(auth)
  .get(function(...) {})
  .all(more_checks)
  .post(function(...) {})

Any Route and Router methods which accept handlers also accept error
(arity 4) handlers which will also behave as expected.

Finally, the `app.router` getter has been removed. Middleware and
handlers are run IN THE ORDER they are seen in the file. This means that
code which injected the `app.router` and then added error handlers (or
other middleware) will need to be updated to move those handlers after
any requests added on the app object. The examples have been updated
accordingly. This is the largest breaking change to codebases in this
commit.
---
 History.md                    |   6 +
 examples/error-pages/index.js |  60 ++---
 examples/error/index.js       |  14 +-
 examples/web-service/index.js |  45 ++--
 lib/application.js            | 214 ++++++++++------
 lib/express.js                |   9 +-
 lib/router/index.js           | 448 +++++++++++++++++++---------------
 lib/router/route.js           | 152 +++++++++++-
 test/Route.js                 | 153 ++++++++++++
 test/Router.js                | 124 ++++------
 test/app.js                   |  22 +-
 test/app.options.js           |   2 +-
 test/app.router.js            |  30 ---
 test/app.routes.js            |  48 ----
 test/req.route.js             |   2 -
 15 files changed, 822 insertions(+), 507 deletions(-)
 create mode 100644 test/Route.js
 delete mode 100644 test/app.routes.js

diff --git a/History.md b/History.md
index b64a6a6a133..40cb5ec433b 100644
--- a/History.md
+++ b/History.md
@@ -6,14 +6,20 @@
    - `req.accepted*` - use `req.accepts*()` instead
    - `app.configure` - use logic in your own app code
    - `express.createServer()` - it has been deprecated for a long time. Use `express()`
+   - `app.router` - is removed
  * change:
    - `req.accepts*` -> `req.accepts*s` - i.e. `req.acceptsEncoding` -> `req.acceptsEncodings`
    - `req.params` is now an object instead of an array
    - `json spaces` no longer enabled by default in development
    - `res.locals` is no longer a function. It is a plain js object. Treat it as such.
+   - `app.route` -> `app.mountpath` when mounting an express app in another express app
  * refactor:
    - `req.accepts*` with [accepts](https://github.com/expressjs/accepts)
    - `req.is` with [type-is](https://github.com/expressjs/type-is)
+ * add:
+   - `app.router()` - returns the app Router instance
+   - `app.route()` - Proxy to the app's `Router#route()` method to create a new route
+   - Router & Route - public API
 
 3.4.7 / 2013-12-10
 ==================
diff --git a/examples/error-pages/index.js b/examples/error-pages/index.js
index 7c8fd31eb8a..0f21bea66d8 100644
--- a/examples/error-pages/index.js
+++ b/examples/error-pages/index.js
@@ -25,14 +25,32 @@ app.use(express.favicon());
 
 silent || app.use(express.logger('dev'));
 
-// "app.router" positions our routes 
-// above the middleware defined below,
-// this means that Express will attempt
-// to match & call routes _before_ continuing
-// on, at which point we assume it's a 404 because
-// no route has handled the request.
+// Routes
 
-app.use(app.router);
+app.get('/', function(req, res){
+  res.render('index.jade');
+});
+
+app.get('/404', function(req, res, next){
+  // trigger a 404 since no other middleware
+  // will match /404 after this one, and we're not
+  // responding here
+  next();
+});
+
+app.get('/403', function(req, res, next){
+  // trigger a 403 error
+  var err = new Error('not allowed!');
+  err.status = 403;
+  next(err);
+});
+
+app.get('/500', function(req, res, next){
+  // trigger a generic (500) error
+  next(new Error('keyboard cat!'));
+});
+
+// Error handlers
 
 // Since this is the last non-error-handling
 // middleware use()d, we assume 404, as nothing else
@@ -44,7 +62,7 @@ app.use(app.router);
 
 app.use(function(req, res, next){
   res.status(404);
-  
+
   // respond with html page
   if (req.accepts('html')) {
     res.render('404', { url: req.url });
@@ -81,32 +99,8 @@ app.use(function(err, req, res, next){
   res.render('500', { error: err });
 });
 
-// Routes
-
-app.get('/', function(req, res){
-  res.render('index.jade');
-});
-
-app.get('/404', function(req, res, next){
-  // trigger a 404 since no other middleware
-  // will match /404 after this one, and we're not
-  // responding here
-  next();
-});
-
-app.get('/403', function(req, res, next){
-  // trigger a 403 error
-  var err = new Error('not allowed!');
-  err.status = 403;
-  next(err);
-});
-
-app.get('/500', function(req, res, next){
-  // trigger a generic (500) error
-  next(new Error('keyboard cat!'));
-});
 
 if (!module.parent) {
   app.listen(3000);
   silent || console.log('Express started on port 3000');
-}
\ No newline at end of file
+}
diff --git a/examples/error/index.js b/examples/error/index.js
index be9cfb51771..9d522798025 100644
--- a/examples/error/index.js
+++ b/examples/error/index.js
@@ -8,13 +8,6 @@ var express = require('../../')
   , test = app.get('env') == 'test';
 
 if (!test) app.use(express.logger('dev'));
-app.use(app.router);
-
-// the error handler is strategically
-// placed *below* the app.router; if it
-// were above it would not receive errors
-// from app.get() etc 
-app.use(error);
 
 // error handling middleware have an arity of 4
 // instead of the typical (req, res, next),
@@ -42,7 +35,12 @@ app.get('/next', function(req, res, next){
   });
 });
 
+// the error handler is placed after routes
+// if it were above it would not receive errors
+// from app.get() etc
+app.use(error);
+
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
-}
\ No newline at end of file
+}
diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index 045adaa8630..08df83ae7c6 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -40,29 +40,6 @@ app.use('/api', function(req, res, next){
   next();
 });
 
-// position our routes above the error handling middleware,
-// and below our API middleware, since we want the API validation
-// to take place BEFORE our routes
-app.use(app.router);
-
-// middleware with an arity of 4 are considered
-// error handling middleware. When you next(err)
-// it will be passed through the defined middleware
-// in order, but ONLY those with an arity of 4, ignoring
-// regular middleware.
-app.use(function(err, req, res, next){
-  // whatever you want here, feel free to populate
-  // properties on `err` to treat it differently in here.
-  res.send(err.status || 500, { error: err.message });
-});
-
-// our custom JSON 404 middleware. Since it's placed last
-// it will be the last middleware called, if all others
-// invoke next() and do not respond.
-app.use(function(req, res){
-  res.send(404, { error: "Lame, can't find that" });
-});
-
 // map of valid api keys, typically mapped to
 // account info with some sort of database like redis.
 // api keys do _not_ serve as authentication, merely to
@@ -104,12 +81,30 @@ app.get('/api/repos', function(req, res, next){
 app.get('/api/user/:name/repos', function(req, res, next){
   var name = req.params.name
     , user = userRepos[name];
-  
+
   if (user) res.send(user);
   else next();
 });
 
+// middleware with an arity of 4 are considered
+// error handling middleware. When you next(err)
+// it will be passed through the defined middleware
+// in order, but ONLY those with an arity of 4, ignoring
+// regular middleware.
+app.use(function(err, req, res, next){
+  // whatever you want here, feel free to populate
+  // properties on `err` to treat it differently in here.
+  res.send(err.status || 500, { error: err.message });
+});
+
+// our custom JSON 404 middleware. Since it's placed last
+// it will be the last middleware called, if all others
+// invoke next() and do not respond.
+app.use(function(req, res){
+  res.send(404, { error: "Lame, can't find that" });
+});
+
 if (!module.parent) {
   app.listen(3000);
   console.log('Express server listening on port 3000');
-}
\ No newline at end of file
+}
diff --git a/lib/application.js b/lib/application.js
index b0c2de60c5d..0f3f2d706c1 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -4,6 +4,7 @@
 
 var connect = require('connect')
   , mixin = require('utils-merge')
+  , escapeHtml = require('escape-html')
   , Router = require('./router')
   , methods = require('methods')
   , middleware = require('./middleware')
@@ -44,13 +45,11 @@ app.defaultConfiguration = function(){
   // default settings
   this.enable('x-powered-by');
   this.enable('etag');
-  this.set('env', process.env.NODE_ENV || 'development');
+  var env = process.env.NODE_ENV || 'development';
+  this.set('env', env);
   this.set('subdomain offset', 2);
-  debug('booting in %s mode', this.get('env'));
 
-  // implicit middleware
-  this.use(connect.query());
-  this.use(middleware.init(this));
+  debug('booting in %s mode', env);
 
   // inherit protos
   this.on('mount', function(parent){
@@ -60,19 +59,12 @@ app.defaultConfiguration = function(){
     this.settings.__proto__ = parent.settings;
   });
 
-  // router
-  this._router = new Router(this);
-  this.routes = this._router.map;
-  this.__defineGetter__('router', function(){
-    this._usedRouter = true;
-    this._router.caseSensitive = this.enabled('case sensitive routing');
-    this._router.strict = this.enabled('strict routing');
-    return this._router.middleware;
-  });
-
   // setup locals
   this.locals = Object.create(null);
 
+  // top-most app is mounted at /
+  this.mountpath = '/';
+
   // default locals
   this.locals.settings = this.settings;
 
@@ -81,14 +73,94 @@ app.defaultConfiguration = function(){
   this.set('views', process.cwd() + '/views');
   this.set('jsonp callback name', 'callback');
 
-  if (this.get('env') === 'production') {
+  if (env === 'production') {
     this.enable('view cache');
   }
+
+  Object.defineProperty(this, 'router', {
+    get: function() {
+      throw new Error('\'app.router\' is deprecated!\nPlease see the 3.x to 4.x migration guide for details on how to update your app.');
+    }
+  });
+};
+
+/**
+ * lazily adds the base router if it has not yet been added.
+ *
+ * We cannot add the base router in the defaultConfiguration because
+ * it reads app settings which might be set after that has run.
+ *
+ * @api private
+ */
+app.lazyrouter = function() {
+  if (!this._router) {
+    this._router = new Router({
+      caseSensitive: this.enabled('case sensitive routing'),
+      strict: this.enabled('strict routing')
+    });
+
+    this._router.use(connect.query());
+    this._router.use(middleware.init(this));
+  }
 };
 
 /**
- * Proxy `connect#use()` to apply settings to
- * mounted applications.
+ * Dispatch a req, res pair into the application. Starts pipeline processing.
+ *
+ * If no _done_ callback is provided, then default error handlers will respond
+ * in the event of an error bubbling through the stack.
+ *
+ * @api private
+ */
+
+app.handle = function(req, res, done) {
+  var env = this.get('env');
+
+  this._router.handle(req, res, function(err) {
+    if (done) {
+      return done(err);
+    }
+
+    // unhandled error
+    if (err) {
+      // default to 500
+      if (res.statusCode < 400) res.statusCode = 500;
+      debug('default %s', res.statusCode);
+
+      // respect err.status
+      if (err.status) res.statusCode = err.status;
+
+      // production gets a basic error message
+      var msg = 'production' == env
+        ? http.STATUS_CODES[res.statusCode]
+        : err.stack || err.toString();
+      msg = escapeHtml(msg);
+
+      // log to stderr in a non-test env
+      if ('test' != env) console.error(err.stack || err.toString());
+      if (res.headerSent) return req.socket.destroy();
+      res.setHeader('Content-Type', 'text/html');
+      res.setHeader('Content-Length', Buffer.byteLength(msg));
+      if ('HEAD' == req.method) return res.end();
+      res.end(msg);
+      return;
+    }
+
+    // 404
+    debug('default 404');
+    res.statusCode = 404;
+    res.setHeader('Content-Type', 'text/html');
+    if ('HEAD' == req.method) return res.end();
+    res.end('Cannot ' + escapeHtml(req.method) + ' ' + escapeHtml(req.originalUrl) + '\n');
+  });
+};
+
+/**
+ * Proxy `Router#use()` to add middleware to the app router.
+ * See Router#use() documentation for details.
+ *
+ * If the _fn_ parameter is an express app, then it will be
+ * mounted at the _route_ specified.
  *
  * @param {String|Function|Server} route
  * @param {Function|Server} fn
@@ -97,20 +169,21 @@ app.defaultConfiguration = function(){
  */
 
 app.use = function(route, fn){
-  var app;
+  var mount_app;
 
   // default route to '/'
   if ('string' != typeof route) fn = route, route = '/';
 
   // express app
-  if (fn.handle && fn.set) app = fn;
+  if (fn.handle && fn.set) mount_app = fn;
 
   // restore .app property on req and res
-  if (app) {
-    app.route = route;
+  if (mount_app) {
+    debug('.use app under %s', route);
+    mount_app.mountpath = route;
     fn = function(req, res, next) {
       var orig = req.app;
-      app.handle(req, res, function(err){
+      mount_app.handle(req, res, function(err) {
         req.__proto__ = orig.request;
         res.__proto__ = orig.response;
         next(err);
@@ -118,17 +191,31 @@ app.use = function(route, fn){
     };
   }
 
-  connect.proto.use.call(this, route, fn);
+  this.lazyrouter();
+  this._router.use(route, fn);
 
   // mounted an app
-  if (app) {
-    app.parent = this;
-    app.emit('mount', this);
+  if (mount_app) {
+    mount_app.parent = this;
+    mount_app.emit('mount', this);
   }
 
   return this;
 };
 
+/**
+ * Proxy to the app `Router#route()`
+ * Returns a new `Route` instance for the _path_.
+ *
+ * Routes are isolated middleware stacks for specific paths.
+ * See the Route api docs for details.
+ *
+ * @api public
+ */
+
+app.route = function(path){
+};
+
 /**
  * Register the given template engine callback `fn`
  * as `ext`.
@@ -171,30 +258,10 @@ app.engine = function(ext, fn){
 };
 
 /**
- * Map the given param placeholder `name`(s) to the given callback(s).
- *
- * Parameter mapping is used to provide pre-conditions to routes
- * which use normalized placeholders. For example a _:user_id_ parameter
- * could automatically load a user's information from the database without
- * any additional code,
- *
- * The callback uses the same signature as middleware, the only difference
- * being that the value of the placeholder is passed, in this case the _id_
- * of the user. Once the `next()` function is invoked, just like middleware
- * it will continue on to execute the route, or subsequent parameter functions.
- *
- *      app.param('user_id', function(req, res, next, id){
- *        User.find(id, function(err, user){
- *          if (err) {
- *            next(err);
- *          } else if (user) {
- *            req.user = user;
- *            next();
- *          } else {
- *            next(new Error('failed to load user'));
- *          }
- *        });
- *      });
+ * Proxy to `Router#param()` with one added api feature. The _name_ parameter
+ * can be an array of names.
+ *
+ * See the Router#param() docs for more details.
  *
  * @param {String|Array} name
  * @param {Function} fn
@@ -203,27 +270,17 @@ app.engine = function(ext, fn){
  */
 
 app.param = function(name, fn){
-  var self = this
-    , fns = [].slice.call(arguments, 1);
+  var self = this;
+  self.lazyrouter();
 
-  // array
   if (Array.isArray(name)) {
-    name.forEach(function(name){
-      fns.forEach(function(fn){
-        self.param(name, fn);
-      });
-    });
-  // param logic
-  } else if ('function' == typeof name) {
-    this._router.param(name);
-  // single
-  } else {
-    if (':' == name[0]) name = name.substr(1);
-    fns.forEach(function(fn){
-      self._router.param(name, fn);
+    name.forEach(function(key) {
+      self.param(key, fn);
     });
+    return this;
   }
 
+  self._router.param(name, fn);
   return this;
 };
 
@@ -267,7 +324,7 @@ app.set = function(setting, val){
 
 app.path = function(){
   return this.parent
-    ? this.parent.path() + this.route
+    ? this.parent.path() + this.mountpath
     : '';
 };
 
@@ -341,16 +398,17 @@ methods.forEach(function(method){
   app[method] = function(path){
     if ('get' == method && 1 == arguments.length) return this.set(path);
 
+    this.lazyrouter();
+
     // deprecated
     if (Array.isArray(path)) {
       console.trace('passing an array to app.VERB() is deprecated and will be removed in 4.0');
     }
 
-    // if no router attached yet, attach the router
-    if (!this._usedRouter) this.use(this.router);
-
-    // setup route
-    this._router[method].apply(this._router, arguments);
+    var route = this._router.route(path);
+    for (var i=1 ; i<arguments.length ; ++i) {
+      route[method](arguments[i]);
+    }
     return this;
   };
 });
@@ -366,10 +424,16 @@ methods.forEach(function(method){
  */
 
 app.all = function(path){
+  this.lazyrouter();
+
+  var route = this._router.route(path);
   var args = arguments;
   methods.forEach(function(method){
-    app[method].apply(this, args);
-  }, this);
+    for (var i=1 ; i<args.length ; ++i) {
+      route[method](args[i]);
+    }
+  });
+
   return this;
 };
 
diff --git a/lib/express.js b/lib/express.js
index 2f0217162c7..ec4d558a765 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -2,6 +2,8 @@
  * Module dependencies.
  */
 
+var EventEmitter = require('events').EventEmitter;
+
 var connect = require('connect')
   , merge = require('merge-descriptors')
   , mixin = require('utils-merge')
@@ -32,8 +34,13 @@ exports.mime = connect.mime;
  */
 
 function createApplication() {
-  var app = connect();
+  var app = function(req, res, next) {
+    app.handle(req, res, next);
+  };
+
   mixin(app, proto);
+  mixin(app, EventEmitter.prototype);
+
   app.request = { __proto__: req, app: app };
   app.response = { __proto__: res, app: app };
   app.init();
diff --git a/lib/router/index.js b/lib/router/index.js
index cd2f2693787..f95a6180ade 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -24,22 +24,47 @@ exports = module.exports = Router;
 function Router(options) {
   options = options || {};
   var self = this;
-  this.map = {};
-  this.params = {};
-  this._params = [];
-  this.caseSensitive = options.caseSensitive;
-  this.strict = options.strict;
-  this.middleware = function router(req, res, next){
-    self._dispatch(req, res, next);
-  };
+
+  self.params = {};
+  self._params = [];
+  self.caseSensitive = options.caseSensitive;
+  self.strict = options.strict;
+  self.stack = [];
+
+  self.middleware = self.handle.bind(self);
 }
 
 /**
- * Register a param callback `fn` for the given `name`.
+ * Map the given param placeholder `name`(s) to the given callback.
+ *
+ * Parameter mapping is used to provide pre-conditions to routes
+ * which use normalized placeholders. For example a _:user_id_ parameter
+ * could automatically load a user's information from the database without
+ * any additional code,
+ *
+ * The callback uses the same signature as middleware, the only difference
+ * being that the value of the placeholder is passed, in this case the _id_
+ * of the user. Once the `next()` function is invoked, just like middleware
+ * it will continue on to execute the route, or subsequent parameter functions.
+ *
+ * Just like in middleware, you must either respond to the request or call next
+ * to avoid stalling the request.
  *
- * @param {String|Function} name
+ *  app.param('user_id', function(req, res, next, id){
+ *    User.find(id, function(err, user){
+ *      if (err) {
+ *        return next(err);
+ *      } else if (!user) {
+ *        return next(new Error('failed to load user'));
+ *      }
+ *      req.user = user;
+ *      next();
+ *    });
+ *  });
+ *
+ * @param {String} name
  * @param {Function} fn
- * @return {Router} for chaining
+ * @return {app} for chaining
  * @api public
  */
 
@@ -55,6 +80,10 @@ Router.prototype.param = function(name, fn){
     , len = params.length
     , ret;
 
+  if (name[0] === ':') {
+    name = name.substr(1);
+  }
+
   for (var i = 0; i < len; ++i) {
     if (ret = params[i](name, fn)) {
       fn = ret;
@@ -72,250 +101,271 @@ Router.prototype.param = function(name, fn){
 };
 
 /**
- * Route dispatcher aka the route "middleware".
+ * Dispatch a req, res into the router.
  *
- * @param {IncomingMessage} req
- * @param {ServerResponse} res
- * @param {Function} next
  * @api private
  */
 
-Router.prototype._dispatch = function(req, res, next){
-  var params = this.params
-    , self = this;
+Router.prototype.handle = function(req, res, done) {
+  var self = this;
+
+  debug('dispatching %s %s', req.method, req.url);
 
-  debug('dispatching %s %s (%s)', req.method, req.url, req.originalUrl);
+  var method = req.method.toLowerCase();
 
-  // route dispatch
-  (function pass(i, err){
-    var paramCallbacks
-      , paramIndex = 0
-      , paramVal
-      , route
-      , keys
-      , key;
+  var search = 1 + req.url.indexOf('?');
+  var pathlength = search ? search - 1 : req.url.length;
+  var fqdn = 1 + req.url.substr(0, pathlength).indexOf('://');
+  var protohost = fqdn ? req.url.substr(0, req.url.indexOf('/', 2 + fqdn)) : '';
+  var idx = 0;
+  var removed = '';
+  var slashAdded = false;
 
-    // match next route
-    function nextRoute(err) {
-      pass(req._route_index + 1, err);
+  // store options for OPTIONS request
+  // only used if OPTIONS request
+  var options = [];
+
+  // middleware and routes
+  var stack = this.stack;
+
+  // for options requests, respond with a default if nothing else responds
+  if (method === 'options') {
+    var old = done;
+    done = function(err) {
+      if (err || options.length === 0) return old(err);
+
+      var body = options.join(',');
+      return res.set('Allow', body).send(body);
+    };
+  }
+
+  (function next(err) {
+    if (err === 'route') {
+      err = undefined;
     }
 
-    // match route
-    req.route = route = self.matchRequest(req, i);
-
-    // implied OPTIONS
-    if (!route && 'OPTIONS' == req.method) return self._options(req, res, next);
-
-    // no route
-    if (!route) return next(err);
-    debug('matched %s %s', route.method, route.path);
-
-    // we have a route
-    // start at param 0
-    req.params = route.params;
-    keys = route.keys;
-    i = 0;
-
-    // param callbacks
-    function param(err) {
-      paramIndex = 0;
-      key = keys[i++];
-      paramVal = key && req.params[key.name];
-      paramCallbacks = key && params[key.name];
-
-      try {
-        if ('route' == err) {
-          nextRoute();
-        } else if (err) {
-          i = 0;
-          callbacks(err);
-        } else if (paramCallbacks && undefined !== paramVal) {
-          paramCallback();
-        } else if (key) {
-          param();
-        } else {
-          i = 0;
-          callbacks();
+    var layer = stack[idx++];
+    if (!layer) {
+      return done(err);
+    }
+
+    if (slashAdded) {
+      req.url = req.url.substr(1);
+      slashAdded = false;
+    }
+
+    req.url = protohost + removed + req.url.substr(protohost.length);
+    req.originalUrl = req.originalUrl || req.url;
+    removed = '';
+
+    try {
+      var path = parse(req).pathname;
+      if (undefined == path) path = '/';
+
+      // route object and not middleware
+      var route = layer.route;
+
+      // handle route
+      if (route) {
+        // we don't run any routs with error first
+        if (err || !route.match(path)) {
+          return next(err);
+        }
+
+        req.params = route.params;
+
+        // we can now dispatch to the route
+        if (method === 'options' && !route.methods['options']) {
+          options.push.apply(options, route._options());
         }
-      } catch (err) {
-        param(err);
+
+        return self.process_params(route, req, res, function(err) {
+          if (err) {
+            return next(err);
+          }
+
+          route.dispatch(req, res, next);
+        });
       }
-    };
 
-    param(err);
+      // skip this layer if the path doesn't match.
+      if (0 != path.toLowerCase().indexOf(layer.path.toLowerCase())) return next(err);
 
-    // single param callbacks
-    function paramCallback(err) {
-      var fn = paramCallbacks[paramIndex++];
-      if (err || !fn) return param(err);
-      fn(req, res, paramCallback, paramVal, key.name);
-    }
+      var c = path[layer.path.length];
+      if (c && '/' != c && '.' != c) return next(err);
+
+      // Trim off the part of the url that matches the route
+      // middleware (.use stuff) needs to have the path stripped
+      debug('trim prefix (%s) from url %s', removed, req.url);
+      removed = layer.path;
+      req.url = protohost + req.url.substr(protohost.length + removed.length);
 
-    // invoke route callbacks
-    function callbacks(err) {
-      var fn = route.callbacks[i++];
-      try {
-        if ('route' == err) {
-          nextRoute();
-        } else if (err && fn) {
-          if (fn.length < 4) return callbacks(err);
-          fn(err, req, res, callbacks);
-        } else if (fn) {
-          if (fn.length < 4) return fn(req, res, callbacks);
-          callbacks();
+      // Ensure leading slash
+      if (!fqdn && '/' != req.url[0]) {
+        req.url = '/' + req.url;
+        slashAdded = true;
+      }
+
+      debug('%s %s : %s', layer.handle.name || 'anonymous', layer.path, req.originalUrl);
+      var arity = layer.handle.length;
+      if (err) {
+        if (arity === 4) {
+          layer.handle(err, req, res, next);
         } else {
-          nextRoute(err);
+          next(err);
         }
-      } catch (err) {
-        callbacks(err);
+      } else if (arity < 4) {
+        layer.handle(req, res, next);
+      } else {
+        next(err);
       }
+    } catch (err) {
+      next(err);
     }
-  })(0);
+  })();
 };
 
 /**
- * Respond to __OPTIONS__ method.
+ * Process any parameters for the route.
  *
- * @param {IncomingMessage} req
- * @param {ServerResponse} res
  * @api private
  */
 
-Router.prototype._options = function(req, res, next){
-  var path = parse(req).pathname
-    , body = this._optionsFor(path).join(',');
-  if (!body) return next();
-  res.set('Allow', body).send(body);
-};
-
-/**
- * Return an array of HTTP verbs or "options" for `path`.
- *
- * @param {String} path
- * @return {Array}
- * @api private
- */
-
-Router.prototype._optionsFor = function(path){
+Router.prototype.process_params = function(route, req, res, done) {
   var self = this;
-  return methods.filter(function(method){
-    var routes = self.map[method];
-    if (!routes || 'options' == method) return;
-    for (var i = 0, len = routes.length; i < len; ++i) {
-      if (routes[i].match(path)) return true;
+  var params = this.params;
+
+  // captured parameters from the route, keys and values
+  var keys = route.keys || [];
+
+  var i = 0;
+  var paramIndex = 0;
+  var key;
+  var paramVal;
+  var paramCallbacks;
+
+  // process params in order
+  // param callbacks can be async
+  function param(err) {
+    if (err) {
+      return done(err);
     }
-  }).map(function(method){
-    return method.toUpperCase();
-  });
-};
 
-/**
- * Attempt to match a route for `req`
- * with optional starting index of `i`
- * defaulting to 0.
- *
- * @param {IncomingMessage} req
- * @param {Number} i
- * @return {Route}
- * @api private
- */
-
-Router.prototype.matchRequest = function(req, i, head){
-  var method = req.method.toLowerCase()
-    , url = parse(req)
-    , path = url.pathname
-    , routes = this.map
-    , i = i || 0
-    , route;
-
-  // HEAD support
-  if (!head && 'head' == method) {
-    route = this.matchRequest(req, i, true);
-    if (route) return route;
-     method = 'get';
-  }
+    if (i >= keys.length ) {
+      return done();
+    }
 
-  // routes for this method
-  if (routes = routes[method]) {
+    paramIndex = 0;
+    key = keys[i++];
+    paramVal = key && req.params[key.name];
+    paramCallbacks = key && params[key.name];
 
-    // matching routes
-    for (var len = routes.length; i < len; ++i) {
-      route = routes[i];
-      if (route.match(path)) {
-        req._route_index = i;
-        return route;
+    try {
+      if (paramCallbacks && undefined !== paramVal) {
+        return paramCallback();
+      } else if (key) {
+        return param();
       }
+    } catch (err) {
+      done(err);
     }
+
+    done();
+  };
+
+  // single param callbacks
+  function paramCallback(err) {
+    var fn = paramCallbacks[paramIndex++];
+    if (err || !fn) return param(err);
+    fn(req, res, paramCallback, paramVal, key.name);
   }
+
+  param();
 };
 
 /**
- * Attempt to match a route for `method`
- * and `url` with optional starting
- * index of `i` defaulting to 0.
+ * Use the given middleware function, with optional path, defaulting to "/".
  *
- * @param {String} method
- * @param {String} url
- * @param {Number} i
- * @return {Route}
- * @api private
+ * Use (like `.all`) will run for any http METHOD, but it will not add
+ * handlers for those methods so OPTIONS requests will not consider `.use`
+ * functions even if they could respond.
+ *
+ * The other difference is that _route_ path is stripped and not visible
+ * to the handler function. The main effect of this feature is that mounted
+ * handlers can operate without any code changes regardless of the "prefix"
+ * pathname.
+ *
+ * @param {String|Function} route
+ * @param {Function} fn
+ * @return {app} for chaining
+ * @api public
  */
 
-Router.prototype.match = function(method, url, i, head){
-  var req = { method: method, url: url };
-  return  this.matchRequest(req, i, head);
+Router.prototype.use = function(route, fn){
+
+  // default route to '/'
+  if ('string' != typeof route) {
+    fn = route;
+    route = '/';
+  }
+
+  // strip trailing slash
+  if ('/' == route[route.length - 1]) {
+    route = route.slice(0, -1);
+  }
+
+  // add the middleware
+  debug('use %s %s', route || '/', fn.name || 'anonymous');
+  this.stack.push({ path: route, handle: fn });
+
+  return this;
 };
 
 /**
- * Route `method`, `path`, and one or more callbacks.
+ * Create a new Route for the given path.
+ *
+ * Each route contains a separate middleware stack and VERB handlers.
+ *
+ * See the Route api documentation for details on adding handlers
+ * and middleware to routes.
  *
- * @param {String} method
  * @param {String} path
- * @param {Function} callback...
- * @return {Router} for chaining
- * @api private
+ * @return {Route}
+ * @api public
  */
 
-Router.prototype.route = function(method, path, callbacks){
-  var method = method.toLowerCase()
-    , callbacks = utils.flatten([].slice.call(arguments, 2));
-
-  // ensure path was given
-  if (!path) throw new Error('Router#' + method + '() requires a path');
-
-  // ensure all callbacks are functions
-  callbacks.forEach(function(fn){
-    if ('function' == typeof fn) return;
-    var type = {}.toString.call(fn);
-    var msg = '.' + method + '() requires callback functions but got a ' + type;
-    throw new Error(msg);
-  });
-
-  // create the route
-  debug('defined %s %s', method, path);
-  var route = new Route(method, path, callbacks, {
+Router.prototype.route = function(path){
+  var route = new Route(path, {
     sensitive: this.caseSensitive,
     strict: this.strict
   });
 
-  // add it
-  (this.map[method] = this.map[method] || []).push(route);
-  return this;
+  this.stack.push({ path: path, route: route });
+  return route;
 };
 
-Router.prototype.all = function(path) {
-  var self = this;
-  var args = [].slice.call(arguments);
+/**
+ * Special-cased "all" method, applying the given route `path`,
+ * middleware, and callback to _every_ HTTP method.
+ *
+ * @param {String} path
+ * @param {Function} ...
+ * @return {app} for chaining
+ * @api public
+ */
+
+Router.prototype.all = function(path, fn) {
+  var route = this.route(path);
   methods.forEach(function(method){
-      self.route.apply(self, [method].concat(args));
+    route[method](fn);
   });
-  return this;
 };
 
+// create Router#VERB functions
 methods.forEach(function(method){
-  Router.prototype[method] = function(path){
-    var args = [method].concat([].slice.call(arguments));
-    this.route.apply(this, args);
-    return this;
+  Router.prototype[method] = function(path, fn){
+    var self = this;
+    self.route(path)[method](fn);
+    return self;
   };
 });
diff --git a/lib/router/route.js b/lib/router/route.js
index 60528ddb3a7..6a55aaa59cf 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -3,7 +3,9 @@
  * Module dependencies.
  */
 
-var utils = require('../utils');
+var utils = require('../utils')
+  , debug = require('debug')('express:router:route')
+  , methods = require('methods')
 
 /**
  * Expose `Route`.
@@ -20,22 +22,25 @@ module.exports = Route;
  *   - `sensitive`    enable case-sensitive routes
  *   - `strict`       enable strict matching for trailing slashes
  *
- * @param {String} method
  * @param {String} path
- * @param {Array} callbacks
  * @param {Object} options.
  * @api private
  */
 
-function Route(method, path, callbacks, options) {
+function Route(path, options) {
+  debug('new %s', path);
   options = options || {};
   this.path = path;
-  this.method = method;
-  this.callbacks = callbacks;
+  this.params = {};
   this.regexp = utils.pathRegexp(path
     , this.keys = []
     , options.sensitive
     , options.strict);
+
+  this.stack = undefined;
+
+  // route handlers for various http methods
+  this.methods = {};
 }
 
 /**
@@ -77,3 +82,138 @@ Route.prototype.match = function(path){
 
   return true;
 };
+
+/**
+ * @return {Array} supported HTTP methods
+ * @api private
+ */
+
+Route.prototype._options = function(){
+  return Object.keys(this.methods).map(function(method) {
+    return method.toUpperCase();
+  });
+};
+
+/**
+ * dispatch req, res into this route
+ *
+ * @api private
+ */
+
+Route.prototype.dispatch = function(req, res, done){
+  var self = this;
+  var method = req.method.toLowerCase();
+
+  if (method === 'head' && !this.methods['head']) {
+    method = 'get';
+  }
+
+  req.route = self;
+
+  // single middleware route case
+  if (typeof this.stack === 'function') {
+    this.stack(req, res, done);
+    return;
+  }
+
+  var stack = self.stack;
+  if (!stack) {
+    return done();
+  }
+
+  var idx = 0;
+  (function next_layer(err) {
+    if (err && err === 'route') {
+      return done();
+    }
+
+    var layer = stack[idx++];
+    if (!layer) {
+      return done(err);
+    }
+
+    if (layer.method && layer.method !== method) {
+      return next_layer(err);
+    }
+
+    var arity = layer.handle.length;
+    if (err) {
+      if (arity < 4) {
+        return next_layer(err);
+      }
+
+      return layer.handle(err, req, res, next_layer);
+    }
+
+    if (arity > 3) {
+      return next_layer();
+    }
+
+    layer.handle(req, res, next_layer);
+  })();
+};
+
+/**
+ * Add a handler for all HTTP verbs to this route.
+ *
+ * Behaves just like middleware and can respond or call `next`
+ * to continue processing.
+ *
+ * You can use multiple `.all` call to add multiple handlers.
+ *
+ *   function check_something(req, res, next){
+ *     next();
+ *   };
+ *
+ *   function validate_user(req, res, next){
+ *     next();
+ *   };
+ *
+ *   route
+ *   .all(validate_user)
+ *   .all(check_something)
+ *   .get(function(req, res, next){
+ *     res.send('hello world');
+ *   });
+ *
+ * @param {function} handler
+ * @return {Route} for chaining
+ * @api public
+ */
+
+Route.prototype.all = function(fn){
+  if (typeof fn !== 'function') {
+    var type = {}.toString.call(fn);
+    var msg = 'Route.use() requires callback functions but got a ' + type;
+    throw new Error(msg);
+  }
+
+  if (!this.stack) {
+    this.stack = fn;
+  }
+  else if (typeof this.stack === 'function') {
+    this.stack = [{ handle: this.stack }, { handle: fn }];
+  }
+  else {
+    this.stack.push({ handle: fn });
+  }
+
+  return this;
+};
+
+methods.forEach(function(method){
+  Route.prototype[method] = function(fn){
+    debug('%s %s', method, this.path);
+
+    if (!this.methods[method]) {
+      this.methods[method] = true;
+    }
+
+    if (!this.stack) {
+      this.stack = [];
+    }
+
+    this.stack.push({ method: method, handle: fn })
+    return this;
+  };
+});
diff --git a/test/Route.js b/test/Route.js
new file mode 100644
index 00000000000..62ec5da5e10
--- /dev/null
+++ b/test/Route.js
@@ -0,0 +1,153 @@
+
+var express = require('../')
+  , Route = express.Route
+  , methods = require('methods')
+  , assert = require('assert');
+
+describe('Route', function(){
+
+  describe('.match', function(){
+    it('should match', function(){
+      var route = new Route('/foo/bar');
+
+      assert(route.match('/foo/bar'));
+      assert(!route.match('/foo/baz'));
+    })
+  })
+
+  describe('.all', function(){
+    it('should add handler', function(done){
+      var route = new Route('/foo');
+
+      route.all(function(req, res, next) {
+        assert.equal(req.a, 1);
+        assert.equal(res.b, 2);
+        next();
+      });
+
+      route.dispatch({ a:1, method: 'GET' }, { b:2 }, done);
+    })
+
+    it('should handle VERBS', function(done) {
+      var route = new Route('/foo');
+
+      var count = 0;
+      route.all(function(req, res, next) {
+        count++;
+      });
+
+      methods.forEach(function testMethod(method) {
+        route.dispatch({ method: method }, {});
+      });
+
+      assert.equal(count, methods.length);
+      done();
+    })
+
+    it('should stack', function(done) {
+      var route = new Route('/foo');
+
+      var count = 0;
+      route.all(function(req, res, next) {
+        count++;
+        next();
+      });
+
+      route.all(function(req, res, next) {
+        count++;
+        next();
+      });
+
+      route.dispatch({ method: 'GET' }, {}, function(err) {
+        assert.ifError(err);
+        count++;
+      });
+
+      assert.equal(count, 3);
+      done();
+    })
+  })
+
+  describe('.VERB', function(){
+    it('should support .get', function(done){
+      var route = new Route('');
+
+      var count = 0;
+      route.get(function(req, res, next) {
+        count++;
+      })
+
+      route.dispatch({ method: 'GET' }, {});
+      assert(count);
+      done();
+    })
+
+    it('should limit to just .VERB', function(done){
+      var route = new Route('');
+
+      route.get(function(req, res, next) {
+        assert(false);
+        done();
+      })
+
+      route.post(function(req, res, next) {
+        assert(true);
+      })
+
+      route.dispatch({ method: 'post' }, {});
+      done();
+    })
+
+    it('should allow fallthrough', function(done){
+      var route = new Route('');
+
+      var order = '';
+      route.get(function(req, res, next) {
+        order += 'a';
+        next();
+      })
+
+      route.all(function(req, res, next) {
+        order += 'b';
+        next();
+      });
+
+      route.get(function(req, res, next) {
+        order += 'c';
+      })
+
+      route.dispatch({ method: 'get' }, {});
+      assert.equal(order, 'abc');
+      done();
+    })
+  })
+
+  describe('errors', function(){
+    it('should handle errors via arity 4 functions', function(done){
+      var route = new Route('');
+
+      var order = '';
+      route.all(function(req, res, next){
+        next(new Error('foobar'));
+      });
+
+      route.all(function(req, res, next){
+        order += '0';
+        next();
+      });
+
+      route.all(function(err, req, res, next){
+        order += 'a';
+        next(err);
+      });
+
+      route.all(function(err, req, res, next){
+        assert.equal(err.message, 'foobar');
+        assert.equal(order, 'a');
+        done();
+      });
+
+      route.dispatch({ method: 'get' }, {});
+    })
+  })
+})
diff --git a/test/Router.js b/test/Router.js
index 5bb49753220..10d6acb0014 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -1,121 +1,97 @@
 
 var express = require('../')
   , Router = express.Router
-  , request = require('./support/http')
   , methods = require('methods')
   , assert = require('assert');
 
 describe('Router', function(){
-  var router, app;
-
-  beforeEach(function(){
-    router = new Router;
-    app = express();
-  })
-
-  describe('.match(method, url, i)', function(){
-    it('should match based on index', function(){
-      router.route('get', '/foo', function(){});
-      router.route('get', '/foob?', function(){});
-      router.route('get', '/bar', function(){});
-
-      var method = 'GET';
-      var url = '/foo?bar=baz';
-
-      var route = router.match(method, url, 0);
-      route.constructor.name.should.equal('Route');
-      route.method.should.equal('get');
-      route.path.should.equal('/foo');
-
-      var route = router.match(method, url, 1);
-      route.path.should.equal('/foob?');
-
-      var route = router.match(method, url, 2);
-      assert(!route);
-
-      url = '/bar';
-      var route = router.match(method, url);
-      route.path.should.equal('/bar');
-    })
-  })
-  
-  describe('.matchRequest(req, i)', function(){
-    it('should match based on index', function(){
-      router.route('get', '/foo', function(){});
-      router.route('get', '/foob?', function(){});
-      router.route('get', '/bar', function(){});
-      var req = { method: 'GET', url: '/foo?bar=baz' };
-
-      var route = router.matchRequest(req, 0);
-      route.constructor.name.should.equal('Route');
-      route.method.should.equal('get');
-      route.path.should.equal('/foo');
-
-      var route = router.matchRequest(req, 1);
-      req._route_index.should.equal(1);
-      route.path.should.equal('/foob?');
-
-      var route = router.matchRequest(req, 2);
-      assert(!route);
-
-      req.url = '/bar';
-      var route = router.matchRequest(req);
-      route.path.should.equal('/bar');
-    })
-  })
 
   describe('.middleware', function(){
     it('should dispatch', function(done){
-      router.route('get', '/foo', function(req, res){
+      var router = new Router();
+
+      router.route('/foo').get(function(req, res){
         res.send('foo');
       });
 
-      app.use(router.middleware);
-
-      request(app)
-      .get('/foo')
-      .expect('foo', done);
+      var res = {
+        send: function(val) {
+          val.should.equal('foo');
+          done();
+        }
+      }
+      router.handle({ url: '/foo', method: 'GET' }, res);
     })
   })
 
   describe('.multiple callbacks', function(){
     it('should throw if a callback is null', function(){
       assert.throws(function () {
-        router.route('get', '/foo', null, function(){});
+        var router = new Router();
+        router.route('/foo').all(null);
       })
     })
 
     it('should throw if a callback is undefined', function(){
       assert.throws(function () {
-        router.route('get', '/foo', undefined, function(){});
+        var router = new Router();
+        router.route('/foo').all(undefined);
       })
     })
 
     it('should throw if a callback is not a function', function(){
       assert.throws(function () {
-        router.route('get', '/foo', 'not a function', function(){});
+        var router = new Router();
+        router.route('/foo').all('not a function');
       })
     })
 
     it('should not throw if all callbacks are functions', function(){
-      router.route('get', '/foo', function(){}, function(){});
+      var router = new Router();
+      router.route('/foo').all(function(){}).all(function(){});
     })
   })
 
+  describe('error', function(){
+    it('should skip non error middleware', function(done){
+      var router = new Router();
+
+      router.get('/foo', function(req, res, next){
+        next(new Error('foo'));
+      });
+
+      router.get('/bar', function(req, res, next){
+        next(new Error('bar'));
+      });
+
+      router.use(function(req, res, next){
+        assert(false);
+      });
+
+      router.use(function(err, req, res, next){
+        assert.equal(err.message, 'foo');
+        done();
+      });
+
+      router.handle({ url: '/foo', method: 'GET' }, {}, done);
+    });
+  })
+
   describe('.all', function() {
-    it('should support using .all to capture all http verbs', function() {
+    it('should support using .all to capture all http verbs', function(done){
       var router = new Router();
 
-      router.all('/foo', function(){});
+      var count = 0;
+      router.all('/foo', function(){ count++; });
 
       var url = '/foo?bar=baz';
 
       methods.forEach(function testMethod(method) {
-        var route = router.match(method, url);
-        route.constructor.name.should.equal('Route');
-        route.method.should.equal(method);
-        route.path.should.equal('/foo');
+        router.handle({ url: url, method: method }, {}, function() {});
       });
+
+      assert.equal(count, methods.length);
+      done();
     })
   })
 })
diff --git a/test/app.js b/test/app.js
index f8ea0f01e6e..03ad3244e79 100644
--- a/test/app.js
+++ b/test/app.js
@@ -25,7 +25,7 @@ describe('app.parent', function(){
   })
 })
 
-describe('app.route', function(){
+describe('app.mountpath', function(){
   it('should return the mounted path', function(){
     var app = express()
       , blog = express()
@@ -34,9 +34,21 @@ describe('app.route', function(){
     app.use('/blog', blog);
     blog.use('/admin', blogAdmin);
 
-    app.route.should.equal('/');
-    blog.route.should.equal('/blog');
-    blogAdmin.route.should.equal('/admin');
+    app.mountpath.should.equal('/');
+    blog.mountpath.should.equal('/blog');
+    blogAdmin.mountpath.should.equal('/admin');
+  })
+})
+
+describe('app.router', function(){
+  it('should throw with notice', function(done){
+    var app = express()
+
+    try {
+      app.router;
+    } catch(err) {
+      done();
+    }
   })
 })
 
@@ -71,4 +83,4 @@ describe('in production', function(){
     app.enabled('view cache').should.be.true;
     process.env.NODE_ENV = 'test';
   })
-})
\ No newline at end of file
+})
diff --git a/test/app.options.js b/test/app.options.js
index a6f7b65fb16..8b4bdc1c44c 100644
--- a/test/app.options.js
+++ b/test/app.options.js
@@ -58,4 +58,4 @@ describe('app.options()', function(){
     .expect('GET')
     .expect('Allow', 'GET', done);
   })
-})
\ No newline at end of file
+})
diff --git a/test/app.router.js b/test/app.router.js
index bf2443c6e32..285e3633841 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -87,36 +87,6 @@ describe('app.router', function(){
       next();
     });
 
-    app.use(app.router);
-
-    app.use(function(req, res, next){
-      calls.push('after');
-      res.end();
-    });
-
-    app.get('/', function(req, res, next){
-      calls.push('GET /')
-      next();
-    });
-
-    request(app)
-    .get('/')
-    .end(function(res){
-      calls.should.eql(['before', 'GET /', 'after'])
-      done();
-    })
-  })
-
-  it('should be auto .use()d on the first app.VERB() call', function(done){
-    var app = express();
-
-    var calls = [];
-
-    app.use(function(req, res, next){
-      calls.push('before');
-      next();
-    });
-
     app.get('/', function(req, res, next){
       calls.push('GET /')
       next();
diff --git a/test/app.routes.js b/test/app.routes.js
deleted file mode 100644
index a559ce8db38..00000000000
--- a/test/app.routes.js
+++ /dev/null
@@ -1,48 +0,0 @@
-
-var express = require('../')
-  , assert = require('assert')
-  , request = require('./support/http');
-
-describe('app.routes', function(){
-  it('should be initialized', function(){
-    var app = express();
-    app.routes.should.eql({});
-  })
-
-  it('should be populated with routes', function(){
-    var app = express();
-
-    app.get('/', function(req, res){});
-    app.get('/user/:id', function(req, res){});
-
-    var get = app.routes.get;
-    get.should.have.length(2);
-
-    get[0].path.should.equal('/');
-    get[0].method.should.equal('get');
-    get[0].regexp.toString().should.equal('/^\\/\\/?$/i');
-
-    get[1].path.should.equal('/user/:id');
-    get[1].method.should.equal('get');
-  })
-
-  it('should be mutable', function(done){
-    var app = express();
-
-    app.get('/', function(req, res){});
-    app.get('/user/:id', function(req, res){});
-
-    var get = app.routes.get;
-    get.should.have.length(2);
-
-    get[0].path.should.equal('/');
-    get[0].method.should.equal('get');
-    get[0].regexp.toString().should.equal('/^\\/\\/?$/i');
-
-    get.splice(1);
-
-    request(app)
-    .get('/user/12')
-    .expect(404, done);
-  })
-})
\ No newline at end of file
diff --git a/test/req.route.js b/test/req.route.js
index 329f85efbdb..8cfe6c2c0d9 100644
--- a/test/req.route.js
+++ b/test/req.route.js
@@ -8,13 +8,11 @@ describe('req', function(){
       var app = express();
 
       app.get('/user/:id/:op?', function(req, res, next){
-        req.route.method.should.equal('get');
         req.route.path.should.equal('/user/:id/:op?');
         next();
       });
       
       app.get('/user/:id/edit', function(req, res){
-        req.route.method.should.equal('get');
         req.route.path.should.equal('/user/:id/edit');
         res.end();
       });

From aac1d52c4fa1ce19e17bb2b4e06669e8756f6816 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Sat, 8 Feb 2014 11:37:43 -0800
Subject: [PATCH 0064/1265] res.location: remove resolving relative urls

closes #1804

this is an unnecessary maintenance burden (see the number of removed
tests), especially when supporting mounting. browsers handle relative
locations, and so should all clients.

a regression could be absolute locations on a mounted app, but 1. we
can fix that later when someone complains and 2) code-smell
---
 lib/response.js         |  33 +-------
 test/acceptance/auth.js |   6 +-
 test/res.location.js    | 166 ----------------------------------------
 test/res.redirect.js    |  74 +-----------------
 4 files changed, 6 insertions(+), 273 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index 97a2ac2b494..39da3d928d6 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -613,47 +613,18 @@ res.cookie = function(name, val, options){
  *
  *    res.location('/foo/bar').;
  *    res.location('http://example.com');
- *    res.location('../login'); // /blog/post/1 -> /blog/login
- *
- * Mounting:
- *
- *   When an application is mounted and `res.location()`
- *   is given a path that does _not_ lead with "/" it becomes
- *   relative to the mount-point. For example if the application
- *   is mounted at "/blog", the following would become "/blog/login".
- *
- *      res.location('login');
- *
- *   While the leading slash would result in a location of "/login":
- *
- *      res.location('/login');
+ *    res.location('../login');
  *
  * @param {String} url
  * @api public
  */
 
 res.location = function(url){
-  var app = this.app
-    , req = this.req
-    , path;
+  var req = this.req;
 
   // "back" is an alias for the referrer
   if ('back' == url) url = req.get('Referrer') || '/';
 
-  // relative
-  if (!~url.indexOf('://') && 0 != url.indexOf('//')) {
-    // relative to path
-    if ('.' == url[0]) {
-      path = req.originalUrl.split('?')[0];
-      path = path + ('/' == path[path.length - 1] ? '' : '/');
-      url = resolve(path, url);
-      // relative to mount-point
-    } else if ('/' != url[0]) {
-      path = app.path();
-      url = path + '/' + url;
-    }
-  }
-
   // Respond
   this.set('Location', url);
   return this;
diff --git a/test/acceptance/auth.js b/test/acceptance/auth.js
index f8ec6a89363..aa1a4ea1d89 100644
--- a/test/acceptance/auth.js
+++ b/test/acceptance/auth.js
@@ -18,7 +18,7 @@ describe('auth', function(){
     it('should redirect to /login', function(done){
       request(app)
       .get('/')
-      .end(redirects(/\/login$/, done))
+      .end(redirects(/login$/, done))
     })
   })
 
@@ -26,7 +26,7 @@ describe('auth', function(){
     it('should redirect to /login', function(done){
       request(app)
       .get('/restricted')
-      .end(redirects(/\/login$/,done))
+      .end(redirects(/login$/,done))
     })
   })
 
@@ -36,7 +36,7 @@ describe('auth', function(){
       .post('/login')
       .type('urlencoded')
       .send('username=not-tj&password=foobar')
-      .end(redirects(/\/login$/, done))
+      .end(redirects(/login$/, done))
     })
   })
 })
\ No newline at end of file
diff --git a/test/res.location.js b/test/res.location.js
index b9810d312b0..2fb9ab73540 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -18,171 +18,5 @@ describe('res', function(){
         done();
       })
     })
-   
-    describe('with leading //', function(){
-      it('should pass through scheme-relative urls', function(done){
-        var app = express();
-
-        app.use(function(req, res){
-          res.location('//cuteoverload.com').end();
-        });
-
-        request(app)
-        .get('/')
-        .end(function(err, res){
-          res.headers.should.have.property('location', '//cuteoverload.com');
-          done();
-        })
-      })
-    })
-   
-    describe('with leading /', function(){
-      it('should construct scheme-relative urls', function(done){
-        var app = express();
-
-        app.use(function(req, res){
-          res.location('/login').end();
-        });
-
-        request(app)
-        .get('/')
-        .end(function(err, res){
-          res.headers.should.have.property('location', '/login');
-          done();
-        })
-      })
-    })
-
-    describe('with leading ./', function(){
-      it('should construct path-relative urls', function(done){
-        var app = express();
-
-        app.use(function(req, res){
-          res.location('./edit').end();
-        });
-
-        request(app)
-        .get('/post/1')
-        .end(function(err, res){
-          res.headers.should.have.property('location', '/post/1/edit');
-          done();
-        })
-      })
-    })
-
-    describe('with leading ../', function(){
-      it('should construct path-relative urls', function(done){
-        var app = express();
-
-        app.use(function(req, res){
-          res.location('../new').end();
-        });
-
-        request(app)
-        .get('/post/1')
-        .end(function(err, res){
-          res.headers.should.have.property('location', '/post/new');
-          done();
-        })
-      })
-    })
-
-    describe('with leading ./ and containing ..', function(){
-      it('should construct path-relative urls', function(done){
-        var app = express();
-
-        app.use(function(req, res){
-          res.location('./skip/../../new').end();
-        });
-
-        request(app)
-        .get('/post/1')
-        .end(function(err, res){
-          res.headers.should.have.property('location', '/post/new');
-          done();
-        })
-      })
-    })
-    
-    describe('without leading /', function(){
-      it('should construct mount-point relative urls', function(done){
-        var app = express();
-
-        app.use(function(req, res){
-          res.location('login').end();
-        });
-
-        request(app)
-        .get('/')
-        .end(function(err, res){
-          res.headers.should.have.property('location', '/login');
-          done();
-        })
-      })
-    })
-    
-    describe('when mounted', function(){
-      describe('deeply', function(){
-        it('should respect the mount-point', function(done){
-          var app = express()
-            , blog = express()
-            , admin = express();
-
-          admin.use(function(req, res){
-            res.location('login').end();
-          });
-
-          app.use('/blog', blog);
-          blog.use('/admin', admin);
-
-          request(app)
-          .get('/blog/admin')
-          .end(function(err, res){
-            res.headers.should.have.property('location', '/blog/admin/login');
-            done();
-          })
-        })
-      })
-
-      describe('omitting leading /', function(){
-        it('should respect the mount-point', function(done){
-          var app = express()
-            , admin = express();
-
-          admin.use(function(req, res){
-            res.location('admin/login').end();
-          });
-
-          app.use('/blog', admin);
-
-          request(app)
-          .get('/blog')
-          .end(function(err, res){
-            res.headers.should.have.property('location', '/blog/admin/login');
-            done();
-          })
-        })
-      })
-
-      describe('providing leading /', function(){
-        it('should ignore mount-point', function(done){
-          var app = express()
-            , admin = express();
-
-          admin.use(function(req, res){
-            res.location('/admin/login').end();
-          });
-
-          app.use('/blog', admin);
-
-          request(app)
-          .get('/blog')
-          .end(function(err, res){
-            res.headers.should.have.property('location', '/admin/login');
-            done();
-          })
-        })
-      })
-    })
   })
 })
diff --git a/test/res.redirect.js b/test/res.redirect.js
index 4640719c7f3..dab3e6e003a 100644
--- a/test/res.redirect.js
+++ b/test/res.redirect.js
@@ -105,7 +105,7 @@ describe('res', function(){
       .set('Host', 'http://example.com')
       .set('Accept', 'text/html')
       .end(function(err, res){
-        res.text.should.equal('<p>Moved Temporarily. Redirecting to <a href="/&lt;lame&gt;">/&lt;lame&gt;</a></p>');
+        res.text.should.equal('<p>Moved Temporarily. Redirecting to <a href="&lt;lame&gt;">&lt;lame&gt;</a></p>');
         done();
       })
     })
@@ -169,76 +169,4 @@ describe('res', function(){
       })
     })
   })
-
-  describe('responses redirected to relative paths', function(){
-    function create(depth, parent) {
-      var app = express();
-
-      if (parent) {
-        parent.use('/depth' + depth, app);
-      }
-
-      app.get('/', function(req, res){
-        res.redirect('./index');
-      });
-
-      app.get('/index', function(req, res){
-        res.json({ depth: depth, content: 'index' });
-      });
-
-      return app;
-    }
-
-    var root = create(0);
-    var depth1 = create(1, root);
-    var depth2 = create(2, depth1);
-    var depth3 = create(3, depth2);
-
-    root.use('/depth2', depth2);
-    root.use('/depth3', depth3);
-
-    it('should not contain redundant leading slashes in the location header', function(done){
-      request(root)
-      .get('/')
-      .end(function(err, res){
-        res.headers.location.search(/^\/{2}/).should.equal(-1);
-        done();
-      })
-    })
-
-    it('should preserve context when redirecting nested applications at any depth', function(done){
-      request(root)
-      .get('/depth1')
-      .end(function(err, res){
-        res.headers.should.have.property('location', '/depth1/index');
-
-        request(root)
-        .get('/depth1/depth2')
-        .end(function(err, res){
-          res.headers.should.have.property('location', '/depth1/depth2/index');
-
-          request(root)
-          .get('/depth1/depth2/depth3')
-          .end(function(err, res){
-            res.headers.should.have.property('location', '/depth1/depth2/depth3/index');
-            done();
-          })
-        })
-      });
-    })
-
-    it('should redirect correctly for nested applications that have been remounted', function(done){
-      request(root)
-      .get('/depth2')
-      .end(function(err, res){
-        res.headers.should.have.property('location', '/depth2/index');
-        request(root)
-        .get('/depth3')
-        .end(function(err, res){
-          res.headers.should.have.property('location', '/depth3/index');
-          done();
-        })
-      })
-    })
-  })
 })

From 0796c1d2d2bd9383205d54383d3823dccf22b60e Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Sat, 8 Feb 2014 11:39:26 -0800
Subject: [PATCH 0065/1265] test app.router: ignore connect method
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

so tests pass in 0.11. 0.11 client seems to throw errors more often, so
this is not an issue with express or node’s servers.
---
 test/app.router.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/test/app.router.js b/test/app.router.js
index 285e3633841..7489efb59e9 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -7,6 +7,8 @@ var express = require('../')
 describe('app.router', function(){
   describe('methods supported', function(){
     methods.forEach(function(method){
+      if (method === 'connect') return;
+
       it('should include ' + method.toUpperCase(), function(done){
         if (method == 'delete') method = 'del';
         var app = express();

From 25e6629bcc2a7cf1b7da5342ad9e6cf28f94f790 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Sat, 8 Feb 2014 11:40:48 -0800
Subject: [PATCH 0066/1265] update history

---
 History.md | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index 40cb5ec433b..3770b975c88 100644
--- a/History.md
+++ b/History.md
@@ -3,16 +3,17 @@
 
  * remove:
    - express(1) - moved to [express-generator](https://github.com/expressjs/generator)
-   - `req.accepted*` - use `req.accepts*()` instead
-   - `app.configure` - use logic in your own app code
    - `express.createServer()` - it has been deprecated for a long time. Use `express()`
+   - `app.configure` - use logic in your own app code
    - `app.router` - is removed
+   - `req.accepted*` - use `req.accepts*()` instead
+   - `res.location` - relative URL resolution is removed
  * change:
+   - `app.route` -> `app.mountpath` when mounting an express app in another express app
+   - `json spaces` no longer enabled by default in development
    - `req.accepts*` -> `req.accepts*s` - i.e. `req.acceptsEncoding` -> `req.acceptsEncodings`
    - `req.params` is now an object instead of an array
-   - `json spaces` no longer enabled by default in development
    - `res.locals` is no longer a function. It is a plain js object. Treat it as such.
-   - `app.route` -> `app.mountpath` when mounting an express app in another express app
  * refactor:
    - `req.accepts*` with [accepts](https://github.com/expressjs/accepts)
    - `req.is` with [type-is](https://github.com/expressjs/type-is)

From 6b05f60badd3cf8e88ec46e192703dd5f3d31071 Mon Sep 17 00:00:00 2001
From: TJ Holowaychuk <tj@vision-media.ca>
Date: Wed, 19 Feb 2014 15:29:39 -0800
Subject: [PATCH 0067/1265] update node-fresh

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index be686aaebce..5e6eeaabe19 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
     "range-parser": "1.0.0",
     "cookie": "0.1.0",
     "buffer-crc32": "0.2.1",
-    "fresh": "0.2.1",
+    "fresh": "0.2.2",
     "methods": "0.1.0",
     "send": "0.2.0",
     "cookie-signature": "1.0.3",

From 9bc63d92a02dc895bafe32dc327b26629944a295 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Tue, 4 Feb 2014 10:10:56 -0500
Subject: [PATCH 0068/1265] move `connect.query()` into our repo

---
 lib/application.js |  5 ++---
 lib/middleware.js  | 36 +++++++++++++++++++++++++++++++++++-
 lib/utils.js       | 24 ++++++++++++++++++++++++
 package.json       |  1 +
 4 files changed, 62 insertions(+), 4 deletions(-)

diff --git a/lib/application.js b/lib/application.js
index 0f3f2d706c1..cb8d4994d8e 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -2,8 +2,7 @@
  * Module dependencies.
  */
 
-var connect = require('connect')
-  , mixin = require('utils-merge')
+var mixin = require('utils-merge')
   , escapeHtml = require('escape-html')
   , Router = require('./router')
   , methods = require('methods')
@@ -99,7 +98,7 @@ app.lazyrouter = function() {
       strict: this.enabled('strict routing')
     });
 
-    this._router.use(connect.query());
+    this._router.use(middleware.query());
     this._router.use(middleware.init(this));
   }
 };
diff --git a/lib/middleware.js b/lib/middleware.js
index 625719d1838..44593d2f2a5 100644
--- a/lib/middleware.js
+++ b/lib/middleware.js
@@ -3,7 +3,8 @@
  * Module dependencies.
  */
 
-var utils = require('./utils');
+var parseUrl = require('./utils').parseUrl;
+var qs = require('qs');
 
 /**
  * Initialization middleware, exposing the
@@ -30,3 +31,36 @@ exports.init = function(app){
     next();
   }
 };
+
+/**
+ * Query:
+ *
+ * Automatically parse the query-string when available,
+ * populating the `req.query` object using
+ * [qs](https://github.com/visionmedia/node-querystring).
+ *
+ * Examples:
+ *
+ *       .use(connect.query())
+ *       .use(function(req, res){
+ *         res.end(JSON.stringify(req.query));
+ *       });
+ *
+ *  The `options` passed are provided to qs.parse function.
+ *
+ * @param {Object} options
+ * @return {Function}
+ * @api public
+ */
+
+exports.query = function query(options){
+  return function query(req, res, next){
+    if (!req.query) {
+      req.query = ~req.url.indexOf('?')
+        ? qs.parse(parseUrl(req).query, options)
+        : {};
+    }
+
+    next();
+  };
+};
diff --git a/lib/utils.js b/lib/utils.js
index 2de05b5d153..1988f958088 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -156,3 +156,27 @@ exports.pathRegexp = function(path, keys, sensitive, strict) {
     .replace(/\*/g, '(.*)');
   return new RegExp('^' + path + '$', sensitive ? '' : 'i');
 }
+
+/**
+ * Parse the `req` url with memoization.
+ *
+ * @param {ServerRequest} req
+ * @return {Object}
+ * @api private
+ */
+
+exports.parseUrl = function(req){
+  var parsed = req._parsedUrl;
+  if (parsed && parsed.href == req.url) {
+    return parsed;
+  } else {
+    parsed = parse(req.url);
+
+    if (parsed.auth && !parsed.protocol && ~parsed.href.indexOf('//')) {
+      // This parses pathnames, and a strange pathname like //r@e should work
+      parsed = parse(req.url.replace(/@/g, '%40'));
+    }
+
+    return req._parsedUrl = parsed;
+  }
+};
diff --git a/package.json b/package.json
index 5e6eeaabe19..7fdd6f95298 100644
--- a/package.json
+++ b/package.json
@@ -35,6 +35,7 @@
     "merge-descriptors": "0.0.2",
     "utils-merge": "1.0.0",
     "escape-html": "1.0.1",
+    "qs": "0.6.6",
     "debug": ">= 0.7.3 < 1"
   },
   "devDependencies": {

From 6a7363e4aec1186a4a1cbfacfe03fa176c38cf21 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Tue, 4 Feb 2014 10:15:46 -0500
Subject: [PATCH 0069/1265] use local copy of parseUrl

---
 lib/request.js      | 2 +-
 lib/router/index.js | 4 ++--
 lib/utils.js        | 3 ++-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/request.js b/lib/request.js
index 062014e7d38..cfc356b0c9c 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -10,7 +10,7 @@ var http = require('http')
   , connect = require('connect')
   , fresh = require('fresh')
   , parseRange = require('range-parser')
-  , parse = connect.utils.parseUrl
+  , parse = utils.parseUrl
   , mime = connect.mime;
 
 /**
diff --git a/lib/router/index.js b/lib/router/index.js
index f95a6180ade..dd1bad46d07 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -6,7 +6,7 @@ var Route = require('./route')
   , utils = require('../utils')
   , methods = require('methods')
   , debug = require('debug')('express:router')
-  , parse = require('connect').utils.parseUrl;
+  , parseUrl = utils.parseUrl;
 
 /**
  * Expose `Router` constructor.
@@ -159,7 +159,7 @@ Router.prototype.handle = function(req, res, done) {
     removed = '';
 
     try {
-      var path = parse(req).pathname;
+      var path = parseUrl(req).pathname;
       if (undefined == path) path = '/';
 
       // route object and not middleware
diff --git a/lib/utils.js b/lib/utils.js
index 1988f958088..06076f20a66 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -4,7 +4,8 @@
  */
 
 var mime = require('connect').mime
-  , crc32 = require('buffer-crc32');
+  , crc32 = require('buffer-crc32')
+  , parse = require('url').parse;
 
 /**
  * toString ref.

From 1396e0855d1f7cf0ef86913e74c262bb9ade7e7e Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sat, 15 Feb 2014 20:20:12 -0500
Subject: [PATCH 0070/1265] remove last pieces of connect dependency

- copy over patch.js to shim ServerResponse
- bundle `static` middleware
---
 History.md                              |  1 +
 examples/auth/app.js                    | 11 ++--
 examples/big-view/index.js              |  5 +-
 examples/cookie-sessions/index.js       | 10 +--
 examples/cookies/app.js                 | 18 +++--
 examples/cors/index.js                  |  6 +-
 examples/error-pages/index.js           |  6 +-
 examples/error/index.js                 |  3 +-
 examples/expose-data-to-client/index.js |  5 +-
 examples/mvc/index.js                   | 15 +++--
 examples/route-separation/index.js      | 10 +--
 examples/session/index.js               |  2 -
 examples/static-files/index.js          |  5 +-
 examples/vhost/index.js                 |  3 +-
 lib/application.js                      |  5 +-
 lib/express.js                          | 26 +++-----
 lib/middleware.js                       | 66 -------------------
 lib/middleware/init.js                  | 26 ++++++++
 lib/middleware/query.js                 | 35 ++++++++++
 lib/middleware/static.js                | 87 +++++++++++++++++++++++++
 lib/patch.js                            | 79 ++++++++++++++++++++++
 lib/request.js                          |  4 +-
 lib/response.js                         |  7 +-
 lib/utils.js                            |  6 +-
 package.json                            |  8 ++-
 support/app.js                          |  1 -
 test/exports.js                         | 10 ---
 test/req.param.js                       |  5 +-
 test/req.signedCookies.js               |  5 +-
 test/res.cookie.js                      |  7 +-
 30 files changed, 321 insertions(+), 156 deletions(-)
 delete mode 100644 lib/middleware.js
 create mode 100644 lib/middleware/init.js
 create mode 100644 lib/middleware/query.js
 create mode 100644 lib/middleware/static.js
 create mode 100644 lib/patch.js

diff --git a/History.md b/History.md
index 3770b975c88..04b8ae0e860 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,7 @@
    - `app.router` - is removed
    - `req.accepted*` - use `req.accepts*()` instead
    - `res.location` - relative URL resolution is removed
+   - all bundled middleware except `static`
  * change:
    - `app.route` -> `app.mountpath` when mounting an express app in another express app
    - `json spaces` no longer enabled by default in development
diff --git a/examples/auth/app.js b/examples/auth/app.js
index 00175ad62d1..301ed6c8e28 100644
--- a/examples/auth/app.js
+++ b/examples/auth/app.js
@@ -3,7 +3,10 @@
  */
 
 var express = require('../..')
-  , hash = require('./pass').hash;
+  , hash = require('./pass').hash
+  , bodyParser = require('body-parser')
+  , cookieParser = require('cookie-parser')
+  , session = require('express-session')
 
 var app = module.exports = express();
 
@@ -14,9 +17,9 @@ app.set('views', __dirname + '/views');
 
 // middleware
 
-app.use(express.bodyParser());
-app.use(express.cookieParser('shhhh, very secret'));
-app.use(express.session());
+app.use(bodyParser());
+app.use(cookieParser('shhhh, very secret'));
+app.use(session());
 
 // Session-persisted message middleware
 
diff --git a/examples/big-view/index.js b/examples/big-view/index.js
index 2cb1a042586..451aa4c3cce 100644
--- a/examples/big-view/index.js
+++ b/examples/big-view/index.js
@@ -1,5 +1,6 @@
 
 var express = require('../..')
+  , logger = require('morgan')
   , app = express();
 
 app.set('views', __dirname);
@@ -14,11 +15,11 @@ while (n--) {
   pets.push({ name: 'Jane', age: 6, species: 'ferret' });
 }
 
-app.use(express.logger('dev'));
+app.use(logger('dev'));
 
 app.get('/', function(req, res){
   res.render('pets', { pets: pets });
 });
 
 app.listen(3000);
-console.log('Express listening on port 3000');
\ No newline at end of file
+console.log('Express listening on port 3000');
diff --git a/examples/cookie-sessions/index.js b/examples/cookie-sessions/index.js
index f7011003d26..56511197837 100644
--- a/examples/cookie-sessions/index.js
+++ b/examples/cookie-sessions/index.js
@@ -4,17 +4,19 @@
  */
 
 var express = require('../../');
+var favicon = require('static-favicon');
+var cookie-parser = require('cookie-parser');
 
 var app = module.exports = express();
 
 // ignore GET /favicon.ico
-app.use(express.favicon());
+app.use(favicon());
 
 // pass a secret to cookieParser() for signed cookies
-app.use(express.cookieParser('manny is cool'));
+app.use(cookieParser('manny is cool'));
 
 // add req.session cookie support
-app.use(express.cookieSession());
+app.use(cookieSession());
 
 // do something with the session
 app.use(count);
@@ -29,4 +31,4 @@ function count(req, res) {
 if (!module.parent) {
   app.listen(3000);
   console.log('Express server listening on port 3000');
-}
\ No newline at end of file
+}
diff --git a/examples/cookies/app.js b/examples/cookies/app.js
index f381fbed8c4..fb5f19cb184 100644
--- a/examples/cookies/app.js
+++ b/examples/cookies/app.js
@@ -4,7 +4,11 @@
  */
 
 var express = require('../../')
-  , app = module.exports = express();
+  , app = module.exports = express()
+  , favicon = require('static-favicon')
+  , logger = require('morgan')
+  , cookieParser = require('cookie-parser')
+  , bodyParser = require('body-parser')
 
 
 // add favicon() before logger() so
@@ -12,20 +16,20 @@ var express = require('../../')
 // logged, because this middleware
 // reponds to /favicon.ico and does not
 // call next()
-app.use(express.favicon());
+app.use(favicon());
 
 // custom log format
 if ('test' != process.env.NODE_ENV)
-  app.use(express.logger(':method :url'));
+  app.use(logger(':method :url'));
 
 // parses request cookies, populating
 // req.cookies and req.signedCookies
-// when the secret is passed, used 
+// when the secret is passed, used
 // for signing the cookies.
-app.use(express.cookieParser('my secret here'));
+app.use(cookieParser('my secret here'));
 
 // parses json, x-www-form-urlencoded, and multipart/form-data
-app.use(express.bodyParser());
+app.use(bodyParser());
 
 app.get('/', function(req, res){
   if (req.cookies.remember) {
@@ -51,4 +55,4 @@ app.post('/', function(req, res){
 if (!module.parent){
   app.listen(3000);
   console.log('Express started on port 3000');
-}
\ No newline at end of file
+}
diff --git a/examples/cors/index.js b/examples/cors/index.js
index 6698b7ad6aa..1d2c5925d0f 100644
--- a/examples/cors/index.js
+++ b/examples/cors/index.js
@@ -3,7 +3,9 @@
  */
 
 var express = require('../..')
+  , logger = require('morgan')
   , app = express()
+  , bodyParser = require('body-parser')
   , api = express();
 
 // app middleware
@@ -12,8 +14,8 @@ app.use(express.static(__dirname + '/public'));
 
 // api middleware
 
-api.use(express.logger('dev'));
-api.use(express.bodyParser());
+api.use(logger('dev'));
+api.use(bodyParser());
 
 /**
  * CORS support.
diff --git a/examples/error-pages/index.js b/examples/error-pages/index.js
index 0f21bea66d8..5f247c92920 100644
--- a/examples/error-pages/index.js
+++ b/examples/error-pages/index.js
@@ -4,6 +4,8 @@
 
 var express = require('../../')
   , app = module.exports = express()
+  , logger = require('morgan')
+  , favicon = require('static-favicon')
   , silent = 'test' == process.env.NODE_ENV;
 
 // general config
@@ -21,9 +23,9 @@ if ('production' == app.settings.env) {
   app.disable('verbose errors');
 }
 
-app.use(express.favicon());
+app.use(favicon());
 
-silent || app.use(express.logger('dev'));
+silent || app.use(logger('dev'));
 
 // Routes
 
diff --git a/examples/error/index.js b/examples/error/index.js
index 9d522798025..91910249b0e 100644
--- a/examples/error/index.js
+++ b/examples/error/index.js
@@ -4,10 +4,11 @@
  */
 
 var express = require('../../')
+  , logger = require('morgan')
   , app = module.exports = express()
   , test = app.get('env') == 'test';
 
-if (!test) app.use(express.logger('dev'));
+if (!test) app.use(logger('dev'));
 
 // error handling middleware have an arity of 4
 // instead of the typical (req, res, next),
diff --git a/examples/expose-data-to-client/index.js b/examples/expose-data-to-client/index.js
index e0f72adbd6e..1d5ef830550 100644
--- a/examples/expose-data-to-client/index.js
+++ b/examples/expose-data-to-client/index.js
@@ -1,5 +1,6 @@
 
 var express = require('../..')
+  , logger = require('morgan')
   , app = express();
 
 app.set('view engine', 'jade');
@@ -23,7 +24,7 @@ User.prototype.toJSON = function(){
   }
 };
 
-app.use(express.logger('dev'));
+app.use(logger('dev'));
 
 // earlier on expose an object
 // that we can tack properties on.
@@ -57,4 +58,4 @@ app.get('/user', function(req, res){
 });
 
 app.listen(3000);
-console.log('app listening on port 3000');
\ No newline at end of file
+console.log('app listening on port 3000');
diff --git a/examples/mvc/index.js b/examples/mvc/index.js
index 3811db4a5d5..7e282f46bbb 100644
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -1,4 +1,8 @@
 var express = require('../..');
+var logger = require('morgan');
+var session = require('express-session');
+var cookieParser = require('cookie-parser');
+var bodyParser = require('body-parser');
 
 var app = module.exports = express();
 
@@ -25,20 +29,17 @@ app.response.message = function(msg){
 };
 
 // log
-if (!module.parent) app.use(express.logger('dev'));
+if (!module.parent) app.use(logger('dev'));
 
 // serve static files
 app.use(express.static(__dirname + '/public'));
 
 // session support
-app.use(express.cookieParser('some secret here'));
-app.use(express.session());
+app.use(cookieParser('some secret here'));
+app.use(session());
 
 // parse request bodies (req.body)
-app.use(express.bodyParser());
-
-// support _method (PUT in forms etc)
-app.use(express.methodOverride());
+app.use(bodyParser());
 
 // expose the "messages" local variable when views are rendered
 app.use(function(req, res, next){
diff --git a/examples/route-separation/index.js b/examples/route-separation/index.js
index cb344e0a901..782d123fb8a 100644
--- a/examples/route-separation/index.js
+++ b/examples/route-separation/index.js
@@ -5,6 +5,9 @@
 
 var express = require('../..')
   , app = express()
+  , logger = require('morgan')
+  , cookieParser = require('cookie-parser')
+  , bodyParser = require('body-parser')
   , site = require('./site')
   , post = require('./post')
   , user = require('./user');
@@ -13,10 +16,9 @@ var express = require('../..')
 
 app.set('view engine', 'jade');
 app.set('views', __dirname + '/views');
-app.use(express.logger('dev'));
-app.use(express.cookieParser());
-app.use(express.bodyParser());
-app.use(express.methodOverride());
+app.use(logger('dev'));
+app.use(cookieParser());
+app.use(bodyParser());
 app.use(express.static(__dirname + '/public'));
 
 // General
diff --git a/examples/session/index.js b/examples/session/index.js
index 5ad94b7f155..8907216bc76 100644
--- a/examples/session/index.js
+++ b/examples/session/index.js
@@ -7,8 +7,6 @@ var express = require('../..');
 
 var app = express();
 
-app.use(express.logger('dev'));
-
 // Required by session() middleware
 // pass the secret for signed cookies
 // (required by session())
diff --git a/examples/static-files/index.js b/examples/static-files/index.js
index e7ef8c2b80e..1f60d446ccb 100644
--- a/examples/static-files/index.js
+++ b/examples/static-files/index.js
@@ -1,9 +1,10 @@
 
 var express = require('../..');
+var logger = require('morgan');
 var app = express();
 
 // log requests
-app.use(express.logger('dev'));
+app.use(logger('dev'));
 
 // express on its own has no notion
 // of a "file". The express.static()
@@ -41,4 +42,4 @@ console.log('listening on port 3000');
 console.log('try:');
 console.log('  GET /hello.txt');
 console.log('  GET /js/app.js');
-console.log('  GET /css/style.css');
\ No newline at end of file
+console.log('  GET /css/style.css');
diff --git a/examples/vhost/index.js b/examples/vhost/index.js
index bbf5070ef17..1fa301080c9 100644
--- a/examples/vhost/index.js
+++ b/examples/vhost/index.js
@@ -3,6 +3,7 @@
  */
 
 var express = require('../..');
+var logger = require('morgan');
 
 /*
 edit /etc/hosts:
@@ -16,7 +17,7 @@ edit /etc/hosts:
 
 var main = express();
 
-main.use(express.logger('dev'));
+main.use(logger('dev'));
 
 main.get('/', function(req, res){
   res.send('Hello from main app!')
diff --git a/lib/application.js b/lib/application.js
index cb8d4994d8e..dc83160dba3 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -6,7 +6,8 @@ var mixin = require('utils-merge')
   , escapeHtml = require('escape-html')
   , Router = require('./router')
   , methods = require('methods')
-  , middleware = require('./middleware')
+  , middleware = require('./middleware/init')
+  , query = require('./middleware/query')
   , debug = require('debug')('express:application')
   , View = require('./view')
   , http = require('http');
@@ -98,7 +99,7 @@ app.lazyrouter = function() {
       strict: this.enabled('strict routing')
     });
 
-    this._router.use(middleware.query());
+    this._router.use(query());
     this._router.use(middleware.init(this));
   }
 };
diff --git a/lib/express.js b/lib/express.js
index ec4d558a765..024783bb9c5 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -4,8 +4,7 @@
 
 var EventEmitter = require('events').EventEmitter;
 
-var connect = require('connect')
-  , merge = require('merge-descriptors')
+var merge = require('merge-descriptors')
   , mixin = require('utils-merge')
 
 var proto = require('./application')
@@ -14,18 +13,15 @@ var proto = require('./application')
   , req = require('./request')
   , res = require('./response')
 
+// monkey patch ServerResponse methods
+require('./patch')
+
 /**
  * Expose `createApplication()`.
  */
 
 exports = module.exports = createApplication;
 
-/**
- * Expose mime.
- */
-
-exports.mime = connect.mime;
-
 /**
  * Create an express application.
  *
@@ -47,13 +43,6 @@ function createApplication() {
   return app;
 }
 
-/**
- * Expose connect.middleware as express.*
- * for example `express.logger` etc.
- */
-
-merge(exports, connect.middleware);
-
 /**
  * Expose the prototypes.
  */
@@ -69,7 +58,8 @@ exports.response = res;
 exports.Route = Route;
 exports.Router = Router;
 
-// Error handler title
-
-exports.errorHandler.title = 'Express';
+/**
+ * Expose middleware
+ */
 
+exports.static = require('./middleware/static');
diff --git a/lib/middleware.js b/lib/middleware.js
deleted file mode 100644
index 44593d2f2a5..00000000000
--- a/lib/middleware.js
+++ /dev/null
@@ -1,66 +0,0 @@
-
-/**
- * Module dependencies.
- */
-
-var parseUrl = require('./utils').parseUrl;
-var qs = require('qs');
-
-/**
- * Initialization middleware, exposing the
- * request and response to eachother, as well
- * as defaulting the X-Powered-By header field.
- *
- * @param {Function} app
- * @return {Function}
- * @api private
- */
-
-exports.init = function(app){
-  return function expressInit(req, res, next){
-    if (app.enabled('x-powered-by')) res.setHeader('X-Powered-By', 'Express');
-    req.res = res;
-    res.req = req;
-    req.next = next;
-
-    req.__proto__ = app.request;
-    res.__proto__ = app.response;
-
-    res.locals = res.locals || Object.create(null);
-
-    next();
-  }
-};
-
-/**
- * Query:
- *
- * Automatically parse the query-string when available,
- * populating the `req.query` object using
- * [qs](https://github.com/visionmedia/node-querystring).
- *
- * Examples:
- *
- *       .use(connect.query())
- *       .use(function(req, res){
- *         res.end(JSON.stringify(req.query));
- *       });
- *
- *  The `options` passed are provided to qs.parse function.
- *
- * @param {Object} options
- * @return {Function}
- * @api public
- */
-
-exports.query = function query(options){
-  return function query(req, res, next){
-    if (!req.query) {
-      req.query = ~req.url.indexOf('?')
-        ? qs.parse(parseUrl(req).query, options)
-        : {};
-    }
-
-    next();
-  };
-};
diff --git a/lib/middleware/init.js b/lib/middleware/init.js
new file mode 100644
index 00000000000..8e8decfbbd5
--- /dev/null
+++ b/lib/middleware/init.js
@@ -0,0 +1,26 @@
+/**
+ * Initialization middleware, exposing the
+ * request and response to eachother, as well
+ * as defaulting the X-Powered-By header field.
+ *
+ * @param {Function} app
+ * @return {Function}
+ * @api private
+ */
+
+exports.init = function(app){
+  return function expressInit(req, res, next){
+    if (app.enabled('x-powered-by')) res.setHeader('X-Powered-By', 'Express');
+    req.res = res;
+    res.req = req;
+    req.next = next;
+
+    req.__proto__ = app.request;
+    res.__proto__ = app.response;
+
+    res.locals = res.locals || Object.create(null);
+
+    next();
+  }
+};
+
diff --git a/lib/middleware/query.js b/lib/middleware/query.js
new file mode 100644
index 00000000000..366c0577447
--- /dev/null
+++ b/lib/middleware/query.js
@@ -0,0 +1,35 @@
+var qs = require('qs');
+var parseUrl = require('../utils').parseUrl;
+
+/**
+ * Query:
+ *
+ * Automatically parse the query-string when available,
+ * populating the `req.query` object using
+ * [qs](https://github.com/visionmedia/node-querystring).
+ *
+ * Examples:
+ *
+ *       .use(connect.query())
+ *       .use(function(req, res){
+ *         res.end(JSON.stringify(req.query));
+ *       });
+ *
+ *  The `options` passed are provided to qs.parse function.
+ *
+ * @param {Object} options
+ * @return {Function}
+ * @api public
+ */
+
+module.exports = function query(options){
+  return function query(req, res, next){
+    if (!req.query) {
+      req.query = ~req.url.indexOf('?')
+        ? qs.parse(parseUrl(req).query, options)
+        : {};
+    }
+
+    next();
+  };
+};
diff --git a/lib/middleware/static.js b/lib/middleware/static.js
new file mode 100644
index 00000000000..5d213ef34b1
--- /dev/null
+++ b/lib/middleware/static.js
@@ -0,0 +1,87 @@
+/*!
+ * Connect - static
+ * Copyright(c) 2010 Sencha Inc.
+ * Copyright(c) 2011 TJ Holowaychuk
+ * MIT Licensed
+ */
+
+/**
+ * Module dependencies.
+ */
+
+var send = require('send')
+  , utils = require('../utils')
+  , parse = utils.parseUrl
+  , url = require('url');
+
+/**
+ * Static:
+ *
+ *   Static file server with the given `root` path.
+ *
+ * Examples:
+ *
+ *     var oneDay = 86400000;
+ *
+ *     connect()
+ *       .use(connect.static(__dirname + '/public'))
+ *
+ *     connect()
+ *       .use(connect.static(__dirname + '/public', { maxAge: oneDay }))
+ *
+ * Options:
+ *
+ *    - `maxAge`     Browser cache maxAge in milliseconds. defaults to 0
+ *    - `hidden`     Allow transfer of hidden files. defaults to false
+ *    - `redirect`   Redirect to trailing "/" when the pathname is a dir. defaults to true
+ *    - `index`      Default file name, defaults to 'index.html'
+ *
+ * @param {String} root
+ * @param {Object} options
+ * @return {Function}
+ * @api public
+ */
+
+exports = module.exports = function(root, options){
+  options = options || {};
+
+  // root required
+  if (!root) throw new Error('static() root path required');
+
+  // default redirect
+  var redirect = false !== options.redirect;
+
+  return function staticMiddleware(req, res, next) {
+    if ('GET' != req.method && 'HEAD' != req.method) return next();
+    var originalUrl = url.parse(req.originalUrl);
+    var path = parse(req).pathname;
+
+    if (path == '/' && originalUrl.pathname[originalUrl.pathname.length - 1] != '/') {
+      return directory();
+    }
+
+    function directory() {
+      if (!redirect) return next();
+      var target;
+      originalUrl.pathname += '/';
+      target = url.format(originalUrl);
+      res.statusCode = 303;
+      res.setHeader('Location', target);
+      res.end('Redirecting to ' + utils.escape(target));
+    }
+
+    function error(err) {
+      if (404 == err.status) return next();
+      next(err);
+    }
+
+    send(req, path)
+      .maxage(options.maxAge || 0)
+      .root(root)
+      .index(options.index || 'index.html')
+      .hidden(options.hidden)
+      .on('error', error)
+      .on('directory', directory)
+      .pipe(res);
+  };
+};
diff --git a/lib/patch.js b/lib/patch.js
new file mode 100644
index 00000000000..24a20e290f8
--- /dev/null
+++ b/lib/patch.js
@@ -0,0 +1,79 @@
+/*!
+ * Connect
+ * Copyright(c) 2011 TJ Holowaychuk
+ * MIT Licensed
+ */
+
+/**
+ * Module dependencies.
+ */
+
+var http = require('http');
+var ServerResponse = http.ServerResponse;
+
+// apply only once
+if (ServerResponse.prototype._hasConnectPatch) {
+  return;
+}
+
+// original methods
+var setHeader = ServerResponse.prototype.setHeader;
+var writeHead = ServerResponse.prototype.writeHead;
+
+/**
+ * Provide a public "header sent" flag
+ * until node does.
+ *
+ * @return {Boolean}
+ * @api public
+ */
+
+ServerResponse.prototype.__defineGetter__('headerSent', function(){
+  return this._header;
+});
+
+/**
+ * Set header `field` to `val`, special-casing
+ * the `Set-Cookie` field for multiple support.
+ *
+ * @param {String} field
+ * @param {String} val
+ * @api public
+ */
+
+ServerResponse.prototype.setHeader = function(field, val){
+  var key = field.toLowerCase()
+    , prev;
+
+  // special-case Set-Cookie
+  if (this._headers && 'set-cookie' == key) {
+    if (prev = this.getHeader(field)) {
+        if (Array.isArray(prev)) {
+            val = prev.concat(val);
+        } else if (Array.isArray(val)) {
+            val = val.concat(prev);
+        } else {
+            val = [prev, val];
+        }
+    }
+  // charset
+  } else if ('content-type' == key && this.charset) {
+    val += '; charset=' + this.charset;
+  }
+
+  return setHeader.call(this, field, val);
+};
+
+ServerResponse.prototype.writeHead = function(statusCode, reasonPhrase, headers){
+  if (typeof reasonPhrase === 'object') headers = reasonPhrase;
+  if (typeof headers === 'object') {
+    Object.keys(headers).forEach(function(key){
+      this.setHeader(key, headers[key]);
+    }, this);
+  }
+  if (!this._emittedHeader) this.emit('header');
+  this._emittedHeader = true;
+  return writeHead.call(this, statusCode, reasonPhrase);
+};
+
+ServerResponse.prototype._hasConnectPatch = true;
diff --git a/lib/request.js b/lib/request.js
index cfc356b0c9c..c0e42310d28 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -7,11 +7,9 @@ var accepts = require('accepts');
 var typeis = require('type-is');
 var http = require('http')
   , utils = require('./utils')
-  , connect = require('connect')
   , fresh = require('fresh')
   , parseRange = require('range-parser')
   , parse = utils.parseUrl
-  , mime = connect.mime;
 
 /**
  * Request prototype.
@@ -191,7 +189,7 @@ req.range = function(size){
  *
  * To utilize request bodies, `req.body`
  * should be an object. This can be done by using
- * the `connect.bodyParser()` middleware.
+ * the `bodyParser()` middleware.
  *
  * @param {String} name
  * @param {Mixed} [defaultValue]
diff --git a/lib/response.js b/lib/response.js
index 39da3d928d6..5bfc6472539 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -4,7 +4,6 @@
 
 var http = require('http')
   , path = require('path')
-  , connect = require('connect')
   , mixin = require('utils-merge')
   , escapeHtml = require('escape-html')
   , sign = require('cookie-signature').sign
@@ -14,10 +13,10 @@ var http = require('http')
   , statusCodes = http.STATUS_CODES
   , cookie = require('cookie')
   , send = require('send')
-  , mime = connect.mime
   , resolve = require('url').resolve
   , basename = path.basename
-  , extname = path.extname;
+  , extname = path.extname
+  , mime = send.mime
 
 /**
  * Response prototype.
@@ -589,7 +588,7 @@ res.cookie = function(name, val, options){
   options = mixin({}, options);
   var secret = this.req.secret;
   var signed = options.signed;
-  if (signed && !secret) throw new Error('connect.cookieParser("secret") required for signed cookies');
+  if (signed && !secret) throw new Error('cookieParser("secret") required for signed cookies');
   if ('number' == typeof val) val = val.toString();
   if ('object' == typeof val) val = 'j:' + JSON.stringify(val);
   if (signed) val = 's:' + sign(val, secret);
diff --git a/lib/utils.js b/lib/utils.js
index 06076f20a66..fda418958da 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -3,9 +3,9 @@
  * Module dependencies.
  */
 
-var mime = require('connect').mime
-  , crc32 = require('buffer-crc32')
-  , parse = require('url').parse;
+var mime = require('send').mime;
+var crc32 = require('buffer-crc32');
+var parse = require('url').parse;
 
 /**
  * toString ref.
diff --git a/package.json b/package.json
index 7fdd6f95298..f1d232deb1c 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,6 @@
     }
   ],
   "dependencies": {
-    "connect": "2.12.0",
     "accepts": "1.0.0",
     "type-is": "1.0.0",
     "range-parser": "1.0.0",
@@ -47,7 +46,12 @@
     "should": "~2.1.1",
     "connect-redis": "~1.4.5",
     "marked": "0.2.10",
-    "supertest": "~0.8.1"
+    "supertest": "~0.8.1",
+    "body-parser": "1.0.0",
+    "cookie-parser": "1.0.0",
+    "static-favicon": "1.0.0",
+    "express-session": "1.0.1",
+    "morgan": "1.0.0"
   },
   "keywords": [
     "express",
diff --git a/support/app.js b/support/app.js
index 42198d92d99..6631bdf3142 100644
--- a/support/app.js
+++ b/support/app.js
@@ -9,7 +9,6 @@ var app = express()
   , blog = express()
   , admin = express();
 
-// app.use(express.logger('dev'))
 blog.use('/admin', admin);
 app.use('/blog', blog);
 app.set('views', __dirname + '/views');
diff --git a/test/exports.js b/test/exports.js
index 8384d95ae0f..25700e6223c 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -4,16 +4,6 @@ var express = require('../')
   , assert = require('assert');
 
 describe('exports', function(){
-  it('should expose connect middleware', function(){
-    express.should.have.property('bodyParser');
-    express.should.have.property('session');
-    express.should.have.property('static');
-  })
-
-  it('should expose .mime', function(){
-    assert(express.mime == require('connect').mime, 'express.mime should be connect.mime');
-  })
-
   it('should expose Router', function(){
     express.Router.should.be.a.Function;
   })
diff --git a/test/req.param.js b/test/req.param.js
index e26257d4479..0f7ebf440c2 100644
--- a/test/req.param.js
+++ b/test/req.param.js
@@ -1,6 +1,7 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('./support/http')
+  , bodyParser = require('body-parser')
 
 describe('req', function(){
   describe('.param(name, default)', function(){
@@ -33,7 +34,7 @@ describe('req', function(){
     it('should check req.body', function(done){
       var app = express();
 
-      app.use(express.bodyParser());
+      app.use(bodyParser());
 
       app.use(function(req, res){
         res.end(req.param('name'));
diff --git a/test/req.signedCookies.js b/test/req.signedCookies.js
index d9f8c594730..32b87bfe25e 100644
--- a/test/req.signedCookies.js
+++ b/test/req.signedCookies.js
@@ -1,13 +1,14 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('./support/http')
+  , cookieParser = require('cookie-parser')
 
 describe('req', function(){
   describe('.signedCookies', function(){
     it('should return a signed JSON cookie', function(done){
       var app = express();
 
-      app.use(express.cookieParser('secret'));
+      app.use(cookieParser('secret'));
 
       app.use(function(req, res){
         if ('/set' == req.path) {
diff --git a/test/res.cookie.js b/test/res.cookie.js
index d60635e0e72..14633ed28e2 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -2,7 +2,8 @@
 var express = require('../')
   , request = require('./support/http')
   , mixin = require('utils-merge')
-  , cookie = require('cookie');
+  , cookie = require('cookie')
+  , cookieParser = require('cookie-parser')
 
 describe('res', function(){
   describe('.cookie(name, object)', function(){
@@ -134,7 +135,7 @@ describe('res', function(){
       it('should generate a signed JSON cookie', function(done){
         var app = express();
 
-        app.use(express.cookieParser('foo bar baz'));
+        app.use(cookieParser('foo bar baz'));
 
         app.use(function(req, res){
           res.cookie('user', { name: 'tobi' }, { signed: true }).end();
@@ -155,7 +156,7 @@ describe('res', function(){
       it('should set a signed cookie', function(done){
         var app = express();
 
-        app.use(express.cookieParser('foo bar baz'));
+        app.use(cookieParser('foo bar baz'));
 
         app.use(function(req, res){
           res.cookie('name', 'tobi', { signed: true }).end();

From 6835289564270d5dedbfa04524694230a2b66b70 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Mon, 17 Feb 2014 23:36:56 -0500
Subject: [PATCH 0071/1265] remove ServerResonse.headerSent monkey patch

node.js ServerResponse contains a headersSent field. Use that instead of
our patched misnamed version.
---
 History.md           |  1 +
 lib/application.js   |  2 +-
 lib/patch.js         | 12 ------------
 lib/response.js      |  6 +++---
 test/res.sendfile.js |  6 +++---
 5 files changed, 8 insertions(+), 19 deletions(-)

diff --git a/History.md b/History.md
index 04b8ae0e860..e680b2999a8 100644
--- a/History.md
+++ b/History.md
@@ -15,6 +15,7 @@
    - `req.accepts*` -> `req.accepts*s` - i.e. `req.acceptsEncoding` -> `req.acceptsEncodings`
    - `req.params` is now an object instead of an array
    - `res.locals` is no longer a function. It is a plain js object. Treat it as such.
+   - `res.headerSent` -> `res.headersSent` to match node.js ServerResponse object
  * refactor:
    - `req.accepts*` with [accepts](https://github.com/expressjs/accepts)
    - `req.is` with [type-is](https://github.com/expressjs/type-is)
diff --git a/lib/application.js b/lib/application.js
index dc83160dba3..1dc530ce284 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -138,7 +138,7 @@ app.handle = function(req, res, done) {
 
       // log to stderr in a non-test env
       if ('test' != env) console.error(err.stack || err.toString());
-      if (res.headerSent) return req.socket.destroy();
+      if (res.headersSent) return req.socket.destroy();
       res.setHeader('Content-Type', 'text/html');
       res.setHeader('Content-Length', Buffer.byteLength(msg));
       if ('HEAD' == req.method) return res.end();
diff --git a/lib/patch.js b/lib/patch.js
index 24a20e290f8..ab832832a73 100644
--- a/lib/patch.js
+++ b/lib/patch.js
@@ -20,18 +20,6 @@ if (ServerResponse.prototype._hasConnectPatch) {
 var setHeader = ServerResponse.prototype.setHeader;
 var writeHead = ServerResponse.prototype.writeHead;
 
-/**
- * Provide a public "header sent" flag
- * until node does.
- *
- * @return {Boolean}
- * @api public
- */
-
-ServerResponse.prototype.__defineGetter__('headerSent', function(){
-  return this._header;
-});
-
 /**
  * Set header `field` to `val`, special-casing
  * the `Set-Cookie` field for multiple support.
diff --git a/lib/response.js b/lib/response.js
index 5bfc6472539..e9283ffff52 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -311,13 +311,13 @@ res.sendfile = function(path, options, fn){
 
     // clean up
     cleanup();
-    if (!self.headerSent) self.removeHeader('Content-Disposition');
+    if (!self.headersSent) self.removeHeader('Content-Disposition');
 
     // callback available
     if (fn) return fn(err);
 
     // list in limbo if there's no callback
-    if (self.headerSent) return;
+    if (self.headersSent) return;
 
     // delegate
     next(err);
@@ -352,7 +352,7 @@ res.sendfile = function(path, options, fn){
  * Optionally providing an alternate attachment `filename`,
  * and optional callback `fn(err)`. The callback is invoked
  * when the data transfer is complete, or when an error has
- * ocurred. Be sure to check `res.headerSent` if you plan to respond.
+ * ocurred. Be sure to check `res.headersSent` if you plan to respond.
  *
  * This method uses `res.sendfile()`.
  *
diff --git a/test/res.sendfile.js b/test/res.sendfile.js
index 30c2ebe00d9..5532a5a5c0f 100644
--- a/test/res.sendfile.js
+++ b/test/res.sendfile.js
@@ -42,7 +42,7 @@ describe('res', function(){
       app.use(function(req, res){
         res.sendfile('test/fixtures/nope.html', function(err){
           ++calls;
-          assert(!res.headerSent);
+          assert(!res.headersSent);
           res.send(err.message);
         });
       });
@@ -77,7 +77,7 @@ describe('res', function(){
 
       app.use(function(req, res){
         res.sendfile('test/fixtures/foo/../user.html', function(err){
-          assert(!res.headerSent);
+          assert(!res.headersSent);
           ++calls;
           res.send(err.message);
         });
@@ -95,7 +95,7 @@ describe('res', function(){
 
       app.use(function(req, res){
         res.sendfile('test/fixtures/user.html', function(err){
-          assert(!res.headerSent);
+          assert(!res.headersSent);
           req.socket.listeners('error').should.have.length(1); // node's original handler
           done();
         });

From 143e72dd8507701d243fb21b03823be8e21c973d Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Mon, 17 Feb 2014 23:39:09 -0500
Subject: [PATCH 0072/1265] remove support for node 0.8

---
 .travis.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index a12e3f0fdeb..6e5919de39a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,4 +1,3 @@
 language: node_js
 node_js:
-  - "0.8"
-  - "0.10"
\ No newline at end of file
+  - "0.10"

From d42d8f5b078eb8136d9fc645d43cdbbf17873854 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Mon, 17 Feb 2014 23:50:22 -0500
Subject: [PATCH 0073/1265] move support for multiple `res.cookie` calls to
 lib/response

Patch.js is simpler and follows upstream node.js closer as a result.
---
 lib/patch.js       | 17 ++---------------
 lib/response.js    | 13 ++++++++++++-
 test/res.cookie.js |  3 ++-
 3 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/lib/patch.js b/lib/patch.js
index ab832832a73..1f487f887aa 100644
--- a/lib/patch.js
+++ b/lib/patch.js
@@ -30,22 +30,9 @@ var writeHead = ServerResponse.prototype.writeHead;
  */
 
 ServerResponse.prototype.setHeader = function(field, val){
-  var key = field.toLowerCase()
-    , prev;
+  var key = field.toLowerCase();
 
-  // special-case Set-Cookie
-  if (this._headers && 'set-cookie' == key) {
-    if (prev = this.getHeader(field)) {
-        if (Array.isArray(prev)) {
-            val = prev.concat(val);
-        } else if (Array.isArray(val)) {
-            val = val.concat(prev);
-        } else {
-            val = [prev, val];
-        }
-    }
-  // charset
-  } else if ('content-type' == key && this.charset) {
+  if ('content-type' == key && this.charset) {
     val += '; charset=' + this.charset;
   }
 
diff --git a/lib/response.js b/lib/response.js
index e9283ffff52..5268a41787c 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -597,7 +597,18 @@ res.cookie = function(name, val, options){
     options.maxAge /= 1000;
   }
   if (null == options.path) options.path = '/';
-  this.set('Set-Cookie', cookie.serialize(name, String(val), options));
+  var headerVal = cookie.serialize(name, String(val), options);
+
+  // supports multiple 'res.cookie' calls by getting previous value
+  var prev = this.get('Set-Cookie');
+  if (prev) {
+    if (Array.isArray(prev)) {
+      headerVal = prev.concat(headerVal);
+    } else {
+      headerVal = [prev, headerVal];
+    }
+  }
+  this.set('Set-Cookie', headerVal);
   return this;
 };
 
diff --git a/test/res.cookie.js b/test/res.cookie.js
index 14633ed28e2..bd259e6a29b 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -47,13 +47,14 @@ describe('res', function(){
       app.use(function(req, res){
         res.cookie('name', 'tobi');
         res.cookie('age', 1);
+        res.cookie('gender', '?');
         res.end();
       });
 
       request(app)
       .get('/')
       .end(function(err, res){
-        var val = ['name=tobi; Path=/', 'age=1; Path=/'];
+        var val = ['name=tobi; Path=/', 'age=1; Path=/', 'gender=%3F; Path=/'];
         res.headers['set-cookie'].should.eql(val);
         done();
       })

From 07b731add0f79ea7e2a256e743adcbbc11d16c80 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sat, 22 Feb 2014 09:20:15 -0500
Subject: [PATCH 0074/1265] bump cookie parser dependency to 1.0.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f1d232deb1c..93317572b09 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "marked": "0.2.10",
     "supertest": "~0.8.1",
     "body-parser": "1.0.0",
-    "cookie-parser": "1.0.0",
+    "cookie-parser": "1.0.1",
     "static-favicon": "1.0.0",
     "express-session": "1.0.1",
     "morgan": "1.0.0"

From 0719e5f402ff4b8129f19fe3d0704b31733f1190 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sun, 23 Feb 2014 11:31:43 -0500
Subject: [PATCH 0075/1265] implement app.route()

---
 lib/application.js |  2 ++
 test/app.route.js  | 20 ++++++++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 test/app.route.js

diff --git a/lib/application.js b/lib/application.js
index 1dc530ce284..0a20118c13e 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -214,6 +214,8 @@ app.use = function(route, fn){
  */
 
 app.route = function(path){
+  this.lazyrouter();
+  return this._router.route(path);
 };
 
 /**
diff --git a/test/app.route.js b/test/app.route.js
new file mode 100644
index 00000000000..62e0755af46
--- /dev/null
+++ b/test/app.route.js
@@ -0,0 +1,20 @@
+var express = require('../')
+  , request = require('./support/http')
+
+describe('app.route', function(){
+  it('should return a new route', function(done){
+    var app = express();
+
+    app.route('/foo')
+    .get(function(req, res) {
+      res.send('get');
+    })
+    .post(function(req, res) {
+      res.send('post');
+    });
+
+    request(app)
+    .post('/foo')
+    .expect('post', done);
+  });
+});

From 691181517117e0784493a8f877beb593923577b5 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sun, 23 Feb 2014 19:21:13 -0500
Subject: [PATCH 0076/1265] Router: add parameter handling to middleware

Middleware (.use) can now specify parameter arguments to trigger
Router.param loading. This is handy if you want to `.use` additional
routers but need to load certain objects before the mounted middleware
runs.
---
 lib/router/index.js | 103 ++++++++++++++++++++++++++++----------------
 lib/router/layer.js |  61 ++++++++++++++++++++++++++
 lib/router/route.js |  61 ++------------------------
 lib/utils.js        |   5 ++-
 test/Route.js       |   9 ----
 test/Router.js      |  35 +++++++++++++++
 6 files changed, 167 insertions(+), 107 deletions(-)
 create mode 100644 lib/router/layer.js

diff --git a/lib/router/index.js b/lib/router/index.js
index dd1bad46d07..2d7596d385e 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -3,6 +3,7 @@
  */
 
 var Route = require('./route')
+  , Layer = require('./layer')
   , utils = require('../utils')
   , methods = require('methods')
   , debug = require('debug')('express:router')
@@ -162,62 +163,72 @@ Router.prototype.handle = function(req, res, done) {
       var path = parseUrl(req).pathname;
       if (undefined == path) path = '/';
 
+      if (!layer.match(path)) return next(err);
+
       // route object and not middleware
       var route = layer.route;
 
-      // handle route
+      // if final route, then we support options
       if (route) {
         // we don't run any routs with error first
-        if (err || !route.match(path)) {
+        if (err) {
           return next(err);
         }
 
-        req.params = route.params;
+        req.route = route;
 
         // we can now dispatch to the route
         if (method === 'options' && !route.methods['options']) {
           options.push.apply(options, route._options());
         }
+      }
 
-        return self.process_params(route, req, res, function(err) {
-          if (err) {
-            return next(err);
-          }
+      req.params = layer.params;
 
-          route.dispatch(req, res, next);
-        });
-      }
+      // this should be done for the layer
+      return self.process_params(layer, req, res, function(err) {
+        if (err) {
+          return next(err);
+        }
 
-      // skip this layer if the path doesn't match.
-      if (0 != path.toLowerCase().indexOf(layer.path.toLowerCase())) return next(err);
+        if (route) {
+          return layer.handle(req, res, next);
+        }
 
-      var c = path[layer.path.length];
-      if (c && '/' != c && '.' != c) return next(err);
+        trim_prefix();
+      });
 
-      // Trim off the part of the url that matches the route
-      // middleware (.use stuff) needs to have the path stripped
-      debug('trim prefix (%s) from url %s', removed, req.url);
-      removed = layer.path;
-      req.url = protohost + req.url.substr(protohost.length + removed.length);
+      return next(err);
 
-      // Ensure leading slash
-      if (!fqdn && '/' != req.url[0]) {
-        req.url = '/' + req.url;
-        slashAdded = true;
-      }
+      function trim_prefix() {
+        var c = path[layer.path.length];
+        if (c && '/' != c && '.' != c) return next(err);
 
-      debug('%s %s : %s', layer.handle.name || 'anonymous', layer.path, req.originalUrl);
-      var arity = layer.handle.length;
-      if (err) {
-        if (arity === 4) {
-          layer.handle(err, req, res, next);
+        // Trim off the part of the url that matches the route
+        // middleware (.use stuff) needs to have the path stripped
+        debug('trim prefix (%s) from url %s', removed, req.url);
+        removed = layer.path;
+        req.url = protohost + req.url.substr(protohost.length + removed.length);
+
+        // Ensure leading slash
+        if (!fqdn && '/' != req.url[0]) {
+          req.url = '/' + req.url;
+          slashAdded = true;
+        }
+
+        debug('%s %s : %s', layer.handle.name || 'anonymous', layer.path, req.originalUrl);
+        var arity = layer.handle.length;
+        if (err) {
+          if (arity === 4) {
+            layer.handle(err, req, res, next);
+          } else {
+            next(err);
+          }
+        } else if (arity < 4) {
+          layer.handle(req, res, next);
         } else {
           next(err);
         }
-      } else if (arity < 4) {
-        layer.handle(req, res, next);
-      } else {
-        next(err);
       }
     } catch (err) {
       next(err);
@@ -238,6 +249,11 @@ Router.prototype.process_params = function(route, req, res, done) {
   // captured parameters from the route, keys and values
   var keys = route.keys || [];
 
+  // fast track
+  if (keys.length === 0) {
+    return done();
+  }
+
   var i = 0;
   var paramIndex = 0;
   var key;
@@ -314,10 +330,16 @@ Router.prototype.use = function(route, fn){
     route = route.slice(0, -1);
   }
 
+  var layer = Layer(route, {
+    sensitive: this.caseSensitive,
+    strict: this.strict,
+    end: false
+  }, fn);
+
   // add the middleware
   debug('use %s %s', route || '/', fn.name || 'anonymous');
-  this.stack.push({ path: route, handle: fn });
 
+  this.stack.push(layer);
   return this;
 };
 
@@ -335,12 +357,17 @@ Router.prototype.use = function(route, fn){
  */
 
 Router.prototype.route = function(path){
-  var route = new Route(path, {
+  var route = new Route(path);
+
+  var layer = Layer(path, {
     sensitive: this.caseSensitive,
-    strict: this.strict
-  });
+    strict: this.strict,
+    end: true
+  }, route.dispatch.bind(route));
+
+  layer.route = route;
 
-  this.stack.push({ path: path, route: route });
+  this.stack.push(layer);
   return route;
 };
 
diff --git a/lib/router/layer.js b/lib/router/layer.js
new file mode 100644
index 00000000000..32b1bb46480
--- /dev/null
+++ b/lib/router/layer.js
@@ -0,0 +1,61 @@
+var utils = require('../utils')
+  , debug = require('debug')('express:router:layer')
+
+function Layer(path, options, fn) {
+  if (!(this instanceof Layer)) {
+    return new Layer(path, options, fn);
+  }
+
+  debug('new %s', path);
+  options = options || {};
+  this.path = path;
+  this.params = {};
+  this.regexp = utils.pathRegexp(path
+    , this.keys = []
+    , options.sensitive
+    , options.strict
+    , options.end);
+  this.handle = fn;
+}
+
+/**
+ * Check if this route matches `path`, if so
+ * populate `.params`.
+ *
+ * @param {String} path
+ * @return {Boolean}
+ * @api private
+ */
+
+Layer.prototype.match = function(path){
+  var keys = this.keys
+    , params = this.params = {}
+    , m = this.regexp.exec(path)
+    , n = 0;
+
+  if (!m) return false;
+
+  for (var i = 1, len = m.length; i < len; ++i) {
+    var key = keys[i - 1];
+
+    try {
+      var val = 'string' == typeof m[i]
+        ? decodeURIComponent(m[i])
+        : m[i];
+    } catch(e) {
+      var err = new Error("Failed to decode param '" + m[i] + "'");
+      err.status = 400;
+      throw err;
+    }
+
+    if (key) {
+      params[key.name] = val;
+    } else {
+      params[n++] = val;
+    }
+  }
+
+  return true;
+};
+
+module.exports = Layer;
diff --git a/lib/router/route.js b/lib/router/route.js
index 6a55aaa59cf..0898a836a4e 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -3,8 +3,7 @@
  * Module dependencies.
  */
 
-var utils = require('../utils')
-  , debug = require('debug')('express:router:route')
+var debug = require('debug')('express:router:route')
   , methods = require('methods')
 
 /**
@@ -14,75 +13,21 @@ var utils = require('../utils')
 module.exports = Route;
 
 /**
- * Initialize `Route` with the given HTTP `method`, `path`,
- * and an array of `callbacks` and `options`.
- *
- * Options:
- *
- *   - `sensitive`    enable case-sensitive routes
- *   - `strict`       enable strict matching for trailing slashes
+ * Initialize `Route` with the given `path`,
  *
  * @param {String} path
- * @param {Object} options.
  * @api private
  */
 
-function Route(path, options) {
+function Route(path) {
   debug('new %s', path);
-  options = options || {};
   this.path = path;
-  this.params = {};
-  this.regexp = utils.pathRegexp(path
-    , this.keys = []
-    , options.sensitive
-    , options.strict);
-
   this.stack = undefined;
 
   // route handlers for various http methods
   this.methods = {};
 }
 
-/**
- * Check if this route matches `path`, if so
- * populate `.params`.
- *
- * @param {String} path
- * @return {Boolean}
- * @api private
- */
-
-Route.prototype.match = function(path){
-  var keys = this.keys
-    , params = this.params = {}
-    , m = this.regexp.exec(path)
-    , n = 0;
-
-  if (!m) return false;
-
-  for (var i = 1, len = m.length; i < len; ++i) {
-    var key = keys[i - 1];
-
-    try {
-      var val = 'string' == typeof m[i]
-        ? decodeURIComponent(m[i])
-        : m[i];
-    } catch(e) {
-      var err = new Error("Failed to decode param '" + m[i] + "'");
-      err.status = 400;
-      throw err;
-    }
-
-    if (key) {
-      params[key.name] = val;
-    } else {
-      params[n++] = val;
-    }
-  }
-
-  return true;
-};
-
 /**
  * @return {Array} supported HTTP methods
  * @api private
diff --git a/lib/utils.js b/lib/utils.js
index fda418958da..624d4c6c594 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -132,11 +132,12 @@ function acceptParams(str, index) {
  * @param  {Array} keys
  * @param  {Boolean} sensitive
  * @param  {Boolean} strict
+ * @param  {Boolean} end (whether to append $ to regex)
  * @return {RegExp}
  * @api private
  */
 
-exports.pathRegexp = function(path, keys, sensitive, strict) {
+exports.pathRegexp = function(path, keys, sensitive, strict, end) {
   if (toString.call(path) == '[object RegExp]') return path;
   if (Array.isArray(path)) path = '(' + path.join('|') + ')';
   path = path
@@ -155,7 +156,7 @@ exports.pathRegexp = function(path, keys, sensitive, strict) {
     })
     .replace(/([\/.])/g, '\\$1')
     .replace(/\*/g, '(.*)');
-  return new RegExp('^' + path + '$', sensitive ? '' : 'i');
+  return new RegExp('^' + path + ((end) ? '$' : ''), sensitive ? '' : 'i');
 }
 
 /**
diff --git a/test/Route.js b/test/Route.js
index 62ec5da5e10..aea1604b9f7 100644
--- a/test/Route.js
+++ b/test/Route.js
@@ -6,15 +6,6 @@ var express = require('../')
 
 describe('Route', function(){
 
-  describe('.match', function(){
-    it('should match', function(){
-      var route = new Route('/foo/bar');
-
-      assert(route.match('/foo/bar'));
-      assert(!route.match('/foo/baz'));
-    })
-  })
-
   describe('.all', function(){
     it('should add handler', function(done){
       var route = new Route('/foo');
diff --git a/test/Router.js b/test/Router.js
index 10d6acb0014..28ca0670260 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -94,4 +94,39 @@ describe('Router', function(){
       done();
     })
   })
+
+  describe('.param', function() {
+    it('should call param function when routing VERBS', function(done) {
+      var router = new Router();
+
+      router.param('id', function(req, res, next, id) {
+        assert.equal(id, '123');
+        next();
+      });
+
+      router.get('/foo/:id/bar', function(req, res, next) {
+        assert.equal(req.params.id, '123');
+        next();
+      });
+
+      router.handle({ url: '/foo/123/bar', method: 'get' }, {}, done);
+    });
+
+    it('should call param function when routing middleware', function(done) {
+      var router = new Router();
+
+      router.param('id', function(req, res, next, id) {
+        assert.equal(id, '123');
+        next();
+      });
+
+      router.use('/foo/:id/bar', function(req, res, next) {
+        assert.equal(req.params.id, '123');
+        assert.equal(req.url, '/baz');
+        next();
+      });
+
+      router.handle({ url: '/foo/123/bar/baz', method: 'get' }, {}, done);
+    });
+  });
 })

From f8b954bcd9a6aeaa5d445a1ea1bbcb37e089f3ef Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Wed, 26 Feb 2014 19:57:11 -0500
Subject: [PATCH 0077/1265] make express.Router() return a Router function
 instance

Similar to how express() returns an express `app` instance which is also
a function, express.Router() returns the Router instance which is also a
function and can be easily used via another router or the app.

app.use(express.Router());
---
 lib/router/index.js | 50 +++++++++++++++++++++++----------------------
 test/Router.js      | 26 ++++++++++++++++++++++-
 test/app.options.js |  2 +-
 3 files changed, 52 insertions(+), 26 deletions(-)

diff --git a/lib/router/index.js b/lib/router/index.js
index 2d7596d385e..755ef96f7d4 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -9,31 +9,32 @@ var Route = require('./route')
   , debug = require('debug')('express:router')
   , parseUrl = utils.parseUrl;
 
-/**
- * Expose `Router` constructor.
- */
-
-exports = module.exports = Router;
-
 /**
  * Initialize a new `Router` with the given `options`.
  *
  * @param {Object} options
- * @api private
+ * @return {Router} which is an callable function
+ * @api public
  */
 
-function Router(options) {
+var proto = module.exports = function(options) {
   options = options || {};
-  var self = this;
 
-  self.params = {};
-  self._params = [];
-  self.caseSensitive = options.caseSensitive;
-  self.strict = options.strict;
-  self.stack = [];
+  function router(req, res, next) {
+    router.handle(req, res, next);
+  };
+
+  // mixin Router class functions
+  router.__proto__ = proto;
 
-  self.middleware = self.handle.bind(self);
-}
+  router.params = {};
+  router._params = [];
+  router.caseSensitive = options.caseSensitive;
+  router.strict = options.strict;
+  router.stack = [];
+
+  return router;
+};
 
 /**
  * Map the given param placeholder `name`(s) to the given callback.
@@ -69,7 +70,7 @@ function Router(options) {
  * @api public
  */
 
-Router.prototype.param = function(name, fn){
+proto.param = function(name, fn){
   // param logic
   if ('function' == typeof name) {
     this._params.push(name);
@@ -107,7 +108,7 @@ Router.prototype.param = function(name, fn){
  * @api private
  */
 
-Router.prototype.handle = function(req, res, done) {
+proto.handle = function(req, res, done) {
   var self = this;
 
   debug('dispatching %s %s', req.method, req.url);
@@ -127,7 +128,7 @@ Router.prototype.handle = function(req, res, done) {
   var options = [];
 
   // middleware and routes
-  var stack = this.stack;
+  var stack = self.stack;
 
   // for options requests, respond with a default if nothing else responds
   if (method === 'options') {
@@ -242,7 +243,7 @@ Router.prototype.handle = function(req, res, done) {
  * @api private
  */
 
-Router.prototype.process_params = function(route, req, res, done) {
+proto.process_params = function(route, req, res, done) {
   var self = this;
   var params = this.params;
 
@@ -317,7 +318,7 @@ Router.prototype.process_params = function(route, req, res, done) {
  * @api public
  */
 
-Router.prototype.use = function(route, fn){
+proto.use = function(route, fn){
 
   // default route to '/'
   if ('string' != typeof route) {
@@ -356,7 +357,7 @@ Router.prototype.use = function(route, fn){
  * @api public
  */
 
-Router.prototype.route = function(path){
+proto.route = function(path){
   var route = new Route(path);
 
   var layer = Layer(path, {
@@ -381,7 +382,7 @@ Router.prototype.route = function(path){
  * @api public
  */
 
-Router.prototype.all = function(path, fn) {
+proto.all = function(path, fn) {
   var route = this.route(path);
   methods.forEach(function(method){
     route[method](fn);
@@ -390,9 +391,10 @@ Router.prototype.all = function(path, fn) {
 
 // create Router#VERB functions
 methods.forEach(function(method){
-  Router.prototype[method] = function(path, fn){
+  proto[method] = function(path, fn){
     var self = this;
     self.route(path)[method](fn);
     return self;
   };
 });
+
diff --git a/test/Router.js b/test/Router.js
index 28ca0670260..30d8b5a46d1 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -6,7 +6,31 @@ var express = require('../')
 
 describe('Router', function(){
 
-  describe('.middleware', function(){
+  it('should return a function with router methods', function() {
+    var router = Router();
+    assert(typeof router == 'function');
+
+    var router = new Router();
+    assert(typeof router == 'function');
+
+    assert(typeof router.get == 'function');
+    assert(typeof router.handle == 'function');
+    assert(typeof router.use == 'function');
+  });
+
+  it('should support .use of other routers', function(done) {
+    var router = Router();
+    var another = Router();
+
+    another.get('/bar', function(req, res) {
+      res.done();
+    });
+    router.use('/foo', another);
+
+    router.handle({ url: '/foo/bar', method: 'GET' }, { done: done });
+  });
+
+  describe('.handle', function(){
     it('should dispatch', function(done){
       var router = new Router();
 
diff --git a/test/app.options.js b/test/app.options.js
index 8b4bdc1c44c..6678b6cdb4f 100644
--- a/test/app.options.js
+++ b/test/app.options.js
@@ -31,7 +31,7 @@ describe('OPTIONS', function(){
     var router = new express.Router();
 
     router.get('/users', function(req, res){});
-    app.use(router.middleware);
+    app.use(router);
     app.get('/other', function(req, res){});
 
     request(app)

From 0fbfce58c6c44d5e6a468b1da21d87deff9827a7 Mon Sep 17 00:00:00 2001
From: Timo Sand <timo.j.sand@gmail.com>
Date: Sat, 1 Mar 2014 12:32:42 +0200
Subject: [PATCH 0078/1265] Fixed deprecated example doctype

---
 examples/search/search.jade | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/search/search.jade b/examples/search/search.jade
index c8dc2890778..37d77e434c6 100644
--- a/examples/search/search.jade
+++ b/examples/search/search.jade
@@ -1,4 +1,4 @@
-!!! 5
+doctype
 html
   head
     title Search example

From 9df10674f051ab8bf9541b0e8fb0e4a6efb6a9d1 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sun, 2 Mar 2014 11:17:29 -0500
Subject: [PATCH 0079/1265] 4.0.0-rc1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 93317572b09..672b43397a3 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.4.7",
+  "version": "4.0.0-rc1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From e3b60e80c02950594e7956eb20eef91c2c04210a Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Sun, 2 Mar 2014 23:32:51 -0800
Subject: [PATCH 0080/1265] Update Readme.md for Express 4

---
 Readme.md | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/Readme.md b/Readme.md
index e1e3f7e9862..c9d74cfb052 100644
--- a/Readme.md
+++ b/Readme.md
@@ -15,17 +15,24 @@ app.get('/', function(req, res){
 app.listen(3000);
 ```
 
+  Note that Express v4 release candidates have been released. 
+  Please try it out, but not in production, and report any issues you may find here or to the appropriate repositories.
+  Be sure to read [Migrating from 3.x to 4.x](https://github.com/visionmedia/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/visionmedia/express/wiki/New-features-in-4.x).
+
 ## Installation
 
-    $ npm install -g express
+    $ npm install express
 
 ## Quick Start
 
  The quickest way to get started with express is to utilize the executable `express(1)` to generate an application as shown below:
+ 
+ Install the executable. As of Express v4, the executable is stored in a separate repository:
+ 
+    $ npm install -g express-generator
 
  Create the app:
 
-    $ npm install -g express
     $ express /tmp/foo && cd /tmp/foo
 
  Install dependencies:
@@ -38,7 +45,6 @@ app.listen(3000);
 
 ## Features
 
-  * Built on [Connect](http://github.com/senchalabs/connect)
   * Robust routing
   * HTTP helpers (redirection, caching, etc)
   * View system supporting 14+ template engines
@@ -54,9 +60,7 @@ app.listen(3000);
   it a great solution for single page applications, web sites, hybrids, or public
   HTTP APIs.
 
-  Built on Connect, you can use _only_ what you need, and nothing more. Applications
-  can be as big or as small as you like, even a single file. Express does
-  not force you to use any specific ORM or template engine. With support for over
+  Express does not force you to use any specific ORM or template engine. With support for over
   14 template engines via [Consolidate.js](http://github.com/visionmedia/consolidate.js),
   you can quickly craft your perfect framework.
 
@@ -65,7 +69,7 @@ app.listen(3000);
   * [Website and Documentation](http://expressjs.com/) stored at [visionmedia/expressjs.com](https://github.com/visionmedia/expressjs.com)
   * Join #express on freenode
   * [Google Group](http://groups.google.com/group/express-js) for discussion
-  * Follow [tjholowaychuk](http://twitter.com/tjholowaychuk) on twitter for updates
+  * Follow [tjholowaychuk](http://twitter.com/tjholowaychuk) and [defunctzombie](https://twitter.com/defunctzombie) on twitter for updates
   * Visit the [Wiki](http://github.com/visionmedia/express/wiki)
   * [Русскоязычная документация](http://jsman.ru/express/)
   * Run express examples [online](https://runnable.com/express)

From d368aed150364477c024e166b3db2b770e492a95 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Mon, 3 Mar 2014 17:50:13 -0500
Subject: [PATCH 0081/1265] fix Route#all before Route#verb

Properly handle calling a VERB after using .all()

close #1945
---
 lib/router/route.js |  3 +++
 test/app.route.js   | 19 +++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/lib/router/route.js b/lib/router/route.js
index 0898a836a4e..c9eff0c354c 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -157,6 +157,9 @@ methods.forEach(function(method){
     if (!this.stack) {
       this.stack = [];
     }
+    else if (typeof this.stack === 'function') {
+      this.stack = [{ handle: this.stack }];
+    }
 
     this.stack.push({ method: method, handle: fn })
     return this;
diff --git a/test/app.route.js b/test/app.route.js
index 62e0755af46..0fcf70a68d9 100644
--- a/test/app.route.js
+++ b/test/app.route.js
@@ -17,4 +17,23 @@ describe('app.route', function(){
     .post('/foo')
     .expect('post', done);
   });
+
+  it('should all .VERB after .all', function(done){
+    var app = express();
+
+    app.route('/foo')
+    .all(function(req, res, next) {
+      next();
+    })
+    .get(function(req, res) {
+      res.send('get');
+    })
+    .post(function(req, res) {
+      res.send('post');
+    });
+
+    request(app)
+    .post('/foo')
+    .expect('post', done);
+  });
 });

From 8472effab341203e73da11e8a1c24c3bff79ac5f Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Tue, 4 Mar 2014 21:31:50 -0800
Subject: [PATCH 0082/1265] Update Readme.md

---
 Readme.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Readme.md b/Readme.md
index c9d74cfb052..5ed35c18063 100644
--- a/Readme.md
+++ b/Readme.md
@@ -27,9 +27,9 @@ app.listen(3000);
 
  The quickest way to get started with express is to utilize the executable `express(1)` to generate an application as shown below:
  
- Install the executable. As of Express v4, the executable is stored in a separate repository:
+ Install the executable. The executable's major version will match Express's:
  
-    $ npm install -g express-generator
+    $ npm install -g express-generator@3
 
  Create the app:
 

From 45500fba7463efb8703f1de4bafc387383a2ba4a Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Tue, 4 Mar 2014 21:32:22 -0800
Subject: [PATCH 0083/1265] Update Readme.md

---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 5ed35c18063..967a8b5fd60 100644
--- a/Readme.md
+++ b/Readme.md
@@ -25,7 +25,7 @@ app.listen(3000);
 
 ## Quick Start
 
- The quickest way to get started with express is to utilize the executable `express(1)` to generate an application as shown below:
+ The quickest way to get started with express is to utilize the executable [`express(1)`](http://github.com/expressjs/generator) to generate an application as shown below:
  
  Install the executable. The executable's major version will match Express's:
  

From eaf63d94f0bcfe1ebac804e93a98f0584dc89ed0 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Wed, 5 Mar 2014 01:32:26 -0500
Subject: [PATCH 0084/1265] 4.0.0-rc2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 672b43397a3..4b84aea0914 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.0.0-rc1",
+  "version": "4.0.0-rc2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From a0e6bb5cb218d30e13ff965900c224df23523b8f Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 5 Mar 2014 03:36:36 -0800
Subject: [PATCH 0085/1265] npm start to start the server!

---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 967a8b5fd60..5bf0fb5338c 100644
--- a/Readme.md
+++ b/Readme.md
@@ -41,7 +41,7 @@ app.listen(3000);
 
  Start the server:
 
-    $ node app
+    $ npm start
 
 ## Features
 

From f1315b9efa6150bd27740842ab0e8fac6dad437f Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Wed, 5 Mar 2014 10:35:26 -0500
Subject: [PATCH 0086/1265] fix examples for express 4 (separate middleware)

close #1947
---
 examples/jade/index.js      |  8 ++++++--
 examples/multipart/index.js |  9 ++++-----
 examples/session/index.js   |  6 ++++--
 examples/session/redis.js   | 13 ++++++++-----
 examples/vhost/index.js     |  5 +++--
 package.json                |  3 ++-
 6 files changed, 27 insertions(+), 17 deletions(-)

diff --git a/examples/jade/index.js b/examples/jade/index.js
index 9c362015f0f..b73b5439b2b 100644
--- a/examples/jade/index.js
+++ b/examples/jade/index.js
@@ -12,9 +12,7 @@ var pub = __dirname + '/public';
 // setup middleware
 
 var app = express();
-app.use(app.router);
 app.use(express.static(pub));
-app.use(express.errorHandler());
 
 // Optional since express defaults to CWD/views
 
@@ -41,5 +39,11 @@ app.get('/', function(req, res){
   res.render('users', { users: users });
 });
 
+// change this to a better error handler in your code
+// sending stacktrace to users in production is not good
+app.use(function(err, req, res, next) {
+  res.send(err.stack);
+});
+
 app.listen(3000);
 console.log('Express app started on port 3000');
diff --git a/examples/multipart/index.js b/examples/multipart/index.js
index e2323595b94..96481f663be 100644
--- a/examples/multipart/index.js
+++ b/examples/multipart/index.js
@@ -4,13 +4,12 @@
  */
 
 var express = require('../..')
+  , bodyParser = require('body-parser')
   , format = require('util').format;
 
 var app = module.exports = express()
 
-// bodyParser in connect 2.x uses node-formidable to parse 
-// the multipart form data.
-app.use(express.bodyParser())
+app.use(bodyParser())
 
 app.get('/', function(req, res){
   res.send('<form method="post" enctype="multipart/form-data">'
@@ -25,7 +24,7 @@ app.post('/', function(req, res, next){
   // title field as `req.body.title`
   res.send(format('\nuploaded %s (%d Kb) to %s as %s'
     , req.files.image.name
-    , req.files.image.size / 1024 | 0 
+    , req.files.image.size / 1024 | 0
     , req.files.image.path
     , req.body.title));
 });
@@ -33,4 +32,4 @@ app.post('/', function(req, res, next){
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
-}
\ No newline at end of file
+}
diff --git a/examples/session/index.js b/examples/session/index.js
index 8907216bc76..3629914d1ea 100644
--- a/examples/session/index.js
+++ b/examples/session/index.js
@@ -4,16 +4,18 @@
 // $ redis-server
 
 var express = require('../..');
+var cookieParser = require('cookie-parser');
+var session = require('express-session');
 
 var app = express();
 
 // Required by session() middleware
 // pass the secret for signed cookies
 // (required by session())
-app.use(express.cookieParser('keyboard cat'));
+app.use(cookieParser('keyboard cat'));
 
 // Populates req.session
-app.use(express.session());
+app.use(session());
 
 app.get('/', function(req, res){
   var body = '';
diff --git a/examples/session/redis.js b/examples/session/redis.js
index 5ba3671bff4..11af51c925d 100644
--- a/examples/session/redis.js
+++ b/examples/session/redis.js
@@ -1,22 +1,25 @@
 
 
 var express = require('../..');
+var logger = require('morgan');
+var cookieParser = require('cookie-parser');
+var session = require('express-session');
 
 // pass the express to the connect redis module
-// allowing it to inherit from express.session.Store
-var RedisStore = require('connect-redis')(express);
+// allowing it to inherit from session.Store
+var RedisStore = require('connect-redis')(session);
 
 var app = express();
 
-app.use(express.logger('dev'));
+app.use(logger('dev'));
 
 // Required by session() middleware
 // pass the secret for signed cookies
 // (required by session())
-app.use(express.cookieParser('keyboard cat'));
+app.use(cookieParser('keyboard cat'));
 
 // Populates req.session
-app.use(express.session({ store: new RedisStore }));
+app.use(session({ store: new RedisStore }));
 
 app.get('/', function(req, res){
   var body = '';
diff --git a/examples/vhost/index.js b/examples/vhost/index.js
index 1fa301080c9..e9596e722ad 100644
--- a/examples/vhost/index.js
+++ b/examples/vhost/index.js
@@ -4,6 +4,7 @@
 
 var express = require('../..');
 var logger = require('morgan');
+var vhost = require('vhost');
 
 /*
 edit /etc/hosts:
@@ -40,8 +41,8 @@ redirect.all('*', function(req, res){
 
 var app = express();
 
-app.use(express.vhost('*.example.com', redirect)) // Serves all subdomains via Redirect app
-app.use(express.vhost('example.com', main)); // Serves top level domain via Main server app 
+app.use(vhost('*.example.com', redirect)) // Serves all subdomains via Redirect app
+app.use(vhost('example.com', main)); // Serves top level domain via Main server app
 
 app.listen(3000);
 console.log('Express app started on port 3000');
diff --git a/package.json b/package.json
index 4b84aea0914..88807e4a145 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,8 @@
     "cookie-parser": "1.0.1",
     "static-favicon": "1.0.0",
     "express-session": "1.0.1",
-    "morgan": "1.0.0"
+    "morgan": "1.0.0",
+    "vhost": "1.0.0"
   },
   "keywords": [
     "express",

From 6ec1904aaca38af3deb7a66ee15d8ac3a82ee261 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 5 Mar 2014 21:58:49 -0800
Subject: [PATCH 0087/1265] use serve-static for static middleware

---
 lib/express.js           |  2 +-
 lib/middleware/static.js | 87 ----------------------------------------
 package.json             |  1 +
 3 files changed, 2 insertions(+), 88 deletions(-)
 delete mode 100644 lib/middleware/static.js

diff --git a/lib/express.js b/lib/express.js
index 024783bb9c5..f7319cba5f2 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -62,4 +62,4 @@ exports.Router = Router;
  * Expose middleware
  */
 
-exports.static = require('./middleware/static');
+exports.static = require('serve-static');
diff --git a/lib/middleware/static.js b/lib/middleware/static.js
deleted file mode 100644
index 5d213ef34b1..00000000000
--- a/lib/middleware/static.js
+++ /dev/null
@@ -1,87 +0,0 @@
-/*!
- * Connect - static
- * Copyright(c) 2010 Sencha Inc.
- * Copyright(c) 2011 TJ Holowaychuk
- * MIT Licensed
- */
-
-/**
- * Module dependencies.
- */
-
-var send = require('send')
-  , utils = require('../utils')
-  , parse = utils.parseUrl
-  , url = require('url');
-
-/**
- * Static:
- *
- *   Static file server with the given `root` path.
- *
- * Examples:
- *
- *     var oneDay = 86400000;
- *
- *     connect()
- *       .use(connect.static(__dirname + '/public'))
- *
- *     connect()
- *       .use(connect.static(__dirname + '/public', { maxAge: oneDay }))
- *
- * Options:
- *
- *    - `maxAge`     Browser cache maxAge in milliseconds. defaults to 0
- *    - `hidden`     Allow transfer of hidden files. defaults to false
- *    - `redirect`   Redirect to trailing "/" when the pathname is a dir. defaults to true
- *    - `index`      Default file name, defaults to 'index.html'
- *
- * @param {String} root
- * @param {Object} options
- * @return {Function}
- * @api public
- */
-
-exports = module.exports = function(root, options){
-  options = options || {};
-
-  // root required
-  if (!root) throw new Error('static() root path required');
-
-  // default redirect
-  var redirect = false !== options.redirect;
-
-  return function staticMiddleware(req, res, next) {
-    if ('GET' != req.method && 'HEAD' != req.method) return next();
-    var originalUrl = url.parse(req.originalUrl);
-    var path = parse(req).pathname;
-
-    if (path == '/' && originalUrl.pathname[originalUrl.pathname.length - 1] != '/') {
-      return directory();
-    }
-
-    function directory() {
-      if (!redirect) return next();
-      var target;
-      originalUrl.pathname += '/';
-      target = url.format(originalUrl);
-      res.statusCode = 303;
-      res.setHeader('Location', target);
-      res.end('Redirecting to ' + utils.escape(target));
-    }
-
-    function error(err) {
-      if (404 == err.status) return next();
-      next(err);
-    }
-
-    send(req, path)
-      .maxage(options.maxAge || 0)
-      .root(root)
-      .index(options.index || 'index.html')
-      .hidden(options.hidden)
-      .on('error', error)
-      .on('directory', directory)
-      .pipe(res);
-  };
-};
diff --git a/package.json b/package.json
index 88807e4a145..8d458962d00 100644
--- a/package.json
+++ b/package.json
@@ -35,6 +35,7 @@
     "utils-merge": "1.0.0",
     "escape-html": "1.0.1",
     "qs": "0.6.6",
+    "serve-static": "1.0.1",
     "debug": ">= 0.7.3 < 1"
   },
   "devDependencies": {

From 85bf9ab76a3d8954b7ba71b6bbad444961f97105 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 5 Mar 2014 22:01:36 -0800
Subject: [PATCH 0088/1265] uncomment a commented out test

lol @visionmedia
---
 test/middleware.basic.js | 87 ++++++++++++++++++++--------------------
 1 file changed, 44 insertions(+), 43 deletions(-)

diff --git a/test/middleware.basic.js b/test/middleware.basic.js
index 448d4779982..550dae68729 100644
--- a/test/middleware.basic.js
+++ b/test/middleware.basic.js
@@ -1,43 +1,44 @@
-// 
-// var express = require('../')
-//   , request = require('./support/http');
-// 
-// describe('middleware', function(){
-//   describe('.next()', function(){
-//     it('should behave like connect', function(done){
-//       var app = express()
-//         , calls = [];
-// 
-//       app.use(function(req, res, next){
-//         calls.push('one');
-//         next();
-//       });
-// 
-//       app.use(function(req, res, next){
-//         calls.push('two');
-//         next();
-//       });
-//       
-//       app.use(function(req, res){
-//         var buf = '';
-//         res.setHeader('Content-Type', 'application/json');
-//         req.setEncoding('utf8');
-//         req.on('data', function(chunk){ buf += chunk });
-//         req.on('end', function(){
-//           res.end(buf);
-//         });
-//       });
-// 
-//       request(app)
-//       .get('/')
-//       .set('Content-Type', 'application/json')
-//       .write('{"foo":"bar"}')
-//       .end(function(res){
-//         res.headers.should.have.property('content-type', 'application/json');
-//         res.statusCode.should.equal(200);
-//         res.body.should.equal('{"foo":"bar"}');
-//         done();
-//       })
-//     })
-//   })
-// })
\ No newline at end of file
+
+var express = require('../');
+var request = require('supertest');
+
+describe('middleware', function(){
+  describe('.next()', function(){
+    it('should behave like connect', function(done){
+      var app = express()
+        , calls = [];
+
+      app.use(function(req, res, next){
+        calls.push('one');
+        next();
+      });
+
+      app.use(function(req, res, next){
+        calls.push('two');
+        next();
+      });
+
+      app.use(function(req, res){
+        var buf = '';
+        res.setHeader('Content-Type', 'application/json');
+        req.setEncoding('utf8');
+        req.on('data', function(chunk){ buf += chunk });
+        req.on('end', function(){
+          res.end(buf);
+        });
+      });
+
+      request(app.listen())
+      .get('/')
+      .set('Content-Type', 'application/json')
+      .send('{"foo":"bar"}')
+      .end(function(err, res){
+        if (err) return done(err);
+        res.headers.should.have.property('content-type', 'application/json');
+        res.statusCode.should.equal(200);
+        res.text.should.equal('{"foo":"bar"}');
+        done();
+      })
+    })
+  })
+})
\ No newline at end of file

From 643397ed21fc7086dc5662d1f291beddfbb976ae Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 5 Mar 2014 22:06:14 -0800
Subject: [PATCH 0089/1265] remove unnecessary test/support/http

---
 test/acceptance/auth.js                |  2 +-
 test/acceptance/content-negotiation.js |  2 +-
 test/acceptance/cookies.js             |  2 +-
 test/acceptance/downloads.js           |  2 +-
 test/acceptance/ejs.js                 |  2 +-
 test/acceptance/error-pages.js         |  2 +-
 test/acceptance/error.js               |  2 +-
 test/acceptance/markdown.js            |  2 +-
 test/acceptance/mvc.js                 |  2 +-
 test/acceptance/params.js              |  2 +-
 test/acceptance/resource.js            |  2 +-
 test/acceptance/web-service.js         |  2 +-
 test/app.all.js                        |  2 +-
 test/app.del.js                        |  2 +-
 test/app.head.js                       |  6 +--
 test/app.listen.js                     |  2 +-
 test/app.locals.js                     |  4 +-
 test/app.options.js                    |  2 +-
 test/app.param.js                      |  2 +-
 test/app.request.js                    |  2 +-
 test/app.response.js                   |  6 +--
 test/app.route.js                      |  4 +-
 test/app.router.js                     |  2 +-
 test/app.routes.error.js               |  2 +-
 test/app.use.js                        |  4 +-
 test/exports.js                        |  6 +--
 test/regression.js                     |  2 +-
 test/req.accepts.js                    |  2 +-
 test/req.acceptsCharset.js             |  2 +-
 test/req.auth.js                       |  2 +-
 test/req.fresh.js                      |  2 +-
 test/req.get.js                        |  2 +-
 test/req.host.js                       |  2 +-
 test/req.ip.js                         |  2 +-
 test/req.ips.js                        |  2 +-
 test/req.is.js                         |  2 +-
 test/req.param.js                      |  6 +--
 test/req.path.js                       |  2 +-
 test/req.protocol.js                   |  2 +-
 test/req.query.js                      |  4 +-
 test/req.route.js                      |  4 +-
 test/req.secure.js                     |  2 +-
 test/req.signedCookies.js              |  2 +-
 test/req.stale.js                      |  2 +-
 test/req.subdomains.js                 |  2 +-
 test/req.xhr.js                        |  8 ++--
 test/res.attachment.js                 |  6 +--
 test/res.charset.js                    |  4 +-
 test/res.clearCookie.js                |  4 +-
 test/res.cookie.js                     |  8 ++--
 test/res.download.js                   |  2 +-
 test/res.format.js                     |  4 +-
 test/res.json.js                       |  2 +-
 test/res.jsonp.js                      |  2 +-
 test/res.locals.js                     |  2 +-
 test/res.location.js                   |  2 +-
 test/res.redirect.js                   |  2 +-
 test/res.render.js                     | 52 +++++++++++++-------------
 test/res.send.js                       |  2 +-
 test/res.sendfile.js                   |  2 +-
 test/res.set.js                        |  4 +-
 test/res.status.js                     |  2 +-
 test/res.type.js                       |  2 +-
 test/support/http.js                   |  2 -
 64 files changed, 113 insertions(+), 115 deletions(-)
 delete mode 100644 test/support/http.js

diff --git a/test/acceptance/auth.js b/test/acceptance/auth.js
index aa1a4ea1d89..8946917cf7e 100644
--- a/test/acceptance/auth.js
+++ b/test/acceptance/auth.js
@@ -1,5 +1,5 @@
 var app = require('../../examples/auth/app')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 function redirects(to, fn){
   return function(err, res){
diff --git a/test/acceptance/content-negotiation.js b/test/acceptance/content-negotiation.js
index 3c92929388f..99842585231 100644
--- a/test/acceptance/content-negotiation.js
+++ b/test/acceptance/content-negotiation.js
@@ -1,5 +1,5 @@
 
-var request = require('../support/http')
+var request = require('supertest')
   , app = require('../../examples/content-negotiation');
 
 describe('content-negotiation', function(){
diff --git a/test/acceptance/cookies.js b/test/acceptance/cookies.js
index 910c1218c36..d6d4f007c2e 100644
--- a/test/acceptance/cookies.js
+++ b/test/acceptance/cookies.js
@@ -1,6 +1,6 @@
 
 var app = require('../../examples/cookies/app')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('cookies', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/downloads.js b/test/acceptance/downloads.js
index 7e7b4da8e4b..ab7082a0ce2 100644
--- a/test/acceptance/downloads.js
+++ b/test/acceptance/downloads.js
@@ -1,6 +1,6 @@
 
 var app = require('../../examples/downloads/app')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('downloads', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/ejs.js b/test/acceptance/ejs.js
index a9877901481..b51c03be7b1 100644
--- a/test/acceptance/ejs.js
+++ b/test/acceptance/ejs.js
@@ -1,5 +1,5 @@
 
-var request = require('../support/http')
+var request = require('supertest')
   , app = require('../../examples/ejs');
 
 describe('ejs', function(){
diff --git a/test/acceptance/error-pages.js b/test/acceptance/error-pages.js
index bc2e103196b..886cedcabe3 100644
--- a/test/acceptance/error-pages.js
+++ b/test/acceptance/error-pages.js
@@ -1,6 +1,6 @@
 
 var app = require('../../examples/error-pages')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('error-pages', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/error.js b/test/acceptance/error.js
index b5dc97bf902..6010f2e2ae4 100644
--- a/test/acceptance/error.js
+++ b/test/acceptance/error.js
@@ -1,6 +1,6 @@
 
 var app = require('../../examples/error')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('error', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/markdown.js b/test/acceptance/markdown.js
index d086992b2f5..8c788e35166 100644
--- a/test/acceptance/markdown.js
+++ b/test/acceptance/markdown.js
@@ -1,6 +1,6 @@
 
 var app = require('../../examples/markdown')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('markdown', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/mvc.js b/test/acceptance/mvc.js
index 031216f0768..3386d8338a8 100644
--- a/test/acceptance/mvc.js
+++ b/test/acceptance/mvc.js
@@ -1,5 +1,5 @@
 
-var request = require('../support/http')
+var request = require('supertest')
   , app = require('../../examples/mvc');
 
 describe('mvc', function(){
diff --git a/test/acceptance/params.js b/test/acceptance/params.js
index f6c449ff26d..f96632445a5 100644
--- a/test/acceptance/params.js
+++ b/test/acceptance/params.js
@@ -1,5 +1,5 @@
 var app = require('../../examples/params/app')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('params', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/resource.js b/test/acceptance/resource.js
index c235fabe09b..8ab2331cdde 100644
--- a/test/acceptance/resource.js
+++ b/test/acceptance/resource.js
@@ -1,5 +1,5 @@
 var app = require('../../examples/resource/app')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('resource', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/web-service.js b/test/acceptance/web-service.js
index 50acddd920d..67e9b44ab8e 100644
--- a/test/acceptance/web-service.js
+++ b/test/acceptance/web-service.js
@@ -1,5 +1,5 @@
 
-var request = require('../support/http')
+var request = require('supertest')
   , app = require('../../examples/web-service');
 
 describe('web-service', function(){
diff --git a/test/app.all.js b/test/app.all.js
index 14720850ef3..a0c68d429d5 100644
--- a/test/app.all.js
+++ b/test/app.all.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app.all()', function(){
   it('should add a router per method', function(done){
diff --git a/test/app.del.js b/test/app.del.js
index ad12199c4b4..d419fbb1580 100644
--- a/test/app.del.js
+++ b/test/app.del.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app.del()', function(){
   it('should alias app.delete()', function(done){
diff --git a/test/app.head.js b/test/app.head.js
index a37c47bfdef..41e12916d0d 100644
--- a/test/app.head.js
+++ b/test/app.head.js
@@ -1,7 +1,7 @@
 
-var express = require('../')
-  , request = require('./support/http')
-  , assert = require('assert');
+var express = require('../');
+var request = require('supertest');
+var assert = require('assert');
 
 describe('HEAD', function(){
   it('should default to GET', function(done){
diff --git a/test/app.listen.js b/test/app.listen.js
index 691e1a9c7d0..b6f68578934 100644
--- a/test/app.listen.js
+++ b/test/app.listen.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app.listen()', function(){
   it('should wrap with an HTTP server', function(done){
diff --git a/test/app.locals.js b/test/app.locals.js
index 9f5fc1f2fed..a8b022957a2 100644
--- a/test/app.locals.js
+++ b/test/app.locals.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   describe('.locals(obj)', function(){
@@ -14,7 +14,7 @@ describe('app', function(){
       app.locals.age.should.equal(2);
     })
   })
-  
+
   describe('.locals.settings', function(){
     it('should expose app settings', function(){
       var app = express();
diff --git a/test/app.options.js b/test/app.options.js
index 6678b6cdb4f..b7689d493f1 100644
--- a/test/app.options.js
+++ b/test/app.options.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('OPTIONS', function(){
   it('should default to the routes defined', function(done){
diff --git a/test/app.param.js b/test/app.param.js
index 98332b5dcb9..6f0ee8e76e7 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   describe('.param(fn)', function(){
diff --git a/test/app.request.js b/test/app.request.js
index 6d31112886f..728043a5a34 100644
--- a/test/app.request.js
+++ b/test/app.request.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   describe('.request', function(){
diff --git a/test/app.response.js b/test/app.response.js
index 84911e4c1b0..c6ea77c820a 100644
--- a/test/app.response.js
+++ b/test/app.response.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   describe('.response', function(){
@@ -19,7 +19,7 @@ describe('app', function(){
       .get('/')
       .expect('HEY', done);
     })
-    
+
     it('should not be influenced by other app protos', function(done){
       var app = express()
         , app2 = express();
@@ -27,7 +27,7 @@ describe('app', function(){
       app.response.shout = function(str){
         this.send(str.toUpperCase());
       };
-      
+
       app2.response.shout = function(str){
         this.send(str);
       };
diff --git a/test/app.route.js b/test/app.route.js
index 0fcf70a68d9..3113cac6202 100644
--- a/test/app.route.js
+++ b/test/app.route.js
@@ -1,5 +1,5 @@
-var express = require('../')
-  , request = require('./support/http')
+var express = require('../');
+var request = require('supertest');
 
 describe('app.route', function(){
   it('should return a new route', function(done){
diff --git a/test/app.router.js b/test/app.router.js
index 7489efb59e9..6c20d168418 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert')
   , methods = require('methods');
 
diff --git a/test/app.routes.error.js b/test/app.routes.error.js
index d76bb2ebf71..ac517efdee2 100644
--- a/test/app.routes.error.js
+++ b/test/app.routes.error.js
@@ -1,5 +1,5 @@
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   describe('.VERB()', function(){
diff --git a/test/app.use.js b/test/app.use.js
index 20a52966cdd..d627bdfe658 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   it('should emit "mount" when mounted', function(done){
@@ -23,7 +23,7 @@ describe('app', function(){
       blog.get('/blog', function(req, res){
         res.end('blog');
       });
-      
+
       app.use(blog);
 
       request(app)
diff --git a/test/exports.js b/test/exports.js
index 25700e6223c..9a593291017 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -1,7 +1,7 @@
 
-var express = require('../')
-  , request = require('./support/http')
-  , assert = require('assert');
+var express = require('../');
+var request = require('supertest');
+var assert = require('assert');
 
 describe('exports', function(){
   it('should expose Router', function(){
diff --git a/test/regression.js b/test/regression.js
index fdb2c5f5c8a..5d4509ed6fb 100644
--- a/test/regression.js
+++ b/test/regression.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('throw after .end()', function(){
   it('should fail gracefully', function(done){
diff --git a/test/req.accepts.js b/test/req.accepts.js
index aeaf2258e56..0df4780e221 100644
--- a/test/req.accepts.js
+++ b/test/req.accepts.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.accepts(type)', function(){
diff --git a/test/req.acceptsCharset.js b/test/req.acceptsCharset.js
index 4b18a4c8675..a5461d01ae8 100644
--- a/test/req.acceptsCharset.js
+++ b/test/req.acceptsCharset.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.acceptsCharset(type)', function(){
diff --git a/test/req.auth.js b/test/req.auth.js
index eac1f4ec4e0..60bec2d38ce 100644
--- a/test/req.auth.js
+++ b/test/req.auth.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.auth', function(){
diff --git a/test/req.fresh.js b/test/req.fresh.js
index e0079bb9897..68912b88604 100644
--- a/test/req.fresh.js
+++ b/test/req.fresh.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.fresh', function(){
diff --git a/test/req.get.js b/test/req.get.js
index 6e114509fad..144a256848d 100644
--- a/test/req.get.js
+++ b/test/req.get.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('req', function(){
diff --git a/test/req.host.js b/test/req.host.js
index 22f5e147b5d..4c5c76ba7d4 100644
--- a/test/req.host.js
+++ b/test/req.host.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('req', function(){
diff --git a/test/req.ip.js b/test/req.ip.js
index 473844a9bac..e778838952c 100644
--- a/test/req.ip.js
+++ b/test/req.ip.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.ip', function(){
diff --git a/test/req.ips.js b/test/req.ips.js
index b34ca90934f..c9123aeaa17 100644
--- a/test/req.ips.js
+++ b/test/req.ips.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.ips', function(){
diff --git a/test/req.is.js b/test/req.is.js
index 5a4c336b186..68e92c55a87 100644
--- a/test/req.is.js
+++ b/test/req.is.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 function req(ct) {
   var req = {
diff --git a/test/req.param.js b/test/req.param.js
index 0f7ebf440c2..6c6483e0852 100644
--- a/test/req.param.js
+++ b/test/req.param.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , bodyParser = require('body-parser')
 
 describe('req', function(){
@@ -30,7 +30,7 @@ describe('req', function(){
       .get('/?name=tj')
       .expect('tj', done);
     })
-    
+
     it('should check req.body', function(done){
       var app = express();
 
@@ -45,7 +45,7 @@ describe('req', function(){
       .send({ name: 'tj' })
       .expect('tj', done);
     })
-    
+
     it('should check req.params', function(done){
       var app = express();
 
diff --git a/test/req.path.js b/test/req.path.js
index f12df3752e6..6ad4009c7d5 100644
--- a/test/req.path.js
+++ b/test/req.path.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.path', function(){
diff --git a/test/req.protocol.js b/test/req.protocol.js
index d25671fe42e..490eb911ce4 100644
--- a/test/req.protocol.js
+++ b/test/req.protocol.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.protocol', function(){
diff --git a/test/req.query.js b/test/req.query.js
index 53d24400380..10547e4a117 100644
--- a/test/req.query.js
+++ b/test/req.query.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.query', function(){
@@ -18,7 +18,7 @@ describe('req', function(){
         done();
       });
     })
-    
+
     it('should contain the parsed query-string', function(done){
       var app = express();
 
diff --git a/test/req.route.js b/test/req.route.js
index 8cfe6c2c0d9..2947b7c3d0f 100644
--- a/test/req.route.js
+++ b/test/req.route.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.route', function(){
@@ -11,7 +11,7 @@ describe('req', function(){
         req.route.path.should.equal('/user/:id/:op?');
         next();
       });
-      
+
       app.get('/user/:id/edit', function(req, res){
         req.route.path.should.equal('/user/:id/edit');
         res.end();
diff --git a/test/req.secure.js b/test/req.secure.js
index 6c59a898fdc..df9ae93fae6 100644
--- a/test/req.secure.js
+++ b/test/req.secure.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.secure', function(){
diff --git a/test/req.signedCookies.js b/test/req.signedCookies.js
index 32b87bfe25e..719cb464d0d 100644
--- a/test/req.signedCookies.js
+++ b/test/req.signedCookies.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , cookieParser = require('cookie-parser')
 
 describe('req', function(){
diff --git a/test/req.stale.js b/test/req.stale.js
index 222628360bc..2c55e8b9a1a 100644
--- a/test/req.stale.js
+++ b/test/req.stale.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.stale', function(){
diff --git a/test/req.subdomains.js b/test/req.subdomains.js
index ff48dbb3488..ec851d2c01a 100644
--- a/test/req.subdomains.js
+++ b/test/req.subdomains.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.subdomains', function(){
diff --git a/test/req.xhr.js b/test/req.xhr.js
index 8c7b56d075d..fe4c0503ee3 100644
--- a/test/req.xhr.js
+++ b/test/req.xhr.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.xhr', function(){
@@ -19,7 +19,7 @@ describe('req', function(){
         done();
       })
     })
-    
+
     it('should case-insensitive', function(done){
       var app = express();
 
@@ -35,7 +35,7 @@ describe('req', function(){
         done();
       })
     })
-    
+
     it('should return false otherwise', function(done){
       var app = express();
 
@@ -51,7 +51,7 @@ describe('req', function(){
         done();
       })
     })
-    
+
     it('should return false when not present', function(done){
       var app = express();
 
diff --git a/test/res.attachment.js b/test/res.attachment.js
index aea5eb16355..1049b07cf59 100644
--- a/test/res.attachment.js
+++ b/test/res.attachment.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.attachment()', function(){
@@ -16,7 +16,7 @@ describe('res', function(){
       .expect('Content-Disposition', 'attachment', done);
     })
   })
-  
+
   describe('.attachment(filename)', function(){
     it('should add the filename param', function(done){
       var app = express();
@@ -30,7 +30,7 @@ describe('res', function(){
       .get('/')
       .expect('Content-Disposition', 'attachment; filename="image.png"', done);
     })
-    
+
     it('should set the Content-Type', function(done){
       var app = express();
 
diff --git a/test/res.charset.js b/test/res.charset.js
index 79ec3dfb46f..2403ba4df4a 100644
--- a/test/res.charset.js
+++ b/test/res.charset.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.charset', function(){
@@ -17,7 +17,7 @@ describe('res', function(){
       .get('/')
       .expect("text/x-foo; charset=utf-8", done);
     })
-    
+
     it('should take precedence over res.send() defaults', function(done){
       var app = express();
 
diff --git a/test/res.clearCookie.js b/test/res.clearCookie.js
index 99c56c0c061..92c9d049f0d 100644
--- a/test/res.clearCookie.js
+++ b/test/res.clearCookie.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.clearCookie(name)', function(){
@@ -20,7 +20,7 @@ describe('res', function(){
       })
     })
   })
-  
+
   describe('.clearCookie(name, options)', function(){
     it('should set the given params', function(done){
       var app = express();
diff --git a/test/res.cookie.js b/test/res.cookie.js
index bd259e6a29b..a339d88fd58 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , mixin = require('utils-merge')
   , cookie = require('cookie')
   , cookieParser = require('cookie-parser')
@@ -40,7 +40,7 @@ describe('res', function(){
         done();
       })
     })
-    
+
     it('should allow multiple calls', function(done){
       var app = express();
 
@@ -60,7 +60,7 @@ describe('res', function(){
       })
     })
   })
-  
+
   describe('.cookie(name, string, options)', function(){
     it('should set params', function(done){
       var app = express();
@@ -78,7 +78,7 @@ describe('res', function(){
         done();
       })
     })
-    
+
     describe('maxAge', function(){
       it('should set relative expires', function(done){
         var app = express();
diff --git a/test/res.download.js b/test/res.download.js
index a78f8d20b1b..614e4320c06 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('res', function(){
diff --git a/test/res.format.js b/test/res.format.js
index 98758144e92..b6eb199d4da 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , utils = require('../lib/utils')
   , assert = require('assert');
 
@@ -15,7 +15,7 @@ app.use(function(req, res, next){
     'text/html': function(){
       res.send('<p>hey</p>');
     },
-  
+
     'application/json': function(a, b, c){
       assert(req == a);
       assert(res == b);
diff --git a/test/res.json.js b/test/res.json.js
index 5712fc3e63f..6ad34d21b6a 100644
--- a/test/res.json.js
+++ b/test/res.json.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('res', function(){
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 9f7769e38a6..5fce46b0760 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('res', function(){
diff --git a/test/res.locals.js b/test/res.locals.js
index 8861bac70fe..3c83e66c54f 100644
--- a/test/res.locals.js
+++ b/test/res.locals.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.locals', function(){
diff --git a/test/res.location.js b/test/res.location.js
index 2fb9ab73540..6481160174a 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.location(url)', function(){
diff --git a/test/res.redirect.js b/test/res.redirect.js
index dab3e6e003a..870f925a869 100644
--- a/test/res.redirect.js
+++ b/test/res.redirect.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.redirect(url)', function(){
diff --git a/test/res.render.js b/test/res.render.js
index 11c01aa1752..83f3662529d 100644
--- a/test/res.render.js
+++ b/test/res.render.js
@@ -1,12 +1,12 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.render(name)', function(){
     it('should support absolute paths', function(done){
       var app = express();
-  
+
       app.locals.user = { name: 'tobi' };
 
       app.use(function(req, res){
@@ -17,10 +17,10 @@ describe('res', function(){
       .get('/')
       .expect('<p>tobi</p>', done);
     })
-    
+
     it('should support absolute paths with "view engine"', function(done){
       var app = express();
-  
+
       app.locals.user = { name: 'tobi' };
       app.set('view engine', 'jade');
 
@@ -35,7 +35,7 @@ describe('res', function(){
 
     it('should expose app.locals', function(done){
       var app = express();
-  
+
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
 
@@ -62,32 +62,32 @@ describe('res', function(){
       .get('/')
       .expect('<p>tobi</p>', done);
     })
-  
+
     it('should support index.<engine>', function(done){
       var app = express();
-  
+
       app.set('views', __dirname + '/fixtures');
       app.set('view engine', 'jade');
 
       app.use(function(req, res){
         res.render('blog/post');
       });
-      
+
       request(app)
       .get('/')
       .expect('<h1>blog post</h1>', done);
     })
-  
+
     describe('when an error occurs', function(){
       it('should next(err)', function(done){
         var app = express();
-  
+
         app.set('views', __dirname + '/fixtures');
 
         app.use(function(req, res){
           res.render('user.jade');
         });
-        
+
         app.use(function(err, req, res, next){
           res.end(err.message);
         });
@@ -97,11 +97,11 @@ describe('res', function(){
         .expect(/user is not defined/, done);
       })
     })
-  
+
     describe('when "view engine" is given', function(){
       it('should render the template', function(done){
         var app = express();
-  
+
         app.set('view engine', 'jade');
         app.set('views', __dirname + '/fixtures');
 
@@ -119,9 +119,9 @@ describe('res', function(){
   describe('.render(name, option)', function(){
     it('should render the template', function(done){
       var app = express();
-  
+
       app.set('views', __dirname + '/fixtures');
-  
+
       var user = { name: 'tobi' };
 
       app.use(function(req, res){
@@ -132,10 +132,10 @@ describe('res', function(){
       .get('/')
       .expect('<p>tobi</p>', done);
     })
-  
+
     it('should expose app.locals', function(done){
       var app = express();
-    
+
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
 
@@ -147,10 +147,10 @@ describe('res', function(){
       .get('/')
       .expect('<p>tobi</p>', done);
     })
-    
+
     it('should expose res.locals', function(done){
       var app = express();
-    
+
       app.set('views', __dirname + '/fixtures');
 
       app.use(function(req, res){
@@ -162,10 +162,10 @@ describe('res', function(){
       .get('/')
       .expect('<p>tobi</p>', done);
     })
-    
+
     it('should give precedence to res.locals over app.locals', function(done){
       var app = express();
-    
+
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
 
@@ -181,10 +181,10 @@ describe('res', function(){
 
     it('should give precedence to res.render() locals over res.locals', function(done){
       var app = express();
-    
+
       app.set('views', __dirname + '/fixtures');
       var jane = { name: 'jane' };
-    
+
       app.use(function(req, res){
         res.locals.user = { name: 'tobi' };
         res.render('user.jade', { user: jane });
@@ -194,14 +194,14 @@ describe('res', function(){
       .get('/')
       .expect('<p>jane</p>', done);
     })
-    
+
     it('should give precedence to res.render() locals over app.locals', function(done){
       var app = express();
-    
+
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
       var jane = { name: 'jane' };
-    
+
       app.use(function(req, res){
         res.render('user.jade', { user: jane });
       });
diff --git a/test/res.send.js b/test/res.send.js
index 9de7cbd3bb4..fc3c6ef0f08 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('res', function(){
diff --git a/test/res.sendfile.js b/test/res.sendfile.js
index 5532a5a5c0f..b6ec9833011 100644
--- a/test/res.sendfile.js
+++ b/test/res.sendfile.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('res', function(){
diff --git a/test/res.set.js b/test/res.set.js
index 152efd355bd..76dcf7fe6f6 100644
--- a/test/res.set.js
+++ b/test/res.set.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , res = express.response;
 
 describe('res', function(){
@@ -45,7 +45,7 @@ describe('res', function(){
       JSON.stringify(res.get('ETag')).should.equal('["123","456"]');
     })
   })
-  
+
   describe('.set(object)', function(){
     it('should set multiple fields', function(done){
       var app = express();
diff --git a/test/res.status.js b/test/res.status.js
index 0de25eb75f8..8c173a645c5 100644
--- a/test/res.status.js
+++ b/test/res.status.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.status(code)', function(){
diff --git a/test/res.type.js b/test/res.type.js
index 09653e39abf..7c03ef4c64d 100644
--- a/test/res.type.js
+++ b/test/res.type.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.type(str)', function(){
diff --git a/test/support/http.js b/test/support/http.js
deleted file mode 100644
index 382e63cea40..00000000000
--- a/test/support/http.js
+++ /dev/null
@@ -1,2 +0,0 @@
-
-module.exports = require('supertest');
\ No newline at end of file

From d84457b9c2984019ec3806a93675fafddb5c2ec0 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 5 Mar 2014 22:07:56 -0800
Subject: [PATCH 0090/1265] remoive legacy docs bin

---
 support/docs | 21 ---------------------
 1 file changed, 21 deletions(-)
 delete mode 100755 support/docs

diff --git a/support/docs b/support/docs
deleted file mode 100755
index f97588a35ce..00000000000
--- a/support/docs
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/usr/bin/env node
-
-var buf = '';
-process.stdin.setEncoding('utf8');
-process.stdin.on('data', function(chunk){
-  buf += chunk;
-}).on('end', function(){
-  var comments = JSON.parse(buf);
-  comments.forEach(function(comment){
-    if (comment.ignore) return;
-    if (comment.isPrivate) return;
-    if (!comment.ctx) return;
-    if (!comment.description.full.indexOf('Module dep')) return;
-    var ctx = comment.ctx;
-    console.log();
-    console.log('# %s', ctx.string);
-    console.log();
-    console.log(comment.description.full.trim().replace(/^/gm, '  '));
-  });
-  console.log();
-}).resume();
\ No newline at end of file

From 9ea18e10c999d99278ad7ad1cac74009bf579c50 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 5 Mar 2014 22:13:54 -0800
Subject: [PATCH 0091/1265] throw errors when users try to access removed
 middleware

---
 lib/express.js | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/lib/express.js b/lib/express.js
index f7319cba5f2..f672869da40 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -62,4 +62,37 @@ exports.Router = Router;
  * Expose middleware
  */
 
+exports.query = require('./middleware/query');
 exports.static = require('serve-static');
+
+/**
+ * Replace removed middleware with an appropriate error message.
+ */
+
+[
+  'json',
+  'urlencoded',
+  'bodyParser',
+  'compress',
+  'cookieSession',
+  'session',
+  'logger',
+  'cookieParser',
+  'favicon',
+  'responseTime',
+  'errorHandler',
+  'timeout',
+  'methodOverride',
+  'vhost',
+  'csrf',
+  'directory',
+  'limit',
+  'multipart',
+  'staticCache',
+].forEach(function (name) {
+  Object.defineProperty(exports, name, {
+    get: function () {
+      throw new Error('Most middleware is no longer bundled with Express and must be installed separately. Please see https://github.com/senchalabs/connect#middleware.');
+    }
+  });
+});

From 74f55a863a63dcc40d5cc595582ca27e3018fe70 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 5 Mar 2014 22:17:25 -0800
Subject: [PATCH 0092/1265] remove .writeHead patch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

no middleware uses the “header” event anymore
---
 lib/patch.js | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/lib/patch.js b/lib/patch.js
index 1f487f887aa..78d42bf5349 100644
--- a/lib/patch.js
+++ b/lib/patch.js
@@ -18,7 +18,6 @@ if (ServerResponse.prototype._hasConnectPatch) {
 
 // original methods
 var setHeader = ServerResponse.prototype.setHeader;
-var writeHead = ServerResponse.prototype.writeHead;
 
 /**
  * Set header `field` to `val`, special-casing
@@ -39,16 +38,4 @@ ServerResponse.prototype.setHeader = function(field, val){
   return setHeader.call(this, field, val);
 };
 
-ServerResponse.prototype.writeHead = function(statusCode, reasonPhrase, headers){
-  if (typeof reasonPhrase === 'object') headers = reasonPhrase;
-  if (typeof headers === 'object') {
-    Object.keys(headers).forEach(function(key){
-      this.setHeader(key, headers[key]);
-    }, this);
-  }
-  if (!this._emittedHeader) this.emit('header');
-  this._emittedHeader = true;
-  return writeHead.call(this, statusCode, reasonPhrase);
-};
-
 ServerResponse.prototype._hasConnectPatch = true;

From 3112f92d08198a3b009fab53584c420e8808b31d Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 5 Mar 2014 22:20:58 -0800
Subject: [PATCH 0093/1265] move the patch to the response proto

---
 lib/express.js  |  3 ---
 lib/patch.js    | 41 -----------------------------------------
 lib/response.js | 24 +++++++++++++++++++++++-
 3 files changed, 23 insertions(+), 45 deletions(-)
 delete mode 100644 lib/patch.js

diff --git a/lib/express.js b/lib/express.js
index f672869da40..56bd8a06636 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -13,9 +13,6 @@ var proto = require('./application')
   , req = require('./request')
   , res = require('./response')
 
-// monkey patch ServerResponse methods
-require('./patch')
-
 /**
  * Expose `createApplication()`.
  */
diff --git a/lib/patch.js b/lib/patch.js
deleted file mode 100644
index 78d42bf5349..00000000000
--- a/lib/patch.js
+++ /dev/null
@@ -1,41 +0,0 @@
-/*!
- * Connect
- * Copyright(c) 2011 TJ Holowaychuk
- * MIT Licensed
- */
-
-/**
- * Module dependencies.
- */
-
-var http = require('http');
-var ServerResponse = http.ServerResponse;
-
-// apply only once
-if (ServerResponse.prototype._hasConnectPatch) {
-  return;
-}
-
-// original methods
-var setHeader = ServerResponse.prototype.setHeader;
-
-/**
- * Set header `field` to `val`, special-casing
- * the `Set-Cookie` field for multiple support.
- *
- * @param {String} field
- * @param {String} val
- * @api public
- */
-
-ServerResponse.prototype.setHeader = function(field, val){
-  var key = field.toLowerCase();
-
-  if ('content-type' == key && this.charset) {
-    val += '; charset=' + this.charset;
-  }
-
-  return setHeader.call(this, field, val);
-};
-
-ServerResponse.prototype._hasConnectPatch = true;
diff --git a/lib/response.js b/lib/response.js
index 5268a41787c..3a0da4d511b 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -16,7 +16,9 @@ var http = require('http')
   , resolve = require('url').resolve
   , basename = path.basename
   , extname = path.extname
-  , mime = send.mime
+  , mime = send.mime;
+var ServerResponse = http.ServerResponse;
+var setHeader = ServerResponse.prototype.setHeader;
 
 /**
  * Response prototype.
@@ -779,3 +781,23 @@ res.render = function(view, options, fn){
   // render
   app.render(view, options, fn);
 };
+
+
+/**
+ * Set header `field` to `val`, special-casing
+ * the `Set-Cookie` field for multiple support.
+ *
+ * @param {String} field
+ * @param {String} val
+ * @api public
+ */
+
+res.setHeader = function(field, val){
+  var key = field.toLowerCase();
+
+  if ('content-type' == key && this.charset) {
+    val += '; charset=' + this.charset;
+  }
+
+  return setHeader.call(this, field, val);
+};
\ No newline at end of file

From 5572897998a961ebd3038316c5137c43b025dbab Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 5 Mar 2014 22:24:35 -0800
Subject: [PATCH 0094/1265] some jshint cleanup

some more errors but whatever
---
 lib/express.js      | 7 ++-----
 lib/request.js      | 2 +-
 lib/response.js     | 1 -
 lib/router/index.js | 7 ++-----
 lib/router/layer.js | 6 ++++--
 5 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/lib/express.js b/lib/express.js
index 56bd8a06636..3a8fa29563d 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -3,15 +3,12 @@
  */
 
 var EventEmitter = require('events').EventEmitter;
-
-var merge = require('merge-descriptors')
-  , mixin = require('utils-merge')
-
+var mixin = require('utils-merge');
 var proto = require('./application')
   , Route = require('./router/route')
   , Router = require('./router')
   , req = require('./request')
-  , res = require('./response')
+  , res = require('./response');
 
 /**
  * Expose `createApplication()`.
diff --git a/lib/request.js b/lib/request.js
index c0e42310d28..ffc85b8dae2 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -149,7 +149,7 @@ req.acceptsCharsets = function(){
  */
 
 req.acceptsLanguage = // backwards compatibility
-req.acceptsLanguages = function(lang){
+req.acceptsLanguages = function(){
   var accept = accepts(this);
   return accept.languages.apply(accept, arguments);
 };
diff --git a/lib/response.js b/lib/response.js
index 3a0da4d511b..16fa01b5b09 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -13,7 +13,6 @@ var http = require('http')
   , statusCodes = http.STATUS_CODES
   , cookie = require('cookie')
   , send = require('send')
-  , resolve = require('url').resolve
   , basename = path.basename
   , extname = path.extname
   , mime = send.mime;
diff --git a/lib/router/index.js b/lib/router/index.js
index 755ef96f7d4..7a2d404e298 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -22,7 +22,7 @@ var proto = module.exports = function(options) {
 
   function router(req, res, next) {
     router.handle(req, res, next);
-  };
+  }
 
   // mixin Router class functions
   router.__proto__ = proto;
@@ -199,8 +199,6 @@ proto.handle = function(req, res, done) {
         trim_prefix();
       });
 
-      return next(err);
-
       function trim_prefix() {
         var c = path[layer.path.length];
         if (c && '/' != c && '.' != c) return next(err);
@@ -244,7 +242,6 @@ proto.handle = function(req, res, done) {
  */
 
 proto.process_params = function(route, req, res, done) {
-  var self = this;
   var params = this.params;
 
   // captured parameters from the route, keys and values
@@ -288,7 +285,7 @@ proto.process_params = function(route, req, res, done) {
     }
 
     done();
-  };
+  }
 
   // single param callbacks
   function paramCallback(err) {
diff --git a/lib/router/layer.js b/lib/router/layer.js
index 32b1bb46480..df374c5ee37 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -32,14 +32,16 @@ Layer.prototype.match = function(path){
     , params = this.params = {}
     , m = this.regexp.exec(path)
     , n = 0;
+  var key;
+  var val;
 
   if (!m) return false;
 
   for (var i = 1, len = m.length; i < len; ++i) {
-    var key = keys[i - 1];
+    key = keys[i - 1];
 
     try {
-      var val = 'string' == typeof m[i]
+      val = 'string' == typeof m[i]
         ? decodeURIComponent(m[i])
         : m[i];
     } catch(e) {

From 3321055025fcfc6e41cd41ea11d8f46ee71b84f3 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 5 Mar 2014 22:35:55 -0800
Subject: [PATCH 0095/1265] use path-to-regexp

---
 lib/router/layer.js | 11 ++++-------
 lib/utils.js        | 40 ----------------------------------------
 package.json        |  1 +
 3 files changed, 5 insertions(+), 47 deletions(-)

diff --git a/lib/router/layer.js b/lib/router/layer.js
index df374c5ee37..2a528db1409 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -1,5 +1,6 @@
-var utils = require('../utils')
-  , debug = require('debug')('express:router:layer')
+var utils = require('../utils');
+var pathRegexp = require('path-to-regexp');
+var debug = require('debug')('express:router:layer');
 
 function Layer(path, options, fn) {
   if (!(this instanceof Layer)) {
@@ -10,11 +11,7 @@ function Layer(path, options, fn) {
   options = options || {};
   this.path = path;
   this.params = {};
-  this.regexp = utils.pathRegexp(path
-    , this.keys = []
-    , options.sensitive
-    , options.strict
-    , options.end);
+  this.regexp = pathRegexp(path, this.keys = [], options);
   this.handle = fn;
 }
 
diff --git a/lib/utils.js b/lib/utils.js
index 624d4c6c594..d30fc5b1d77 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -119,46 +119,6 @@ function acceptParams(str, index) {
   return ret;
 }
 
-/**
- * Normalize the given path string,
- * returning a regular expression.
- *
- * An empty array should be passed,
- * which will contain the placeholder
- * key names. For example "/user/:id" will
- * then contain ["id"].
- *
- * @param  {String|RegExp|Array} path
- * @param  {Array} keys
- * @param  {Boolean} sensitive
- * @param  {Boolean} strict
- * @param  {Boolean} end (whether to append $ to regex)
- * @return {RegExp}
- * @api private
- */
-
-exports.pathRegexp = function(path, keys, sensitive, strict, end) {
-  if (toString.call(path) == '[object RegExp]') return path;
-  if (Array.isArray(path)) path = '(' + path.join('|') + ')';
-  path = path
-    .concat(strict ? '' : '/?')
-    .replace(/\/\(/g, '(?:/')
-    .replace(/(\/)?(\.)?:(\w+)(?:(\(.*?\)))?(\?)?(\*)?/g, function(_, slash, format, key, capture, optional, star){
-      keys.push({ name: key, optional: !! optional });
-      slash = slash || '';
-      return ''
-        + (optional ? '' : slash)
-        + '(?:'
-        + (optional ? slash : '')
-        + (format || '') + (capture || (format && '([^/.]+?)' || '([^/]+?)')) + ')'
-        + (optional || '')
-        + (star ? '(/*)?' : '');
-    })
-    .replace(/([\/.])/g, '\\$1')
-    .replace(/\*/g, '(.*)');
-  return new RegExp('^' + path + ((end) ? '$' : ''), sensitive ? '' : 'i');
-}
-
 /**
  * Parse the `req` url with memoization.
  *
diff --git a/package.json b/package.json
index 8d458962d00..d4f9d97dd68 100644
--- a/package.json
+++ b/package.json
@@ -36,6 +36,7 @@
     "escape-html": "1.0.1",
     "qs": "0.6.6",
     "serve-static": "1.0.1",
+    "path-to-regexp": "0.1.0",
     "debug": ">= 0.7.3 < 1"
   },
   "devDependencies": {

From b0351a08de73058df37cfacd624de2e26eacced8 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 5 Mar 2014 22:45:36 -0800
Subject: [PATCH 0096/1265] Update History.md

---
 History.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/History.md b/History.md
index e680b2999a8..8dd24f21b39 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,8 @@
 ==================
 
  * remove:
+   - node 0.8 support
+   - connect and connect's patches except for charset handling
    - express(1) - moved to [express-generator](https://github.com/expressjs/generator)
    - `express.createServer()` - it has been deprecated for a long time. Use `express()`
    - `app.configure` - use logic in your own app code
@@ -19,6 +21,7 @@
  * refactor:
    - `req.accepts*` with [accepts](https://github.com/expressjs/accepts)
    - `req.is` with [type-is](https://github.com/expressjs/type-is)
+   - [path-to-regexp](https://github.com/component/path-to-regexp) 
  * add:
    - `app.router()` - returns the app Router instance
    - `app.route()` - Proxy to the app's `Router#route()` method to create a new route

From 4ce1ee458ec1e0580d53a1b9d060b900176b023b Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Thu, 6 Mar 2014 14:57:05 -0800
Subject: [PATCH 0097/1265] bump deps

---
 History.md   |  5 +++++
 package.json | 10 +++++-----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index 9d53bef43a3..30ceafcdd1a 100644
--- a/History.md
+++ b/History.md
@@ -13,6 +13,11 @@
    - `req.accepts*` with [accepts](https://github.com/expressjs/accepts)
    - `req.is` with [type-is](https://github.com/expressjs/type-is)
 
+3.5.0 / 2014-03-06
+==================
+
+ * bump deps
+
 3.4.8 / 2014-01-13
 ==================
 
diff --git a/package.json b/package.json
index 2d2624480d4..0165eb020e1 100644
--- a/package.json
+++ b/package.json
@@ -22,13 +22,13 @@
     }
   ],
   "dependencies": {
-    "connect": "2.12.0",
+    "connect": "2.14.1",
     "commander": "1.3.2",
     "range-parser": "1.0.0",
     "mkdirp": "0.3.5",
-    "cookie": "0.1.0",
+    "cookie": "0.1.1",
     "buffer-crc32": "0.2.1",
-    "fresh": "0.2.1",
+    "fresh": "0.2.2",
     "methods": "0.1.0",
     "send": "0.2.0",
     "cookie-signature": "1.0.3",
@@ -37,14 +37,14 @@
   },
   "devDependencies": {
     "ejs": "~0.8.4",
-    "mocha": "~1.15.1",
+    "mocha": "~1.17.1",
     "jade": "~0.30.0",
     "hjs": "~0.0.6",
     "stylus": "~0.40.0",
     "should": "~2.1.1",
     "connect-redis": "~1.4.5",
     "marked": "0.2.10",
-    "supertest": "~0.8.1"
+    "supertest": "~0.9.0"
   },
   "keywords": [
     "express",

From 87912103c96d2032bbb93d0b3667a41714955dc5 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Thu, 6 Mar 2014 14:57:30 -0800
Subject: [PATCH 0098/1265] 3.5.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 0165eb020e1..80122cefc60 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.4.8",
+  "version": "3.5.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From b443da410a21b08018f8dc7450f65f04da5735fa Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Thu, 6 Mar 2014 14:59:36 -0800
Subject: [PATCH 0099/1265] update History.md with 3.x branch

---
 History.md | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 8dd24f21b39..e92fbff8416 100644
--- a/History.md
+++ b/History.md
@@ -21,12 +21,24 @@
  * refactor:
    - `req.accepts*` with [accepts](https://github.com/expressjs/accepts)
    - `req.is` with [type-is](https://github.com/expressjs/type-is)
-   - [path-to-regexp](https://github.com/component/path-to-regexp) 
+   - [path-to-regexp](https://github.com/component/path-to-regexp)
  * add:
    - `app.router()` - returns the app Router instance
    - `app.route()` - Proxy to the app's `Router#route()` method to create a new route
    - Router & Route - public API
 
+3.5.0 / 2014-03-06
+==================
+
+ * bump deps
+
+3.4.8 / 2014-01-13
+==================
+
+ * prevent incorrect automatic OPTIONS responses #1868 @dpatti
+ * update binary and examples for jade 1.0 #1876 @yossi, #1877 @reqshark, #1892 @matheusazzi
+ * throw 400 in case of malformed paths @rlidwka
+
 3.4.7 / 2013-12-10
 ==================
 

From 3cf7b2e39ee42bf6f3a195dc3275193c40ac1c77 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Fri, 7 Mar 2014 16:18:51 -0800
Subject: [PATCH 0100/1265] refactor to use basic-auth

---
 lib/request.js   | 32 +++++++++++++-------------------
 package.json     |  1 +
 test/req.auth.js | 10 ++++++++--
 3 files changed, 22 insertions(+), 21 deletions(-)

diff --git a/lib/request.js b/lib/request.js
index ffc85b8dae2..e6f45cd87fb 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -5,11 +5,12 @@
 
 var accepts = require('accepts');
 var typeis = require('type-is');
-var http = require('http')
-  , utils = require('./utils')
-  , fresh = require('fresh')
-  , parseRange = require('range-parser')
-  , parse = utils.parseUrl
+var basicAuth = require('basic-auth');
+var http = require('http');
+var fresh = require('fresh');
+var parseRange = require('range-parser');
+var utils = require('./utils');
+var parse = utils.parseUrl;
 
 /**
  * Request prototype.
@@ -318,20 +319,13 @@ req.__defineGetter__('ips', function(){
  */
 
 req.__defineGetter__('auth', function(){
-  // missing
-  var auth = this.get('Authorization');
-  if (!auth) return;
-
-  // malformed
-  var parts = auth.split(' ');
-  if ('basic' != parts[0].toLowerCase()) return;
-  if (!parts[1]) return;
-  auth = parts[1];
-
-  // credentials
-  auth = new Buffer(auth, 'base64').toString().match(/^([^:]*):(.*)$/);
-  if (!auth) return;
-  return { username: auth[1], password: auth[2] };
+  var auth = basicAuth(this);
+  if (auth) {
+    // aliases for backwards compatibilty
+    auth.username = auth.name;
+    auth.password = auth.pass;
+  }
+  return auth;
 });
 
 /**
diff --git a/package.json b/package.json
index d4f9d97dd68..85711792828 100644
--- a/package.json
+++ b/package.json
@@ -22,6 +22,7 @@
     }
   ],
   "dependencies": {
+    "basic-auth": "0.0.1",
     "accepts": "1.0.0",
     "type-is": "1.0.0",
     "range-parser": "1.0.0",
diff --git a/test/req.auth.js b/test/req.auth.js
index 60bec2d38ce..0a3bda973b0 100644
--- a/test/req.auth.js
+++ b/test/req.auth.js
@@ -68,7 +68,10 @@ describe('req', function(){
         var app = express();
 
         app.get('/', function(req, res){
-          res.send(req.auth || 'none');
+          res.send({
+            username: req.auth.username,
+            password: req.auth.password,
+          });
         });
 
         request(app)
@@ -82,7 +85,10 @@ describe('req', function(){
       var app = express();
 
       app.get('/', function(req, res){
-        res.send(req.auth || 'none');
+        res.send({
+          username: req.auth.username,
+          password: req.auth.password,
+        });
       });
 
       request(app)

From bad55f797721fcce2c1879165d4b498a735f37e0 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Fri, 7 Mar 2014 16:32:41 -0800
Subject: [PATCH 0101/1265] move setHeader charset patch to .set

note that application/json no longer adds charset=utf-8. could be a
regression.

closes #1952
See also: https://github.com/broofa/node-mime/issues/86
---
 lib/response.js      | 55 +++++++++++++++-----------------------------
 test/req.is.js       |  2 +-
 test/res.charset.js  | 34 ---------------------------
 test/res.json.js     | 10 ++++----
 test/res.jsonp.js    | 10 ++++----
 test/res.send.js     |  6 ++---
 test/res.sendfile.js |  2 +-
 test/res.set.js      | 10 ++++++--
 8 files changed, 42 insertions(+), 87 deletions(-)
 delete mode 100644 test/res.charset.js

diff --git a/lib/response.js b/lib/response.js
index 16fa01b5b09..76ccf7e3bfb 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -2,22 +2,20 @@
  * Module dependencies.
  */
 
-var http = require('http')
-  , path = require('path')
-  , mixin = require('utils-merge')
-  , escapeHtml = require('escape-html')
-  , sign = require('cookie-signature').sign
-  , normalizeType = require('./utils').normalizeType
-  , normalizeTypes = require('./utils').normalizeTypes
-  , etag = require('./utils').etag
-  , statusCodes = http.STATUS_CODES
-  , cookie = require('cookie')
-  , send = require('send')
-  , basename = path.basename
-  , extname = path.extname
-  , mime = send.mime;
-var ServerResponse = http.ServerResponse;
-var setHeader = ServerResponse.prototype.setHeader;
+var http = require('http');
+var path = require('path');
+var mixin = require('utils-merge');
+var escapeHtml = require('escape-html');
+var sign = require('cookie-signature').sign;
+var normalizeType = require('./utils').normalizeType;
+var normalizeTypes = require('./utils').normalizeTypes;
+var etag = require('./utils').etag;
+var statusCodes = http.STATUS_CODES;
+var cookie = require('cookie');
+var send = require('send');
+var basename = path.basename;
+var extname = path.extname;
+var mime = send.mime;
 
 /**
  * Response prototype.
@@ -525,6 +523,11 @@ res.header = function(field, val){
   if (2 == arguments.length) {
     if (Array.isArray(val)) val = val.map(String);
     else val = String(val);
+    field = field.toLowerCase();
+    if ('content-type' == field && !/;\s*charset\s*=/.test(val)) {
+      var charset = mime.charsets.lookup(val.split(';')[0]);
+      if (charset) val += '; charset=' + charset.toLowerCase();
+    }
     this.setHeader(field, val);
   } else {
     for (var key in field) {
@@ -780,23 +783,3 @@ res.render = function(view, options, fn){
   // render
   app.render(view, options, fn);
 };
-
-
-/**
- * Set header `field` to `val`, special-casing
- * the `Set-Cookie` field for multiple support.
- *
- * @param {String} field
- * @param {String} val
- * @api public
- */
-
-res.setHeader = function(field, val){
-  var key = field.toLowerCase();
-
-  if ('content-type' == key && this.charset) {
-    val += '; charset=' + this.charset;
-  }
-
-  return setHeader.call(this, field, val);
-};
\ No newline at end of file
diff --git a/test/req.is.js b/test/req.is.js
index 68e92c55a87..e5adb19de90 100644
--- a/test/req.is.js
+++ b/test/req.is.js
@@ -16,7 +16,7 @@ function req(ct) {
 
 describe('req.is()', function(){
   it('should ignore charset', function(){
-    req('application/json; charset=utf-8')
+    req('application/json')
     .is('json')
     .should.equal('json');
   })
diff --git a/test/res.charset.js b/test/res.charset.js
deleted file mode 100644
index 2403ba4df4a..00000000000
--- a/test/res.charset.js
+++ /dev/null
@@ -1,34 +0,0 @@
-
-var express = require('../')
-  , request = require('supertest');
-
-describe('res', function(){
-  describe('.charset', function(){
-    it('should add the charset param to Content-Type', function(done){
-      var app = express();
-
-      app.use(function(req, res){
-        res.charset = 'utf-8';
-        res.set('Content-Type', 'text/x-foo');
-        res.end(res.get('Content-Type'));
-      });
-
-      request(app)
-      .get('/')
-      .expect("text/x-foo; charset=utf-8", done);
-    })
-
-    it('should take precedence over res.send() defaults', function(done){
-      var app = express();
-
-      app.use(function(req, res){
-        res.charset = 'whoop';
-        res.send('hey');
-      });
-
-      request(app)
-      .get('/')
-      .expect('Content-Type', 'text/html; charset=whoop', done);
-    })
-  })
-})
diff --git a/test/res.json.js b/test/res.json.js
index 6ad34d21b6a..c088ab45569 100644
--- a/test/res.json.js
+++ b/test/res.json.js
@@ -28,7 +28,7 @@ describe('res', function(){
         request(app)
         .get('/')
         .end(function(err, res){
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+          res.headers.should.have.property('content-type', 'application/json');
           res.text.should.equal('null');
           done();
         })
@@ -46,7 +46,7 @@ describe('res', function(){
         request(app)
         .get('/')
         .end(function(err, res){
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+          res.headers.should.have.property('content-type', 'application/json');
           res.text.should.equal('["foo","bar","baz"]');
           done();
         })
@@ -64,7 +64,7 @@ describe('res', function(){
         request(app)
         .get('/')
         .end(function(err, res){
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+          res.headers.should.have.property('content-type', 'application/json');
           res.text.should.equal('{"name":"tobi"}');
           done();
         })
@@ -131,7 +131,7 @@ describe('res', function(){
       .get('/')
       .end(function(err, res){
         res.statusCode.should.equal(201);
-        res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+        res.headers.should.have.property('content-type', 'application/json');
         res.text.should.equal('{"id":1}');
         done();
       })
@@ -150,7 +150,7 @@ describe('res', function(){
       .get('/')
       .end(function(err, res){
         res.statusCode.should.equal(201);
-        res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+        res.headers.should.have.property('content-type', 'application/json');
         res.text.should.equal('{"id":1}');
         done();
       })
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 5fce46b0760..f08a5adda95 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -114,7 +114,7 @@ describe('res', function(){
         request(app)
         .get('/')
         .end(function(err, res){
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+          res.headers.should.have.property('content-type', 'application/json');
           res.text.should.equal('null');
           done();
         })
@@ -132,7 +132,7 @@ describe('res', function(){
         request(app)
         .get('/')
         .end(function(err, res){
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+          res.headers.should.have.property('content-type', 'application/json');
           res.text.should.equal('["foo","bar","baz"]');
           done();
         })
@@ -150,7 +150,7 @@ describe('res', function(){
         request(app)
         .get('/')
         .end(function(err, res){
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+          res.headers.should.have.property('content-type', 'application/json');
           res.text.should.equal('{"name":"tobi"}');
           done();
         })
@@ -217,7 +217,7 @@ describe('res', function(){
       .get('/')
       .end(function(err, res){
         res.statusCode.should.equal(201);
-        res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+        res.headers.should.have.property('content-type', 'application/json');
         res.text.should.equal('{"id":1}');
         done();
       })
@@ -236,7 +236,7 @@ describe('res', function(){
       .get('/')
       .end(function(err, res){
         res.statusCode.should.equal(201);
-        res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+        res.headers.should.have.property('content-type', 'application/json');
         res.text.should.equal('{"id":1}');
         done();
       })
diff --git a/test/res.send.js b/test/res.send.js
index fc3c6ef0f08..54f2bf7eed2 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -139,7 +139,7 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('Content-Type', 'text/plain')
+      .expect('Content-Type', 'text/plain; charset=utf-8')
       .expect('hey')
       .expect(200, done);
     })
@@ -187,7 +187,7 @@ describe('res', function(){
       request(app)
       .get('/')
       .end(function(err, res){
-        res.headers.should.have.property('content-type', 'text/plain');
+        res.headers.should.have.property('content-type', 'text/plain; charset=utf-8');
         res.text.should.equal('hey');
         res.statusCode.should.equal(200);
         done();
@@ -206,7 +206,7 @@ describe('res', function(){
       request(app)
       .get('/')
       .end(function(err, res){
-        res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+        res.headers.should.have.property('content-type', 'application/json');
         res.text.should.equal('{"name":"tobi"}');
         done();
       })
diff --git a/test/res.sendfile.js b/test/res.sendfile.js
index b6ec9833011..cdc869545a6 100644
--- a/test/res.sendfile.js
+++ b/test/res.sendfile.js
@@ -67,7 +67,7 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('Content-Type', 'text/plain')
+      .expect('Content-Type', 'text/plain; charset=utf-8')
       .end(done);
     })
 
diff --git a/test/res.set.js b/test/res.set.js
index 76dcf7fe6f6..92fffc2cc1f 100644
--- a/test/res.set.js
+++ b/test/res.set.js
@@ -9,12 +9,12 @@ describe('res', function(){
       var app = express();
 
       app.use(function(req, res){
-        res.set('Content-Type', 'text/x-foo').end();
+        res.set('Content-Type', 'text/x-foo; charset=utf-8').end();
       });
 
       request(app)
       .get('/')
-      .expect('Content-Type', 'text/x-foo')
+      .expect('Content-Type', 'text/x-foo; charset=utf-8')
       .end(done);
     })
 
@@ -44,6 +44,12 @@ describe('res', function(){
       res.set('ETag', [123, 456]);
       JSON.stringify(res.get('ETag')).should.equal('["123","456"]');
     })
+
+    it('should not set a charset of one is already set', function () {
+      res.headers = {};
+      res.set('Content-Type', 'text/html; charset=lol');
+      res.get('content-type').should.equal('text/html; charset=lol');
+    })
   })
 
   describe('.set(object)', function(){

From 3228fd3cbc6486d1f60fff2789447077834aa9ac Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Fri, 7 Mar 2014 16:33:17 -0800
Subject: [PATCH 0102/1265] remove res.charset support

---
 History.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/History.md b/History.md
index e92fbff8416..06377385c73 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,7 @@
    - `app.router` - is removed
    - `req.accepted*` - use `req.accepts*()` instead
    - `res.location` - relative URL resolution is removed
+   - `res.charset` - include the charset in the content type when using `res.set()`
    - all bundled middleware except `static`
  * change:
    - `app.route` -> `app.mountpath` when mounting an express app in another express app

From 2064f412cbadfe64e84f8a40f3edb0c2a98bb34d Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Fri, 7 Mar 2014 16:46:54 -0800
Subject: [PATCH 0103/1265] remove res.charset usage

---
 lib/response.js    | 12 ++----------
 test/res.format.js |  6 +++---
 2 files changed, 5 insertions(+), 13 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index 76ccf7e3bfb..ffc92a83123 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -106,10 +106,7 @@ res.send = function(body){
       break;
     // string defaulting to html
     case 'string':
-      if (!this.get('Content-Type')) {
-        this.charset = this.charset || 'utf-8';
-        this.type('html');
-      }
+      if (!this.get('Content-Type')) this.type('html');
       break;
     case 'boolean':
     case 'object':
@@ -189,7 +186,6 @@ res.json = function(obj){
   var body = JSON.stringify(obj, replacer, spaces);
 
   // content-type
-  this.charset = this.charset || 'utf-8';
   this.get('Content-Type') || this.set('Content-Type', 'application/json');
 
   return this.send(body);
@@ -233,7 +229,6 @@ res.jsonp = function(obj){
   var callback = this.req.query[app.get('jsonp callback name')];
 
   // content-type
-  this.charset = this.charset || 'utf-8';
   this.set('Content-Type', 'application/json');
 
   // jsonp
@@ -467,10 +462,7 @@ res.format = function(obj){
   this.vary("Accept");
 
   if (key) {
-    var type = normalizeType(key).value;
-    var charset = mime.charsets.lookup(type);
-    if (charset) type += '; charset=' + charset;
-    this.set('Content-Type', type);
+    this.set('Content-Type', normalizeType(key).value);
     obj[key](req, this, next);
   } else if (fn) {
     fn();
diff --git a/test/res.format.js b/test/res.format.js
index b6eb199d4da..5495410cfec 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -93,7 +93,7 @@ function test(app) {
     request(app)
     .get('/')
     .set('Accept', 'text/html; q=.5, text/plain')
-    .expect('Content-Type', 'text/plain; charset=UTF-8')
+    .expect('Content-Type', 'text/plain; charset=utf-8')
     .expect('hey', done);
   })
 
@@ -101,12 +101,12 @@ function test(app) {
     request(app)
     .get('/')
     .set('Accept', 'text/html')
-    .expect('Content-Type', 'text/html; charset=UTF-8');
+    .expect('Content-Type', 'text/html; charset=utf-8');
 
     request(app)
     .get('/')
     .set('Accept', 'text/plain')
-    .expect('Content-Type', 'text/plain; charset=UTF-8');
+    .expect('Content-Type', 'text/plain; charset=utf-8');
 
     request(app)
     .get('/')

From 110f471efa6e08103242d5bbc74e8630cc7ddf0c Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Fri, 7 Mar 2014 18:04:03 -0800
Subject: [PATCH 0104/1265] lint

---
 lib/router/layer.js | 2 +-
 lib/utils.js        | 6 ------
 2 files changed, 1 insertion(+), 7 deletions(-)

diff --git a/lib/router/layer.js b/lib/router/layer.js
index 2a528db1409..0d191b2484b 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -1,4 +1,4 @@
-var utils = require('../utils');
+
 var pathRegexp = require('path-to-regexp');
 var debug = require('debug')('express:router:layer');
 
diff --git a/lib/utils.js b/lib/utils.js
index d30fc5b1d77..c6e098c6d58 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -7,12 +7,6 @@ var mime = require('send').mime;
 var crc32 = require('buffer-crc32');
 var parse = require('url').parse;
 
-/**
- * toString ref.
- */
-
-var toString = {}.toString;
-
 /**
  * Return ETag for `body`.
  *

From 7693aa5464203d7eec896f3751be789327d66a1b Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Fri, 7 Mar 2014 18:27:26 -0800
Subject: [PATCH 0105/1265] use parseurl

---
 lib/middleware/query.js |  2 +-
 lib/request.js          |  3 +--
 lib/router/index.js     |  3 +--
 lib/utils.js            | 25 -------------------------
 package.json            |  1 +
 5 files changed, 4 insertions(+), 30 deletions(-)

diff --git a/lib/middleware/query.js b/lib/middleware/query.js
index 366c0577447..4e9e5f1bb15 100644
--- a/lib/middleware/query.js
+++ b/lib/middleware/query.js
@@ -1,5 +1,5 @@
 var qs = require('qs');
-var parseUrl = require('../utils').parseUrl;
+var parseUrl = require('parseurl');
 
 /**
  * Query:
diff --git a/lib/request.js b/lib/request.js
index e6f45cd87fb..af48083803d 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -9,8 +9,7 @@ var basicAuth = require('basic-auth');
 var http = require('http');
 var fresh = require('fresh');
 var parseRange = require('range-parser');
-var utils = require('./utils');
-var parse = utils.parseUrl;
+var parse = require('parseurl');
 
 /**
  * Request prototype.
diff --git a/lib/router/index.js b/lib/router/index.js
index 7a2d404e298..6e4c8581683 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -4,10 +4,9 @@
 
 var Route = require('./route')
   , Layer = require('./layer')
-  , utils = require('../utils')
   , methods = require('methods')
   , debug = require('debug')('express:router')
-  , parseUrl = utils.parseUrl;
+  , parseUrl = require('parseurl');
 
 /**
  * Initialize a new `Router` with the given `options`.
diff --git a/lib/utils.js b/lib/utils.js
index c6e098c6d58..d6bb4d824e9 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -5,7 +5,6 @@
 
 var mime = require('send').mime;
 var crc32 = require('buffer-crc32');
-var parse = require('url').parse;
 
 /**
  * Return ETag for `body`.
@@ -112,27 +111,3 @@ function acceptParams(str, index) {
 
   return ret;
 }
-
-/**
- * Parse the `req` url with memoization.
- *
- * @param {ServerRequest} req
- * @return {Object}
- * @api private
- */
-
-exports.parseUrl = function(req){
-  var parsed = req._parsedUrl;
-  if (parsed && parsed.href == req.url) {
-    return parsed;
-  } else {
-    parsed = parse(req.url);
-
-    if (parsed.auth && !parsed.protocol && ~parsed.href.indexOf('//')) {
-      // This parses pathnames, and a strange pathname like //r@e should work
-      parsed = parse(req.url.replace(/@/g, '%40'));
-    }
-
-    return req._parsedUrl = parsed;
-  }
-};
diff --git a/package.json b/package.json
index 85711792828..08fb26a9b7e 100644
--- a/package.json
+++ b/package.json
@@ -22,6 +22,7 @@
     }
   ],
   "dependencies": {
+    "parseurl": "1.0.1",
     "basic-auth": "0.0.1",
     "accepts": "1.0.0",
     "type-is": "1.0.0",

From 5e12bab5ccea6f0a0d4b071a74b7519a3109849f Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sun, 9 Mar 2014 22:30:47 -0400
Subject: [PATCH 0106/1265] add better error messages for non-functions as
 middleware

Only functions are supported for [VERB](path, fn), use(path, fn) and
all(fn) calls in Router and Routes. This catches those errors earlier to
avoid checks during actual request processing.
---
 lib/router/index.js | 6 ++++++
 lib/router/route.js | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/lib/router/index.js b/lib/router/index.js
index 6e4c8581683..8b1bbc552e5 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -322,6 +322,12 @@ proto.use = function(route, fn){
     route = '/';
   }
 
+  if (typeof fn !== 'function') {
+    var type = {}.toString.call(fn);
+    var msg = 'Router.use() requires callback functions but got a ' + type;
+    throw new Error(msg);
+  }
+
   // strip trailing slash
   if ('/' == route[route.length - 1]) {
     route = route.slice(0, -1);
diff --git a/lib/router/route.js b/lib/router/route.js
index c9eff0c354c..33b7d4b23cc 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -148,6 +148,12 @@ Route.prototype.all = function(fn){
 
 methods.forEach(function(method){
   Route.prototype[method] = function(fn){
+    if (typeof fn !== 'function') {
+      var type = {}.toString.call(fn);
+      var msg = 'Route.use() requires callback functions but got a ' + type;
+      throw new Error(msg);
+    }
+
     debug('%s %s', method, this.path);
 
     if (!this.methods[method]) {

From 68996d7561f911856dd2fab18e6b5f3def074e0b Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Sun, 9 Mar 2014 19:45:43 -0700
Subject: [PATCH 0107/1265] remove req.auth

---
 History.md       |   1 +
 lib/request.js   |  24 ------------
 package.json     |   1 -
 test/req.auth.js | 100 -----------------------------------------------
 4 files changed, 1 insertion(+), 125 deletions(-)
 delete mode 100644 test/req.auth.js

diff --git a/History.md b/History.md
index 06377385c73..867b9623459 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,7 @@
    - `express.createServer()` - it has been deprecated for a long time. Use `express()`
    - `app.configure` - use logic in your own app code
    - `app.router` - is removed
+   - `req.auth` - use `basic-auth` instead
    - `req.accepted*` - use `req.accepts*()` instead
    - `res.location` - relative URL resolution is removed
    - `res.charset` - include the charset in the content type when using `res.set()`
diff --git a/lib/request.js b/lib/request.js
index af48083803d..73b4c4624f9 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -5,7 +5,6 @@
 
 var accepts = require('accepts');
 var typeis = require('type-is');
-var basicAuth = require('basic-auth');
 var http = require('http');
 var fresh = require('fresh');
 var parseRange = require('range-parser');
@@ -304,29 +303,6 @@ req.__defineGetter__('ips', function(){
     : [];
 });
 
-/**
- * Return basic auth credentials.
- *
- * Examples:
- *
- *    // http://tobi:hello@example.com
- *    req.auth
- *    // => { username: 'tobi', password: 'hello' }
- *
- * @return {Object} or undefined
- * @api public
- */
-
-req.__defineGetter__('auth', function(){
-  var auth = basicAuth(this);
-  if (auth) {
-    // aliases for backwards compatibilty
-    auth.username = auth.name;
-    auth.password = auth.pass;
-  }
-  return auth;
-});
-
 /**
  * Return subdomains as an array.
  *
diff --git a/package.json b/package.json
index 08fb26a9b7e..05ffb29beb2 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,6 @@
   ],
   "dependencies": {
     "parseurl": "1.0.1",
-    "basic-auth": "0.0.1",
     "accepts": "1.0.0",
     "type-is": "1.0.0",
     "range-parser": "1.0.0",
diff --git a/test/req.auth.js b/test/req.auth.js
deleted file mode 100644
index 0a3bda973b0..00000000000
--- a/test/req.auth.js
+++ /dev/null
@@ -1,100 +0,0 @@
-
-var express = require('../')
-  , request = require('supertest');
-
-describe('req', function(){
-  describe('.auth', function(){
-    describe('when Authorization is missing', function(){
-      it('should return undefined', function(done){
-        var app = express();
-
-        app.get('/', function(req, res){
-          res.send(req.auth || 'none');
-        });
-
-        request(app)
-        .get('/')
-        .expect('none', done)
-      })
-    })
-
-    describe('when Authorization is malformed', function(){
-      it('should return undefined', function(done){
-        var app = express();
-
-        app.get('/', function(req, res){
-          res.send(req.auth || 'none');
-        });
-
-        request(app)
-        .get('/')
-        .set('Authorization', 'meow')
-        .expect('none', done)
-      })
-    })
-
-    describe('when Authorization is not Basic', function(){
-      it('should return undefined', function(done){
-        var app = express();
-
-        app.get('/', function(req, res){
-          res.send(req.auth || 'none');
-        });
-
-        request(app)
-        .get('/')
-        .set('Authorization', 'Meow dG9iaTpmZXJyZXQ')
-        .expect('none', done)
-      })
-    })
-
-    describe('when encoded string is malformed', function(){
-      it('should return undefined', function(done){
-        var app = express();
-
-        app.get('/', function(req, res){
-          res.send(req.auth || 'none');
-        });
-
-        request(app)
-        .get('/')
-        .set('Authorization', 'Basic Z21ldGh2aW4=')
-        .expect('none', done)
-      })
-    })
-
-    describe('when password contains a colon', function(){
-      it('should return .username and .password', function(done){
-        var app = express();
-
-        app.get('/', function(req, res){
-          res.send({
-            username: req.auth.username,
-            password: req.auth.password,
-          });
-        });
-
-        request(app)
-        .get('/')
-        .set('Authorization', 'Basic dG9iaTpmZXJyZXQ6ZmVycmV0')
-        .expect('{"username":"tobi","password":"ferret:ferret"}', done)
-      })
-    })
-
-    it('should return .username and .password', function(done){
-      var app = express();
-
-      app.get('/', function(req, res){
-        res.send({
-          username: req.auth.username,
-          password: req.auth.password,
-        });
-      });
-
-      request(app)
-      .get('/')
-      .set('Authorization', 'Basic dG9iaTpmZXJyZXQ=')
-      .expect('{"username":"tobi","password":"ferret"}', done)
-    })
-  })
-})

From 59da745d6c847957a1b35cb47e34036e0dc7db60 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Sun, 9 Mar 2014 19:46:52 -0700
Subject: [PATCH 0108/1265] add @jonathanong and @defunctzombie as contributors

---
 package.json | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/package.json b/package.json
index 05ffb29beb2..3af218f6a41 100644
--- a/package.json
+++ b/package.json
@@ -19,6 +19,14 @@
     {
       "name": "Guillermo Rauch",
       "email": "rauchg@gmail.com"
+    },
+    {
+      "name": "Jonathan Ong",
+      "email": "me@jongleberry.com"
+    },
+    {
+      "name": "Roman Shtylman",
+      "email": "shtylman+www@gmail.com"
     }
   ],
   "dependencies": {

From 76147c78a15904d4e4e469095a29d1bec9775ab6 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sun, 9 Mar 2014 22:49:33 -0400
Subject: [PATCH 0109/1265] change my contributor email to tag with expressjs

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 3af218f6a41..815528769ea 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     },
     {
       "name": "Roman Shtylman",
-      "email": "shtylman+www@gmail.com"
+      "email": "shtylman+expressjs@gmail.com"
     }
   ],
   "dependencies": {

From be52dbbaa1bb8a096ce5cfd55afe014935284406 Mon Sep 17 00:00:00 2001
From: Blake Embrey <hello@blakeembrey.com>
Date: Mon, 10 Mar 2014 13:13:39 -0400
Subject: [PATCH 0110/1265] Allow dynamic mounting with `.use`.

Retains params from the parent application.
---
 lib/router/index.js | 10 +++++++---
 lib/router/layer.js |  4 ++--
 package.json        |  2 +-
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/lib/router/index.js b/lib/router/index.js
index 8b1bbc552e5..cc50f7564c0 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -183,7 +183,11 @@ proto.handle = function(req, res, done) {
         }
       }
 
-      req.params = layer.params;
+      req.params = req.params || {};
+
+      for (var key in layer.params) {
+        req.params[key] = layer.params[key];
+      }
 
       // this should be done for the layer
       return self.process_params(layer, req, res, function(err) {
@@ -244,10 +248,10 @@ proto.process_params = function(route, req, res, done) {
   var params = this.params;
 
   // captured parameters from the route, keys and values
-  var keys = route.keys || [];
+  var keys = route.keys;
 
   // fast track
-  if (keys.length === 0) {
+  if (!keys || keys.length === 0) {
     return done();
   }
 
diff --git a/lib/router/layer.js b/lib/router/layer.js
index 0d191b2484b..e07dfb5c52b 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -9,8 +9,6 @@ function Layer(path, options, fn) {
 
   debug('new %s', path);
   options = options || {};
-  this.path = path;
-  this.params = {};
   this.regexp = pathRegexp(path, this.keys = [], options);
   this.handle = fn;
 }
@@ -34,6 +32,8 @@ Layer.prototype.match = function(path){
 
   if (!m) return false;
 
+  this.path = m[0];
+
   for (var i = 1, len = m.length; i < len; ++i) {
     key = keys[i - 1];
 
diff --git a/package.json b/package.json
index 815528769ea..8105478a38d 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "escape-html": "1.0.1",
     "qs": "0.6.6",
     "serve-static": "1.0.1",
-    "path-to-regexp": "0.1.0",
+    "path-to-regexp": "0.1.2",
     "debug": ">= 0.7.3 < 1"
   },
   "devDependencies": {

From 51e80ffd481ca8af8c0d44a1c13b9b4b53c938f5 Mon Sep 17 00:00:00 2001
From: Blake Embrey <hello@blakeembrey.com>
Date: Mon, 10 Mar 2014 13:16:39 -0400
Subject: [PATCH 0111/1265] Add tests for dynamic mounting.

---
 test/Router.js    | 14 ++++++++++++++
 test/app.route.js | 13 +++++++++++++
 test/app.use.js   | 15 +++++++++++++++
 3 files changed, 42 insertions(+)

diff --git a/test/Router.js b/test/Router.js
index 30d8b5a46d1..0a2b5b66df7 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -30,6 +30,20 @@ describe('Router', function(){
     router.handle({ url: '/foo/bar', method: 'GET' }, { done: done });
   });
 
+  it('should support dynamic routes', function(done){
+    var router = new Router();
+    var another = new Router();
+
+    another.get('/:bar', function(req, res){
+      req.params.foo.should.equal('test');
+      req.params.bar.should.equal('route');
+      res.end();
+    });
+    router.use('/:foo', another);
+
+    router.handle({ url: '/test/route', method: 'GET' }, { end: done });
+  });
+
   describe('.handle', function(){
     it('should dispatch', function(done){
       var router = new Router();
diff --git a/test/app.route.js b/test/app.route.js
index 3113cac6202..8675b4e184b 100644
--- a/test/app.route.js
+++ b/test/app.route.js
@@ -36,4 +36,17 @@ describe('app.route', function(){
     .post('/foo')
     .expect('post', done);
   });
+
+  it('should support dynamic routes', function(done){
+    var app = express();
+
+    app.route('/:foo')
+    .get(function(req, res) {
+      res.send(req.params.foo);
+    });
+
+    request(app)
+    .get('/test')
+    .expect('test', done);
+  });
 });
diff --git a/test/app.use.js b/test/app.use.js
index d627bdfe658..074a08c9a0d 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -63,5 +63,20 @@ describe('app', function(){
       app.use('/blog', blog);
       blog.parent.should.equal(app);
     })
+
+    it('should support dynamic routes', function(done){
+      var blog = express()
+        , app = express();
+
+      blog.get('/', function(req, res){
+        res.end(req.params.article);
+      });
+
+      app.use('/post/:article', blog);
+
+      request(app)
+      .get('/post/once-upon-a-time')
+      .expect('once-upon-a-time', done);
+    })
   })
 })

From 9ae1d0d22def9b905a3dc77506b853457be911b9 Mon Sep 17 00:00:00 2001
From: Blake Embrey <hello@blakeembrey.com>
Date: Mon, 10 Mar 2014 13:18:23 -0400
Subject: [PATCH 0112/1265] Remove redundant `.all` function.

---
 lib/router/index.js | 19 +------------------
 1 file changed, 1 insertion(+), 18 deletions(-)

diff --git a/lib/router/index.js b/lib/router/index.js
index cc50f7564c0..e7c67ce5d2b 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -378,25 +378,8 @@ proto.route = function(path){
   return route;
 };
 
-/**
- * Special-cased "all" method, applying the given route `path`,
- * middleware, and callback to _every_ HTTP method.
- *
- * @param {String} path
- * @param {Function} ...
- * @return {app} for chaining
- * @api public
- */
-
-proto.all = function(path, fn) {
-  var route = this.route(path);
-  methods.forEach(function(method){
-    route[method](fn);
-  });
-};
-
 // create Router#VERB functions
-methods.forEach(function(method){
+methods.concat('all').forEach(function(method){
   proto[method] = function(path, fn){
     var self = this;
     self.route(path)[method](fn);

From c7e84d804450b1799611191d6aed12b44dc8201c Mon Sep 17 00:00:00 2001
From: Blake Embrey <hello@blakeembrey.com>
Date: Mon, 10 Mar 2014 13:19:03 -0400
Subject: [PATCH 0113/1265] Clean up code and syntax issues.

---
 lib/router/index.js | 12 +++++-------
 lib/router/route.js |  4 ++--
 test/Router.js      | 13 ++++++-------
 3 files changed, 13 insertions(+), 16 deletions(-)

diff --git a/lib/router/index.js b/lib/router/index.js
index e7c67ce5d2b..b528df256ce 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -170,7 +170,7 @@ proto.handle = function(req, res, done) {
 
       // if final route, then we support options
       if (route) {
-        // we don't run any routs with error first
+        // we don't run any routes with error first
         if (err) {
           return next(err);
         }
@@ -319,7 +319,6 @@ proto.process_params = function(route, req, res, done) {
  */
 
 proto.use = function(route, fn){
-
   // default route to '/'
   if ('string' != typeof route) {
     fn = route;
@@ -337,7 +336,7 @@ proto.use = function(route, fn){
     route = route.slice(0, -1);
   }
 
-  var layer = Layer(route, {
+  var layer = new Layer(route, {
     sensitive: this.caseSensitive,
     strict: this.strict,
     end: false
@@ -366,7 +365,7 @@ proto.use = function(route, fn){
 proto.route = function(path){
   var route = new Route(path);
 
-  var layer = Layer(path, {
+  var layer = new Layer(path, {
     sensitive: this.caseSensitive,
     strict: this.strict,
     end: true
@@ -381,9 +380,8 @@ proto.route = function(path){
 // create Router#VERB functions
 methods.concat('all').forEach(function(method){
   proto[method] = function(path, fn){
-    var self = this;
-    self.route(path)[method](fn);
-    return self;
+    this.route(path)[method](fn);
+    return this;
   };
 });
 
diff --git a/lib/router/route.js b/lib/router/route.js
index 33b7d4b23cc..c3ad2c51f80 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -129,7 +129,7 @@ Route.prototype.dispatch = function(req, res, done){
 Route.prototype.all = function(fn){
   if (typeof fn !== 'function') {
     var type = {}.toString.call(fn);
-    var msg = 'Route.use() requires callback functions but got a ' + type;
+    var msg = 'Route.all() requires callback functions but got a ' + type;
     throw new Error(msg);
   }
 
@@ -150,7 +150,7 @@ methods.forEach(function(method){
   Route.prototype[method] = function(fn){
     if (typeof fn !== 'function') {
       var type = {}.toString.call(fn);
-      var msg = 'Route.use() requires callback functions but got a ' + type;
+      var msg = 'Route.' + method + '() requires callback functions but got a ' + type;
       throw new Error(msg);
     }
 
diff --git a/test/Router.js b/test/Router.js
index 0a2b5b66df7..8f8ff44d4d1 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -5,7 +5,6 @@ var express = require('../')
   , assert = require('assert');
 
 describe('Router', function(){
-
   it('should return a function with router methods', function() {
     var router = Router();
     assert(typeof router == 'function');
@@ -18,16 +17,16 @@ describe('Router', function(){
     assert(typeof router.use == 'function');
   });
 
-  it('should support .use of other routers', function(done) {
-    var router = Router();
-    var another = Router();
+  it('should support .use of other routers', function(done){
+    var router = new Router();
+    var another = new Router();
 
-    another.get('/bar', function(req, res) {
-      res.done();
+    another.get('/bar', function(req, res){
+      res.end();
     });
     router.use('/foo', another);
 
-    router.handle({ url: '/foo/bar', method: 'GET' }, { done: done });
+    router.handle({ url: '/foo/bar', method: 'GET' }, { end: done });
   });
 
   it('should support dynamic routes', function(done){

From 3bbcbfdcf9f050255a0cc80499c2fef51fe193fa Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Tue, 11 Mar 2014 21:39:01 -0400
Subject: [PATCH 0114/1265] 4.0.0-rc3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 815528769ea..c1942685cd0 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.0.0-rc2",
+  "version": "4.0.0-rc3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From 3ea3250dbe7e0def1311e1a5bbdd44b9f34cf33b Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Wed, 12 Mar 2014 10:27:10 -0400
Subject: [PATCH 0115/1265] examples: remove reference to app.router in
 static-files

closes #1974
---
 examples/static-files/index.js | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/examples/static-files/index.js b/examples/static-files/index.js
index 1f60d446ccb..597ed2318aa 100644
--- a/examples/static-files/index.js
+++ b/examples/static-files/index.js
@@ -29,14 +29,6 @@ app.use('/static', express.static(__dirname + '/public'));
 // this will allow "GET /style.css" instead of "GET /css/style.css":
 app.use(express.static(__dirname + '/public/css'));
 
-// this examples does not have any routes, however
-// you may `app.use(app.router)` before or after these
-// static() middleware. If placed before them your routes
-// will be matched BEFORE file serving takes place. If placed
-// after as shown here then file serving is performed BEFORE
-// any routes are hit:
-app.use(app.router);
-
 app.listen(3000);
 console.log('listening on port 3000');
 console.log('try:');

From 8bd5d54b0e1d518ec7e9b8f9368c8393b8d59aee Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Thu, 13 Mar 2014 16:27:34 -0400
Subject: [PATCH 0116/1265] update license year, tired of all the fluff issues
 about this

---
 LICENSE | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/LICENSE b/LICENSE
index d23e93ce9a5..0f3c7678929 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,6 +1,6 @@
 (The MIT License)
 
-Copyright (c) 2009-2013 TJ Holowaychuk <tj@vision-media.ca>
+Copyright (c) 2009-2014 TJ Holowaychuk <tj@vision-media.ca>
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -19,4 +19,4 @@ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
 CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
\ No newline at end of file
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

From 8e3d0a6569f82662903523d1831fbc58ea3fe877 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Thu, 13 Mar 2014 20:20:04 -0400
Subject: [PATCH 0117/1265] remove license text from readme

---
 Readme.md | 23 +----------------------
 1 file changed, 1 insertion(+), 22 deletions(-)

diff --git a/Readme.md b/Readme.md
index 5bf0fb5338c..a2821b847f6 100644
--- a/Readme.md
+++ b/Readme.md
@@ -106,25 +106,4 @@ Then run the tests:
 
 ## License
 
-(The MIT License)
-
-Copyright (c) 2009-2012 TJ Holowaychuk &lt;tj@vision-media.ca&gt;
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+MIT

From efbe1779e370a8cd7409dde569607e5e1e818f2c Mon Sep 17 00:00:00 2001
From: Blake Embrey <hello@blakeembrey.com>
Date: Mon, 17 Mar 2014 15:01:04 -0300
Subject: [PATCH 0118/1265] Override params every layer.

---
 lib/router/index.js | 6 +-----
 test/Router.js      | 1 -
 test/app.use.js     | 4 ++--
 3 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/lib/router/index.js b/lib/router/index.js
index b528df256ce..74183e20c0f 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -183,11 +183,7 @@ proto.handle = function(req, res, done) {
         }
       }
 
-      req.params = req.params || {};
-
-      for (var key in layer.params) {
-        req.params[key] = layer.params[key];
-      }
+      req.params = layer.params;
 
       // this should be done for the layer
       return self.process_params(layer, req, res, function(err) {
diff --git a/test/Router.js b/test/Router.js
index 8f8ff44d4d1..c2058c5b8c3 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -34,7 +34,6 @@ describe('Router', function(){
     var another = new Router();
 
     another.get('/:bar', function(req, res){
-      req.params.foo.should.equal('test');
       req.params.bar.should.equal('route');
       res.end();
     });
diff --git a/test/app.use.js b/test/app.use.js
index 074a08c9a0d..6ebd4eda13c 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -69,14 +69,14 @@ describe('app', function(){
         , app = express();
 
       blog.get('/', function(req, res){
-        res.end(req.params.article);
+        res.end('success');
       });
 
       app.use('/post/:article', blog);
 
       request(app)
       .get('/post/once-upon-a-time')
-      .expect('once-upon-a-time', done);
+      .expect('success', done);
     })
   })
 })

From cb1fbce46b078dff2da0aab4dcf1d3c2ce840e24 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sun, 23 Mar 2014 14:42:46 -0400
Subject: [PATCH 0119/1265] don't call done twice for thrown errors inside
 parameterized routes

fixes #1995
---
 lib/router/index.js |  2 +-
 test/Router.js      | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/lib/router/index.js b/lib/router/index.js
index 74183e20c0f..e41f5f1f9c2 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -280,7 +280,7 @@ proto.process_params = function(route, req, res, done) {
         return param();
       }
     } catch (err) {
-      done(err);
+      return done(err);
     }
 
     done();
diff --git a/test/Router.js b/test/Router.js
index c2058c5b8c3..55f6bcff857 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -111,6 +111,25 @@ describe('Router', function(){
 
       router.handle({ url: '/foo', method: 'GET' }, {}, done);
     });
+
+    it('should handle throwing inside routes with params', function(done) {
+      var router = new Router();
+
+      router.get('/foo/:id', function(req, res, next){
+        throw new Error('foo');
+      });
+
+      router.use(function(req, res, next){
+        assert(false);
+      });
+
+      router.use(function(err, req, res, next){
+        assert.equal(err.message, 'foo');
+        done();
+      });
+
+      router.handle({ url: '/foo/2', method: 'GET' }, {}, done);
+    });
   })
 
   describe('.all', function() {

From 6b19e3dc0a3b303c541708860a6f9de2ae281b9d Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sun, 23 Mar 2014 21:07:37 -0400
Subject: [PATCH 0120/1265] remove deprecation message about passing path as
 array

---
 lib/application.js | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/lib/application.js b/lib/application.js
index 0a20118c13e..2872bf1b491 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -402,11 +402,6 @@ methods.forEach(function(method){
 
     this.lazyrouter();
 
-    // deprecated
-    if (Array.isArray(path)) {
-      console.trace('passing an array to app.VERB() is deprecated and will be removed in 4.0');
-    }
-
     var route = this._router.route(path);
     for (var i=1 ; i<arguments.length ; ++i) {
       route[method](arguments[i]);

From 1eba854f23ee050fe36ee979177761def8226ea5 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sun, 23 Mar 2014 21:29:59 -0400
Subject: [PATCH 0121/1265] support arrays as middleware arguments to .VERB and
 .all

Express 3.x supported passing in arrays for sets of common middleware.
While there are better ways to do this, removing this feature causes
headache in upgrading for no real gain. We can support it without much
more code.
---
 lib/application.js  | 10 ++----
 lib/router/index.js |  5 +--
 lib/router/route.js | 78 +++++++++++++++++++++++++--------------------
 3 files changed, 50 insertions(+), 43 deletions(-)

diff --git a/lib/application.js b/lib/application.js
index 2872bf1b491..47fa0e308d0 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -403,9 +403,7 @@ methods.forEach(function(method){
     this.lazyrouter();
 
     var route = this._router.route(path);
-    for (var i=1 ; i<arguments.length ; ++i) {
-      route[method](arguments[i]);
-    }
+    route[method].apply(route, [].slice.call(arguments, 1));
     return this;
   };
 });
@@ -424,11 +422,9 @@ app.all = function(path){
   this.lazyrouter();
 
   var route = this._router.route(path);
-  var args = arguments;
+  var args = [].slice.call(arguments, 1);
   methods.forEach(function(method){
-    for (var i=1 ; i<args.length ; ++i) {
-      route[method](args[i]);
-    }
+    route[method].apply(route, args);
   });
 
   return this;
diff --git a/lib/router/index.js b/lib/router/index.js
index e41f5f1f9c2..bf4d2b32549 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -375,8 +375,9 @@ proto.route = function(path){
 
 // create Router#VERB functions
 methods.concat('all').forEach(function(method){
-  proto[method] = function(path, fn){
-    this.route(path)[method](fn);
+  proto[method] = function(path){
+    var route = this.route(path)
+    route[method].apply(route, [].slice.call(arguments, 1));
     return this;
   };
 });
diff --git a/lib/router/route.js b/lib/router/route.js
index c3ad2c51f80..524afe70d45 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -5,6 +5,7 @@
 
 var debug = require('debug')('express:router:route')
   , methods = require('methods')
+  , utils = require('../utils')
 
 /**
  * Expose `Route`.
@@ -126,48 +127,57 @@ Route.prototype.dispatch = function(req, res, done){
  * @api public
  */
 
-Route.prototype.all = function(fn){
-  if (typeof fn !== 'function') {
-    var type = {}.toString.call(fn);
-    var msg = 'Route.all() requires callback functions but got a ' + type;
-    throw new Error(msg);
-  }
-
-  if (!this.stack) {
-    this.stack = fn;
-  }
-  else if (typeof this.stack === 'function') {
-    this.stack = [{ handle: this.stack }, { handle: fn }];
-  }
-  else {
-    this.stack.push({ handle: fn });
-  }
-
-  return this;
-};
-
-methods.forEach(function(method){
-  Route.prototype[method] = function(fn){
+Route.prototype.all = function(){
+  var self = this;
+  var callbacks = utils.flatten([].slice.call(arguments));
+  callbacks.forEach(function(fn) {
     if (typeof fn !== 'function') {
       var type = {}.toString.call(fn);
-      var msg = 'Route.' + method + '() requires callback functions but got a ' + type;
+      var msg = 'Route.all() requires callback functions but got a ' + type;
       throw new Error(msg);
     }
 
-    debug('%s %s', method, this.path);
-
-    if (!this.methods[method]) {
-      this.methods[method] = true;
+    if (!self.stack) {
+      self.stack = fn;
     }
-
-    if (!this.stack) {
-      this.stack = [];
+    else if (typeof self.stack === 'function') {
+      self.stack = [{ handle: self.stack }, { handle: fn }];
     }
-    else if (typeof this.stack === 'function') {
-      this.stack = [{ handle: this.stack }];
+    else {
+      self.stack.push({ handle: fn });
     }
+  });
+
+  return self;
+};
+
+methods.forEach(function(method){
+  Route.prototype[method] = function(){
+    var self = this;
+    var callbacks = utils.flatten([].slice.call(arguments));
+
+    callbacks.forEach(function(fn) {
+      if (typeof fn !== 'function') {
+        var type = {}.toString.call(fn);
+        var msg = 'Route.' + method + '() requires callback functions but got a ' + type;
+        throw new Error(msg);
+      }
+
+      debug('%s %s', method, self.path);
+
+      if (!self.methods[method]) {
+        self.methods[method] = true;
+      }
+
+      if (!self.stack) {
+        self.stack = [];
+      }
+      else if (typeof self.stack === 'function') {
+        self.stack = [{ handle: self.stack }];
+      }
 
-    this.stack.push({ method: method, handle: fn })
-    return this;
+      self.stack.push({ method: method, handle: fn })
+    });
+    return self;
   };
 });

From e36746363aeee402c0d85b6ad8b4035922174c95 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Mon, 24 Mar 2014 22:53:35 -0400
Subject: [PATCH 0122/1265] 4.0.0-rc4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index bb96a66cb50..1807c73e5f9 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.0.0-rc3",
+  "version": "4.0.0-rc4",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From abd6b7c5c338ad1aa58c46ca95ba139cf3b5ac97 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Tue, 25 Mar 2014 16:55:57 -0400
Subject: [PATCH 0123/1265] pin down less-middleware

Things are broken in 0.2 version of less-middleware so use 0.1 line
---
 bin/express | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/express b/bin/express
index cb979288397..ad0d64a810d 100755
--- a/bin/express
+++ b/bin/express
@@ -357,7 +357,7 @@ function createApplicationAt(path) {
     // CSS Engine support
     switch (program.css) {
       case 'less':
-        pkg.dependencies['less-middleware'] = '*';
+        pkg.dependencies['less-middleware'] = '~0.1.15';
         break;
       default:
         if (program.css) {

From df50669092d3de0ec4bd041aabb3b2a4d2954e01 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Tue, 25 Mar 2014 16:56:54 -0400
Subject: [PATCH 0124/1265] 3.5.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 80122cefc60..352f4d9b239 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.5.0",
+  "version": "3.5.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From 13475977af6ef4c1409ca473566349c3242b14cf Mon Sep 17 00:00:00 2001
From: agchou <aarongchou@gmail.com>
Date: Tue, 25 Mar 2014 15:23:04 -0700
Subject: [PATCH 0125/1265] some code cleanup

---
 lib/application.js      | 26 +++++++++++++-------------
 lib/express.js          | 10 +++++-----
 lib/middleware/init.js  |  2 +-
 lib/middleware/query.js |  4 ++++
 lib/request.js          |  1 -
 lib/response.js         | 29 +++++++++++++++--------------
 lib/router/index.js     | 17 ++++++++---------
 lib/router/layer.js     | 19 +++++++++++++------
 lib/router/route.js     |  9 ++++-----
 lib/utils.js            |  6 ++----
 lib/view.js             | 16 ++++++++--------
 11 files changed, 73 insertions(+), 66 deletions(-)

diff --git a/lib/application.js b/lib/application.js
index 47fa0e308d0..c12b8f1503e 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -2,15 +2,15 @@
  * Module dependencies.
  */
 
-var mixin = require('utils-merge')
-  , escapeHtml = require('escape-html')
-  , Router = require('./router')
-  , methods = require('methods')
-  , middleware = require('./middleware/init')
-  , query = require('./middleware/query')
-  , debug = require('debug')('express:application')
-  , View = require('./view')
-  , http = require('http');
+var mixin = require('utils-merge');
+var escapeHtml = require('escape-html');
+var Router = require('./router');
+var methods = require('methods');
+var middleware = require('./middleware/init');
+var query = require('./middleware/query');
+var debug = require('debug')('express:application');
+var View = require('./view');
+var http = require('http');
 
 /**
  * Application prototype.
@@ -452,10 +452,10 @@ app.del = app.delete;
  */
 
 app.render = function(name, options, fn){
-  var opts = {}
-    , cache = this.cache
-    , engines = this.engines
-    , view;
+  var opts = {};
+  var cache = this.cache;
+  var engines = this.engines;
+  var view;
 
   // support callback function as second arg
   if ('function' == typeof options) {
diff --git a/lib/express.js b/lib/express.js
index 3a8fa29563d..aa7dd557c06 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -4,11 +4,11 @@
 
 var EventEmitter = require('events').EventEmitter;
 var mixin = require('utils-merge');
-var proto = require('./application')
-  , Route = require('./router/route')
-  , Router = require('./router')
-  , req = require('./request')
-  , res = require('./response');
+var proto = require('./application');
+var Route = require('./router/route');
+var Router = require('./router');
+var req = require('./request');
+var res = require('./response');
 
 /**
  * Expose `createApplication()`.
diff --git a/lib/middleware/init.js b/lib/middleware/init.js
index 8e8decfbbd5..c09cf0c69c4 100644
--- a/lib/middleware/init.js
+++ b/lib/middleware/init.js
@@ -21,6 +21,6 @@ exports.init = function(app){
     res.locals = res.locals || Object.create(null);
 
     next();
-  }
+  };
 };
 
diff --git a/lib/middleware/query.js b/lib/middleware/query.js
index 4e9e5f1bb15..b828c85ef08 100644
--- a/lib/middleware/query.js
+++ b/lib/middleware/query.js
@@ -1,3 +1,7 @@
+/**
+ * Module dependencies.
+ */
+
 var qs = require('qs');
 var parseUrl = require('parseurl');
 
diff --git a/lib/request.js b/lib/request.js
index 73b4c4624f9..82e0fb113bc 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -1,4 +1,3 @@
-
 /**
  * Module dependencies.
  */
diff --git a/lib/response.js b/lib/response.js
index ffc92a83123..317b8b31a94 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -283,11 +283,12 @@ res.jsonp = function(obj){
  */
 
 res.sendfile = function(path, options, fn){
-  var self = this
-    , req = self.req
-    , next = this.req.next
-    , options = options || {}
-    , done;
+  options = options || {};
+  var self = this;
+  var req = self.req;
+  var next = this.req.next;
+  var done;
+
 
   // support function as second arg
   if ('function' == typeof options) {
@@ -450,8 +451,8 @@ res.type = function(type){
  */
 
 res.format = function(obj){
-  var req = this.req
-    , next = req.next;
+  var req = this.req;
+  var next = req.next;
 
   var fn = obj.default;
   if (fn) delete obj.default;
@@ -658,9 +659,9 @@ res.location = function(url){
  */
 
 res.redirect = function(url){
-  var head = 'HEAD' == this.req.method
-    , status = 302
-    , body;
+  var head = 'HEAD' == this.req.method;
+  var status = 302;
+  var body;
 
   // allow status / url
   if (2 == arguments.length) {
@@ -753,10 +754,10 @@ res.vary = function(field){
  */
 
 res.render = function(view, options, fn){
-  var self = this
-    , options = options || {}
-    , req = this.req
-    , app = req.app;
+  options = options || {};
+  var self = this;
+  var req = this.req;
+  var app = req.app;
 
   // support callback function as second arg
   if ('function' == typeof options) {
diff --git a/lib/router/index.js b/lib/router/index.js
index bf4d2b32549..7c17884c924 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -2,11 +2,11 @@
  * Module dependencies.
  */
 
-var Route = require('./route')
-  , Layer = require('./layer')
-  , methods = require('methods')
-  , debug = require('debug')('express:router')
-  , parseUrl = require('parseurl');
+var Route = require('./route');
+var Layer = require('./layer');
+var methods = require('methods');
+var debug = require('debug')('express:router');
+var parseUrl = require('parseurl');
 
 /**
  * Initialize a new `Router` with the given `options`.
@@ -77,9 +77,9 @@ proto.param = function(name, fn){
   }
 
   // apply param functions
-  var params = this._params
-    , len = params.length
-    , ret;
+  var params = this._params;
+  var len = params.length;
+  var ret;
 
   if (name[0] === ':') {
     name = name.substr(1);
@@ -381,4 +381,3 @@ methods.concat('all').forEach(function(method){
     return this;
   };
 });
-
diff --git a/lib/router/layer.js b/lib/router/layer.js
index e07dfb5c52b..2dcb288b2f9 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -1,7 +1,16 @@
+/**
+ * Module dependencies.
+ */
 
 var pathRegexp = require('path-to-regexp');
 var debug = require('debug')('express:router:layer');
 
+/**
+ * Expose `Layer`.
+ */
+
+module.exports = Layer;
+
 function Layer(path, options, fn) {
   if (!(this instanceof Layer)) {
     return new Layer(path, options, fn);
@@ -23,10 +32,10 @@ function Layer(path, options, fn) {
  */
 
 Layer.prototype.match = function(path){
-  var keys = this.keys
-    , params = this.params = {}
-    , m = this.regexp.exec(path)
-    , n = 0;
+  var keys = this.keys;
+  var params = this.params = {};
+  var m = this.regexp.exec(path);
+  var n = 0;
   var key;
   var val;
 
@@ -56,5 +65,3 @@ Layer.prototype.match = function(path){
 
   return true;
 };
-
-module.exports = Layer;
diff --git a/lib/router/route.js b/lib/router/route.js
index 524afe70d45..c592c37ca08 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -1,11 +1,10 @@
-
 /**
  * Module dependencies.
  */
 
-var debug = require('debug')('express:router:route')
-  , methods = require('methods')
-  , utils = require('../utils')
+var debug = require('debug')('express:router:route');
+var methods = require('methods');
+var utils = require('../utils');
 
 /**
  * Expose `Route`.
@@ -176,7 +175,7 @@ methods.forEach(function(method){
         self.stack = [{ handle: self.stack }];
       }
 
-      self.stack.push({ method: method, handle: fn })
+      self.stack.push({ method: method, handle: fn });
     });
     return self;
   };
diff --git a/lib/utils.js b/lib/utils.js
index d6bb4d824e9..ce725a2dc78 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -1,4 +1,3 @@
-
 /**
  * Module dependencies.
  */
@@ -41,8 +40,8 @@ exports.isAbsolute = function(path){
  */
 
 exports.flatten = function(arr, ret){
-  var ret = ret || []
-    , len = arr.length;
+  ret = ret || [];
+  var len = arr.length;
   for (var i = 0; i < len; ++i) {
     if (Array.isArray(arr[i])) {
       exports.flatten(arr[i], ret);
@@ -85,7 +84,6 @@ exports.normalizeTypes = function(types){
   return ret;
 };
 
-
 /**
  * Parse accept params `str` returning an
  * object with `.value`, `.quality` and `.params`.
diff --git a/lib/view.js b/lib/view.js
index b9dc69e0e4d..989e8bb251d 100644
--- a/lib/view.js
+++ b/lib/view.js
@@ -2,14 +2,14 @@
  * Module dependencies.
  */
 
-var path = require('path')
-  , fs = require('fs')
-  , utils = require('./utils')
-  , dirname = path.dirname
-  , basename = path.basename
-  , extname = path.extname
-  , exists = fs.existsSync || path.existsSync
-  , join = path.join;
+var path = require('path');
+var fs = require('fs');
+var utils = require('./utils');
+var dirname = path.dirname;
+var basename = path.basename;
+var extname = path.extname;
+var exists = fs.existsSync || path.existsSync;
+var join = path.join;
 
 /**
  * Expose `View`.

From 06dcb22ae22b1346d3b6e207799c0d92fdd42617 Mon Sep 17 00:00:00 2001
From: agchou <aarongchou@gmail.com>
Date: Thu, 27 Mar 2014 09:15:27 -0700
Subject: [PATCH 0126/1265] clean up code consistency

---
 examples/auth/app.js                       | 20 ++++++++++----------
 examples/big-view/index.js                 |  9 ++++++---
 examples/content-negotiation/db.js         |  1 -
 examples/content-negotiation/index.js      | 12 ++++++------
 examples/cookie-sessions/index.js          |  1 -
 examples/cookies/app.js                    | 14 ++++++--------
 examples/cors/index.js                     | 10 +++++-----
 examples/downloads/app.js                  |  9 ++++-----
 examples/ejs/index.js                      |  1 -
 examples/error-pages/index.js              | 10 +++++-----
 examples/error/index.js                    |  9 ++++-----
 examples/expose-data-to-client/index.js    |  8 ++++----
 examples/hello-world/index.js              |  1 -
 examples/jade/index.js                     |  1 -
 examples/markdown/index.js                 | 15 +++++++--------
 examples/multipart/index.js                | 11 +++++------
 examples/mvc/controllers/main/index.js     |  1 -
 examples/mvc/controllers/pet/index.js      |  3 +++
 examples/mvc/controllers/user-pet/index.js |  3 +++
 examples/mvc/controllers/user/index.js     |  5 ++++-
 examples/mvc/db.js                         |  1 -
 examples/mvc/index.js                      |  4 ++++
 examples/mvc/lib/boot.js                   | 19 +++++++++++--------
 examples/online/index.js                   |  9 ++++-----
 examples/params/app.js                     | 13 ++++++-------
 examples/resource/app.js                   |  9 ++++-----
 examples/route-map/index.js                | 11 ++++++++---
 examples/route-separation/index.js         | 17 ++++++++---------
 examples/route-separation/post.js          |  1 -
 examples/route-separation/site.js          |  1 -
 examples/route-separation/user.js          |  1 -
 examples/search/client.js                  |  1 -
 examples/search/index.js                   |  8 ++++----
 examples/session/index.js                  |  1 -
 examples/session/redis.js                  |  4 +++-
 examples/static-files/index.js             |  3 +++
 examples/vhost/index.js                    |  4 ++--
 examples/view-constructor/github-view.js   |  7 +++----
 examples/view-constructor/index.js         | 17 ++++++++---------
 examples/view-locals/index.js              | 11 +++++++----
 examples/view-locals/user.js               |  1 -
 examples/web-service/index.js              |  5 ++---
 42 files changed, 149 insertions(+), 143 deletions(-)

diff --git a/examples/auth/app.js b/examples/auth/app.js
index 301ed6c8e28..243d9d927b9 100644
--- a/examples/auth/app.js
+++ b/examples/auth/app.js
@@ -2,11 +2,11 @@
  * Module dependencies.
  */
 
-var express = require('../..')
-  , hash = require('./pass').hash
-  , bodyParser = require('body-parser')
-  , cookieParser = require('cookie-parser')
-  , session = require('express-session')
+var express = require('../..');
+var hash = require('./pass').hash;
+var bodyParser = require('body-parser');
+var cookieParser = require('cookie-parser');
+var session = require('express-session');
 
 var app = module.exports = express();
 
@@ -24,8 +24,8 @@ app.use(session());
 // Session-persisted message middleware
 
 app.use(function(req, res, next){
-  var err = req.session.error
-    , msg = req.session.success;
+  var err = req.session.error;
+  var msg = req.session.success;
   delete req.session.error;
   delete req.session.success;
   res.locals.message = '';
@@ -65,7 +65,7 @@ function authenticate(name, pass, fn) {
     if (err) return fn(err);
     if (hash == user.hash) return fn(null, user);
     fn(new Error('invalid password'));
-  })
+  });
 }
 
 function restrict(req, res, next) {
@@ -101,9 +101,9 @@ app.post('/login', function(req, res){
   authenticate(req.body.username, req.body.password, function(err, user){
     if (user) {
       // Regenerate session when signing in
-      // to prevent fixation 
+      // to prevent fixation
       req.session.regenerate(function(){
-        // Store the user's primary key 
+        // Store the user's primary key
         // in the session store to be retrieved,
         // or in this case the entire user object
         req.session.user = user;
diff --git a/examples/big-view/index.js b/examples/big-view/index.js
index 451aa4c3cce..b99ffcef5e5 100644
--- a/examples/big-view/index.js
+++ b/examples/big-view/index.js
@@ -1,7 +1,10 @@
+/**
+ * Module dependencies.
+ */
 
-var express = require('../..')
-  , logger = require('morgan')
-  , app = express();
+var express = require('../..');
+var logger = require('morgan');
+var app = express();
 
 app.set('views', __dirname);
 app.set('view engine', 'jade');
diff --git a/examples/content-negotiation/db.js b/examples/content-negotiation/db.js
index 89d007dd6bf..8def2f5ad21 100644
--- a/examples/content-negotiation/db.js
+++ b/examples/content-negotiation/db.js
@@ -1,4 +1,3 @@
-
 var users = [];
 
 users.push({ name: 'Tobi' });
diff --git a/examples/content-negotiation/index.js b/examples/content-negotiation/index.js
index db5ac863121..98c367cf437 100644
--- a/examples/content-negotiation/index.js
+++ b/examples/content-negotiation/index.js
@@ -1,8 +1,8 @@
-var express = require('../../')
-  , app = module.exports = express()
-  , users = require('./db');
+var express = require('../../');
+var app = module.exports = express();
+var users = require('./db');
 
-// so either you can deal with different types of formatting 
+// so either you can deal with different types of formatting
 // for expected response in index.js
 app.get('/', function(req, res){
   res.format({
@@ -21,7 +21,7 @@ app.get('/', function(req, res){
     json: function(){
       res.json(users);
     }
-  })
+  });
 });
 
 // or you could write a tiny middleware like
@@ -32,7 +32,7 @@ function format(path) {
   var obj = require(path);
   return function(req, res){
     res.format(obj);
-  }
+  };
 }
 
 app.get('/users', format('./users'));
diff --git a/examples/cookie-sessions/index.js b/examples/cookie-sessions/index.js
index 56511197837..9bb8714f560 100644
--- a/examples/cookie-sessions/index.js
+++ b/examples/cookie-sessions/index.js
@@ -1,4 +1,3 @@
-
 /**
  * Module dependencies.
  */
diff --git a/examples/cookies/app.js b/examples/cookies/app.js
index fb5f19cb184..7ec95089bf9 100644
--- a/examples/cookies/app.js
+++ b/examples/cookies/app.js
@@ -1,15 +1,13 @@
-
 /**
  * Module dependencies.
  */
 
-var express = require('../../')
-  , app = module.exports = express()
-  , favicon = require('static-favicon')
-  , logger = require('morgan')
-  , cookieParser = require('cookie-parser')
-  , bodyParser = require('body-parser')
-
+var express = require('../../');
+var app = module.exports = express();
+var favicon = require('static-favicon');
+var logger = require('morgan');
+var cookieParser = require('cookie-parser');
+var bodyParser = require('body-parser');
 
 // add favicon() before logger() so
 // GET /favicon.ico requests are not
diff --git a/examples/cors/index.js b/examples/cors/index.js
index 1d2c5925d0f..6de9cbf5c99 100644
--- a/examples/cors/index.js
+++ b/examples/cors/index.js
@@ -2,11 +2,11 @@
  * Module dependencies.
  */
 
-var express = require('../..')
-  , logger = require('morgan')
-  , app = express()
-  , bodyParser = require('body-parser')
-  , api = express();
+var express = require('../..');
+var logger = require('morgan');
+var app = express();
+var bodyParser = require('body-parser');
+var api = express();
 
 // app middleware
 
diff --git a/examples/downloads/app.js b/examples/downloads/app.js
index 69620fa948d..34c82a2b072 100644
--- a/examples/downloads/app.js
+++ b/examples/downloads/app.js
@@ -1,10 +1,9 @@
-
 /**
  * Module dependencies.
  */
 
-var express = require('../../')
-  , app = module.exports = express();
+var express = require('../../');
+var app = module.exports = express();
 
 app.get('/', function(req, res){
   res.send('<ul>'
@@ -16,8 +15,8 @@ app.get('/', function(req, res){
 // /files/* is accessed via req.params[0]
 // but here we name it :file
 app.get('/files/:file(*)', function(req, res, next){
-  var file = req.params.file
-    , path = __dirname + '/files/' + file;
+  var file = req.params.file;
+  var path = __dirname + '/files/' + file;
 
   res.download(path);
 });
diff --git a/examples/ejs/index.js b/examples/ejs/index.js
index f9ee51c797c..f54fb75f675 100644
--- a/examples/ejs/index.js
+++ b/examples/ejs/index.js
@@ -1,4 +1,3 @@
-
 /**
  * Module dependencies.
  */
diff --git a/examples/error-pages/index.js b/examples/error-pages/index.js
index 5f247c92920..4ba5d6671b7 100644
--- a/examples/error-pages/index.js
+++ b/examples/error-pages/index.js
@@ -2,11 +2,11 @@
  * Module dependencies.
  */
 
-var express = require('../../')
-  , app = module.exports = express()
-  , logger = require('morgan')
-  , favicon = require('static-favicon')
-  , silent = 'test' == process.env.NODE_ENV;
+var express = require('../../');
+var app = module.exports = express();
+var logger = require('morgan');
+var favicon = require('static-favicon');
+var silent = 'test' == process.env.NODE_ENV;
 
 // general config
 app.set('views', __dirname + '/views');
diff --git a/examples/error/index.js b/examples/error/index.js
index 91910249b0e..05b44177239 100644
--- a/examples/error/index.js
+++ b/examples/error/index.js
@@ -1,12 +1,11 @@
-
 /**
  * Module dependencies.
  */
 
-var express = require('../../')
-  , logger = require('morgan')
-  , app = module.exports = express()
-  , test = app.get('env') == 'test';
+var express = require('../../');
+var logger = require('morgan');
+var app = module.exports = express();
+var test = app.get('env') == 'test';
 
 if (!test) app.use(logger('dev'));
 
diff --git a/examples/expose-data-to-client/index.js b/examples/expose-data-to-client/index.js
index 1d5ef830550..452777e421c 100644
--- a/examples/expose-data-to-client/index.js
+++ b/examples/expose-data-to-client/index.js
@@ -1,7 +1,7 @@
 
-var express = require('../..')
-  , logger = require('morgan')
-  , app = express();
+var express = require('../..');
+var logger = require('morgan');
+var app = express();
 
 app.set('view engine', 'jade');
 app.set('views', __dirname + '/views');
@@ -21,7 +21,7 @@ User.prototype.toJSON = function(){
   return {
     id: this.id,
     name: this.name
-  }
+  };
 };
 
 app.use(logger('dev'));
diff --git a/examples/hello-world/index.js b/examples/hello-world/index.js
index 2cd9fc456c9..31c161a422f 100644
--- a/examples/hello-world/index.js
+++ b/examples/hello-world/index.js
@@ -1,4 +1,3 @@
-
 var express = require('../../');
 
 var app = express();
diff --git a/examples/jade/index.js b/examples/jade/index.js
index b73b5439b2b..35ff47c3430 100644
--- a/examples/jade/index.js
+++ b/examples/jade/index.js
@@ -1,4 +1,3 @@
-
 /**
  * Module dependencies.
  */
diff --git a/examples/markdown/index.js b/examples/markdown/index.js
index f872e139786..5899c2df2cd 100644
--- a/examples/markdown/index.js
+++ b/examples/markdown/index.js
@@ -1,11 +1,10 @@
-
 /**
  * Module dependencies.
  */
 
-var express = require('../..')
-  , fs = require('fs')
-  , md = require('marked').parse;
+var express = require('../..');
+var fs = require('fs');
+var md = require('marked').parse;
 
 var app = module.exports = express();
 
@@ -18,13 +17,13 @@ app.engine('md', function(path, options, fn){
       var html = md(str);
       html = html.replace(/\{([^}]+)\}/g, function(_, name){
         return options[name] || '';
-      })
+      });
       fn(null, html);
     } catch(err) {
       fn(err);
     }
   });
-})
+});
 
 app.set('views', __dirname + '/views');
 
@@ -33,11 +32,11 @@ app.set('view engine', 'md');
 
 app.get('/', function(req, res){
   res.render('index', { title: 'Markdown Example' });
-})
+});
 
 app.get('/fail', function(req, res){
   res.render('missing', { title: 'Markdown Example' });
-})
+});
 
 if (!module.parent) {
   app.listen(3000);
diff --git a/examples/multipart/index.js b/examples/multipart/index.js
index 96481f663be..02e8eb51ee8 100644
--- a/examples/multipart/index.js
+++ b/examples/multipart/index.js
@@ -1,15 +1,14 @@
-
 /**
  * Module dependencies.
  */
 
-var express = require('../..')
-  , bodyParser = require('body-parser')
-  , format = require('util').format;
+var express = require('../..');
+var bodyParser = require('body-parser');
+var format = require('util').format;
 
-var app = module.exports = express()
+var app = module.exports = express();
 
-app.use(bodyParser())
+app.use(bodyParser());
 
 app.get('/', function(req, res){
   res.send('<form method="post" enctype="multipart/form-data">'
diff --git a/examples/mvc/controllers/main/index.js b/examples/mvc/controllers/main/index.js
index 636de80f560..83db90f6f20 100644
--- a/examples/mvc/controllers/main/index.js
+++ b/examples/mvc/controllers/main/index.js
@@ -1,4 +1,3 @@
-
 exports.index = function(req, res){
   res.redirect('/users');
 };
\ No newline at end of file
diff --git a/examples/mvc/controllers/pet/index.js b/examples/mvc/controllers/pet/index.js
index bce0eacb4b5..5836a5b701e 100644
--- a/examples/mvc/controllers/pet/index.js
+++ b/examples/mvc/controllers/pet/index.js
@@ -1,3 +1,6 @@
+/**
+ * Module dependencies.
+ */
 
 var db = require('../../db');
 
diff --git a/examples/mvc/controllers/user-pet/index.js b/examples/mvc/controllers/user-pet/index.js
index e6e9535b8b1..b05d80a4fe4 100644
--- a/examples/mvc/controllers/user-pet/index.js
+++ b/examples/mvc/controllers/user-pet/index.js
@@ -1,3 +1,6 @@
+/**
+ * Module dependencies.
+ */
 
 var db = require('../../db');
 
diff --git a/examples/mvc/controllers/user/index.js b/examples/mvc/controllers/user/index.js
index a5bd030edbe..0eb40f3f5cf 100644
--- a/examples/mvc/controllers/user/index.js
+++ b/examples/mvc/controllers/user/index.js
@@ -1,3 +1,6 @@
+/**
+ * Module dependencies.
+ */
 
 var db = require('../../db');
 
@@ -12,7 +15,7 @@ exports.before = function(req, res, next){
     // found it, move on to the routes
     next();
   });
-}
+};
 
 exports.list = function(req, res, next){
   res.render('list', { users: db.users });
diff --git a/examples/mvc/db.js b/examples/mvc/db.js
index 16fd6fac3d9..565fdfaa507 100644
--- a/examples/mvc/db.js
+++ b/examples/mvc/db.js
@@ -1,4 +1,3 @@
-
 // faux database
 
 var pets = exports.pets = [];
diff --git a/examples/mvc/index.js b/examples/mvc/index.js
index 7e282f46bbb..f6b264364ec 100644
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -1,3 +1,7 @@
+/**
+ * Module dependencies.
+ */
+
 var express = require('../..');
 var logger = require('morgan');
 var session = require('express-session');
diff --git a/examples/mvc/lib/boot.js b/examples/mvc/lib/boot.js
index 947b59cde0e..9cad303feab 100644
--- a/examples/mvc/lib/boot.js
+++ b/examples/mvc/lib/boot.js
@@ -1,17 +1,20 @@
+/**
+ * Module dependencies.
+ */
 
-var express = require('../../..')
-  , fs = require('fs');
+var express = require('../../..');
+var fs = require('fs');
 
 module.exports = function(parent, options){
   var verbose = options.verbose;
   fs.readdirSync(__dirname + '/../controllers').forEach(function(name){
     verbose && console.log('\n   %s:', name);
-    var obj = require('./../controllers/' + name)
-      , name = obj.name || name
-      , prefix = obj.prefix || ''
-      , app = express()
-      , method
-      , path;
+    var obj = require('./../controllers/' + name);
+    var name = obj.name || name;
+    var prefix = obj.prefix || '';
+    var app = express();
+    var method;
+    var path;
 
     // allow specifying the view engine
     if (obj.engine) app.set('view engine', obj.engine);
diff --git a/examples/online/index.js b/examples/online/index.js
index 5ebfe6a760a..672b835414f 100644
--- a/examples/online/index.js
+++ b/examples/online/index.js
@@ -1,4 +1,3 @@
-
 // first:
 // $ npm install redis online
 // $ redis-server
@@ -7,10 +6,10 @@
  * Module dependencies.
  */
 
-var express = require('../..')
-  , online = require('online')
-  , redis = require('redis')
-  , db = redis.createClient();
+var express = require('../..');
+var online = require('online');
+var redis = require('redis');
+var db = redis.createClient();
 
 // online
 
diff --git a/examples/params/app.js b/examples/params/app.js
index 4c6e2b528a9..9daff2605c7 100644
--- a/examples/params/app.js
+++ b/examples/params/app.js
@@ -1,10 +1,9 @@
-
 /**
  * Module dependencies.
  */
 
-var express = require('../../')
-  , app = module.exports = express();
+var express = require('../../');
+var app = module.exports = express();
 
 // Faux database
 
@@ -18,7 +17,7 @@ var users = [
 
 // Convert :to and :from to integers
 
-app.param(['to', 'from'], function(req, res, next, num, name){ 
+app.param(['to', 'from'], function(req, res, next, num, name){
   req.params[name] = num = parseInt(num, 10);
   if( isNaN(num) ){
     next(new Error('failed to parseInt '+num));
@@ -58,9 +57,9 @@ app.get('/user/:user', function(req, res, next){
  */
 
 app.get('/users/:from-:to', function(req, res, next){
-  var from = req.params.from
-    , to = req.params.to
-    , names = users.map(function(user){ return user.name; });
+  var from = req.params.from;
+  var to = req.params.to;
+  var names = users.map(function(user){ return user.name; });
   res.send('users ' + names.slice(from, to).join(', '));
 });
 
diff --git a/examples/resource/app.js b/examples/resource/app.js
index 03132e36ff2..cbceaf6f0c6 100644
--- a/examples/resource/app.js
+++ b/examples/resource/app.js
@@ -1,4 +1,3 @@
-
 /**
  * Module dependencies.
  */
@@ -12,9 +11,9 @@ var app = module.exports = express();
 app.resource = function(path, obj) {
   this.get(path, obj.index);
   this.get(path + '/:a..:b.:format?', function(req, res){
-    var a = parseInt(req.params.a, 10)
-      , b = parseInt(req.params.b, 10)
-      , format = req.params.format;
+    var a = parseInt(req.params.a, 10);
+    var b = parseInt(req.params.b, 10);
+    var format = req.params.format;
     obj.range(req, res, a, b, format);
   });
   this.get(path + '/:id', obj.show);
@@ -82,7 +81,7 @@ app.get('/', function(req, res){
     , '<li>GET /users/1..3.json</li>'
     , '<li>DELETE /users/4</li>'
     , '</ul>'
-  ].join('\n')); 
+  ].join('\n'));
 });
 
 if (!module.parent) {
diff --git a/examples/route-map/index.js b/examples/route-map/index.js
index 31d25fce829..76c68bbdd82 100644
--- a/examples/route-map/index.js
+++ b/examples/route-map/index.js
@@ -1,7 +1,12 @@
+/**
+ * Module dependencies.
+ */
 
-var express = require('../../lib/express')
-  , verbose = process.env.NODE_ENV != 'test'
-  , app = module.exports = express();
+var express = require('../../lib/express');
+
+var verbose = process.env.NODE_ENV != 'test';
+
+var app = module.exports = express();
 
 app.map = function(a, route){
   route = route || '';
diff --git a/examples/route-separation/index.js b/examples/route-separation/index.js
index 782d123fb8a..d2fb1f8971e 100644
--- a/examples/route-separation/index.js
+++ b/examples/route-separation/index.js
@@ -1,16 +1,15 @@
-
 /**
  * Module dependencies.
  */
 
-var express = require('../..')
-  , app = express()
-  , logger = require('morgan')
-  , cookieParser = require('cookie-parser')
-  , bodyParser = require('body-parser')
-  , site = require('./site')
-  , post = require('./post')
-  , user = require('./user');
+var express = require('../..');
+var app = express();
+var logger = require('morgan');
+var cookieParser = require('cookie-parser');
+var bodyParser = require('body-parser');
+var site = require('./site');
+var post = require('./post');
+var user = require('./user');
 
 // Config
 
diff --git a/examples/route-separation/post.js b/examples/route-separation/post.js
index 752c0f283db..e3f12e78847 100644
--- a/examples/route-separation/post.js
+++ b/examples/route-separation/post.js
@@ -1,4 +1,3 @@
-
 // Fake posts database
 
 var posts = [
diff --git a/examples/route-separation/site.js b/examples/route-separation/site.js
index 9ec7db14763..698892cc89c 100644
--- a/examples/route-separation/site.js
+++ b/examples/route-separation/site.js
@@ -1,4 +1,3 @@
-
 exports.index = function(req, res){
   res.render('index', { title: 'Route Separation Example' });
 };
\ No newline at end of file
diff --git a/examples/route-separation/user.js b/examples/route-separation/user.js
index b44891dc88f..a5c20410439 100644
--- a/examples/route-separation/user.js
+++ b/examples/route-separation/user.js
@@ -1,4 +1,3 @@
-
 // Fake user database
 
 var users = [
diff --git a/examples/search/client.js b/examples/search/client.js
index e19adb8df5f..0c198cc39fa 100644
--- a/examples/search/client.js
+++ b/examples/search/client.js
@@ -1,4 +1,3 @@
-
 var search = document.querySelector('[type=search]');
 var code = document.querySelector('pre');
 
diff --git a/examples/search/index.js b/examples/search/index.js
index 731c3c6183a..7fd2c476632 100644
--- a/examples/search/index.js
+++ b/examples/search/index.js
@@ -1,4 +1,3 @@
-
 // first:
 // $ npm install redis
 // $ redis-server
@@ -7,9 +6,10 @@
  * Module dependencies.
  */
 
-var express = require('../..')
-  , redis = require('redis')
-  , db = redis.createClient();
+var express = require('../..');
+var redis = require('redis');
+
+var db = redis.createClient();
 
 // npm install redis
 
diff --git a/examples/session/index.js b/examples/session/index.js
index 3629914d1ea..c210760627e 100644
--- a/examples/session/index.js
+++ b/examples/session/index.js
@@ -1,4 +1,3 @@
-
 // first:
 // $ npm install redis
 // $ redis-server
diff --git a/examples/session/redis.js b/examples/session/redis.js
index 11af51c925d..b3211c76da7 100644
--- a/examples/session/redis.js
+++ b/examples/session/redis.js
@@ -1,4 +1,6 @@
-
+/**
+ * Module dependencies.
+ */
 
 var express = require('../..');
 var logger = require('morgan');
diff --git a/examples/static-files/index.js b/examples/static-files/index.js
index 597ed2318aa..c3b1659d861 100644
--- a/examples/static-files/index.js
+++ b/examples/static-files/index.js
@@ -1,3 +1,6 @@
+/**
+ * Module dependencies.
+ */
 
 var express = require('../..');
 var logger = require('morgan');
diff --git a/examples/vhost/index.js b/examples/vhost/index.js
index e9596e722ad..194d04db9d9 100644
--- a/examples/vhost/index.js
+++ b/examples/vhost/index.js
@@ -21,7 +21,7 @@ var main = express();
 main.use(logger('dev'));
 
 main.get('/', function(req, res){
-  res.send('Hello from main app!')
+  res.send('Hello from main app!');
 });
 
 main.get('/:sub', function(req, res){
@@ -41,7 +41,7 @@ redirect.all('*', function(req, res){
 
 var app = express();
 
-app.use(vhost('*.example.com', redirect)) // Serves all subdomains via Redirect app
+app.use(vhost('*.example.com', redirect)); // Serves all subdomains via Redirect app
 app.use(vhost('example.com', main)); // Serves top level domain via Main server app
 
 app.listen(3000);
diff --git a/examples/view-constructor/github-view.js b/examples/view-constructor/github-view.js
index d3fb6a1bf1d..8163d4601e6 100644
--- a/examples/view-constructor/github-view.js
+++ b/examples/view-constructor/github-view.js
@@ -1,11 +1,10 @@
-
 /**
  * Module dependencies.
  */
 
-var http = require('http')
-  , path = require('path')
-  , extname = path.extname
+var http = require('http');
+var path = require('path');
+var extname = path.extname;
 
 /**
  * Expose `GithubView`.
diff --git a/examples/view-constructor/index.js b/examples/view-constructor/index.js
index 3f1aa42240f..b3c2eeecb0a 100644
--- a/examples/view-constructor/index.js
+++ b/examples/view-constructor/index.js
@@ -1,12 +1,11 @@
-
 /**
  * Module dependencies.
  */
 
-var express = require('../../')
-  , http = require('http')
-  , GithubView = require('./github-view')
-  , md = require('marked').parse;
+var express = require('../../');
+var http = require('http');
+var GithubView = require('./github-view');
+var md = require('marked').parse;
 
 var app = module.exports = express();
 
@@ -16,12 +15,12 @@ app.engine('md', function(str, options, fn){
     var html = md(str);
     html = html.replace(/\{([^}]+)\}/g, function(_, name){
       return options[name] || '';
-    })
+    });
     fn(null, html);
   } catch(err) {
     fn(err);
   }
-})
+});
 
 // pointing to a particular github repo to load files from it
 app.set('views', 'visionmedia/express');
@@ -34,12 +33,12 @@ app.get('/', function(req, res){
   // app.locals, res.locals, and locals passed
   // work like they normally would
   res.render('examples/markdown/views/index.md', { title: 'Example' });
-})
+});
 
 app.get('/Readme.md', function(req, res){
   // rendering a view from https://github.com/visionmedia/express/blob/master/Readme.md
   res.render('Readme.md');
-})
+});
 
 if (!module.parent) {
   app.listen(3000);
diff --git a/examples/view-locals/index.js b/examples/view-locals/index.js
index 7658e83fa3f..70381166105 100644
--- a/examples/view-locals/index.js
+++ b/examples/view-locals/index.js
@@ -1,7 +1,10 @@
+/**
+ * Module dependencies.
+ */
 
-var express = require('../..')
-  , User = require('./user')
-  , app = express();
+var express = require('../..');
+var User = require('./user');
+var app = express();
 
 app.set('views', __dirname);
 app.set('view engine', 'jade');
@@ -69,7 +72,7 @@ app.get('/middleware', count, users, function(req, res, next){
 // this approach is much like the last
 // however we're explicitly exposing
 // the locals within each middleware
-// 
+//
 // note that this may not always work
 // well, for example here we filter
 // the users in the middleware, which
diff --git a/examples/view-locals/user.js b/examples/view-locals/user.js
index 27b80e7dac9..0e3373d548c 100644
--- a/examples/view-locals/user.js
+++ b/examples/view-locals/user.js
@@ -1,4 +1,3 @@
-
 module.exports = User;
 
 // faux model
diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index 08df83ae7c6..1d09b6d4d42 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -1,4 +1,3 @@
-
 /**
  * Module dependencies.
  */
@@ -79,8 +78,8 @@ app.get('/api/repos', function(req, res, next){
 });
 
 app.get('/api/user/:name/repos', function(req, res, next){
-  var name = req.params.name
-    , user = userRepos[name];
+  var name = req.params.name;
+  var user = userRepos[name];
 
   if (user) res.send(user);
   else next();

From 001c9380be1631ea44069745ee695a09083bfa2c Mon Sep 17 00:00:00 2001
From: "Kent C. Dodds" <kent+github@doddsfamily.us>
Date: Fri, 28 Mar 2014 06:19:29 -0600
Subject: [PATCH 0127/1265] Tell me what I'm using that isn't allowed

I'm migrating and it would be useful in a large application to know what I'm using that's not allowed. I think lots of people would feel this way. Let me know if you would prefer a different implementation.
---
 lib/express.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/express.js b/lib/express.js
index aa7dd557c06..6bbc9f3b6b4 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -86,7 +86,7 @@ exports.static = require('serve-static');
 ].forEach(function (name) {
   Object.defineProperty(exports, name, {
     get: function () {
-      throw new Error('Most middleware is no longer bundled with Express and must be installed separately. Please see https://github.com/senchalabs/connect#middleware.');
+      throw new Error('Most middleware (like ' + name + ') is no longer bundled with Express and must be installed separately. Please see https://github.com/senchalabs/connect#middleware.');
     }
   });
 });

From dd8e279cac316ad8ba1c52d8a12d37302a7cfa14 Mon Sep 17 00:00:00 2001
From: WON JONG YOO <calmgracian@hotmail.com>
Date: Mon, 31 Mar 2014 16:52:22 -0400
Subject: [PATCH 0128/1265] Not work..

This example does not work with express 4.x.
bodyParser() does not have multipart() anymore.
Multiparty module and middleware are added.
---
 examples/multipart/index.js | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/examples/multipart/index.js b/examples/multipart/index.js
index 02e8eb51ee8..a037f3361b1 100644
--- a/examples/multipart/index.js
+++ b/examples/multipart/index.js
@@ -4,11 +4,26 @@
 
 var express = require('../..');
 var bodyParser = require('body-parser');
+var multiparty = require('multiparty');
 var format = require('util').format;
 
 var app = module.exports = express();
 
 app.use(bodyParser());
+app.use(function(req, res, next){
+	console.log(req.method);
+	if(req.method === 'POST' && req.headers['content-type'].indexOf("multipart/form-data") !== -1){
+		var form = new multiparty.Form();
+		form.parse(req, function(err, fields, files){
+			req.files = files;
+			next();
+		});
+		
+	}
+	else next();
+	
+});
+
 
 app.get('/', function(req, res){
   res.send('<form method="post" enctype="multipart/form-data">'
@@ -22,9 +37,9 @@ app.post('/', function(req, res, next){
   // the uploaded file can be found as `req.files.image` and the
   // title field as `req.body.title`
   res.send(format('\nuploaded %s (%d Kb) to %s as %s'
-    , req.files.image.name
-    , req.files.image.size / 1024 | 0
-    , req.files.image.path
+    , req.files.image[0].name
+    , req.files.image[0].size / 1024 | 0
+    , req.files.image[0].path
     , req.body.title));
 });
 

From ba0b046a9513f0b72a7ab7fba39b06c5971070c0 Mon Sep 17 00:00:00 2001
From: Sean Linsley <xovatdev@gmail.com>
Date: Sat, 5 Apr 2014 15:35:46 -0500
Subject: [PATCH 0129/1265] Use SVG badges in Readme

---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index a2821b847f6..ee0d948a0a2 100644
--- a/Readme.md
+++ b/Readme.md
@@ -2,7 +2,7 @@
 
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
-  [![Build Status](https://secure.travis-ci.org/visionmedia/express.png)](http://travis-ci.org/visionmedia/express) [![Gittip](http://img.shields.io/gittip/visionmedia.png)](https://www.gittip.com/visionmedia/)
+  [![Build Status](https://secure.travis-ci.org/visionmedia/express.svg)](https://travis-ci.org/visionmedia/express) [![Gittip](https://img.shields.io/gittip/visionmedia.svg)](https://www.gittip.com/visionmedia/)
 
 ```js
 var express = require('express');

From d72f27909fd869908998a7650172782e13c6dca4 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Tue, 8 Apr 2014 14:50:26 -0400
Subject: [PATCH 0130/1265] handle thrown errors inside Route

close #2029
---
 lib/router/route.js | 13 +++++++++++--
 test/Route.js       | 27 +++++++++++++++++++++++++++
 2 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/lib/router/route.js b/lib/router/route.js
index c592c37ca08..dca4b1b2241 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -87,14 +87,23 @@ Route.prototype.dispatch = function(req, res, done){
         return next_layer(err);
       }
 
-      return layer.handle(err, req, res, next_layer);
+      try {
+        layer.handle(err, req, res, next_layer);
+      } catch (err) {
+        next_layer(err);
+      }
+      return;
     }
 
     if (arity > 3) {
       return next_layer();
     }
 
-    layer.handle(req, res, next_layer);
+    try {
+      layer.handle(req, res, next_layer);
+    } catch (err) {
+      next_layer(err);
+    }
   })();
 };
 
diff --git a/test/Route.js b/test/Route.js
index aea1604b9f7..ccb102232fd 100644
--- a/test/Route.js
+++ b/test/Route.js
@@ -140,5 +140,32 @@ describe('Route', function(){
 
       route.dispatch({ method: 'get' }, {});
     })
+
+    it('should handle throw', function(done) {
+      var route = new Route('');
+
+      var order = '';
+      route.all(function(req, res, next){
+        throw new Error('foobar');
+      });
+
+      route.all(function(req, res, next){
+        order += '0';
+        next();
+      });
+
+      route.all(function(err, req, res, next){
+        order += 'a';
+        next(err);
+      });
+
+      route.all(function(err, req, res, next){
+        assert.equal(err.message, 'foobar');
+        assert.equal(order, 'a');
+        done();
+      });
+
+      route.dispatch({ method: 'get' }, {});
+    });
   })
 })

From 147c2507c3bdcd22c7c0176e57c9d585d0aa2642 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Wed, 9 Apr 2014 16:38:40 -0400
Subject: [PATCH 0131/1265] 4.0.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 1807c73e5f9..e51949b69d0 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.0.0-rc4",
+  "version": "4.0.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From b8dd60dec7aa927496b6a341a77d9e0bed5a4570 Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Thu, 10 Apr 2014 09:57:30 -0400
Subject: [PATCH 0132/1265] update readme to v4 release

- remove 3.0.0 from logo
- remove RC status for v4

close #2036
---
 Readme.md | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/Readme.md b/Readme.md
index ee0d948a0a2..2d11d6cd517 100644
--- a/Readme.md
+++ b/Readme.md
@@ -1,4 +1,4 @@
-[![express logo](http://f.cl.ly/items/0V2S1n0K1i3y1c122g04/Screen%20Shot%202012-04-11%20at%209.59.42%20AM.png)](http://expressjs.com/)
+[![express logo](https://i.cloudup.com/zfY6lL7eFa-3000x3000.png)](http://expressjs.com/)
 
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
@@ -15,9 +15,7 @@ app.get('/', function(req, res){
 app.listen(3000);
 ```
 
-  Note that Express v4 release candidates have been released. 
-  Please try it out, but not in production, and report any issues you may find here or to the appropriate repositories.
-  Be sure to read [Migrating from 3.x to 4.x](https://github.com/visionmedia/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/visionmedia/express/wiki/New-features-in-4.x).
+**PROTIP** Be sure to read [Migrating from 3.x to 4.x](https://github.com/visionmedia/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/visionmedia/express/wiki/New-features-in-4.x).
 
 ## Installation
 

From 0dbaacfe12fab8801b4bb40ddfd288f32f3c0e90 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Apr 2014 16:57:00 -0400
Subject: [PATCH 0133/1265] update history

---
 History.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 867b9623459..769fd365299 100644
--- a/History.md
+++ b/History.md
@@ -1,4 +1,4 @@
-4.0.0 /
+4.0.0 / 2014-04-09
 ==================
 
  * remove:

From a802405e19bb36e648a7e33601a6d10333b82dee Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Apr 2014 15:37:49 -0400
Subject: [PATCH 0134/1265] update type-is to 1.0.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e51949b69d0..c546ce4fb03 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,7 @@
   "dependencies": {
     "parseurl": "1.0.1",
     "accepts": "1.0.0",
-    "type-is": "1.0.0",
+    "type-is": "1.0.1",
     "range-parser": "1.0.0",
     "cookie": "0.1.0",
     "buffer-crc32": "0.2.1",

From c610902b671a1449aa15d9d7c3b051c9c01f221e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Apr 2014 15:38:55 -0400
Subject: [PATCH 0135/1265] update accepts to 1.0.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index c546ce4fb03..efd2f09bece 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,7 @@
   ],
   "dependencies": {
     "parseurl": "1.0.1",
-    "accepts": "1.0.0",
+    "accepts": "1.0.1",
     "type-is": "1.0.1",
     "range-parser": "1.0.0",
     "cookie": "0.1.0",

From 2377fc8bcf0a3dcdf02e5596b94e4180e7ba0523 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Apr 2014 15:41:40 -0400
Subject: [PATCH 0136/1265] update serve-static to 1.0.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index efd2f09bece..404b9fb8496 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "utils-merge": "1.0.0",
     "escape-html": "1.0.1",
     "qs": "0.6.6",
-    "serve-static": "1.0.1",
+    "serve-static": "1.0.4",
     "path-to-regexp": "0.1.2",
     "debug": ">= 0.7.3 < 1"
   },

From fb1232043da3aa42bea6bccc4cf3b1a07392703b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Apr 2014 15:43:02 -0400
Subject: [PATCH 0137/1265] update cookie to 0.1.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 404b9fb8496..2a18d5062f5 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "accepts": "1.0.1",
     "type-is": "1.0.1",
     "range-parser": "1.0.0",
-    "cookie": "0.1.0",
+    "cookie": "0.1.1",
     "buffer-crc32": "0.2.1",
     "fresh": "0.2.2",
     "methods": "0.1.0",

From 260141ee089eb36335d1281f6a4b58933c75d863 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Apr 2014 17:04:19 -0400
Subject: [PATCH 0138/1265] add soft testing on node.js 0.11

---
 .npmignore  | 1 +
 .travis.yml | 5 +++++
 Readme.md   | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.npmignore b/.npmignore
index caf574de4de..66229e9d9d8 100644
--- a/.npmignore
+++ b/.npmignore
@@ -5,5 +5,6 @@ support/
 test/
 testing.js
 .DS_Store
+.travis.yml
 coverage.html
 lib-cov
diff --git a/.travis.yml b/.travis.yml
index 6e5919de39a..20082f9ee9b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,3 +1,8 @@
 language: node_js
 node_js:
   - "0.10"
+  - "0.11"
+matrix:
+  allow_failures:
+    - node_js: "0.11"
+  fast_finish: true
diff --git a/Readme.md b/Readme.md
index 2d11d6cd517..cb6b233c952 100644
--- a/Readme.md
+++ b/Readme.md
@@ -2,7 +2,7 @@
 
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
-  [![Build Status](https://secure.travis-ci.org/visionmedia/express.svg)](https://travis-ci.org/visionmedia/express) [![Gittip](https://img.shields.io/gittip/visionmedia.svg)](https://www.gittip.com/visionmedia/)
+  [![Build Status](https://travis-ci.org/visionmedia/express.svg?branch=master)](https://travis-ci.org/visionmedia/express) [![Gittip](https://img.shields.io/gittip/visionmedia.svg)](https://www.gittip.com/visionmedia/)
 
 ```js
 var express = require('express');

From b79a2715538e377db9d96c25c662439e00182f98 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Sat, 12 Apr 2014 17:25:33 -0700
Subject: [PATCH 0139/1265] update type-is@1.1.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 2a18d5062f5..5175ff19a51 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,7 @@
   "dependencies": {
     "parseurl": "1.0.1",
     "accepts": "1.0.1",
-    "type-is": "1.0.1",
+    "type-is": "1.1.0",
     "range-parser": "1.0.0",
     "cookie": "0.1.1",
     "buffer-crc32": "0.2.1",

From 6b1c44321245f62274d002ed861cf40c227c6745 Mon Sep 17 00:00:00 2001
From: Wang <pana.wang@outlook.com>
Date: Sun, 13 Apr 2014 22:05:49 +0800
Subject: [PATCH 0140/1265] remove one feature description

---
 Readme.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index cb6b233c952..1591e1c56f7 100644
--- a/Readme.md
+++ b/Readme.md
@@ -48,7 +48,6 @@ app.listen(3000);
   * View system supporting 14+ template engines
   * Content negotiation
   * Focus on high performance
-  * Environment based configuration
   * Executable for generating applications quickly
   * High test coverage
 

From 19983272f3d43eba9e5afbc7af1b97972045033c Mon Sep 17 00:00:00 2001
From: Ke Zhu <davidzhu.4.2@gmail.com>
Date: Tue, 15 Apr 2014 00:11:09 -0400
Subject: [PATCH 0141/1265] improve req.xhr test by verifying status code

---
 test/req.xhr.js | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/test/req.xhr.js b/test/req.xhr.js
index fe4c0503ee3..cc8754ce4cf 100644
--- a/test/req.xhr.js
+++ b/test/req.xhr.js
@@ -15,8 +15,9 @@ describe('req', function(){
       request(app)
       .get('/')
       .set('X-Requested-With', 'xmlhttprequest')
-      .end(function(res){
-        done();
+      .expect(200)
+      .end(function(err, res){
+        done(err);
       })
     })
 
@@ -31,8 +32,9 @@ describe('req', function(){
       request(app)
       .get('/')
       .set('X-Requested-With', 'XMLHttpRequest')
-      .end(function(res){
-        done();
+      .expect(200)
+      .end(function(err, res){
+        done(err);
       })
     })
 
@@ -47,8 +49,9 @@ describe('req', function(){
       request(app)
       .get('/')
       .set('X-Requested-With', 'blahblah')
-      .end(function(res){
-        done();
+      .expect(200)
+      .end(function(err, res){
+        done(err);
       })
     })
 
@@ -62,8 +65,9 @@ describe('req', function(){
 
       request(app)
       .get('/')
-      .end(function(res){
-        done();
+      .expect(200)
+      .end(function(err, res){
+        done(err);
       })
     })
   })

From 79cc5a4d2745cc96a481c133836e042852f178fe Mon Sep 17 00:00:00 2001
From: Chris Andrejewski <andrejewski.chris@gmail.com>
Date: Tue, 15 Apr 2014 20:12:23 -0400
Subject: [PATCH 0142/1265] make old middleware properties configurable

closes #2054
---
 lib/express.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/express.js b/lib/express.js
index 6bbc9f3b6b4..7be6832fb6e 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -87,6 +87,7 @@ exports.static = require('serve-static');
   Object.defineProperty(exports, name, {
     get: function () {
       throw new Error('Most middleware (like ' + name + ') is no longer bundled with Express and must be installed separately. Please see https://github.com/senchalabs/connect#middleware.');
-    }
+    },
+    configurable: true
   });
 });

From b9e957608383605d20f5a3e3803394f47c71bdf6 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Fri, 18 Apr 2014 00:28:43 -0700
Subject: [PATCH 0143/1265] Readme: add Roman as lead maintainer

so people start emailing him instead of TJ :D
---
 Readme.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/Readme.md b/Readme.md
index 1591e1c56f7..ac90eb9a57a 100644
--- a/Readme.md
+++ b/Readme.md
@@ -98,8 +98,10 @@ Then run the tests:
     $ make test
 
 ## Contributors
-
-  https://github.com/visionmedia/express/graphs/contributors
+  
+  Author: [TJ Holowaychuk](http://github.com/visionmedia)  
+  Lead Maintainer: [Roman Shtylman](https://github.com/defunctzombie)  
+  Contributors: https://github.com/visionmedia/express/graphs/contributors  
 
 ## License
 

From 56b672e6570e64f4536e72c76f92c0e2144c2afa Mon Sep 17 00:00:00 2001
From: Andy VanWagoner <thetalecrafter@gmail.com>
Date: Sat, 19 Apr 2014 21:16:11 -0600
Subject: [PATCH 0144/1265] support non-ascii filenames in content-disposition
 headers

---
 examples/downloads/app.js                     |  3 +-
 ... \355\225\234\344\270\255\346\227\245.txt" |  1 +
 lib/response.js                               |  7 ++---
 lib/utils.js                                  | 23 ++++++++++++++
 test/res.attachment.js                        | 31 +++++++++++++++++++
 5 files changed, 60 insertions(+), 5 deletions(-)
 create mode 100644 "examples/downloads/files/utf-8 \355\225\234\344\270\255\346\227\245.txt"

diff --git a/examples/downloads/app.js b/examples/downloads/app.js
index 34c82a2b072..a9afca28503 100644
--- a/examples/downloads/app.js
+++ b/examples/downloads/app.js
@@ -8,6 +8,7 @@ var app = module.exports = express();
 app.get('/', function(req, res){
   res.send('<ul>'
     + '<li>Download <a href="/files/amazing.txt">amazing.txt</a>.</li>'
+    + '<li>Download <a href="/files/utf-8 한中日.txt">utf-8 한中日.txt</a>.</li>'
     + '<li>Download <a href="/files/missing.txt">missing.txt</a>.</li>'
     + '</ul>');
 });
@@ -40,4 +41,4 @@ app.use(function(err, req, res, next){
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
-}
\ No newline at end of file
+}
diff --git "a/examples/downloads/files/utf-8 \355\225\234\344\270\255\346\227\245.txt" "b/examples/downloads/files/utf-8 \355\225\234\344\270\255\346\227\245.txt"
new file mode 100644
index 00000000000..2a4ee9c7d25
--- /dev/null
+++ "b/examples/downloads/files/utf-8 \355\225\234\344\270\255\346\227\245.txt"	
@@ -0,0 +1 @@
+한中日
\ No newline at end of file
diff --git a/lib/response.js b/lib/response.js
index 317b8b31a94..778dcc742ae 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -9,6 +9,7 @@ var escapeHtml = require('escape-html');
 var sign = require('cookie-signature').sign;
 var normalizeType = require('./utils').normalizeType;
 var normalizeTypes = require('./utils').normalizeTypes;
+var contentDisposition = require('./utils').contentDisposition;
 var etag = require('./utils').etag;
 var statusCodes = http.STATUS_CODES;
 var cookie = require('cookie');
@@ -365,7 +366,7 @@ res.download = function(path, filename, fn){
   }
 
   filename = filename || path;
-  this.set('Content-Disposition', 'attachment; filename="' + basename(filename) + '"');
+  this.set('Content-Disposition', contentDisposition(filename));
   return this.sendfile(path, fn);
 };
 
@@ -487,9 +488,7 @@ res.format = function(obj){
 
 res.attachment = function(filename){
   if (filename) this.type(extname(filename));
-  this.set('Content-Disposition', filename
-    ? 'attachment; filename="' + basename(filename) + '"'
-    : 'attachment');
+  this.set('Content-Disposition', contentDisposition(filename));
   return this;
 };
 
diff --git a/lib/utils.js b/lib/utils.js
index ce725a2dc78..4297cbce757 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -4,6 +4,7 @@
 
 var mime = require('send').mime;
 var crc32 = require('buffer-crc32');
+var basename = require('path').basename;
 
 /**
  * Return ETag for `body`.
@@ -84,6 +85,28 @@ exports.normalizeTypes = function(types){
   return ret;
 };
 
+/**
+ * Generate Content-Disposition header appropriate for the filename.
+ * non-ascii filenames are urlencoded and a filename* parameter is added
+ *
+ * @param {String} filename
+ * @return {String}
+ * @api private
+ */
+
+exports.contentDisposition = function(filename){
+  var ret = 'attachment';
+  if (filename) {
+    filename = basename(filename);
+    // if filename contains non-ascii characters, add a utf-8 version ala RFC 5987
+    ret = /[^\040-\176]/.test(filename)
+      ? 'attachment; filename=' + encodeURI(filename) + '; filename*=UTF-8\'\'' + encodeURI(filename)
+      : 'attachment; filename="' + filename + '"';
+  }
+
+  return ret;
+};
+
 /**
  * Parse accept params `str` returning an
  * object with `.value`, `.quality` and `.params`.
diff --git a/test/res.attachment.js b/test/res.attachment.js
index 1049b07cf59..a0cbbe2b191 100644
--- a/test/res.attachment.js
+++ b/test/res.attachment.js
@@ -44,4 +44,35 @@ describe('res', function(){
       .expect('Content-Type', 'image/png', done);
     })
   })
+
+  describe('.attachment(utf8filename)', function(){
+    it('should add the filename and filename* params', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.attachment('/locales/日本語.txt');
+        res.send('japanese');
+      });
+
+      request(app)
+      .get('/')
+      .expect('Content-Disposition', 'attachment;' +
+          ' filename=%E6%97%A5%E6%9C%AC%E8%AA%9E.txt;' +
+          ' filename*=UTF-8\'\'%E6%97%A5%E6%9C%AC%E8%AA%9E.txt',
+        done);
+    })
+
+    it('should set the Content-Type', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.attachment('/locales/日本語.txt');
+        res.send('japanese');
+      });
+
+      request(app)
+      .get('/')
+      .expect('Content-Type', 'text/plain; charset=utf-8', done);
+    })
+  })
 })

From 50158b851c441d6b7dcd360cde04f2eb9adafe18 Mon Sep 17 00:00:00 2001
From: Fernando Silveira <fsilveira@gmail.com>
Date: Mon, 21 Apr 2014 12:08:34 -0300
Subject: [PATCH 0145/1265] Express 4 now uses "method-override" external
 library.

---
 examples/mvc/index.js | 4 ++++
 package.json          | 1 +
 2 files changed, 5 insertions(+)

diff --git a/examples/mvc/index.js b/examples/mvc/index.js
index f6b264364ec..297344b5a2f 100644
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -7,6 +7,7 @@ var logger = require('morgan');
 var session = require('express-session');
 var cookieParser = require('cookie-parser');
 var bodyParser = require('body-parser');
+var methodOverride = require('method-override');
 
 var app = module.exports = express();
 
@@ -45,6 +46,9 @@ app.use(session());
 // parse request bodies (req.body)
 app.use(bodyParser());
 
+// override methods (put, delete)
+app.use(methodOverride());
+
 // expose the "messages" local variable when views are rendered
 app.use(function(req, res, next){
   var msgs = req.session.messages || [];
diff --git a/package.json b/package.json
index 5175ff19a51..4c862b6efc1 100644
--- a/package.json
+++ b/package.json
@@ -59,6 +59,7 @@
     "marked": "0.2.10",
     "supertest": "~0.8.1",
     "body-parser": "1.0.0",
+    "method-override": "^1.0.0",
     "cookie-parser": "1.0.1",
     "static-favicon": "1.0.0",
     "express-session": "1.0.1",

From 896609c859758e2f71fec7862bc666caea37b2ac Mon Sep 17 00:00:00 2001
From: Fernando Silveira <fsilveira@gmail.com>
Date: Mon, 21 Apr 2014 12:10:21 -0300
Subject: [PATCH 0146/1265] Fixing bug when updating pet name in MVC example.

---
 examples/mvc/controllers/pet/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/mvc/controllers/pet/index.js b/examples/mvc/controllers/pet/index.js
index 5836a5b701e..0702d289ec6 100644
--- a/examples/mvc/controllers/pet/index.js
+++ b/examples/mvc/controllers/pet/index.js
@@ -23,7 +23,7 @@ exports.edit = function(req, res, next){
 
 exports.update = function(req, res, next){
   var body = req.body;
-  req.pet.name = body.user.name;
+  req.pet.name = body.pet.name;
   res.message('Information updated!');
   res.redirect('/pet/' + req.pet.id);
 };

From 4ac7474e4e83c3b5f8557e591bae9da54e4420d8 Mon Sep 17 00:00:00 2001
From: Andrea Giammarchi <andrea.giammarchi@gmail.com>
Date: Tue, 22 Apr 2014 17:02:54 -0700
Subject: [PATCH 0147/1265] trim_prefix causing --use-strict flag to fail

as specified in bug #2064 the `trim_prefix` function declaration within the `try/catch` causes problems when starting express with `--use_strict` directive.
---
 lib/router/index.js | 56 +++++++++++++++++++++++----------------------
 1 file changed, 29 insertions(+), 27 deletions(-)

diff --git a/lib/router/index.js b/lib/router/index.js
index 7c17884c924..7dc479e8911 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -198,39 +198,41 @@ proto.handle = function(req, res, done) {
         trim_prefix();
       });
 
-      function trim_prefix() {
-        var c = path[layer.path.length];
-        if (c && '/' != c && '.' != c) return next(err);
-
-        // Trim off the part of the url that matches the route
-        // middleware (.use stuff) needs to have the path stripped
-        debug('trim prefix (%s) from url %s', removed, req.url);
-        removed = layer.path;
-        req.url = protohost + req.url.substr(protohost.length + removed.length);
-
-        // Ensure leading slash
-        if (!fqdn && '/' != req.url[0]) {
-          req.url = '/' + req.url;
-          slashAdded = true;
-        }
+    } catch (err) {
+      next(err);
+    }
 
-        debug('%s %s : %s', layer.handle.name || 'anonymous', layer.path, req.originalUrl);
-        var arity = layer.handle.length;
-        if (err) {
-          if (arity === 4) {
-            layer.handle(err, req, res, next);
-          } else {
-            next(err);
-          }
-        } else if (arity < 4) {
-          layer.handle(req, res, next);
+    function trim_prefix() {
+      var c = path[layer.path.length];
+      if (c && '/' != c && '.' != c) return next(err);
+
+      // Trim off the part of the url that matches the route
+      // middleware (.use stuff) needs to have the path stripped
+      debug('trim prefix (%s) from url %s', removed, req.url);
+      removed = layer.path;
+      req.url = protohost + req.url.substr(protohost.length + removed.length);
+
+      // Ensure leading slash
+      if (!fqdn && '/' != req.url[0]) {
+        req.url = '/' + req.url;
+        slashAdded = true;
+      }
+
+      debug('%s %s : %s', layer.handle.name || 'anonymous', layer.path, req.originalUrl);
+      var arity = layer.handle.length;
+      if (err) {
+        if (arity === 4) {
+          layer.handle(err, req, res, next);
         } else {
           next(err);
         }
+      } else if (arity < 4) {
+        layer.handle(req, res, next);
+      } else {
+        next(err);
       }
-    } catch (err) {
-      next(err);
     }
+
   })();
 };
 

From 8d8f44f352392758d4660becd1bce147a115bb2c Mon Sep 17 00:00:00 2001
From: Fernando Silveira <fsilveira@gmail.com>
Date: Tue, 22 Apr 2014 22:46:52 -0300
Subject: [PATCH 0148/1265] Fix "method-override" dependency.

Depend on method-override@1.0.0 strictly, following the pattern for (almost) all other devDependencies.
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 4c862b6efc1..622e1bfd3a9 100644
--- a/package.json
+++ b/package.json
@@ -59,7 +59,7 @@
     "marked": "0.2.10",
     "supertest": "~0.8.1",
     "body-parser": "1.0.0",
-    "method-override": "^1.0.0",
+    "method-override": "1.0.0",
     "cookie-parser": "1.0.1",
     "static-favicon": "1.0.0",
     "express-session": "1.0.1",

From b38ffd7376a97f249001c52481fea545b5b28ab1 Mon Sep 17 00:00:00 2001
From: Fernando Silveira <fsilveira@gmail.com>
Date: Tue, 22 Apr 2014 23:30:17 -0300
Subject: [PATCH 0149/1265] Fixing bug in MVC example pet view.

---
 examples/mvc/controllers/pet/views/edit.jade | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/mvc/controllers/pet/views/edit.jade b/examples/mvc/controllers/pet/views/edit.jade
index 911a54a3088..1ccc29dc2f3 100644
--- a/examples/mvc/controllers/pet/views/edit.jade
+++ b/examples/mvc/controllers/pet/views/edit.jade
@@ -2,6 +2,6 @@ link(rel='stylesheet', href='/style.css')
 h1= pet.name
 form(action='/pet/#{pet.id}', method='post')
   input(type='hidden', name='_method', value='put')
-  label Name: 
-    input(type='text', name='user[name]', value=pet.name)
+  label= 'Name: '
+    input(type='text', name='pet[name]', value=pet.name)
   input(type='submit', value='Update')

From ce17efd95babe62369e73fc843214bc94f1ecd37 Mon Sep 17 00:00:00 2001
From: Fernando Silveira <fsilveira@gmail.com>
Date: Tue, 22 Apr 2014 23:37:49 -0300
Subject: [PATCH 0150/1265] MVC example: EJS -> Jade.

---
 examples/mvc/controllers/pet/index.js         |  2 --
 examples/mvc/controllers/user/views/edit.html | 12 -----------
 examples/mvc/controllers/user/views/edit.jade | 12 +++++++++++
 examples/mvc/controllers/user/views/list.html |  8 -------
 examples/mvc/controllers/user/views/list.jade |  7 +++++++
 examples/mvc/controllers/user/views/show.html | 21 -------------------
 examples/mvc/controllers/user/views/show.jade | 17 +++++++++++++++
 examples/mvc/index.js                         |  8 +++----
 examples/mvc/views/404.html                   |  3 ---
 examples/mvc/views/404.jade                   |  3 +++
 examples/mvc/views/5xx.html                   |  3 ---
 examples/mvc/views/5xx.jade                   |  3 +++
 12 files changed, 45 insertions(+), 54 deletions(-)
 delete mode 100644 examples/mvc/controllers/user/views/edit.html
 create mode 100644 examples/mvc/controllers/user/views/edit.jade
 delete mode 100644 examples/mvc/controllers/user/views/list.html
 create mode 100644 examples/mvc/controllers/user/views/list.jade
 delete mode 100644 examples/mvc/controllers/user/views/show.html
 create mode 100644 examples/mvc/controllers/user/views/show.jade
 delete mode 100644 examples/mvc/views/404.html
 create mode 100644 examples/mvc/views/404.jade
 delete mode 100644 examples/mvc/views/5xx.html
 create mode 100644 examples/mvc/views/5xx.jade

diff --git a/examples/mvc/controllers/pet/index.js b/examples/mvc/controllers/pet/index.js
index 0702d289ec6..c183e51c9eb 100644
--- a/examples/mvc/controllers/pet/index.js
+++ b/examples/mvc/controllers/pet/index.js
@@ -4,8 +4,6 @@
 
 var db = require('../../db');
 
-exports.engine = 'jade';
-
 exports.before = function(req, res, next){
   var pet = db.pets[req.params.pet_id];
   if (!pet) return next(new Error('Pet not found'));
diff --git a/examples/mvc/controllers/user/views/edit.html b/examples/mvc/controllers/user/views/edit.html
deleted file mode 100644
index f5b9ae9b5c5..00000000000
--- a/examples/mvc/controllers/user/views/edit.html
+++ /dev/null
@@ -1,12 +0,0 @@
-<link rel="stylesheet" href="/style.css" />
-<h1><%= user.name %></h1>
-<form action='/user/<%= user.id %>' method='post'>
-  <input type="hidden" name="_method" value="put" />
-  <label>Name: <input type="text" name="user[name]" value="<%= user.name %>" /></label>
-  <input type="submit" value="Update" />
-</form>
-
-<form action='/user/<%= user.id %>/pet' method='post'>
-  <label>Pet: <input type="text" name="pet[name]" placeholder="name" /></label>
-  <input type="submit" value="Add" />
-</form>
\ No newline at end of file
diff --git a/examples/mvc/controllers/user/views/edit.jade b/examples/mvc/controllers/user/views/edit.jade
new file mode 100644
index 00000000000..ab9cdbeeccf
--- /dev/null
+++ b/examples/mvc/controllers/user/views/edit.jade
@@ -0,0 +1,12 @@
+link(rel='stylesheet', href='/style.css')
+h1= user.name
+form(action='/user/#{user.id}', method='post')
+  input(type='hidden', name='_method', value='put')
+  label= 'Name: '
+    input(type='text', name='user[name]', value='#{user.name}')
+  input(type='submit', value='Update')
+
+form(action='/user/#{user.id}/pet', method='post')
+  label= 'Pet: '
+    input(type='text', name='pet[name]', placeholder='Name')
+  input(type='submit', value='Add')
diff --git a/examples/mvc/controllers/user/views/list.html b/examples/mvc/controllers/user/views/list.html
deleted file mode 100644
index 736025f06f6..00000000000
--- a/examples/mvc/controllers/user/views/list.html
+++ /dev/null
@@ -1,8 +0,0 @@
-<link rel="stylesheet" href="/style.css" />
-<h1>Users</h1>
-<p>Click a user below to view their pets.</p>
-<ul>
-  <% users.forEach(function(user){ %>
-    <li><a href="/user/<%= user.id %>"><%= user.name %></a></li>
-  <% }) %>
-</ul>
\ No newline at end of file
diff --git a/examples/mvc/controllers/user/views/list.jade b/examples/mvc/controllers/user/views/list.jade
new file mode 100644
index 00000000000..af8933cfe05
--- /dev/null
+++ b/examples/mvc/controllers/user/views/list.jade
@@ -0,0 +1,7 @@
+link(rel='stylesheet', href='/style.css')
+h1 Users
+p Click a user below to view their pets.
+ul
+  each user in users
+    li
+      a(href='/user/#{user.id}')= user.name
diff --git a/examples/mvc/controllers/user/views/show.html b/examples/mvc/controllers/user/views/show.html
deleted file mode 100644
index 814a11a8d84..00000000000
--- a/examples/mvc/controllers/user/views/show.html
+++ /dev/null
@@ -1,21 +0,0 @@
-<link rel="stylesheet" href="/style.css" />
-<h1><%= user.name %> <a href="/user/<%= user.id %>/edit">edit</a></h1>
-
-<% if (hasMessages) { %>
-  <ul id="messages">
-    <% messages.forEach(function(msg){ %>
-      <li><%= msg %></li>
-    <% }) %>
-  </ul>
-<% } %>
-
-<% if (user.pets.length) { %>
-  <p>View <%= user.name %>s pets:</p>
-  <ul>
-    <% user.pets.forEach(function(pet){ %>
-      <li><a href="/pet/<%= pet.id %>"><%= pet.name %></a></li>
-    <% }) %>
-  </ul>
-<% } else { %>
-  <p>No pets!</p>
-<% } %>
\ No newline at end of file
diff --git a/examples/mvc/controllers/user/views/show.jade b/examples/mvc/controllers/user/views/show.jade
new file mode 100644
index 00000000000..267d3ef7e40
--- /dev/null
+++ b/examples/mvc/controllers/user/views/show.jade
@@ -0,0 +1,17 @@
+link(rel='stylesheet', href='/style.css')
+h1= user.name + ' '
+  a(href='/user/#{user.id}/edit') edit
+
+if (hasMessages)
+  ul#messages
+    each msg in messages
+      li= msg
+
+if (user.pets.length)
+  p View #{user.name}'s pets:
+  ul
+    each pet in user.pets
+      li
+        a(href='/pet/#{pet.id}')= pet.name
+else
+  p No pets!
diff --git a/examples/mvc/index.js b/examples/mvc/index.js
index 297344b5a2f..f228a375e6e 100644
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -13,11 +13,9 @@ var app = module.exports = express();
 
 // settings
 
-// map .renderFile to ".html" files
-app.engine('html', require('ejs').renderFile);
-
-// make ".html" the default
-app.set('view engine', 'html');
+// set our default template engine to "jade"
+// which prevents the need for extensions
+app.set('view engine', 'jade');
 
 // set views for error and 404 pages
 app.set('views', __dirname + '/views');
diff --git a/examples/mvc/views/404.html b/examples/mvc/views/404.html
deleted file mode 100644
index 5710154e153..00000000000
--- a/examples/mvc/views/404.html
+++ /dev/null
@@ -1,3 +0,0 @@
-<link rel="stylesheet" href="/style.css" />
-<h1>404: Not Found</h1>
-<p>Sorry we can't find <%= url %></p>
\ No newline at end of file
diff --git a/examples/mvc/views/404.jade b/examples/mvc/views/404.jade
new file mode 100644
index 00000000000..110c471f1b9
--- /dev/null
+++ b/examples/mvc/views/404.jade
@@ -0,0 +1,3 @@
+link(rel='stylesheet', href='/style.css')
+h1 404: Not Found
+p Sorry we can't find #{url}
diff --git a/examples/mvc/views/5xx.html b/examples/mvc/views/5xx.html
deleted file mode 100644
index 2d810558dd5..00000000000
--- a/examples/mvc/views/5xx.html
+++ /dev/null
@@ -1,3 +0,0 @@
-<link rel="stylesheet" href="/style.css" />
-<h1>500: Internal Server Error</h1>
-<p>Looks like something blew up!</p>
\ No newline at end of file
diff --git a/examples/mvc/views/5xx.jade b/examples/mvc/views/5xx.jade
new file mode 100644
index 00000000000..3508b7c0e2a
--- /dev/null
+++ b/examples/mvc/views/5xx.jade
@@ -0,0 +1,3 @@
+link(rel='stylesheet', href='/style.css')
+h1 500: Internal Server Error
+p Looks like something blew up!

From 30d18888b952b0806b90b5863a609b3878760bad Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Apr 2014 15:45:50 -0400
Subject: [PATCH 0151/1265] update connect to 2.14.5

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 352f4d9b239..26dc4b365a3 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
     }
   ],
   "dependencies": {
-    "connect": "2.14.1",
+    "connect": "2.14.5",
     "commander": "1.3.2",
     "range-parser": "1.0.0",
     "mkdirp": "0.3.5",

From c7791a207bf463d752627c83b5f3a417694fcb8d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Apr 2014 15:00:07 -0400
Subject: [PATCH 0152/1265] update send to 0.3.0

fixes #2024
closes #2071
closes #2072
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 26dc4b365a3..686360bff9e 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "buffer-crc32": "0.2.1",
     "fresh": "0.2.2",
     "methods": "0.1.0",
-    "send": "0.2.0",
+    "send": "0.3.0",
     "cookie-signature": "1.0.3",
     "merge-descriptors": "0.0.2",
     "debug": ">= 0.7.3 < 1"

From 55dea47b94b5c472c96a4d5d162c133fb3088204 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Apr 2014 16:20:31 -0400
Subject: [PATCH 0153/1265] update mkdirp to 0.4.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 686360bff9e..aab793d329f 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "connect": "2.14.5",
     "commander": "1.3.2",
     "range-parser": "1.0.0",
-    "mkdirp": "0.3.5",
+    "mkdirp": "0.4.0",
     "cookie": "0.1.1",
     "buffer-crc32": "0.2.1",
     "fresh": "0.2.2",

From 90fbc1a33ed60819d9beb4ef2dee747c9f281986 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Apr 2014 16:21:22 -0400
Subject: [PATCH 0154/1265] update cookie to 0.1.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index aab793d329f..dea173b7676 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "commander": "1.3.2",
     "range-parser": "1.0.0",
     "mkdirp": "0.4.0",
-    "cookie": "0.1.1",
+    "cookie": "0.1.2",
     "buffer-crc32": "0.2.1",
     "fresh": "0.2.2",
     "methods": "0.1.0",

From 5d8dba5fe0ffaca4843ca4822f1ab033c6a53afc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Apr 2014 16:23:58 -0400
Subject: [PATCH 0155/1265] update mocha to 1.18.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index dea173b7676..d4c9ae317c9 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
   },
   "devDependencies": {
     "ejs": "~0.8.4",
-    "mocha": "~1.17.1",
+    "mocha": "~1.18.2",
     "jade": "~0.30.0",
     "hjs": "~0.0.6",
     "stylus": "~0.40.0",

From 8894e30869e1015b0abc5d8efe202347314f0131 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Apr 2014 16:27:00 -0400
Subject: [PATCH 0156/1265] Skip publishing benchmarks dir to npm

---
 .npmignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.npmignore b/.npmignore
index caf574de4de..5f64c32ba84 100644
--- a/.npmignore
+++ b/.npmignore
@@ -1,4 +1,5 @@
 .git*
+benchmarks/
 docs/
 examples/
 support/

From 972c01afc993aa117d6f83e9f275deb8aee2830a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Apr 2014 16:30:58 -0400
Subject: [PATCH 0157/1265] update supertest to 0.11.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index d4c9ae317c9..e4e488d40f9 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "should": "~2.1.1",
     "connect-redis": "~1.4.5",
     "marked": "0.2.10",
-    "supertest": "~0.9.0"
+    "supertest": "~0.11.0"
   },
   "keywords": [
     "express",

From d5815922caca984435cbd4d75aeaf12afe73b8cb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Apr 2014 16:36:37 -0400
Subject: [PATCH 0158/1265] 3.5.2

---
 History.md   | 26 ++++++++++++--------------
 package.json |  2 +-
 2 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/History.md b/History.md
index 30ceafcdd1a..4b9066f4e3f 100644
--- a/History.md
+++ b/History.md
@@ -1,17 +1,15 @@
-4.0.0 /
-==================
-
- * remove:
-   - express(1) - moved to [express-generator](https://github.com/expressjs/generator)
-   - `req.accepted*` - use `req.accepts*()` instead
-   - `app.configure` - use logic in your own app code
- * change:
-   - `req.accepts*` -> `req.accepts*s` - i.e. `req.acceptsEncoding` -> `req.acceptsEncodings`
-   - `req.params` is now an object instead of an array
-   - `json spaces` no longer enabled by default in development
- * refactor:
-   - `req.accepts*` with [accepts](https://github.com/expressjs/accepts)
-   - `req.is` with [type-is](https://github.com/expressjs/type-is)
+3.5.2 / 2014-04-24
+==================
+
+ * update connect to 2.14.5
+ * update cookie to 0.1.2
+ * update mkdirp to 0.4.0
+ * update send to 0.3.0
+
+3.5.1 / 2014-03-25
+==================
+
+ * pin less-middleware in generated app
 
 3.5.0 / 2014-03-06
 ==================
diff --git a/package.json b/package.json
index e4e488d40f9..1f8811e0f42 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.5.1",
+  "version": "3.5.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From 2fd3e72a19aaeca9c5916df643758bed8c1a8697 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Apr 2014 15:17:22 -0400
Subject: [PATCH 0159/1265] Pass options from res.sendfile to send

fixes #2017
---
 lib/response.js      | 10 +++++++---
 test/fixtures/.name  |  1 +
 test/res.sendfile.js | 24 ++++++++++++++++++++++++
 3 files changed, 32 insertions(+), 3 deletions(-)
 create mode 100644 test/fixtures/.name

diff --git a/lib/response.js b/lib/response.js
index 778dcc742ae..8a89d8a1f0d 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -256,6 +256,9 @@ res.jsonp = function(obj){
  *
  *   - `maxAge` defaulting to 0
  *   - `root`   root directory for relative filenames
+ *   - `hidden` serve hidden files, defaulting to false
+ *
+ * Other options are passed along to `send`.
  *
  * Examples:
  *
@@ -331,10 +334,11 @@ res.sendfile = function(path, options, fn){
     req.socket.removeListener('error', error);
   }
 
+  // Back-compat
+  options.maxage = options.maxage || options.maxAge || 0;
+
   // transfer
-  var file = send(req, path);
-  if (options.root) file.root(options.root);
-  file.maxage(options.maxAge || 0);
+  var file = send(req, path, options);
   file.on('error', error);
   file.on('directory', next);
   file.on('stream', stream);
diff --git a/test/fixtures/.name b/test/fixtures/.name
new file mode 100644
index 00000000000..fa66f37ff21
--- /dev/null
+++ b/test/fixtures/.name
@@ -0,0 +1 @@
+tobi
\ No newline at end of file
diff --git a/test/res.sendfile.js b/test/res.sendfile.js
index cdc869545a6..3df68770a00 100644
--- a/test/res.sendfile.js
+++ b/test/res.sendfile.js
@@ -110,6 +110,30 @@ describe('res', function(){
   })
 
   describe('.sendfile(path)', function(){
+    it('should not serve hidden files', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.sendfile('test/fixtures/.name');
+      });
+
+      request(app)
+      .get('/')
+      .expect(404, done);
+    })
+
+    it('should accept hidden option', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.sendfile('test/fixtures/.name', { hidden: true });
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, 'tobi', done);
+    })
+
     describe('with an absolute path', function(){
       it('should transfer the file', function(done){
         var app = express();

From 9863fa0903b7094ef63d9d7a6681128b1bcdb86f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Apr 2014 16:46:51 -0400
Subject: [PATCH 0160/1265] update serve-static to 1.1.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 5d01363daf4..bd8653ca45b 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "utils-merge": "1.0.0",
     "escape-html": "1.0.1",
     "qs": "0.6.6",
-    "serve-static": "1.0.4",
+    "serve-static": "1.1.0",
     "path-to-regexp": "0.1.2",
     "debug": ">= 0.7.3 < 1"
   },

From ce8555c6906a5b5688c6802d206d4fc7cb0daf83 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Apr 2014 16:51:49 -0400
Subject: [PATCH 0161/1265] update should to 3.3.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index bd8653ca45b..0752dcdb89a 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,7 @@
     "jade": "~0.30.0",
     "hjs": "~0.0.6",
     "stylus": "~0.40.0",
-    "should": "~2.1.1",
+    "should": "~3.3.1",
     "connect-redis": "~1.4.5",
     "marked": "0.2.10",
     "supertest": "~0.11.0",

From 203fb05d3e90b7e22d3660aee6046b77577ff62c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Apr 2014 17:05:20 -0400
Subject: [PATCH 0162/1265] update example dependencies

---
 package.json       | 15 +++++++--------
 test/app.render.js |  2 +-
 test/res.render.js |  4 ++--
 3 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/package.json b/package.json
index 0752dcdb89a..8768f819393 100644
--- a/package.json
+++ b/package.json
@@ -49,20 +49,19 @@
     "debug": ">= 0.7.3 < 1"
   },
   "devDependencies": {
-    "ejs": "~0.8.4",
     "mocha": "~1.18.2",
-    "jade": "~0.30.0",
+    "body-parser": "1.0.2",
+    "connect-redis": "~2.0.0",
+    "ejs": "~1.0.0",
+    "express-session": "1.0.3",
+    "jade": "~0.35.0",
+    "marked": "0.3.2",
+    "static-favicon": "1.0.2",
     "hjs": "~0.0.6",
-    "stylus": "~0.40.0",
     "should": "~3.3.1",
-    "connect-redis": "~1.4.5",
-    "marked": "0.2.10",
     "supertest": "~0.11.0",
-    "body-parser": "1.0.0",
     "method-override": "1.0.0",
     "cookie-parser": "1.0.1",
-    "static-favicon": "1.0.0",
-    "express-session": "1.0.1",
     "morgan": "1.0.0",
     "vhost": "1.0.0"
   },
diff --git a/test/app.render.js b/test/app.render.js
index a9586c77c68..718d869e801 100644
--- a/test/app.render.js
+++ b/test/app.render.js
@@ -74,7 +74,7 @@ describe('app', function(){
         app.render('user.jade', function(err, str){
           // nextTick to prevent cyclic
           process.nextTick(function(){
-            err.message.should.match(/user is not defined/);
+            err.message.should.match(/Cannot read property '[^']+' of undefined/);
             done();
           });
         })
diff --git a/test/res.render.js b/test/res.render.js
index 83f3662529d..6d576dc23b7 100644
--- a/test/res.render.js
+++ b/test/res.render.js
@@ -94,7 +94,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect(/user is not defined/, done);
+        .expect(/Cannot read property '[^']+' of undefined/, done);
       })
     })
 
@@ -265,7 +265,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect(/is not defined/, done);
+        .expect(/Cannot read property '[^']+' of undefined/, done);
       })
     })
   })

From 374e6c3789911c14b1e9c7b2150b80f934e6b5d3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Apr 2014 17:50:20 -0400
Subject: [PATCH 0163/1265] fix multipart example

closes #2061
---
 examples/multipart/index.js | 60 +++++++++++++++++++++----------------
 package.json                |  1 +
 2 files changed, 36 insertions(+), 25 deletions(-)

diff --git a/examples/multipart/index.js b/examples/multipart/index.js
index a037f3361b1..24430109fdb 100644
--- a/examples/multipart/index.js
+++ b/examples/multipart/index.js
@@ -3,28 +3,11 @@
  */
 
 var express = require('../..');
-var bodyParser = require('body-parser');
 var multiparty = require('multiparty');
 var format = require('util').format;
 
 var app = module.exports = express();
 
-app.use(bodyParser());
-app.use(function(req, res, next){
-	console.log(req.method);
-	if(req.method === 'POST' && req.headers['content-type'].indexOf("multipart/form-data") !== -1){
-		var form = new multiparty.Form();
-		form.parse(req, function(err, fields, files){
-			req.files = files;
-			next();
-		});
-		
-	}
-	else next();
-	
-});
-
-
 app.get('/', function(req, res){
   res.send('<form method="post" enctype="multipart/form-data">'
     + '<p>Title: <input type="text" name="title" /></p>'
@@ -34,16 +17,43 @@ app.get('/', function(req, res){
 });
 
 app.post('/', function(req, res, next){
-  // the uploaded file can be found as `req.files.image` and the
-  // title field as `req.body.title`
-  res.send(format('\nuploaded %s (%d Kb) to %s as %s'
-    , req.files.image[0].name
-    , req.files.image[0].size / 1024 | 0
-    , req.files.image[0].path
-    , req.body.title));
+  // create a form to begin parsing
+  var form = new multiparty.Form();
+  var image;
+  var title;
+
+  form.on('error', next);
+  form.on('close', function(){
+    res.send(format('\nuploaded %s (%d Kb) as %s'
+      , image.filename
+      , image.size / 1024 | 0
+      , title));
+  });
+
+  // listen on field event for title
+  form.on('field', function(name, val){
+    if (name !== 'title') return;
+    title = val;
+  });
+
+  // listen on part event for image file
+  form.on('part', function(part){
+    if (!part.filename) return;
+    if (part.name !== 'image') return part.resume();
+    image = {};
+    image.filename = part.filename;
+    image.size = 0;
+    part.on('data', function(buf){
+      image.size += buf.length;
+    });
+  });
+
+
+  // parse the form
+  form.parse(req);
 });
 
 if (!module.parent) {
-  app.listen(3000);
+  app.listen(4000);
   console.log('Express started on port 3000');
 }
diff --git a/package.json b/package.json
index 8768f819393..bb296da79d7 100644
--- a/package.json
+++ b/package.json
@@ -56,6 +56,7 @@
     "express-session": "1.0.3",
     "jade": "~0.35.0",
     "marked": "0.3.2",
+    "multiparty": "~3.2.4",
     "static-favicon": "1.0.2",
     "hjs": "~0.0.6",
     "should": "~3.3.1",

From 1536a2196e695523f991a5dab2d99d3702bd6007 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Apr 2014 17:58:54 -0400
Subject: [PATCH 0164/1265] preserve casing of headers in res.header and
 res.set

fixes #2063
---
 lib/response.js | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index 8a89d8a1f0d..dcf8913a494 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -519,8 +519,7 @@ res.header = function(field, val){
   if (2 == arguments.length) {
     if (Array.isArray(val)) val = val.map(String);
     else val = String(val);
-    field = field.toLowerCase();
-    if ('content-type' == field && !/;\s*charset\s*=/.test(val)) {
+    if ('content-type' == field.toLowerCase() && !/;\s*charset\s*=/.test(val)) {
       var charset = mime.charsets.lookup(val.split(';')[0]);
       if (charset) val += '; charset=' + charset.toLowerCase();
     }

From dbea8312bbd6b59e5d78e145696a876c7397a332 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Apr 2014 18:08:41 -0400
Subject: [PATCH 0165/1265] 4.1.0

---
 History.md   | 12 ++++++++++++
 package.json |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index fe680ee8f9f..c78d6f055aa 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,15 @@
+4.1.0 / 2014-04-24
+==================
+
+ * pass options from `res.sendfile` to `send`
+ * preserve casing of headers in `res.header` and `res.set`
+ * support unicode file names in `res.attachment` and `res.download`
+ * update accepts to 1.0.1
+ * update cookie to 0.1.2
+ * update send to 0.3.0
+ * update serve-static to 1.1.0
+ * update type-is to 1.1.0
+
 4.0.0 / 2014-04-09
 ==================
 
diff --git a/package.json b/package.json
index bb296da79d7..5c89aecbe80 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From c0545813706ffa17161293af00fe39b7f2f43fe2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 27 Apr 2014 19:44:05 -0400
Subject: [PATCH 0166/1265] fix package.json to reflect supported node version

closes #2080
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 5c89aecbe80..83041b2cbec 100644
--- a/package.json
+++ b/package.json
@@ -83,7 +83,7 @@
     "test": "make test"
   },
   "engines": {
-    "node": ">= 0.8.0"
+    "node": ">= 0.10.0"
   },
   "license": "MIT"
 }

From 61f2929a35b7588ee707c02ab64512c3fac5f61f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 27 Apr 2014 19:49:05 -0400
Subject: [PATCH 0167/1265] 4.1.1

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c78d6f055aa..291d7bba6fa 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+4.1.1 / 2014-04-27
+==================
+
+ * fix package.json to reflect supported node version
+
 4.1.0 / 2014-04-24
 ==================
 
diff --git a/package.json b/package.json
index 83041b2cbec..2753dff5e93 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.1.0",
+  "version": "4.1.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From 3c7310ebcbee1d65f47e6c6115ade2fa4cbd5b59 Mon Sep 17 00:00:00 2001
From: Tiago Relvao <relvao@gmail.com>
Date: Mon, 28 Apr 2014 10:54:51 +0100
Subject: [PATCH 0168/1265] Include ETag in HEAD requests

fixes #2083
---
 lib/response.js  |  2 +-
 test/app.head.js | 23 +++++++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/lib/response.js b/lib/response.js
index dcf8913a494..8260a73b579 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -130,7 +130,7 @@ res.send = function(body){
 
   // ETag support
   // TODO: W/ support
-  if (app.settings.etag && len && 'GET' == req.method) {
+  if (app.settings.etag && len && ('GET' == req.method || 'HEAD' == req.method)) {
     if (!this.get('ETag')) {
       this.set('ETag', etag(body));
     }
diff --git a/test/app.head.js b/test/app.head.js
index 41e12916d0d..9ba2ad9a911 100644
--- a/test/app.head.js
+++ b/test/app.head.js
@@ -16,6 +16,29 @@ describe('HEAD', function(){
     .head('/tobi')
     .expect(200, done);
   })
+
+  it('should output the same headers as GET requests', function(done){
+    var app = express();
+
+    app.get('/tobi', function(req, res){
+      // send() detects HEAD
+      res.send('tobi');
+    });
+
+    request(app)
+    .get('/tobi')
+    .expect(200, function(err, res){
+      if (err) return done(err);
+      var headers = res.headers;
+      request(app)
+      .get('/tobi')
+      .expect(200, function(err, res){
+        if (err) return done(err);
+        assert.deepEqual(res.headers, headers);
+        done();
+      });
+    });
+  })
 })
 
 describe('app.head()', function(){

From 5c3852b91c17fa66d25527045f49aa6f50ee7e41 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 2 May 2014 09:00:33 -0400
Subject: [PATCH 0169/1265] tests: remove unused image fixture

closes #2091
---
 test/acceptance/fixtures/grey.png | Bin 122924 -> 0 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 test/acceptance/fixtures/grey.png

diff --git a/test/acceptance/fixtures/grey.png b/test/acceptance/fixtures/grey.png
deleted file mode 100644
index cbf19561340da0979439c03b82d5753b819b9519..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 122924
zcmV)HK)t_-P)<h;3K|Lk000e1NJLTq00A=q00ABd0ssI2X$WQE000&dX+uL$Nkc;*
zP;zf(X>4Tx09b{USO-v4OPB6Dkr{>|=bUrSIp>_Cz>ss!s6>&Z1OX+91VIqNL=X`X
zK?D&&1q^@$kz@cB1W7wQ-@bphcK_PiQ`Obqoa%eJ=YFSepRWO+Hz9<D1;Ho)2o8yg
zu+rD!aBy_uKu-f0KmrOt319@z$S_R{3ls2fZF>?x$NekO<5>TG-2ZBnUfz+O06-Q*
z9O@P68BD~zM6BZ(77+yi3_-*^u~A{iSb&IWB8UqlVwGd;`v)ICOXKked;K-W#!8!r
z;{YJR5eN~!0ASOJevTMVUt%0=9RMh*5HJ4_04O?%Sk2RqKzxpFhd4$gI5?Du>3N7)
zz~jHf@%?WxJ^qPFAo%`+|NNJ~j8;1|C^Uk@L|cbLn-Jvh5kZLZ_WFOmoBz{-gQEX)
zzGDV(-XXTu$Ll6G7N8A6K@hP;01jY6{G~(ewE=<X^9LS8F9AdWZ{QW>9T#;RKsz)n
zKEmJEFN#Bx$fCChhhd1Pm<WfIgrpQW&WS(M{IL3KCW!9EzkJ>+0H_c%2s8FCU%&+b
zng)pPG5cRWK4$<JMF6<<(la_D=8x}~USg(U0Xd)njDQVr6IU+^q<|by1{y#Y7y)x&
z0~~=X@C1G!n7Hm(a1x||43GozK`|%;RiGAJ12@2J&;h!^Bk%+~17lzUya#h&39N$+
zunqPg2tq?-5H-XIu|vF&FeC*jKx&XKWCB@1j*vU#3xz<@&`Br_%7F@@GN>AAgl<9i
zphwUUG!DIm=Al*SJM<d{hv8r}Fjg2JOdO^F(}WqrY+xr~zOZmu0xTVN9(D;<18au0
z!ydt&!6smHuyxoL9KcE8bZ}0%C|m)q4L657!F}Kn@YC>YcnQ1)-U9D}55ix;=ir~=
zy9gA58o_}OMJOW-5Vi<UL^$F!A{SAHxQ1v)^dnv&<`El+LnIlJ1u2YFLK-3+kiN)R
zWCpSXS&wW(4j?CxOUP{$3Pp$FN6DiMP>!eoR3a)DRf%dv^`gd6i>NI$8qJ6nMysOD
z(FAl9Is;vbZbm;uzeF#gcSuM{*h!>F^hlgYLP%0cN=TYWdPrW9ER*bEC@{PjC5$=7
z3lopY!_;BAFfTAmm^~~dmLIE%wZR5pQ?Qq?E!Y9<H1-E6DJd7JBB>>*KWQ@QCDNOu
zPf6!VcX3oWA)GeO1s9Dwk88m7;@;wZkdcw`k!g@QkwuZ6Cu<~oOg2llgQv!e;SKR#
z_#}Kez8(J(|CJm=&P%RI?n<6OUP69{`~~@E3Je7wg*F9&;xt7$#XX8CiY-cNN=Zs{
z%3#V|$|lMo$`vX!6(5x@l^0byRV~$HszquzH8-_3wI_8NbshBp^%4z=hM&feCV(b~
z<_66u%?2$MtqiRlZ5(Ym?E~65IyfC4ogrNiT^`+Sx=Fg<^sMxn^xpJY^eyx+>3=aW
zGiWe)Gh{QgGE6Z1X5?VhWej92VC-O=VL~toF<COjGF@gGVEW8V!>r8g$(+r6oB16J
zj75mWiY1YymSu!xi<OO4pEZoNl=U&|XEr)E4YmNbBDNm3Rd#B2HFkgYBKC*uYaFy3
znjAqKmpJ-4HaJ;04LGAYt2swG_qh1EY`IdoTDfMpvD^yWKHNpzecT&7>^!DCCwZ>(
zyyM02D)9R8UgRC*{l&-6XU}(*uY+%epMl?yKY{-`|Fi&^fVx1qK#jm_L6o3^V4z^7
z;Fu6hNLI*Cs9flUFicoZ*k8C(cw7W2q9_s~QX?`YiWAiojS;;rIxj{iW+Ij<)*<#)
zoJZVAyg+<V{7^zxB1oc6;=Lr5q>*H*WS8W3DIqCOsdA~;(qz(l(n->t(wj2EGTt(m
zW!}hA%bLobmF<%~kdv2-kZX}!mFJOnm#>hYQlL?=P{>tys)$t7QcP0pR@_yRQ;Jf$
zt@KS<R5?(&NqI$uU&ULcPGwP*OO>EntvaX1q2{i3MQu)<Q=On*qrRZQt>L9nud%Et
zs2QNytoc<-LMuY6P3xDolJ+U>ULClOzD~Bzs4kVRt!|m_tR9!1uikaN4SiYtMEza^
zq=B(Pfx(m^tD&c1qv3{;ywNG6eq)@mwQ-s8f{Bnxgh`hv%+$#Ag6XswuUUv$hdD4e
zG{0azW5I6`ZgJldWocnqZu!Yd((0tupf$C%n{|`*wvCoep3Qq(0o!QXK09(d7rREg
zU-mloh4ym};tr=Ao;fl(`a5<yp`GlU>YcWnb)Acymt16BGF&E4@Slh~G33hR8sz%G
zjogjkcE=s*ZtvdYzE3bG)DX5j3_U75HaxXGFM6(fX?PWRt$M3^7kV%IsQMK8toW+>
zUhrM@Q}-+J`|PjnU*^9VU=UCh@GH<fup#g$$Udkwm?YRe_+AKANMJ~RC|hV;=y;fL
zSVq`fxKem=_(p_rM13R_c_OkiiiUXjjzkMYpNXE2QHv>$*@?A_y%R?n7ZNuTFBG2@
zznq|#a5WK;=$Y7elJjKB$@x>7r>ajwr#(*hC2=RECoLuGCtpj!rUa%uPnAe5O#PW=
zpVpPmnx34#ct-!s^$dJQM8?!v<+D|ph)n;?(Jbk#(yYU5uk7I*iJX$0{anx7;d7Gb
zE}c6%?{j`MPcH9rJ}N&Xf3iTm;94PNVM5{J1=9=dMI1%hML&z(iib*MN~$hmFGgRS
zyJT{yvy`VazjVLMuWX`RtGu;>r6Q~1SEX0w%gY*<TdG*Aa;kn`@xSt>TEDuzhOefi
z7F8Ql`>D>ZZt$wY)y8_J`keZMhLDE2YgX6#8|51tn^>CiuEVZJUteu@X&$?wbEC6G
zw57V0t~KW-xEXzO?Uwtk$=k-a`|c>*X}QaLx1x=@ExR3Rk8j`T@avfCbnG0zXLPTx
zOS!A<zS#YSZqDxV2ec3Jdaym|Jx31{9&Yu9^?rWj`)IMxt?&I~hsUq`E&E3Yj0c`R
z(R=cEP;>C%Q`M*4LrO#Uh82c8p2<CHACVntdoKIDZB%Zw{e}FC&N0QYu5p#|o|oz`
zAHC9f_2jkT>t_>Y6XTP%lW(S6rsm#wy;*r1^mg-I%)7n!$<xT`>=}xgl3AA7nh$~>
zTIb~E9?a{^k1SX(ykGQOT>lvPaepcO6WOPdW%lL96{(f(RlU`*HRrXZ^|1B5&lz7R
zzf^n`_<Hx7#<!6ThmEDph|Qz#xjz_xH2jqL*|%k}HM<?Wz4t47hjHiHuEOr%Z~NcN
zd$IfI{YwXe2VIB8hto&FM@M0V2*O{b0G!xhK0W|^ZvcSI5di8jVqJy*Q?vbTaANTR
zBldQXE=&`yfM7skQ6y*y5=TrL_8|^MM!<JaU@3#BhG}GJE9e13Amb>r97{gyI=co(
z9_KhWmPe7-kuQ)xSinV4ONdoyQ}~HUsc4{>syLbW2Z>h6WGPE&PU$Z)_hiq=S<17>
zFDbMr#wlqkW0ha2RH%BXiKu;7@6b4@silR}`k>vT)1+IeSD=5|fMBR@#9*{(JYv#f
zT4`2o-fgjHg|ue0VX~#LgWK)f?>Pb|j5FSa>;&S(mg|Dsn0qhbjz_&`saLjlypON1
zjh~jkOn^`zXAomBc?dk@XXrxMSor;jy2$fUNzoZGZE=Wr?}Xly;1u6!r6j{-=alHw
z^J&HDiDzWaEN0}LwaDbnBFzRluw2S>0_WB8%<}CEoC=*TI273x+mu*dG`nP6s$Zs6
zu2!K~DScVAO6ZD2wQ)^a?c7zv`sRl9M#?7M>ypjNH*{J|TkUVU-SWE~b|?1k>9*AN
zGaZ?oIrs9qitkr+*FU)1Gw^V#cka<-U+ZI^eun<110_#l2YsHN7_uL>d}chN|J-2I
z=0*6}mGQT)NMDOjXipkW>Aq2T%li)hZukAl^qZMSv$Y@6=6vUE7t9t-KbkL@e==HD
zT%li?Tg_gRS({tG_Br8;!B>*6jo<XYEpF6q#(j7FVgA!}D`2~C=j`u}1D&IzzxkJh
zBjBruIpiX0g9MI|!}^g{;O6i`<gpY_s2Hi^X<pMw(Wf%ZFv&7!u#B-Wu{&@SaCUP|
zb8qo%^RDqd=dTrr5L6Q)5qd3LB@!SiD|#sQMEtyjy(GKjvQ&$7jEt%*Bs(CNEpM(s
ztuU!rs^qN9syt210v9z#wJG(B8qS)0ntNIk+P8Fab-nde^eOc}8FU*K8^suVn|PS|
znT47MTX<NSTPa%$*)ZGU?O=A>_R9{Fj*p#MoXcIZPb9edyE(Y)5X3zgJR#3DuL<vd
zpElomzY_oSfY3n4AdO)D5HeyW%!kc}|BU2}a*HmFc@+C5ZZZCI!tP1ZQ*5UNk~or4
z$sbbMQuERx(p}HkW;mSn&rHjz%)XJ+mfL>r?)h7JH}V?`t`=UoP+nAAoL7={G4)b>
zX=s^mxqn4+<-;n$E7xlHYYXdMUEOWKUt?<IZW1Eqf&2}%7M)hpn~t}FZfD%7z1!0^
z-agy0()ptcexJTu_<?ed#zXmD&PT9E3w?u++xi;@%Ae#9o_U%u6fqq2ENi5Dl<vi;
zv6+`luhd`LO!!PDPhEZU;_c7(RMVm}CbMB5F3#Pbf4MNbxbSiP6Ozb&%If$!<!6a6
zvS0bWk$>CS__R6oefY<{pVeDQ+jhVBe{Jt{?<V|K-ox$d9IXD$zZkR*tAx8E1d(Xu
zCTbPEMzVm}B*o%*$u#j!<S7)*l;c!KG`zIBbOH2d7^)cWG7T_4WqHDSpRJlbjzf#%
zH)kD}G1oeGCJ#SPAFnI#E?*J91plyruOM2mLC8R8SvW&PKx9DFQw)ezimQmfk%%T%
zH?2}8QY+GFGHf!PvR1O6<<7{n%Xbi~mKDV$B|4?+%9_eARXkO`swS$T)yman)F(9(
zG}$yewam5NYWry)>D1_2=wb98>z_1`F<3LKF>*0xFrG9iHnlb*HybifvrxA9Y1wKO
zXw7f^(Wct=gdL;ZYx_J01BWBWHm4wG9_JaCk`rbpwq1+dc-`*0Yr4N9#CdReydi!^
z{Jiyj<b4(W4E+fK!GVMz^<awN>5!|T!C|st`{9oxvLh{`XrtaoSH*b6^2L6NyBx0@
zKb;ViNR#;L<o#1Ur~8v0C*MnHOf5-EOAkHcoS}PGC=;3aI;%9>DTgO#FL&<T^Yi!e
zuH>ICa4uB3z;t1^XtMZr$;FH3E)|wmm)$9UQt_s8?eg9gvTBYR=~{z2m#d-mryH`a
z<u)ca5w6QO<D0+V_|md_6L*X4w$vSqyNPXg+jlw@?}c@h-oM%1`QU!f(8H}q`hEBM
ztp~OSONOL}Uyqy{bssZ)srg!KGUzRSdVOJZZR_XmG5>$G`>~<q0Jx9>fI|iVw(0;B
z^b>XF1W|Wl0k9wgz(x_k_<R5iHv%A~`G3w2h<Mtd04bmZ41gW*0|}r+)W_z)3HX3W
zqPoljmq82Y0WZKj_(@cbERZCm54l0HPyy5oJ%v8OP%r_Q2`my;Nz{2qL|qpHzXv}=
z=p!y57Ld}&OymcY5~>unM^sqDB=RH;7-mcXmK2*siY3j*G2t4>WXQVls`xH)1@ik8
z1{Cipqo^pTZcyt`kJH%DjMJLazNB-b+o3OIP-U29JjKM!)Wz(|f??@qjbW2v`@w#j
zBZ5<wbDwLFyM)J&SA`GHH^+ZRAXCsoNK=?k1TV5D`c>?s_=H58WTKR$)U0%-jI7Kz
z*-p7a`FI5{MH3|nWqK97s+d~2hOp*2ts(7ix+HqE`iurFhCD_x#%3nrrkBk6&A(f6
zTiIKmw;8lU*y}iCIF2~exp<sta{cIzB2apuJhnWSyr#X^e98Tc{fh&ZgH(cxLcWF>
zg*QdwqQax!#p=a%CWt21pW--Oo=lfgkcLf9IkR;(AagxCCpY+fTLI+-rlKz;jhEcY
z=*q_`&sFJP*{aE_qq&+{zkMyR@%#1s8@jEOH#cv8y1UZ8-nrbh*uD9X{*m@$*8%rI
z>ml`L;?D(N$c=}*+L=PU!%SCwpq}qp!mpfM*Zk7@ZST9>PrYsIuX8)YyDPt!_TKK_
zJ;*=wIFk75`*F-a8sGpGU<8~%2uK4}U;u1@I|v4eAPba&MsN>212bR)LPAWC#9!>k
zLq*U{XcYPaBZo=DoM36N+pr}#JKPOk2mg$aL!=`nkb=k*<TR1{ax_5up(jXmNjfp&
zm?o?swwY9h^dZgyw@4O;$KZ>}ImvGl_3L}eSSmWI4r)8<FEpoUv9y=yMCpd<LmB89
zdKvwhXqbALLs@uOrddnb9M~Dy-*QxPdT~i`1Mb&6*Ll<VT=->(T5e5nMCcCj6w4D$
z6FVs$CE+QlA%&9~mClwimZg{7lzS^bsL-xhqm-+hpc12+rPitbOH*3QOFKuWUbkKE
zzW#lK2ZlpN^CmD;Au~JkGZr0|pRIXp+-xiDW*xX31Dx7j&?oF&%iIRs#|eENjh>la
z{@zwT2ELAdss6ozWI-Om-Jwij3E?x5T2YNL<gsCK&k{HjV@{5pmQAWlVNNYd$DT>d
z_?$_|TF6N_Cy@uspDDam6jLH|@q6j5^5{yX%fGMG*GSb?)-BibH~3w<*+hT6;)ZI=
zmz$-x74M9;5!&}UYq~7E!Gp$!CcT?|Rs9}Ml%8@9Bc45f9`gb<mi-d<s%FA%%Jgl}
z`-Yk2IrasMk13yeR_WLCzw&K7|53D^yKA^7wSW2G<KgDt{38GcP!M-NClCg5KpR*9
zS0eYPh&#U;+yzg;EOFoCAU;R~Isqj@<<J9Y9)=;ZPJk7|#^AJYZ}<ZQ3nCe@hIB+e
zM`@!TpjFY2NK8m(Fp*et>`hWT930m{7LJ$1?~o5rlu|}hIZ_+a7|~kN8PUr#2r|kt
zxiQDHM6r6X*|3{&m~xtOnQ)u(Sn;~?Me?5$XcBxXv?@X-Dlg_EUM4Xq#U$+|(<-|s
zZ=vv9DNDss4XK{5v9D#UoknD^L$6!E$6(ZO&)C?c-Av59*;34^-A3DX(mvP`>(uOG
z=St~L>fz?)?ETSK*)PZcQ=nDQNQi0Z%W&t2m8irRw%FPDCyBkMDwAxJf2UTb+hwqy
z-N<^7lY7o5Prrb%@L7>h@%F{EQp&QL3c1SXRX){FO+}r;)rp4aM&_oc%}Fi#H^p!3
z-A!t*>CEeL?52M(^|1Vr<70IH)h9B8_lI<cr$*vN#mC^|8?RO-#-|G2^1rKme>kH%
zoBiS0Jo$p{;+2o9pCp$9SFWr+U0eH%{KE28;+xKf{U+hN*AI)ITtBzA&TX@7H~mul
zRrYIl$9|`Mmu@#=w|#f-x5n@E-$Q%&J?p)Tdt>_~`x^Uk`?vO24>%7T4+;;44-O6`
z54{dA9zHufJd!-}KDu-?a?F3EkF?aETT`4C0La;+qaS<#pbG&wC^$OWt2sJ4s3nSx
zX#jeI{@e%ub=FV-P_c20hB?ds$6f4y0C=++P^Uuq-T(jq32;bRa{vGf6951U69E94
zoEQKAAOJ~3K~#90)V=AKB)5?#_%j3CJtDIXQoKa9G_9WA<I8@S|Nrg0dHZ2@dwP3j
zwA(%1Qb{6NJc?&kWo2bXggann`@!51aQBF;ERyPe3+WX-J>WPDcEezxuRr;FRRus(
z0RX_v%*>zt<@6KzduC>00BUMxMCAXHx5VUc0GOILh^lbl(y1v#G{zW0P*qiB<`6<k
zseH)HJ^(W-6;xG3h=`f%agH@1s#;G3KnS6p>GbQYj`vl@zZg6PV{l5UD$Gp8A`(J?
z5p!gwQgZ=VZ^Q@hfBKsO^F^71eH@1J*kb*1QMq2kMeqKrP37b#i*>)Fly8~Y*QK7a
zFUlS59Kj2SDKq;g-jtb@g;<QuU*?>B^~*38i>sPNL_{#Hd+Bk}a%tSmxXjL=syXM|
z+uNJ#>-}!8s(_`Gyx$ljGkcw!a|prFvW&+YbePnjC@2j;MEqO-sZ1*Rmy1!}xflS*
z0S5vxLGJV2oozBAMW@VR7(~P;Q`QL;eivdZlPnm3iY%GgU=zd(XlPMwssOA|oQS;s
z#CJxV3mgFu8yUfo5+))bg0f+1*9R4dh+w1)RuVEYQbw?G<v>J%#>G>Br+)z$K*U5A
zh!qMm8OK^rzs%??cvlo&mpiya4cJl&o{gW3G%y0ECasz{*W)SN9DtcR{gfe%2zFwn
zEXH_T;;ByIdNpNw1v3R`qD;+MR(wheV!)ve5Rr;FDw>%ICNW?>FaOuOVCJ@M>lxL8
z1alVY#9YAW%>pQd?X!pz3+H-DM1YZ~n3*#dp9KIKhYc0Ll#Q7pXp}rEMg(SJFpN}$
znVAW2hH7RO0s}-KGnj$A!o=6><;*#k`IoVkIu4Y=nHKmbB1C{O!HACd;hm}(5r`Nd
zCI&$*k1vb?H6_te7a#_KnHk0)%?2}7m~sHTZlJ&bj0^-N8tIEMv1kBLh8e(6GlDN5
z0Lx~~WB?fi#td~VCo-6tSVjQE*QHVr%Bo}HPzxbYBgcaF7T_u{uVv;*rKycEt4huw
ziXnh`L~S32f5=Q`AX3+tN+Z)M1F#XN2ml$!GlH?KyJL@*MVSQkdi*$&Jrgl=G=qpa
zQ8_Z0(Zop@+=z&cs|R(-1IIIxELpNxRx*lAL_xH`-^b%bm2>u0D1tPEP$p95<rL@g
z)-l}WO&NUCGyvjaMaSi|LZU7=j=wSoW`@AnCit*7t*S(02dcKh1SWE@mhO(LRzO@Z
zpng+xqXm+cX=7DN_2p|b?~zDLQ-lB-|7XT_{E%Q|0F;TyD3C#vbkcg%M>`1+=eW)f
zofX^EkWDXvxt?L;=gI~{k?%%F$VffgGUjU4*3-X#SrF|TD|0n|25kBl)k_D3&EGFp
z{p1Mh!PGox!HF<m`g1riVXxO=03k$Fx~r-&Oe^LNUuw094#;2%1B}=)gccaMcqkOR
z9?}Ab7ow=1R4gBq`JbBJv1O_>7GTEMYTn=y+2#|bGwMw}=o;KbRMx9PmFluwggLz4
zh_4Iwj5&%gSlw8MNmj~#4Z63&@{@yKOR8GvooxR{cluTXtB1E><!k&QqWg1;1)i+?
zT>#-^we>127Podr*kt~>L{YN^178D_$XTwH(U#&8ve=DYzc#b$*}13}k%C%v%`($i
zL+1!?7;K5$3l>m=V4B@s2vql4hFc2e{KLmx6F^NNE1=D+k$QM*;yg)&CrbgkbD86N
zm$|37<{Nvzqp$Vz$r+vd^(TtWH;$@w;j(~NV>=-q2yZ*6H=@nC`s+FiK-E-)l@{g*
zfBed6Z~pCA)0XUedT&KyxkoU@Sg3Tt$WW2Yf}0e~IZ|f%axtp~uvE=gr>^g#p?Se%
zkuO;3NjMe~tsz)5xyAgkqSZB<Jh_~Uk*p;ER%>~Z7u3RkE#=nr?^$RiA=l7bPv<W|
zmgkE2@SK5~5x|uue;ho~Nxk(x<>Y+VoE>N6WX*ibb9r#4UtBmNvgM?;5P}g5M3_tR
zvGUB;JO1P-;YOxgp0!)6u2ux*xy2=-yR_Lm=%@VY55+D=h0p*(2zQW2;a-Kj3&@HD
zUVm6t=ng4*j-1Xl=nr+LHQ_CIfw@EVO#3yU--=*rWGXKUWU!*r#hbsJ%v^KfJHY!>
zxKe3hfv*c5y5`7hid{Sxe6vZ3wYfSPLZEt@?whQpG7ZB3P+(q3&U!Fq^X42_it`dH
zAeRqg`KAVkO=|Zkq@VHi0;a_VkxNT=0iP6ZCp$ffm$(O|P5$vW*kh>70J_uYt%o;*
z-K6u>^t>j*w?)vC%ms5|sQ+Ey++S2?E@tNf!KpzierlC|NTYZ9?ZjpcRor7zC#7Zm
za?wIjAQ#X!GbSdkgv8W4(_-6`h{*RSYKCQ%<D;~{P-PcOwphfn?Nok>7&jP}I9hfT
z0|#PKQTHIKj=MvcQ%-5orXA<9al8fuCcU&g7wNh%0}9ZK1Gz}HdNMUx`h&y8rmzGb
zTlsb&;mfGXbG;q6SYT!@e&<@+mtV_QwXmJI^Gq_Yd#_<tJ};lR$>6XmGp*wm7VBLz
zth$S%@SlfOEV$bO^~YvIFd{J{SNNC=BsO_r-Ase2JEa$Vt-_W?S@gc<J`Rn-2W$V|
zIU1&FnH+8*gq(BvsqBAFqpy_Ykv`Qm&+#XMEAk?<9ZN5ZxPba)S)(Iag-`}i^xiUY
zGmAtdA|W`NJ1*yO<7o1ax+E`M)~kLJD0lq2z>@WR7Lcv+qabDdVR6zdeytbgWSi$!
z_uR-anOHTtqv8lPJ+Fz7XvS;n?iMsqGnxYGnjzK|7HzKQc(T)z@Tq@VFNB#96WnDo
z?QP!yu9K8`uI8f7Ndi7O=JojNQZr3d@d-B9L~H@KIn|9L#Mu#^doILM-qfO^3@pZ2
zfZ)6!Vhmgw2OUFn38^&lBvbQ^^0A>wox2Yl?<i$tYq?Yp`abQP?7b$HaUv@imG^Hk
zc;|4HSMA7Ut2ZZ^OEIAry`LOE=D~e6hpxGJVZ)1Q+I*wz<a#Yov;OJiC&z(}md^3t
zll8blm6`>=kxGB|QWF^Fd}rkBm2Z}a%+d1nK<f?p>XV9H*1TYWp9`_Ez@Iw4Dq`d!
z69xn(q7u2WSnqnO^~*B2HAbE*MTTI~vlkSyrq3E3PqL`>!{S?<((!6Y-KQ)B(S7(x
zJ=4V^o!gbIQMoQw?G@Jzx;U)|R!`X~RpQ)4>Y<*Sk)4_7$@+8;BCkJR)OkCOd8*Vw
zLJLm1XncXUOa!+iPmWqo<G@MqE~Y?4Gxc~Xu45N|8bXLQ#t@N;av1I2<G8gR;1P)R
zeAd8yE3n?Na%)i1N*>n2q5NBPcbo}JD6{y97=Q}<*CVgXNm;s{J5}05`LO21>!wbU
z*#d9wGmDeM{wZa>SZ}O}pKnpt&nE%(c7?&<^@`LHcI&brmYV&Y{3I4K^_~>!kypMg
zbNqP4J!)xFuf45IraJ~&t5ORQzvkR0$^Int7jG7t#v*b6Z;1zY@S}wsUVLRM$JK(@
zo*e&T@Fie)J<au`7E)r-(W3EsNcRNAVgO4(RU-Bz=Q=r4%q_sT9m#9}E3M(&P!~U`
z*|>>vs{doPNzq%oCl}&mK`8~uG--=5#u|BY&as|=ssLncOf#QqSy5*4V;gJad!x8G
z2epNn^v1Gg|3su7Z7RoxhzNGvcr2iq9sqWq)?2dY%C0M|+2otSMEL+jq-mOw-&OX5
zh?D~gn6&GK!@ZR9VZCga^BPp7b&^jpuv8c-T&y{L?WesjK+YG&5&zzn%zipqqT08x
zDIDVD?97ZYhR9+9g^2Kp0gxFCmDe5SakLy*RlS2E#?&-&G{8i}l#M7Jk7p2(nVOlJ
z1s+3keE<fF0Gk?^j?gdyVLTb*!Q2jFJ4U+C21`UM#|F;pay7x%?1!ekL9cUiV`daP
z3|1(^52+Yn>b|vc%zlPLOac>A5H%A~)es}h%oK#cOo3FzAV6@KnX0G~oke<^qMwV`
zdoj}mpI$uM{QST<|F%P>25HUI*NBA`!=j_V(RCoN1XSLdaTtYcsz}!|?z*RiNpqBk
zRm`bN$v12hpDG6UNgn_Tqv=QxkB3;OjM&UTlke0I`c0$tHwNRvq?{3#k($zYf_7xx
z4jBT`bd<^fHH=46Kn6C0INLWOBBil92Ua687&Dm3R})a8hS&mAhB2F|5joX5C$_){
zM8?K!k~7Riooo?8hykjRz#wx38~3M(&74%&9YPLrn;)l|pfQrrIuNN=r7%}tQK6bY
zq?C&E;HlVRYt+vtGE~ivMg|TZmFzaP!<>VksM0Z9Op$ZWX;3q$X<%jonW!`|gkU)j
zL!!{N1~@H*5Joedq3O5*WoCdC^`j7jM@X*8uWWGD8&PHFwql%1owJhdvr>~f&DG%Y
z>rqU>@))YEBN7vt%WZ%s^d(|b^{pU<jU?xb#?vsy24UtB#)mr+dd(3Sm0CEF#_`QG
z_%&HN$*@CXf|ZIH+bE;FM>5eoa%3}|oHPUw6M>+lrbJ9J1T_;?KUfQzG(B}#dwV`3
z9k&F@4-Fa-b5K=-@75v<vRGga8~~?vLWlv=Ak37>6yjvk#K3GoU{+%_kiv*K1SMi3
za6lxsXdsg8-3uWyaR@3Dr*(DyF;j>`n4R!i<4O(df_ydV;NE3@4q!pm<MM~;<TSu$
z9>Zx9*Yu-jlj8><63fVvp%z)y4oQ$@({<cX-}hUi?So5Jvtcl?At%6M6Pwru)*&V2
zQ3_)+A&ksbkXpR2F|Q`G1xD7=cwuv%L)^O5V5w^^$g<R}KP=0~rv&>w%X)b0@w}}r
zN}v#q2;hS(X9?y_5fRy>H!^vgoa3&`K4KJca<ATNZGWa091D{l-X$)Rw5d49KT<~+
zbA4DH<r0YOXo%9Zq2<w3v578RY*M5}B$h#()TtKAWYNABaHlFxx1QBn**mvj3#WgP
zMP+OStBPDg6%lgEDS{y<0D+kh@{o4BemD$6N=?%=O_L#go3n8fnx+dz99-LhAMAGS
zcvSsIrbFXFpfSV9sZ!Rnwi4I83>6=|12QMuU%a`yodrjz2U$PdztrF23?05LaTZMh
z6_=??`KiVS%-MlI9D}0n*S}600p<*DJ%%-;%*^IV9+-|I$|mcbm5q-tb;^=czH$$c
z<JFNe>+WpMP0N7~OmSx?cViX+qUxl`qQW^2U4OoiGxODAq7#RU){8fWsxWbgH#fU)
zzy9`{?|wMk><|0HAi8ba?(*`YjqP^x(fjW|dh}@1Vzb$D;3Ojb;F^(x8i0`pCyr}V
zVywoct(IZEf;G5`$Ge8c+Y-jQEYz9l<%}(!q#}BInOT4PlLoyiI!EzyEQ6}u?~`FF
zvw$0##YMQ`P4hQ4*De;)rKX?7(k@mO6V(;MTL8aqu!Pt9n;4I2ihMO={lNmmP9j_p
z;&UWeqs1~dr5@rvORe~sSqQ=X)3O3b*-$zzk`ZxKm6ta+pMUY?AO7XZ7hgO(><2PV
zDK|~?_?>sUw&g${e(>S1KK|uLAN=AM@BU)D?aa(Ti0nyHJQPGqCLz~sR&LUDS<KW{
z*+6Qzot*U>!BP)ny%ls4*ynKl?jFxoUX%S|koRo4*s4V&(!4CHms!`G<tU(zhSgj1
zj+1M8W*8$Es6(t>ZWYGiN*^j{6syg}W95mMHO|b-^O@_8YZAwKh!-(ZNOxWBjU0Ln
z?gEh!?nk+Gl#^7EicUG#%q(ZUdj0yVFTehmfBD0c-~ajL%U8^?Yc?j}kcMP!+r}8L
zU+sVR{`qfz^Q(_P-hJ@Fdk-Ew*meQthbkg7%+w^PDn)P=O<qXCRzZLD#A{I0*jDd-
zEqL4=P+BN8HMHxlPXh2HVBfeX>v9rJ>!#kiK@e5iMBRQ_<zr<FuFgRVMti)D5r~a}
zz{eafRVM(Z{9E%kMU$NkeleKi^W5uJFGRhji;#CrTw~3}0C-A-GSiVV?Tm?1ADh5j
z4BE<ySR+SyU-~ON=Ijd1O^C(l*C4}u<Dq^K(?c3wUR^)=<DWkH?CI;*J4wb38v=)*
zYP;KE=(TOT*K)YNy3YII^{d_O&EZ$S`uM%~ABPx;G=xYTV1NouY0O+v_w0jyKz2RU
zwK9KlvI{8T6mqXYy$1NYLAbVdia_cH??aq*v*(`g9?6@_xSPO5TGmlDCr7vzYh$&A
z^l|#}Pv-9@b@ptth4xnL><GODP5OXKVy?Q)GOv14CCFYR7fNxu8!59$yqZJ{k<>#h
z`*>Q;=~d)plj`h0`L23t>fG6}H57c%zLnyYod%3ydA4|7Ii=Kf9j5*LoU@8a)>qfJ
z|Ks;hu3o%)c=>LU+aXgBMhHV5h-k<|pQP*BsPxrW&tANE@#6Z`Vd#y1`|i7sV-pYk
zunC<R1V&6C$~miQ*L7x=QVJn7O_Ne8fN}`<*2uyyRWltQc8u}ld6YVexLyUEC)AR#
zw62UfR{4XB2@Q|?-OgyvVdvucZh3frnk)+qfG`WqznekVt6zRPB7>Rd-I!YT6oyt4
z7=W_jX-*8MhFzF`Q9GGA#6VLH&I0F>)z+urJ8Cud)(m%n@Wo~<KaCFC8bIe@UDxqv
z$Gm#KZULae3~KDG&%cy{%BH1xCQrAdoutQnp;^^T&5C|+lNYyaGr9#Hn(lUg`1HxA
zuV38mU-y=80>>ss6FVGwf^ri_GeB)n9d`Sho89g0?r^iey}kYG-~RT!_a0qdUJxP1
zz`@5OIZN9%&L(`=WrPLRsAvo;f~>b&Xf7OTuq<|=-m2KNnS?p}D-f=Yl(%hsjVkx2
z#yi@al1(0UA3Jq0h=>ZB6up!xIaVpFP#RU$QDL1tKfX&j>as*&HYly6oK6Mv1wC16
z!YeCSzAX~fsts+M6jyJdUKjGSCJWS=!)s~L>69Pc%v^xfxfN`#7*nN$tSc;P)^I5c
zQ&M#m3)^F$7JQVa)ScylO!Faq|NV2##t69|VjGQ&$V8Hvs%aVqRbk>y8zVP;f4I83
z&MuR|BES6AuRacei4lmwU=B{pwS+{)hH4hGSjaNq1uI-=<25wa!5ep!lc=*MOH`T>
z=J<5SAW!y%YEADy&O63mo)_|sD(lI{V3?8C%*ux+DAO>75@90C>A{X_ERAtvu(~fF
z!(xA)i0F)0X@Tm+60EsxskWv}nvR&D2;TdEtd;`{sIB2xe^|2(oM!=b<Au8{G%iPa
zJrMy4pG?lV#N{xDzE3ZHc=`J3HX?SBQc}rgGBjPsW<$<-7)&)w;sD8;uDi&BoFu<`
z#m`uS?S{RYeDtf29ygDgz^r0`nFU#D3MES#RmRd9CT03--c%#O8x7R^l(F{;(hK@r
z@WD0Sys@04+n=|rSp101R=GgmIFg#SPZkAuW$Kpz8=95%p51JmsK~4|Roih3hFh<@
z(~I{Q@4ph|`<mZ-LuK2vbnm298n3thYQ!xdtI57--c)5b8|xd<6k=8{i7Wa|(-af@
z<;(B?^v6%GuU_Y@WE_YjWitfvWcZ>crV3KGzjwP`41qX`%Ju78`uf{L-=}miwzg~9
z_7TS*Ip>r@6BjbG<gh5E=of2jSd4t}6@HWmS~NJeQ$<tOWVvp?e10F9S-)H?`p;F?
zOk|;XE%*qp;!IAqS)k!Ny_LKPG(V7B#6!J%KVtqFn0Q3z;-#%(#TI+EIORw1Pu?Ii
zYwlh*q4S8)QookerL3WOt|L^!z4TJFL^A_}^f;s%OPou&f(_t@=g<H2hbPh}9mLGo
z;*e6?c1U7bSP^3|hKR67J(}M&V_8&oJGIpJyOa)K%R~D0U;own@4wGsR8#6v)fPM|
zbg`A*e(q%%e_=!TS#f=V=rxv~q`mtz_~Sl2SDYWOrFY$9sR@86R7sgJ53s8=4s%13
zt7gc|2%*~TJez>C7Ftw92u^3Xu63nSil{7<QUq1O@H(}!O))^DZ}uFJ*KD{Z(eme_
z>AD4F4^~zpGA35CK%_7lqu@XYwrsHAsBiMrJ`y%k5XNt*44!$sm<i+I0Dkeq%d4wv
zqR!0x9ud_dtF2f8W~w3vgurH!C8yMj<imk?w+9o5*#35(M47sW4=<URyHF;ormCVU
z^M#y%Kmd8-93v+3Lw`mf^@9W$Z%d$>Chu4UOsx}&raJw{10(A78n+L4YQ`LcCr@PY
zfJ8HyuicTB=Od{H;kT|(H4G($>As{I4G0j7Kh2r|h@gO@@2Dl(GG{2+=&m{1lQ#Y3
z0r)nC>=U3c^|*SPaW{2$?DQVTw0;C47_l#r(s*+QP{w042F^M_ZB53t?7=B9STt1t
zzS-tP>;BtX?AxTJ$1yl`io&RAdf_(oUtN2y!_yYR?YPDaA~rywaIchKZB(MtX_hX@
zXI0*mEx}qRG&5FDU1w1Bg9!dr+jWP1-!>bubU5VCo_^h3JR0^Inod(v(XMNAPMfZa
zp*<W9GN5fj2;0MO$da1NCiqoD06<CPaM0cD!T350V)KB|ee}^U-+TX2Y$OI#6OhKp
zAU*W^&1R#jqQ~tMBJ#_4MgW!=2`acUdNTl+E+uNgiF$#F2t-1D!`O(eG$F^#kvJM1
zQ)I6>8z2z#$oC00ovj#&+L_o<b6coh<G;C9{KmX)Dn=BD7|gIquK2@9J#_r3*uX{r
z!$_vPLPo@}@fIxAkqklzMb{I8Sq5MX0vk~__tI;L`e5b|BAJcXr<pMWL`<ADW9<gx
zpr)p#WB~ybRWoylkwmm<gw#?>mQ`qJaTJbhlL?bja?hw+ScL*<x@VyfQSsLLE^P7h
zbJ@>ihE={5?_;rPQy%Jgpjw2^)TBUG@x8^}J7X`?Pk5UXeP)i`Ho-*4RW|X<WJL7!
z&CQGFSHoc-L{%Av!E%lvh7hK1Eu|s%AR-Rbgs3V$Ue9|^Dyj;jJjm6{*Ps0PsfZ29
znufRAhuj3H2{eR2K&lcY)-XJ&Bb5PE|Grr>yr=ef6m~Sx!?9ah{!4WH^DS;6q1nUO
zh0Xpf{jNJTnnA@TIrKJ#D)+?tr?Fu(kzCg|GqE%7ZX*~g3BXz@B$eH5UTfq>D~dRo
zj@|XRl99a#Ew5ki{HsbKD;G%9u8A%+dpmOl;>6Wv`uCdOGcz&gAGIBKcbUfHY!;PP
zsUbw4&FkyeS644zU0((20EEbDB*-w^?{9sKA+SNs53a(nw;UOS7-Ni4g@!Z?Ikmh|
z$o1=2PoF+Dv%oook3RhHy{_vdX+ThzWj~fQ)AnuLj(dY$Jw2Q-brw3(*!Z0mQO!m%
zo;ki(S*+m6G5-Y%jR3g6Uz+(CXLDrGbB$y4hA=UW*k7P@pDw)F3fX5bF^|kCZ;Cgx
zRxoR&vWV7lk3$H-6WbP5R8?mY?U;*cstP72GEcD=Z<yXaPvE?L@hxT>&5_X`?Uc!6
z2GF>r$-W*=Y2slnL^+9>GI0o@iH)ibDW#l@l*E|GSc#}19uzmXx6ItMErVabe*M)~
zUoqu|`?hU9_}~KyK>;G>7);HhKZ$4R!#NaxGXSe{QaGHfhI^ykdOUR_I6v~jYbPyw
zd`Z9=&t-{unEkmf_a~Ub{TG9*2k*u+5e4$o2?Q=@?C({qDy4ltOX5zNH963fNWlMG
zT=?Zb6`QlxJuzpFR-ZLljHxtH`d*B(2FDtv2CaNzKYw9n1YhiNH^t9WiwFUt(lqh%
z@=`J+=YAMu7@UX27)>=xh9DA$5H`#lSS%BfXD#uXZH%eUH#awd!}f9;nwWErtdVnU
z+iiQX*={%zGq=rFBr#J6U<yX#^=~!Y7mRNyGf#-jSv7y=;^$Z?z&1BZ0pRG%_&H0J
zb!-0eJXzVDf0lAj%A6v}rq<>lUBH|<jJXb`KZ}a{<}&#Uaf(kBBfJnxO;^Q*S^lgA
zY%T3jT{YtLb<70q9A({ic~d)l>-o=hr}>VJon^W|v3TMFGbI9I(fUb6V9upz7;?^;
z$g<{sI1IypEX*uop`q9?aWJ*4$-{eM!x60kDJ9L4DTNr@wr$(?X1_~0@qu|rP<!2V
zpXI%pZo7+L|N5^kF1Hk!BlUyC82nxZA{rg+&YK)pba5l<gv-Y|wavMNDn>sq!Ah!~
zBOZ?#FN~N2%~`-b%UYFvE2;idi@T>ziHB81M*tf=?qkha!lW|(B2<*LVEFwfHMKJz
z2@zHCB&B8v->D3lv3l9|x5`4SDahL?adoZ_PrD|kZp%dF7p)C|dWPjI@8HO>46qWM
z_;Z$NE7f2itu_S;YcM?=4t;+Z(vXt?=(?`ijBegMB!tj)9TDY}a>|;Os%%Dnr?(lJ
zwrQHCNsafLQUb8s?+$xWwfEoq@X@2kZQBAI!75NTA|?(nBQ`Snx!BXc9)<i{mwT`k
zj}NO48835)7b#+9(=N`G%d65D-#nO+J<YU%nk;L@hb9A(t8}n5kGwBxa4kIRKY6<J
zb`0rOHJ%K&x~F;@y=D)nwn|ay&1L3hHtyI}R`NpOt_3oDqq2&GvME5XQcK2wtPt2d
zACjAOQx>VFY0_X19z1yd;?=8{FH*{8#!MbSP{!|R9s0g!<`{Uh*#Jm6-MqdjTMllE
z_lE<Rx~^-x%{~n&r4aZq44cTWuW$eK$4?$V{>65C`RGv-IL68A8)E~&l7c}P<NnVo
zv2$Gr6;jp<e}t8dZt0S$yR=`HtU_)g;+lmYSBI#ocEs0msI8m;K7p{SKnuqtDyGF$
zjs!OPUndT}x)_G0-J=>fW|mTlG1mL_fkWTl5N$&Usxpd~*vzE`JGr`-Xf!g*j@TT$
zJ_Gj5iIey>v%s837f##vz4Pl3g275&Qk_Rf)O(F(S<7yJ>37+IE`R_4AOJ~3K~xxq
zuIrris?_Yq%_<Z-^IVy0Q{$TjmDVzIhEI3em}|Xa%_bKzyb{r6x5N!PA~OfNs^yeD
z|A2@Pftf^LW*~&XA#jY5LD}76qi<be;71Q19uB=hJ#YPxh9PANqp1)KFdK$+`+7GJ
zwwK$NKfL_YlTXa>@BjVZ{Pkb|RSYRxPAP|eh%qox6{2!fP|L*Yhlv@@W<UO?a->b^
zNHJ-`N5yyoJJrk^c#GYL1s9+@-LvC%SLuaMZ@Jvv`4mHb*N_UqmwAawj7<p4>_^y-
zd);eEXr?1?Itoms6~CiOEIL*D;5h^pai>vDa;21x>J5uhnWlZm1sWGd!_0m(D(BoZ
zQKuXw&WvJN)HR$=&bj90n8yL$0i!v*W|UmNuVrREr5cEZGAFQ)W|oUiF(IPZwggs7
zs!+{N#>{~^_%Q_|H5Kvn(UPICtdJat;wE|?H&2kKSp*POHt3N0EYifLX<xp)mOp<o
z48vx#`PHvJY?>CyhMb0>4`E9j-~qao!^G$9&*kO#uM)!p$3}`O8Bps50cbSGip#~O
zfG7}w=gv_(b1%n<vJla0o;dyl0ON@%f1^yJ8Mj*VlYJ8%EoX!JX9VymM&S3amQYX;
zkt~k5Osvp?Eo+pUgikSej^?Q2&B;$D<OG43S*LtiMKP>z5~)eFJQsIP*&|u-IM>=#
zwP~6XPim9nhlrY{VdiqP?FqQl;W&kmc&>_+UTg1@W0;+y&ocDV6jrEEfz=ARa=Bs+
z#ZNs2v;d~=4O1f8w%wyg54($P7GXk&(bS^*iI{cD3hgd_B91Yd8d30Y4Kwpl+ZZFv
zR5cArMcsNHQrhi%BHr)!hr_|l-hKS|z4zYz+rRy7)3hLnWL0fKB(T<8d79~3VA>cj
zw{)$o1=pyd&f!`y#F0EkdHFULF0V99V98;9kv#LO^F>ViivI7aykR%{n7-IfRCWl|
zx_Zue$f?_InZp$O73%u+gbE$j{-L_lYMO2v(By?0`MsmGh;PV^vJR(06>1?_j2EhG
z&SPv=b)d>~I8JYl(FkJ<(4_X9)h+JQYHZ0rYMb+puTCi*C-`(NJS$(+1UsHUPoBe?
zh=`41*KD`ju4#5eMC`T!tC{mpBHx5Mt{e=az_{T%3^}Di12Zv)kVzn-rc6xCQ0x2Q
z_IBU4v2D9Nr0<_U|LoJJ@4ffV<Hrx1u9buD7t<)(+`TqMK-Ky}J<YNgakshwk9=L3
zWHkWS^n9OEvqH@Enp$%)pa}e$IL{3GE%L3LJoi`-x?nRIh?ih2&tnSG(V#scDltPU
zZ=8vYCKM`DoU%mEdI|F@s22lp(sdbFGSMusx=7JdhsJX%$1pPg^)5Tps#4lrM`_fk
zP^%W_u%qyX#lo)}tmVcLKQMvS>?juq90H&MA#0q*a!vp#f|(&J6F3CV)H{A>W|qw?
zo7$l#cYHgHFuDgkoq_)ulnk`lbVTIw@gnx})z#CdUwrW4FaGv#fBX3HBQr}WH%*+x
z9upCRbVTf#PjAd<K5BDTd-e&_f&2<Eqtfd5=jVZWd>-xD<2KFPm3k4^`pey<zTWY_
zXOF0m`y^#LulIVR>J+0N12Dt6Eu!*r8W@)dp@N@&2%*eioaO}X68DZ0*X0qpM1iST
zD9q$ml&joDgDs^_{ZR%`M5u_kTd|CarodWy<0&w#q}f8%Il;Hyw2&u%wGz0?Q$(pB
z_#y&(;(0%rK?Eqw%ya&a<|QU)NzTSWq43;1%w#5-i4_z>8@mvKsWRtDpg~0?W<^Yr
zMY12-NTw<ZV6)veO_W@e4coLE6_cEYA>H2Inkm7){`#YjKmO>^<3~0g<N-j8FsjU>
zMQr2gjJX^9jY}{uC+ZWE@BNf(h$p&zn|9AI%0<yLy7W&eM7E|(A4!Ojh)u<P^<4e5
zP`=hJOp>oUr#ihUjf~4PpHaoQC#8DS35hw97<|jl*pU6}oU^N@B?VMXrKrfVcx7|W
zW>9UI4P$B|R#nNFh@*<9Y&!DtV!{?(VzDPvi_N0AmVl%3m3xtGF2QZegHld->3B*N
zA%sW)Fj0fS0>{8&$uc-Ha~qh2jFe49VPIkk%%*Aq*zFEY(`rt`?l2q<ZHO^8rj%0-
zA$HrYiH$0hT|QaPgIG4VB0!-FEWyUxc`T~rOlcVUgE3RvvZ|?yN;EZQu*Jje-ZV*0
zDIY%l^s~#$ZH&$1UpyZ2aJ%m>E-tubRTWk9uod5}8uyyVb@J=0IZU2az|8U#LRm9l
zz~J%VwXHBk{)AW-Wu!?1+)Yg*YjfYr(whf>FuJRzx8vYS0vA4RFsRIYe(nMYC+WF(
zHHm0(hFeuep*NlCk~M+5UjR^*lm-!Pn%Fg)5|wUM%sPN^q?NKQC2)U&i}<M&z_*?K
z*Kyi&x&=U!=fn|s7={pns^zSK0tZ512t>q`OzCjwF`aw@kWy}&4IOXV9PfOHG4}nC
z1_>c>j4(=rwz1Wma~=rjVn-g)K3{&+&*e{?^3&X1%uLJ*4q_flQ~|W|i16f3BoLqk
zX4VD<C>b%B*wl{{l?8BfE&zTrO$ZD#-rer|UC$woX@dk{Vh(_*3Md!_Ll#maWeeiF
zW8z^3?j+LKMCRgrGF4Kxem`PHR*NkG2ozpCfAQx(fAa9*!~f;-e>F013@cOo{?J>1
zsQmk{SxS$!qBOae-aMBIoobVB7HC@bGtRYe+$pN+R~2~S;Q5ioPU#|}I2nZsMh%&Y
zr*PU6PykKScmlxbCnI=<O%5S4^LQN9Y#36Ek+;E>C~{}42$3O7L7gr=k5H&6vxZI`
zJzIkbcOp#@lC{x@Q_HaEu{L;o&!>o1_G<>cvYs$7VhEef=HjA@%ywj8mU2!xnX3O^
zN7G>3XqMvzWP#nVobXT8%9((+?b^2CV<x4XhBTxh=e*zd&z^n#`RAYS_xl(l5f6Q;
zb5-2U*VYrc4}|Yie){JphkefmnL|yMj?I|6Fy6@Vi<P+cap36JS?0f|w^HRt)zubn
zrmQ1JG-l?e;VBeP%w!a<%mgL`7`q4+vBTle_k&*w2{0*{@$Jn%CnX9Z+V_3xld1uT
zO>CNmN6#>pXH9B^D172L^m#M`?&O^g%IOI2^7t5*_;>80293|TtY2ZF^~<_G5p~_>
z;loFd9zDLkJy2jMJ9twTB8f4^08@)GkbuZU7-EtK%`}ny=q?|I-bd)6@F6&B9n~Do
zSw#CoADA|Wt(kuN?RVdP``z~9qKWNpf6Jj{T6lB*$U?&>;qxO3t-UPwvn1;Q)MJ~5
zbl(BgTN<{q3@0jej;|*jxdn4nEd(ZFwKSZCUz6|m|3^s2MoxNw2)>a{NnwP*M24hv
zNq0AbFhW{71Ze~$q((|hOXtX;G}1Bn?elv)zWWRA-Pe82b<XScJjXIoyVwacT~A%V
zPo{M6G|T<{jb{cXi~mC=L!if$hpv2oEZ;&lc>K$MWWna9Z)s^QBg2$nu)4Ca{^{)C
z{Ty7S+U~WcZhAj`{Q%6H{LJq&VUbdFzn*01D5JFwVYUOM7Ta?|jnY;iupiruXWl2H
zbt{{U;#A9h1tQp7YyQmVT(AZ8Qi)x(>L=+`Kqz-@a%ORA*a;ge2=-KOhQ@y5;)S+A
zxD}p-nX^T#Jm5yQy|p#?>d(I=myX-b6gk=8os|UH8zQ>pG(Nq^zt_D7q-jl|$C9}l
zpRC(8cC6M~#)p4@H57XL4&;+6RQ}ggj^)QlC7iWNdf~%Y=!x3ZXkY`00Nc~2PdVS8
zUFPh7is}jI<7Z!e{rTk;n}WR+fwn-V^?5HT4uBYdQ^^o*BT&02zzHH2^votzd5Zc?
z3bKDpguA1o3`u;7(-l}dY(W!KW&D!#uVH<)*U3_LLMSpN&Ow^nc)A@gk=Jn@@y&A3
zcOkNnHyQrRK<RBSwBAY}3T)_OkK}UrdRSOeQXwD$Q(+swax7v0H6keX^_pk*&>;P=
z5SLpV(hJ5N*}u4m#LM`*_Z}5;I_i_a(q7-byd^@T)k4SMFrvS<(DKXW-C>XN(Umvk
zpfs#~p)30$!C}Lw`9I8D{W6KX+mHYuL98`fYFX%`jY(fM8hwKz7afHBm%?pkokly`
z&p<)#$1b`$aDgvb1-KlZ*@$j-aY1FU0d%U@9IQdy-^=!)B6^!kV0u~HEl#AYz!aM1
z2h{k?Qm>zV$!kN9^ffV8U6t3Xs(52duEmV^h0|CIakpF#;t$&gRWUgb>m9~dOga`p
zQUZIb+5KCjD(gFhn>xkS1%G%z;zhmIwc}DFZ$iAv-y+m-VzNHFbu$mH)c!@qvxPjl
zhxJPSy!Ok(0M?MZ;YY7)hFr*Nvz|N;4*JiniBB$`cTQ+Zm!rk<t*Bce2_Jv<y$_|!
zZo7O*MZ(ly=3q}Zqb!nu@0ye6o~^*pE{$#gJ1WIf9N!G5f=pC#jNJhK8WnWuG<Mw`
zKCt9mX%E3~MI?#WYIA^}T;=6`DkZW>HDJA!|7_b9pTxg0$>FT-syJl*LGZ&}hGutE
zWlCX-30}o~yp(0zLb6Bq=Pq~Sfs^em<^NzWq+$ipsq@RqE<{9vjniGpduwDi5u-NL
z3WI)sQeqG`+PU7JOFxzWPCvy3@Q{xzi&P=N-|RLL-G3=MvV+chx~5g@FbDU@qu?vd
z(ZlxzN4cvtO!eNyEykwaE!5LE9sX~SGMi$KPJ%|dD~XYxnaT(7Jx$5dL8oKk=G2fT
z{g5PQ?<Q8zSLIR2UjKL^h8^8sfsovpKmG41iBH~(r-hJnp3>n1>o2ZgZ)0RRvHPS;
zF83W1ht#2|ZvN}i%BMhBhhi30h`Hwzs<0W=Pl)Vq1~g2IB1DkGi=MsgbYwQhxfAIZ
zRKIj&(KC{BN{?e6;I{s_2m72o*w|d7Kk8)6azY(>0;!oOWWF4a5`oQ1k3<Xnc7OF5
z&ieDfUcOSQyFM*C=NFx4@KSSotRv+`SLhX)>Or3@hZSqOIkT@HtDktLSapBh&EgU>
zo{IQ{O%m>7$#0>79*GDAGA@f0D_~NNwz+atPgqx@C`eRzGAGgzpoMDCAeeNdv+X+A
z>$yZd9QRGt<lWy4qwWs|Dq5Egu<iWXM!F{R!MmQ2lPQL{hfeO&$k8X!V}<A;x)BYi
zCE`%yh0oBXX(8~t6w?JVcUNmG0{l6NfSgDmSp&IJfZEZksWxeEJ-GF}y|L*$iZY)+
zx(S~5T58;Dou=gZYvVELl^fIHd$NoD)p)Z${7Yx`&VJ2#K+%NLUrnT;wJ{9-BEG9G
z(u9eLZ{^gpDX1sWEEtzm%*{;QnN8plKNJBpeQd*}Zh6l=&?p*i^@uyNgg9HwIjclV
zt6*fLx3?cB>@j}I+i4qil8P5CX&AV0LI(o!#i7T!seX)-xr{RgmQqJh$m<<|)T<vC
zH|@AxmFo0;nC!C-kYM8D<I5^JA^$9t&d#?R<zEt;B`UC&b&-a)CGQsxHqrBaceoa-
zjX4O<4=&tXUy^DStFPW8dlm__NPC;Z5i)5ZPyN+9SCs@JsiLccp8eLoK-tvPgbF-8
zh-Ect3l0kK^7^rK;E{&m^V29Rk1nY~b7s|FL^bSL*S`w8O8h5Fek;-oI~_I+0*Yt5
zHj{r}tS)xneB&fPtK5eR*MB1ZrR5XJbWX5x*tzD9F#<hM1!Gd#?-=^y!mo1!06ik|
zFK+Mi5h}F92~cf1VkX}+?&Qaa=+D!+D7B9Btrqpg#^<m3Q7~N{Im`AH=au0sIK^@=
zS3g(9!ut2|<dXI`bdw!&h=o{s{(PB$i~R+?hpC4<aoE)I>Z)wu)%T7pyO)NfZ251E
zH1E%pU;C?+BW0_us*HI(xrpa7;oclEA7Vf#g}-xx+eMSy$ueNa!RRlredyMG>NPbj
zIm2j!rJ6oy;S$N((dl=8x9x+?Fj!Bzx~9hCckrLg!hvr4*?AGcUSK9SB7?|Gqd!YN
z3Ad?-jo;KH=yJt}lEsOiA6eoQULGyqI|BWzwDB{sD=>+UH>Khmlb7`jH6i>dOA8eF
zsKuY>@xZUVUxhyyN=rrgdR<ub_mjp-k|Py=MXQ@WsneKdRqBiBk;KOZakvY7$uW74
z?lI5*y;iEfQX@r1Sf8pL4?DxoQlv#h|MP&e9l2cAm>7lJ{GBolzUwAr4LshRscdvw
z8ROOUS&xq;-k^EKD_{dLMy1KplWiP!2<)_6@{466w>6s<)Q+_ECG(3kI;jQmxg>67
z;&)6-i&80~!Yg{g3j$<4m3x)+{LY<M8{4s!dwP0$a)A#PgFOA*nG#n8y<Y%fmX4uj
zTtWGqjEszsr_2O`edxLa${y?it@;H&-n<p;CmM#5lp(U7Bq6SU(s&j;OL&8ctl*G*
zG&I|+0G(<ftepGNEc2Qn#Vfn)_xNX_e{*(;EZ;1-1nUU7g|z7y;fpJWUCZ8}7+?>0
zjrv3Wg+*}}Z(6kY2-{?Er@CTV&h$5mPxe`}DNflHE_Ts>GL%(|oscDh+UmjCRSFtP
zR!wqkzSy+_Ln)VXzWc;5>_0O_G!RKk;54a?U*7Zy{t<OR>)77j_qMFL`2?Emr`{~3
z2%Q=oDKTg7({y&M|LJVD%&B-mh6yL6q+!4f*N0`5wC{*$wWJ0cMZ=bzn?gG}I)bn7
zuJug+|0h{F*V;*ZtB9h+tS9zc@~aUs@qokBJ!QW-wdOnlK*NC2<G)5ntDO{MJiX3$
zuVYmbP=05}>yNg>DtV=K>pp!;-{JJg($Ad@+y9}Uu5E7fy<C^@2b%9w7Fx@^;x)b4
z=7>Mz<G}>Agy-cJoLWk8PG$`-MqD4kXZrXMSHyBJIBQTtfLba4C2pct18hnRV$|vX
zgpLnceIS;6y8c~`>E^(j+On;E<;l<zmtzwn$ZqNIyJipr09b2F61LR%NvmF!YLsVX
z_3#fi2L94_VyBpI|9qt!9l`6xi4)J_J{*jDT?zgsHM?z<**nr{Q1I2wO`1p9WB7t%
z<LnzX%r=E0jGdaY#l_O+u%utOultxI^kv0hA#$lF-82|8@KiHTHt1&KTD^|6c34ra
zOjS*B4vV;eKtq!KMB#*l+d19AFY*<LB<<9wEcaWzr+(1bcFLXgjDC$uZ(?l^@oOpO
znVxQ%!ijm2+v1(9Gvkjcyi)hdt7#85Mbrxn<_JI9050e!OhCr_GLki(kt3;PBQ}fw
z#EQlK@n+=#2`0(YsJ*G%pz}Uz+=D{C5W`ek-n%*?M@v?W9J8u%JQ&}NCSMRkVN)?^
z^QNWqAk<|P2GR>u{0b(bL5_-v1fj4IXVuW|3q**LANEF*J583`rRDU=zaR_H;iR=F
znK;9&*UH@8O&wviflA7dlN0lKpIkB6NV2L*=oLhK&G(~*R`zh9V5xFX#u;L_okP4c
zc2~lgB+>k>0w5y^iw{UN8%LceD^Zc4auW5;EPEwC#lD746#F*qX3S_DdHLZ2sX0Q;
z-aOWPo|r|YK%`-&b&k|n#<zBz<s9N`Oy_ye?j0o7@BOn-il~;`qTg!DTE)F>W80UD
zPROK*T7YH5@?%#9PuAbc?794)o9q1GhplXvj+Tzrj#jlO+3yBKl8KpiWK4+2dp60B
zK+f`Le0?_0T05k&{uFirnVGEx{(`{%OD?M0;QZo{`@3i4?h-|5($Hn`UFh)8-w)JE
zm7WV9)%LhWv^UkXcpYYFLSv}%$EHjc%SCsTR6d5#L>sP#lG#HocUf6uD})H;U@)j!
z=ugoHup&akdAND%DKM(5Lb5a`nJn>}{j8ICb;(7~m#LTYyh24HhYbpFwIrS$Nb$>2
z315aQvyKt_;G%b)5=^eQHxsN|DRRLl*`^Ojl_Qgz9}0O0TlTWY;Nf2S?2-Srq|%U&
z!rndT;?6o2ZT-gm{4ibU>o1byKHLU-Ozh=tt$$6PA;|pOGKTq|Fro1r4)=oms)>|N
z7eJ0D?db_{WW-DZ5*I*iV^g@muM)ppwtKpx_i+AjzruQdytVh<6t%pJ=2gs}ZjPP8
zu>%A9i)2&Sfn26+09ti+9&8a52U`Myq79Q%-H*W~*ioZbd^`(}1rp39*3pKHkV_uY
zaF5JyHab%k#$Io^KI!m1QJF}7*S90>mu>%WkkRO{pp6I%kMi-`taa*!ltqsAk9cD`
zSR(<wjq4ID_9t)Kw0jfi4njuQlY}$g7NaN?78{+2mPJO*!Eb5B@_JHvC7GR<mJYmc
z&;Cw54Y@m(yNh~o0!PeSP?NlQ`d2j8#|PYc?;bDfkleAukU1JRV@K=B9DgdDmeRjf
zSVLSI{#K8XrWCJYuz;2EtY@YNU;LwBzei~alnDVsL{s*x507`=?S$N8LT;l_nByMG
zp2Vp{%G(0g$OD_HzUsJ7nZsiG=G*bLLp;e)_X`f#fKi4)lsVwBFqZT}9VxMB)h}1b
zC^OJl&$tzO3%uF>&Z8epb=Ef~BAT;6SN+aJTz@N4M|PdPjI=IIxkMN9pWfRMGJ=$x
zZaRrF)CHa8k`sVx=sH6u6ala)qv%=V5)p24Qin?JG-Cag9)T{+s8jcvWdn`Z;fM-u
zQAqEgxwIX#rLPxecS=+4delW$_Yd+&*8grSTyScGgqQS9ez&lprPx@aE~K+B`+7&+
zbb9=qO~sWxd_ersSLw~HdK-%Kj$!?WrwJ+1pI&j2_6PQjbdRsghTQ)f$J*zY4|h?T
z4|fZfC^>o%I0~pZO<^l;JSD<~Rxu&@M<4cfc5HLM*>ZDDGUVpOwUw&isPBstBUT(q
z4YlMb{<z)mGx?Q{#2zNO!}eOIMe%VD6X~4X=it~Xou6_2#QCk+nf-~c!Gju4Dl32<
zOvC|dvp*+OBRh_?-Om-_x<h%Ky(32MSq3eSYD4=Ztq%jRD(G=tOvb=rbeXE|6oB-n
zjpzBU&XN=KbgDEz<lm5KP#elc?Bqm>(yVQ;TX*~qh1PZYe<8$mMsDMqw<(pH&=D)}
zOv+@&PveN7gr8HLDLtmVk*d&F!e1Z_NqF+eo`d@L<M&rvnwr?8Qu*HWGRj0J3X(|`
zDkf%Lzu?@IWXU45Fmm>vY!(%-z`e*e2rf!HnoR3odjPG=)K`QdoR-oWTD>HHZ5S$>
zJL}ATf#hgBfAN@n^Dhpr?XPzsB!=4G$YB9^kNEetjeu?Ae*a!GC(Q?(5jesrl%V8-
z5%UeTc0Blq;#6L?Vi7W)O5h{>MjUoE$L$I(Kvd7VtAvK+{y7neFv?2UM>^s1xoXqG
z)ilA7pXx6S8fTYku@y0qyMwt~In3X2NlMn>E7I#@j9r~I^}NOqB|Yz~g|V$#u;9B?
zV*kotD#UVOKABo$$_|CH>en7t#2NJIzCV7Oc)iaUiwCO0WOOC_%PR3KeB^C(h`8s9
z(=_LK8RJ08dFn6UUPNK&HL)v09`Zv1|7{IjqOjjTD;W_}_WTwk`vaah#6C?Uc#L2K
zf=|cO@t;}4&nw%H*4BXDP;N3Cs|o`I43_zG8~eMcleE71wD`?3Z@8?Er*1-cAU<K>
zkv$bIfGe`4c1(qG;Z+8V-hY<C{kiyE>CY&EkBtH7Wy6@o=32kDkA7Ch>;?^jz4Icl
z;o5azoc_pks$!g$j5)$ft-U!~f-JoBf*~PTC!Hznn2lX1Jmzs&bS7RsItQURRcEax
zc?-<~D|szBIy;+&V9v#t4$#-9d#F3nJJpHaH)Qxa5Shq#6I%r`gwTpMYnR>$`1`zE
zuadMHuflv2qEcfqFH>)6JPjyIm0*??%LD8^{Bc_!w}52&K+jfK7eO=O;FlT`)ZJ9b
z?Mi;$-SsJdCzcQ0cKzcaXEk|%W{)Idx3pyUW#`U#4<iYSW>3PA_H&l#7Yxcn0H9gX
zs^$jdSu#<hCKoGQ8Lv1Oy|b(BBF%02UKBpIvdC<K?L3P?T5psXnfOPt|M8_49p|ty
zwmY*e(fXxR64)*%@L+}h$p79*nzl(LpMDO@VQ`LDAuj}Sf%>#1vm&2xot7AEn@~~n
zPDtS5?5U8O?IN93n!BzjP}Epm0W-l$5mmPbwmkEdsXAnQ{<CAL;V^>);%VF@#iW5D
zqNKicmJqKc57Y2MF06K}{;!3|54t#WxktOOw4Vy#gCjB*tF@?eHmpeP9~VRvo14xV
zwBdhOb~L;WQzP0tvyo;z2*Yu(lAD{`7<W$^lDL2Nz7)ojpdNlm|ETtHaVoZ5enY3X
zV*pwC#|u4L%6?SiNOGCIuLB5<j_l&?@Ba$(9QhAyD*JFKhbev7?7TA#Y3f`M6;x0q
zV7xGR`}{yW8@A+}1?=i>4+n_C97uprGUYJEC6NL<_c4hVq6;H$-HG;zopEbFa=$=i
z*|ay$Yw(#^zA&MS{JW9=2jLB$dOm`bPsxPoOb6DgJE}n%3!Uh`^G#HlWHV^R;PY|n
z4KPkNG#R)}d|c{z`)S}^z5t6XA#@~>@KtU%nIl>aA*4R`>iOm461G>tnXFhX#pry1
zrhG@(t9~j9Qivb=3ifJL86}iS;z1_;%ZckX4|&goND^3&zdAqo;w+ZG<BmKSGbTkT
zNnkVY`!CH#Lgx8z%y2Hru|cLbQ+-8UwXXJGX5*>HO$rbylqIjaQNMv4;tCL#Da}^h
z(dIWhm&-H!UtPp5IHH$`2%keiz*ddNl_qIi?%}NS0UNPXa+rkdy`||=6YYG89yX}0
z!tE;m>XM@v&yENg@QEv%ZYWTKW)4IcUmFdh=3wRT;sj-c;&}k6%LFGP0I@h|#zW||
ztD~Z$B1iJF{C|O-(vrsUJD)@KHD=A6LS9(oul)&<{Y|fDV=cL}o4z`}_Rh6kdd@|y
zvutbUC!I{oGcf`fHAvWvy08NNr5Y=(lR|)y&a#mI{*MKSFk><&u(2QzUIacD7ytt;
z&rVZ%1kQqv{w)msU_*J=*K!?RB6B`QTZYD<Q|UZT2q|8=cdQ&(#4-K3@P62)H<k1I
zHvr!BUUJ%0)?rfsyFjlDM20-r{HOGu9@1R>4d-!Mm8p0YUC7(=W!{j1AOBy*!rC3k
zp54M-Cj|_GK4UL|*-}Pf<Q`7t9(v^N<}_um&vtipCggu1S7di+EbCXC#j_7=>P35k
zeddoYVN*sXCImKde3xK_W2fW~)#nBqsZ>eIT*B&#&;FG}g9PILoOV5~jb>wj7qU4g
zT{A<uS-yPGQR&yd4kNLCHtlsL`e*$6wWU<?g2(4!@a}4CNxR`@U!5RmK7$)rV3*Zw
zCo}S8#c{D3`>sB?iS#7al|U+;TC1J1Z5JtT%|q~*#+M~LrC*dS%T0=m_H93^Y|g6s
zo}=x}Us+KRQ)Vm1(tg)nr@_Oi@v8p7`O-A#dLM)3U)I7exxs`>SV7dm<M*SoaSP!U
zr2q%FGZ%g3YX44{Dm$E-efKsPxx#0m6+iRr(lQqwBxvd}8lBNape_jl8L0Az*0x~D
z?}3oJfrq>Nhw*XQ+x-bjWcCti2NA?s>|G&gClPmq>-nys5<mpDnMD(7Htn7Lf;qsc
zyg>OJ$Zq~?L7j&fz-2G~oN(_Ji=2%MY^N?t*m$s}Akvu*o)oKAY4E+(wuxN+@0ry`
z=%z4Q#Pr2arZBqUH_xVV1bx_+p+~!M?hKvH+_WGasKvOz1ZB7)lTC|U1aQ^wGB@W`
zfGnz~;3%MTps|-R^%xJAeeJM0XG(w*0Ha<w-3l<Hl_yXUvWaJs_mntezY#DBeporh
z4$a(eCdh5jrPDK)Gz`x4uO_7C%YEei`v-m_X-R40O|nu@$SBWKTw+HNh1nc9Lg%!4
zTP7kirppb?s7e8KYCRyEED-K3*Qq$xJwc){her?htQ`;cw{uuX$K^7+L{v!EKKs+{
z%O^WUibU(~w`&^~?{Hb-<ROhKk4g@hY%VI1?qiA!?!OM-3qHZk=7N7(LnJ<lMu52c
zyQU+K4|@iV+HVj0N`y)2?sA4sR%=hby{ZK}FmS7(Rm%jja5r98cQbs*%Wioi@vOE5
zP&Qs=GPtPsR=Ppr*~V$SwEb+js&sDmRy}k32@{@h6gE#S=`J+LC90|QOdL@(A@wl#
zUgl|(tg`#9V<T8O$?jMC#u5isdgF@Dv~+~RPtrb?xE<(a4zS70<OowULR{xp_PHm#
zk$&g9Hw*Rek2)>~c~5IrQI79sn3|P>%88SnK9LL$c9|e6ecD0KTGjDekVM6}{>GqT
zF9qRN@sK3p6xaMMS3gBi^kZAR79sVcyrfK<LT9rU&28_dfQuQukV~J3?Ne+byU2E_
zF)=Q;U21saEC%Z#CzBk`SdbK3DM2<j|7o3_tZ~ZnM&b}^y01aPVUDfU+k>|&1-$v{
zL^?$UtQ=9qd@LD%&-dn*hQ*YFcXE9&)6PUM6?8|PJN%+ILpD?kEi8n*yOKl`k}w^T
z0FKW8a*aKh4%D-vsuI@D9=><uu})u7>IsEa2xY&cvwl|kDX4m~{yIlrUqfVnKth?0
z<C#HSMIX?@vDr@N^9Z(PnY}=otMbH(!H{;W;feJ{=6`NGjsn<Y1Z91X*>-Z^6k)d=
zogEz|T@_S{2q)?dtp8Vm?!l2q)W$+8$uMgpno!(<SZ9yQfYIN*1YMN;!B;)3d1n|W
z+mox@C_#d#C93clSJ}Z6rVn!&_bw(Ck8|sN0BrcL?GUx?t^Ny*%)+=$5}%nVwHxyk
zasp+$f|d=34WROO3#Iv(frqQkko#*rp3+q5JXsM~kD8!J1vnBKQN7gQv{`;%ZzYov
z;|g{u5XA#Zx+2095rS{1Gh6HoHy#oiF74epU;W1aoRLWlc$rLNCnR<2>XUH$z=~BH
zTwGjU+xQQ@_VG$OEdMo9!I=bNJ9M^DJM0GFKNGHOQki}7<Oy!5l=QMOY@rktRiG?2
z<W)&q<x$TqtgQ{$8Z>0ij5PPX*#GM<^D`QiOEgwh_tm;le+H~Y)&*K2rpXCQ1iw3^
zn+H{iL9+W@mxMG49hIYDPPB~kOkJQwa2#H<xREF>8>D>6fV|W$5GZ2q1K@P|kHvyb
zSw*jjYm9*JaNiqFAt(0(G5BYd4Q+!6Q~1LB2#{=0{xSX0i$99L;b0zRT}yTn!5dp{
zeXpV6Z#Jq#1jRJ2Y&H?$W%lRuAPapLu^<gm{%7`PHm{3xtPI>WUcs0k{nH8n5*iCA
zzES}IqJ*cDVkg%ge4B=Ava%d_-RCl=$2{;Am!u2izD)9Vo@$<>im`D=%FLeB6@jx1
z``G+(9$l)m`%g<&cDPi5@uwT4%W{Rbi}`9Y`5m1r%~KgPXFfvvzLb$AS4_+))+Xb?
z{I)9-8IBjNPs^w`gtPyRCuV1S!|p&u?nQyOK^ggCj+$-)Ulxyj6+63*Nr&$_>i+2A
z0vU2O08Y^r{c$eA*ODsfGRx>O{G-`YL-0cIoEW&x*{l+ZQyV%fJ&<^F-UTVjP#_8=
z>M98ZYsVSCNYio{YGE6I>cotxKc7jBW^*M0-bk3#IOm&|3i8lAdGQQtd{(RJB(EZ@
z0&s;3ommpjB;|x9A@o-&iP=wI=`}2rDohzt9@H^cHH-o?r3$1nIM}3;IetJ=Eg>wE
zNeuqXIN!T17S&#<)=K?GNPt**uE+4W26o0LnY*-BD*jFoj&4|u9U^)J;wyF5*op~W
z6Lm230~M--V1)INl_c7^jZsz88|XJW(8!7N+PUKU<0&ch_m)<Yf*o0Jrr|b;FInk^
z4z${AZ0z2rhLs;EX%tk0<QV?=3ui6#c&mp+)}qEKwLaWPsCKTfbUZYrcU~WaaH?&_
zkl}X`my3ptegcjrRJ=R{R1*M06T@TFW-RBFG8OPeXdeX^*+2o}@)3<RdG>Rmfkq>X
zUe4Ob8cr{Z(#QZ3q5a@-JZlwd+%J?H{igB0#4SPZ*}RY8v6)d__;)W22D=jVD?Eb|
zdMS!ZoLX>PL#FXRG)_$T`J?ZQU)w7WYJ97<QIIeE$o*k9<a$L8v-5EJa5E=&_aDeE
z31~s4@1gV&LLRhBNBf?HIf~{}K?ariBaRQL@VRs2bP0UG8kqZ$IFMSKlPnI=wP;nF
z0g!hDxzUmu(`&e8(T3qg^+G@r0Ib*47Tk(vQ3ss_mRN>quTd|r#GkNAe4x%DJbwKj
zE5pyPs>~85W+i+N55BinYB$~OZFlEPvyDnRMS1_pds7MASshMODEJzAW#E7YW+cum
zE5CgZX8&OM1wZ}?zdcvsFdRS@Z5b2inZfm(D)V+8va#-pfRI%d>`~*+!0C97Ogf3f
z4AqD4RJ~V-ni1T6&8Q<Bvvw2y;@M{aprWIBOIDKMnCMPc+8ufnsmCAOwrccIm1b=5
zS=GdjP1STS<a@=8Awr_as^pN4L%nK*3GS&)h$s6Zd*EpYZ9qcYedqMS9hCJpCI8NJ
zVQhgbsKRhqbpvj17v$wbIzn+VY-!3`AcT;g*1{Qlsq<f7o}gNi+}-`<!*%CfdQHdu
zS7bUI@qv*oQ7VTJqp_cg*ODasA*<MTdGW0xX;r$Byr{c0uhJv<{_O;)53E=Pk3~Az
z8Sfj`jj$`=3o1*h<@+Nb5v~CN!f_m-Q9#*iy+&#3HsT-m?)A5U*2dj`GXT=;zW48+
zOr27Om`4X`oM}c|PjR;Ol05uY{95(jyqZi{tMeZuUvV|L(+6P?^6OiAEl<E{Z;;xy
zt3(+I8~blK+Aiy>C4-(l*AF98V;{@$upJ}s+uQ=-mm1xpY1Wc-nO8(JY=vM21W)>J
zGh&^OX$l%6>u<ZYeQZCk8g7qf|IcX~wW(+6?>xY*+?95SgB0@>r+VnlfH?p$*y`^I
zv=sjCr9=#o@Q10K_f`qZhb6zur534fPq*7gj`>gTG*=Ot9gmLZ=s&Xv$^#}UET$I+
zSyBF7vv^DcAixN(J8(kNumpp<4~ZZ$vnZZjJYGWHMul8G+}}T3WBJ^^*mOvQuCM7Q
zMjr|Br@+Y(xLWV>8`DvWmG+}suw{Vl_*WV<0SOpR6b7`kpsw_CXMNjijI*o(V#Z-C
z`Zl|$&`G^0<Ovqf78U*sM|6#FFrW90y{G;1sF+pffVE~(Y3b`s;QgZ1)bg>4OsMI<
z%=ep}fqTC*G{<M3vV7tST-!zOz8-;AZQ|ntAQ3<+Ed-MV!e)%AQ0nFJSJybU-=m`k
z6O{U%KMX%XAQl5|&*~A?x|{y>hW4M^JOx#&NS_zeOp2*T@El9TL-95CMoZGz*%eWz
zZXD>f!+G65QwsH{Bh!w+>#d=KgOtio@gq3PB3{*ToWpf&AO8EyE4iag_~tvWI#(fZ
z&{#=&CosdOXCkTtrx^on3TK_yM~3cDEckKw?`v&#=5w8<H(6Q`%Y~q2?{mUL59>m|
zkvq-p-%PzfAs(igq|yGI<>4H=c!}z~S_yerk-O`WYxh5Y)}P_AdT>!Wvup2RT**X1
z2s&sDW}4eOXUJTe&McxX?G=GRB0Ty!3P`C6T7?OeU)LVNP2XqkC>2%2WH(r`Oaq=r
zcsjca2^Ui1v6~n>IlJWd4_dHrFb}86nF@wC-Ql%`P0BS_r`z}?p)lVV4-XG6O<N^d
z=S^;}@nX+o4+0rj&)&-U-EBT?iC(FU`T6SLGdCM{aoDs^xylZ(5K);$lxhL+{LxAP
zAZr~Qd)wb}B&kfHyDI{VT3MYqO|H~o$EC1pWTH5*LJ*ItJujhy+kT>Z#2WQd`vnul
zO5#}Q$_*b3t~6pO#|$X3yEz$PokPW&2A<qqT)aa0IKQdn9sc$#NRDK>$DA(7jS1kI
zg*J3R`BdE+s)2?p7;q^SQHK1U*dem~s*3zU%5l)IZU1ZESUIQ14;_U^wL|Nx$)FoB
z9+7?#I%mKQ|7YhL2btWfr?1)iY^#e?ZS+tf4?QT%%KsXH`|HDlTY??;D6HVQ--t9;
z)UDCotKPGWLz|?3TMLuum+!55wp48u=LU{caUKB1ECpsvB8H%k0PtPFn}*QZOx^No
z6-}EGSSoF8!2qQHs*m2($kYXpSpKS5&anF=i!G0LYEcH$*Z0qj_2)3-#np{zTh6hY
z`r3|5Zfsxrq)VlC{!BThkpG6hF|yjQX3jS82?v3&%6lDg>L!H|o+rWwShHf(GfC0F
zKJUE^L7nl!DAL%3PMcA8vyK;u(bZ5$XNPB!=6ZSIWJG6<$!ySl{s<Jy{&WR0wzapR
zcx}w^*2^FbUPR;8le~Sfgao&w!YiG{vS;jREsfHOQwvEDSLjhjAFK@{31|;_SY64N
zZdo{Jyv5wFuj4FW+YQDq_>&1YkLRx})_5Q0W42U#=O_9op3lllCtFKM3x!_sH^LtL
zk!Pm1K_P9Q;b`mNo2~LN5D-r%y|aPNv@s$+p>fU-)ROw|e9jb0`9EO9O+)HY2M$#T
zpk<7p=)e!u>yaEd%2VX6=#Jwjc8*6S6PGgV6>4h6sLLHcWBb#y=wWF*`IsaGMHC*1
zhpkx#U3EB8SF}oWrzMpa{;nMWV&W}6t2D*f|6mx6!_AuCX7v|KalI4%D?#rbe49@7
zlX7-av$~hHGr(^v;qn7%zMpbg(DBVj70h?~-NTZ2Tk_Btgz;R+#exUg<synn!PLQ6
zIy+3tmvHZ#tCw!Te#~D&<JRxLl5$qC`6@G3&ERB;G|xo0@!GT+)=0e3oyocF5ZBYz
z)+SUfCxvVo#%Btw*YWlUcpA_7HtBrEOQ8lmq8P3dVS*zU>>HO3G79Xyny`BW-HeP)
zO^>{nddyo}TJm<TN3+Fk^58xp569?H?1$)3b&EMP59kb<Cl8{O-;_Wn!$gZcIU5CB
z>kMNmvZPpdh(-J6t9jWtJ|IOECM*?v1shJf$!{bcJY6y%ZA4#KOvCzdr%0{_B7u-E
z8Gx>qpQyYt8tNa(j_=Nyz<=MS$kc=n^lf^&x&(hjU;(vs>)`8+?GQ}O!#QQ=!!!QJ
z-?oKnj{;~D4dJSqdCRRF0KVbhaR)ayS&AFLEJrtvE`(skq6n;t&&<Ynu4-<Nr60^*
zvoTM32(wm%wx{BLDFb|(Zb4V*od3~Vl=R>PT<zDt*UXdtJHR5(?MuDw4tkJuniU+k
zV!M^}`dREJ%@CTIZ_$_V{FFEA5rBMm@2XyM%{#EwELDcE|NZaK)8+-g0((<q&9akF
zl|&dRX8jN8>!)_I>5};V_jmQ?;ERC2ty_o1)2Yb_779Y2KQ~*4HjB6lPz~evIwf`{
zXoD4*Jzn+alAK&zu4Ot19`c~kpJO~+TA64&1J1~4Wj7_xUK1;OzX!C<REJ<6K4966
zuSLzcW^U9sF$t*76V+qxGY_g|SVLag+@Fi1Qga?ITplj|H!m!iZkR9acY_|yKJX6k
z@Hm~S%x}Cs5P|U&xBfo9IlQjl@i{tN!JLlE3ZH^gc7<3=np{w`MgTXafpeQrh%kxX
zqT)B~Y~JOn1SQ~L-3W;U|D5_Mpat?}SWkH?o@6>uAw}4V0#I$JsOr=f24wtuajlDM
zhWxzDtbV8zn=KP^Z)9ZH9}B20nBv2KUsW531OZ;Yaj>-lPNw>1owj9nUZb-+A68Hg
zdvXuv$fe4`R#WOnI{z8K_nR4kEvc3V11pRlxQe&Bpkb1Y0R<JK?;?SjifSqn4&{YY
zOt;gnfr!AMAmi4;3QPvYQV>sUCIIZaCw&e2_P2_+ceD8hb)WFizQ_I}jD&{5NPXrR
zEaS*+HUdGm4&A#bsJ}70c1*b6#z-+T-pwp+C-M8VjhON4MV;;>luib2Zbtv$`8M^E
z2*k{c%gS?#_`U~^GcMw^m@=oUn#2vIa#O3_`l7%EcL#ycfbL?xstjfMo{3_<ZTPB8
z+xV@dJGZ*>#(dwVqGRFi$ns@SQZn5BoQ%g%skqFpdv-xZqadYF-Cz|Z(+h0vC{Q#m
z>bP6q#;mkgbogKIVnql5cX0={GX$jNbnf0uz_4b|G4=@E$2`UaBSvTZv(j=Hlcc2s
zF4{CL<)Bp!OPwL-|Nck$ytnBQa1_f%-J!*?V3CQMxec3VeaYL&?@z1Mph*j`?&lu?
zp_1c*-h)h;pylPCc4S1XetQWE%<`l!8AD$tWc=eGC3Amg)!jM`DJ*L^zg$83=vcL{
zHgpt+?+vlNL)Fbh!~><Ra0QwSpG3&3{@|tbLDKV^1fI{ZK5U!bZ(|EHN=hkVQplKx
za*^yOMO2R#<>?iTpodztB>ToKl2D~6wmWII&5o$x!b1^8?J;zHc+cm$Ye53(1LG-k
z3e0pISy;>@pBfc6td9h%-mb{v<3`X-VSx)b508~g;x6Nv$+6YJ;4xi4Nrw;VXdL>a
zt#MwGcpam*<J!Y~uJ3nS7v0i&x7Xp<K@XC1L)*A+3*^GWj$4_LuM^zrIJ}LcG%N}Y
zfw_+}C*u+)j7L)kGm_ZhRyA*wsy;W9jaByhi;`t`f9nXk^$wVS+#^r~Wd_V^Jw6*G
zb7g{>H5#^7FF7~a%u@b`kMH7F;>BD9UNMFi|Jl+;T>>}_0V77NEG!qdLA04Wepw|1
zGeN$-e{MR`exAv&&novC#Mm<rX!TC+QCwp0ekx`JJD`|G(YG0S`xkY8SBmxMSU@$^
z)p;@j-a%e6@n2bQW1v<M1GLu?RAEV(l`%0;&J8nmuoQq$Tad%zi|a`an{2#p<Mlt`
z*d`n^;YI>Gj*`tBdNz+YGhGF0v`IAVI89-{ykj+et_9;|URo7^9(@D?kH2RJ-~AmO
zrmwj_j{0BkVv0G&kb1mV`_m<_!Gq6U2xlnPR^?e;UKa2mQc0nn6rx2$B*fr5{lqsU
z@%N^L(rA+i8lhHOMGDP9p#I+<YWPZk6DuP+MKLigR7v`<Wrzi0{ghv>v!&&gv8T8o
z2X2u{YmU0G<b^Q5(k{QuOfhYXRA{*H{kiUyp38t%`IN%3Tk+1nw!ao4BWDtflkU>4
zBB#JbfT!o&X1nI-i6N0{1X@9!1|s1m@1tk;DOmU0^Jyl%%9)7+^nr7e43l@ftf%7m
zil=_0Gt)pAZtP$kuO$DdW(7CE+jwB)RC*4Mc>H%hyB*B<o$e+pQ+4!-lx<w#_l52i
zUj9cQ=-Zjg+ZFp_n~Qr)j{q5$Nncmy<L(x|!fzFI8ZFxjw+FKQ`VQ^LklTyV{|x9X
z^32i)PVQG$8dki5T$EZ<;pt}Ju9q!s!KW{Zr+-`Oco7yc0MOPiDV}YVs4ibJLw-iD
z;&d?tS<ZQp8!ksYeZB1|@$@AWT8e%K%5(^~Ke`OC3I4ZrVLR`N9~|74dtGBZO0E!h
z>9Z7a+jN9Ym3uWEH#bp7ruSEydvMQs1CB>S3JB-bvv;5*$@tBQOYB2eq<Q3(43W2D
zi9dJhRtiZrd2CVQXam7V>w0<$iwc7(z2c42GmPIw{nnYO;856Q7o_4Si&f?EGbwpi
zYz?pCpvIMH4-z87OU||n7Xz}ZxL<$o1QQW=?Q?`aEU^CMxmAH)=64Ip-LKay@G+ye
z%L4<;hKWBXbXLo3Jasv64mL={GN|Cl4E-Vmo$$v$U;%srfH>{%wLpdjDYt^84<Pmu
zn#^OYIgFM81zq&f3-<N6>r-6Y*Hff^5oF28U(f`Y8Kjlype}<puXdx>msuTpL=IAT
zimeTf@dZS}m9Hm9&RsJW<JbYIaK%BW2n@UJ0KS$Ahk8c5iN$R$ABX@PV^2_er+SYf
zs>gHw^^)=26Ru~)`#!hyH(0|Q9JzkDf~46Lh{qCu2WKX2*LEI17O*ClSI-1xk9@=t
z3UzcT1(<jC84-!MB-%$mEsAgY_H9-T{|9zs5A>~rQZLuWM(|b*<i#(NTvEcYpYSxh
ztVnZ20h0G7uk;mP)wJfpeQ!C9LCL=!tRVYvThoELSgPs7BD&cP{$#|dFlMaZjQTh;
zUz%#Dws1IodwJ<}Rx}C`q!RAz>=bv<VSQfQ96+>=M%yq&&GtKfj$foxC#1m1)G>xu
z=xI}z!;TbShNxt`Xp5mI#i<qwANKb4va=ZrEj3qhm}qh{9&<GM|6Z8I70gvQ9{4v-
zSo|eFvsVSP7jkrgU~2998fX@<lYJ6qAl4Zo+az}69fm8N&)5fyEO<{*qU)doij7fy
z&Bb1#9Eo5C30M+^If&|rKkXmn$?NCBRupxq+veCJvhwL%=l#E-VDT1Tz6Bh(8cujc
z%r59llv^h%3aEe;)Ctwf#p|tk0PhzGV+3JS76gc@kDquh&?Orh-|9S9zK@Us1XZ9m
zHab%K?*VNc3|-$(N|>Vbm^pkP5t!f#ot2Yyb3(S~EDk>!Zf~P7!JWLZNNkXR%+a&X
zprojt`@d7ARed-63#U8d`Ne!em{IWx>_V+z4EjLRco&;K^E?i33K%0B=Yl&!PSH+P
z#Y#unm6iRRs?fdj8=@~EIkt*~c!VB!_=Nd8nVC`McMF@72!%yF*TOqHTN98Q;q!~#
zK27Ysn}7c|9~*$ksHg+yfQ%g`MGG?a$oUUCtKal^9{G&7WcV=(I{fGwwHJ;LLJCcZ
zeCh#f+h6zx9~;U~cM(7$s`px}E7|Mcaw!wmb7W>`#uz^T6~{ybz>5O6=)S4kY*yo8
z`<e2zsq*~S%Fq(RB*jJ?N&-QM_+5Wx3zWF%Xz(hQ+eZK=TK0)2fWHy0MI?B>%bR#}
zgn-C=-;=;C^;0R<hr5ua6TF6BZZqFi1lUZ*SeubAlsLrzv4U}yDBFDX(I?~B<rwg<
zHd7T_U<GI)Pyu!M%)M+O){Q6(x3$oL^^bXg=?{~d8c5{I`uYI22c9RSz)aMLRd(!^
z{{6n+$iyKa)trImsp+Q$e#l$wBob7j7#X2h-FW99v`NI{WxrVX!(I(Rqo7e96KaW~
z3{%t)9B+vccnT_ilQ8pvWAe(aBUm=odQ5Z<)8h@M(#k2#{O*>!4YXhc%pa9t%-`ED
z9ndAIm7lgTQIN9F8U~;DVS0Mv5gj+Xlu4GdTRumt<ds@6<VR8G=QHOAqExiyl$1+)
z{3f^smF0V<JNa{PC6WHnK^~};kW9sB#$M9FG#So}=uXay!`o`LXov|ss^R-=cfy+2
zjv+nmc#Cvf0M;$(xH&0h?Y!xkJ32b7B`>FmhKPEv1L5>kD(;tt6|=3W8x&!9U0P4P
z#*~;Nt1WHV7$PANX6WADfjZqMP{C|$Rj*R?RRmoB7*~2Mj2ef%Z(`;}7%@UD&zl}k
zo)+RhLuL6VYOouJ6v(25vq;Ch)Ad|lI-uOlhDI{NSL8+1lpL<2n}-|M3wHnPEP2Mc
z)-TnyDSYhmqy$>;#&36~A@3DsG%fSrn~cfldvtCE#_aG7^PGG6GG$6q#pX_l3Gd&o
zj`Zu?jHa93b%ye7z)wBF13E=!j>_^730sipu`-KRdJDj;C>2fyN#DjovlO?Z{)%v)
zDf|`zpC)l*wz1*5;rcIn!df4@20c4N-b}^w^h)e}#LG5Fvv6Kxxj}^Cf9A0Kf(agv
zhFH|Tpa_4qUt-;EIA>9u_Ea;U*C6&qi)ocOO-A&Gmz@3=XA3J!0TxhnF}g>nDr()n
ze)idqEt<b8OHD3Vto!fibICd%ue`&Hr5S&+uzC`Zr=pLq1Wh?W;(#9d41St?dDPT0
z-NtKzZ8Whj*P}*<<?s+$jdFQ9oP~=5aQz<(5IK3$7jm`K$y3~TbDGVH3cTJ<N8SHL
zbv;+8&@TT`G+nh3Bi^lZcy#3A?A$ti@IP!XtCxrU`EbrDq(n4SGNTm$HlOGpi{E$t
zQ}n6m=lVfq6QrNj6my0hO?<$big#1__eQb6NzaVs_Tm9{29B2Of=}hAh81>Oo&lnW
zKhpe&dAberACDu$6a{oZ<&txf$N)1mU1h9i(A-BNW4W{NOy-LK_*#btmkwy?AWU0F
zT#23<hn6JOA_54*ry6?G<!MqfnyxALaMyS=Y4q+k31l(XM5te+gunXXy|lyY>=sd-
zij=t*rH-u745yM|oQW>}wv8vOr+(>_Kd0-5u2r1&>R0lr&g!@VuWL15tW&0irg?iC
z8=f0W@>bh)8x?KEReh)^))nOW`7NoKuKf3<BI**_up+a+Gql`46JxmrmW;?r&#6by
zTqMUfI&ujKmv&HtBI;Q#v}%RtHr51t>rZQn^@$FHM<NtlFQ2>z0F&ByTej%#B^fxX
zXaAE2M};N9)v`wo>##BoP|?!f^RoA?L+)N2{s>L9Ak>Gy1#Mle^Y$}(*^8&YiwTX{
zSbN4*V$<JSqMK01`<?gtV6Vv<ByWmUFFdf9z9~+-MhoiOMU-N>4ivkmXB7Qw#I()#
z{P4gSaZ;MUdVy)Ad#u+p@o9X}fwul@o(hq<iH!|`fKBlAzio*NP3OGVr_vM-qIS7S
zVn*FeWs^Pb6~!zRx7h4~9m=ffyuVp;xo->VtSqiDG_bGw08N^}$w(r?nbuJ1wVyPs
z+euVZ{fnhZ#l@Q<-zY&bt`ZHN0DwB*vkeN3K^nx+D0aIB_CC`|DqyX4c3Ezha9``6
z({}Jm0<wec^WJ@16#x=#5e(n6vE!7p{yrEzZ)RZdk`SDDm0Q*)Rkc4Is4*PXGf6J$
z!BI%M=YA<HbYqJXR|2~R0Z$w=$%`()Zh5?0c!QO4zwc$K%p3V%obnn4Uxf#S4Drfc
z9rL`$>YJ8iI=gke0Db!^3bK8QjY1RHvc^j0L`}80;Uh8{&Jy1suNmIE_4SuJI(t|^
zkcndLHAqJ!y=`LSFuM}A3okETXU%eaO%#>^kBgwuJ`3cPNPqUWBAowJh)gkNa=Q1e
z{qy1q+abSpgQhO?88334e$`&jc0*%h({^OQ!yTHK(D{)Gd&O|ulCuL3Q?%szNwDJQ
z7o)<$KE|w;)WYIPIj2ktZ+;Z>w)hf(GSx?aG_*CO!lV6|2n9y1*X4&SP1K%yrQUpB
zS(TB-C$VApjigcFId`2erEy4$lv;6|{d4vmg_2vA3%F=-v;U^M8609(GKyW7Im)Pm
zZ1ICDW$Chmno{9!0Rrysio%4S^=ke%vyzX!DH5>dTM*{FiSja_zYEfAS@paB2bL%g
z?6v%C<i2`HN6^fmi>>>5>;*z2`$&1<yDwf`JX?Y6EK+i?H!~Z!W^dZl#_3j7RpTs!
zG-%7+LR$2Aen3lT6go|inW|5O1xH(W)yLqO3(LBjH&`TV-cigu?nMGV_oz6Id^ob<
zAC#1e(V6Zp{p6G9Bqr*sp40^f<47yF6W1<6B@vm+n#>jaef^`v&ua<RqOYv;yZi=R
zIWM@4)p)pYd%gScd?3-S9MBj<*)xEAui)<tU2B8GLsaZE*s{tRx$=DY?r`NDV29(W
zmoj_hpF?=DzcqTgc(_?!CzlC7F)=G5+n&S0^RjKrjcLg-A+yy_r@S}@(PE$@xJ`X|
zgx;-46N=yL>1o_Up8L!2lj8M(nd1;qSOmd2;l+ZAkg8Ua;X5%}ZF)trFdSoOTHUna
zjEH2J1JAEe)mi_2rM{7}K6ga?R+u1^O-$ZRuRQg%ZR_qk^8hVXS`;%N)kq<ZoHZTJ
zFyN(zb%>BWJ5ej)$dK#p8hbjQkXy9VTyf6n?d1_xmWUk0*5)2TGNZyCW+VWUSXUyn
ziJA;kiJ!?m7CV^3s^LD^=D58=MtUDiEs@b29&T<%0g2n>X0IqLDWsjuT(I9$ACi9l
z8fb~z1usU>)JE#MjAlc~d#82J`j5!sd7gM!5^aL3cD<1*?3};UiJ@C0=pWPe@QeW(
zJVB5U0YT$fOzQ6E%rv2d9@ij`DVtw#HGucw-L)I<S*?B0mWZp59^TGycZ(?r+v5|O
zCWT>hOs~<EZONH1rQb!&PU{$<?oDlFLrUENq0M#r^V5IGW#%r6xKFF~_SWTQ{m??2
zwSDfV7&$Q|4ka=k3dK&|#8YfXAlDX*@vmP<P0pq;jnk@PDeuL}I;H>IwzWyzHBLmh
zpkK^h5F=s(EQdRki?V&G$Qz0QFnoS&FN$wv0fO{)Nyj$I`-2IEhg&{$2X~6kiRDfo
zpRlu6l*vb!k@q@}v>7@9cz24mR_I5cq{BU8nAs6A+6bZurWelSwbNecYMWxQ6O`(R
zPVtYcB7L6UK9vRUm`lQSRTZBh7icDj-j0NR0dAP5H$@qLwy-x1zTOrfYe}7x>o~;D
zL|)&Wj$=D+>G8@LwNap7UK)Ym(~T}IY@%NI-+bBO%8K0ml-&Iu_6S#;QJ2`ggM%Jg
z&qu1X9%m>j-u3ZalvAe|k<c6r)N0DGr@?c+7m$LuKMp31$;M<_szzu`C|IZo7FT;5
zW1O3KNkOsGM!!Z=mZp8q?;-9))8SH7({*Koo*6d<n_W<q)!Z&~FacB`5o<%5)V%v4
z8nIUWp48E)Q~0jz`JoNnvT=6{ZHDY;_F!8wUnXetnV0JadJc<#`MZd)Rt+isgp1R{
z_{ooP1ErmpKQlt?kR!r4<=rfxg4viTzeP<%_jI2zY&cn+rz@j%-sfxPGS-i9eGnL*
zk{-A54hkY)>k-J16zm0$N`c&foFvg&IFqq7*`oabvnp1rL)huTciu2ONJ&R51eZOn
zZEFPf5xYwXMolT`{)M9DNCj{N*Nb6G)U~A0+uNIc?6BFXDi56!c~xad3i)i5<!(54
zNxnN#9iBN?AxSS>rG$PGOE*Pl?4a?BG&61D93R4E5vOiaq;Ew8AzP`yk;+s+eKIp6
zaF&2sXU0nLM#0_BRfEPg3V7jZQFbv9Xh4~rs*lhAsN98_nVFT9m27dBk#DT6o!8l&
z3$l(%XXqQT9V2yY#0{0JGjpeA`A{O|9<Ik9uErnku*_S#|B3r548;EULsF%`s0dLn
z4NrfD0<WmB+qn7u3mx1PqgWDM8ew{B6<!04D$`G!5+!aLf}&3x|0$RDI1#acAV6h>
z(3x}e&0i;?f>BzmQo;bR(D-46e_XMT7(o+-X~!VG=oDkSX|y{+Q32aFIlH)ITlf1q
zc8W_Au(SR16FS=$J~6`i89O^T>DIFO@o|IC45m))?2qsYi=t7;-CgnCX+G=0-NpjL
z_!9rZmZ{h<rTFE1aqXVAnxEbA%<?Pcgn0n7O0p@-z{@8gxBos?RO>p}V2wa_QT#DK
zP*P61k!!nwPte;VHIs}2a!o<%&`LW;ZK+ViAQ_fjhfkvMZ#ohnRN5x)b5GdCroa|D
znOM#*nAMUV%b4;^`u}i0HD@X!5#E7E2Df3C1)QS2@V3J(cNNrLLEU-CR=xgq!(u3~
z;)A7`SUn~<-^01qjYtdst&Uos{PRls=kWkBKXUPcQZRf!V@s>O2ZCSNHQdGqCo50A
z*&nL+<NGmte)DUDg@vWx?Gs`|FhU>e%H9Hh+W&x;)oLys+#f78Ih7q89y(`H{6Ct`
z`;qGZedCAJ`;c+Su5i?mgK(^nkPdO|V`U|KoQ|2DnQ_SO*vCkY*&$gSGa1J`k`S^I
zC%Y2L{JuUve9vES*6aDa@9TQp*L}7IkkH+pr|yUD_0w&kf!XM%d*AL?XsI_=!)Pa`
zKfm=pS3CW+vD0w^42zsRK&_3Zp)E??{25Z{*b!y#^`J&cK8^eU?b;2z_M`ajeOL9D
zk>`Dt=m8|9T$7zbvngz?P7mLO5*s>NTE4MxkP8RtZY;r(kLzzEh(J8t)VSOhfc-se
zU{W|rKmeMRO};PTRSP7Coakug@}tGGe!3y!F1TxM=I2vC_hh5P$GNW7U>t86lJiTd
zmw?IOD~~y6Y+OPyqi|!q;3#+hV(M>u?+<*1*v+?`PZ;hLK5+Wgqdd3HN0WW_oOi+?
zPc1tjbj^SEAAxcW^pVALG9U2Eg!N&5n_1m4sAZ3K2~A{6O>2m+v&+H3PPV%SQ2B1{
zzYJ4ipR{sFB1^D}tha8}2%;B=89Yc+*~&~@ON}ACF=VDq0wmo7fO#Nr`a$c-$e#aA
zz{He<iOks8&Mma>915^!2d^E4=g|Os8c=h9=nxM-{r-t{do`@WW#pB(t~q^d`%GJC
zXrRCU%J#DKYQ{bAt*NP<g?4?!Jn&jrfPRzHN5pjOjC@V6QJC6ko{f_->2b9S@0jx}
z59W_^I<GJ_#qzFpwQ{41pS@OLDj2@(q2F(|5z-#~#d81}Bk8Ky!`nVN^CP9D=5~6y
zX{(SqTU2&%$iaU5?T+x1?USSUTVC@yt?s}fP2FTuqE%OmTO=XEk46F$f;tx{ymo-w
zzddpUSU{(1tvjsa9Pn7lm**6<aQy<JvCv7YY-gtKkG)9k3|;m0sr;&MB8%P;XAea%
z-br}n)tv07iktTq0_!f$K^#$Gi;&Vug0A*lNTcV?TjVbRttWiT4>9N87dlp2{lP77
z0BFilk8yP$@6jGFESo6d?DEZ~tU7;WZ_f;~Np3C^Y80_c8oP=VD|#|Qm$HdW_4rA-
zfBgORUk&=rW6%08skRGJilj@+U3QOy2x`Y&;^m6}c<w8o-MHNHEaF$SRGe9aqMk6<
z)f_l-yY7}5&|8r4|1+0iQo6cdas~{S4%@Dn_IBxdE@xl3=3PCqZ0x6{PaMq1_Tjat
zuDdGBAVA@YWLy5Idg-2C<<aJDT>>_di4WoD7`(6(0D5CZGOsoRFSP~9S7z>`UP*fy
z2>Fj)uK!t?_2t-))VTc72xv%R$WHa<;x7NGUpLu^xA$v*ST@bhZ*;qiHSJtIITrHC
ztdrcLw8>_BOC~<Qx}5Bkf(WR5sXv3NDkni%T5B**?t_e~O99&IiQ;D9f7hP|1ywY*
z%noJO0u8O%%Ic~X(w7=>I$q>up1<dEF9tZBLv!}W?FWfXHJ{SwPVg@hI9*r)Qf=oj
zMq3yF-;6c?s7Q^=KtIUo8!8xDhrq;4VZcC9^~jz+id|HQ-A^0A8Wz|&yHoC7ST?d+
zC3yHAU=>}S4Y%Xp4wDg6p_wxJtXepD-(-wjy=3ny*Z;i7$E#uM1uEV_zM->!lfT+l
z#qciCGX~03QhaLmBfJA|M@3jchIrJksBxGS4vOvLoO;He7|!m#nDi;+`6uKNt7~%h
zxivd|>%R-fQ~9Fo$6H?E<Gs{56cxRZk<EKsQ3i=25kJ2+TXcQQnC$cd!zHhY6#1_0
z1QCvhplm_XkdVcXZk~5F2g9XU;uLDk5pg2&Jc>7mUJKh!<yxa0Gw-SWVcXe3^w#W@
zb$<>lNJw2?2UOMi=^S^`(+kC`ZLiHYM4~@?suYw7BYPx07;P8wF}RmIEn*sax?DLl
zwD==oqjN)z%J$jlg=Dd^5d0x00wFkgt)e+A?;7J0#F5?B)^<$AWJ*)rQl^!X0}`Tr
z<;>;(+K_AxbvW|3Nu{dy5IN1PSJ4<~-&E~F3<UQmFAI<}w>*!w_hv_n!khS;OMDNu
zI}#&XZ%e;zX-eQSlmAaR39blMuDMn1bH$IkBe*@k&`yKINt#W(2M%P5jp|3kPYH0d
zORFz84%;|yU8z0v;Z6H8!aDSO*6ysS1-RPh+Rr+4=U&_}^eXxqgQqXu*s#6@=svC8
zP^tO^9R5<aN<;BslBCD;&z{ZV#F!Y;{O&)VA}@t}mt^4&OAnrU;J5A%Z`{vahL8Ta
zR=qv_=x1I3Kexec)>B1+;3k^kzRk=w4fL;Vvq125eR4r(uOJPR?>_b)`;HWb>FJ*>
zP`Vp0#knx6+h*ePlbM~__hBS6Q#uyLg1HGz)HO?)dmtm8dJhlX+|=}^V6lv$Peke*
zln!25RcU@8>0dp;1j=%byH@it&VIAyCCZFlIKzr<{AI6N^0pG>9LVQ~$-$qs`n`}#
zjyKShbclOvm?$x^-^CBRI<l8L(P8Lmptq~idi&ht=GJb{TQ&FD;SWSg34Yv+P+{~!
zs>}L?C<ok?dkjxp1Sk`4CE%Jp(mejVBX8V&q}aEbZgY|PTetSt4_kH)wYzkl=jOf>
z7k+n{o%vpb)$b8K%{+p=%9XNpCXe7s78l2|YQ^tFD|)2V3Sg5;UlqBzcV~VGT^>BY
zz5hc!ichEN-EC-VR5cXzUw}L-Ly8DGYsLGEAzN#TWA@?1JM<;wJ2E)|ai?t|4r0B|
z?$FZGvUb#EZN;f^k>3$a__qCKNEjLepc$OEWsiPMqyn;pg++c-Yp(1kMb<%6R<__=
zU&*LoUW#OI-OfaT(mO|RI&MToibMH}P4Z~b9XpcwdS?IC&%-khdMm&0y3uEQH-Fq@
zlKNA4*>P>!ikf>vm|q$EK6i34NzU6_HBr>Y^Y8AKuf5`pl5Fa(BTon!eJp?BUw!hA
zt=TEy(#(>H|8nhJRfUth7_3^1;gN80mc{26RrhDP92UUx#403f&-WTn?)bZ!AoYB|
z3NH2$fX)a3{2&gxyjd030}aj`-VeV@nx!Wu6l41Ih{D9db(cmf(##VMklbp;Nw^(K
zr*g~>jhYL#wf5a^`E0ZXCw7OYer$*w*i?Kr8#nW@ZsQQ0W$v1Ska+u<py`n`FdSzu
zeV^&`%pc*8>Wad7eiz<54<LbL>}zHy5}2h*14PwxQDF{y&h9~~Dj`Xs9uTR!8ED}N
zo5b9S64jF2^Q^+YIR_)H`%w4vq~ICB>lPp(W44zr=Ob&bX*}^qURSRRsqcUR&h=6J
z!2$RUzXf1^ZlcA`BTHT6;mys4XcY26m7>u`p0?u)klUS?_Pp^ULAqn_HIY?`lg`wt
z!|@Hlot*_>8Z#N_clKMu3R#06mYQoQn)~UG;1xfMZBwtH*UQ|gWbec&i>Yo!>Hnmm
zB5EQy*LSn8fL0)>d0_2Ty3Ke0WTB<D?&%$4M_OaV{p3IImIn+!R9*@?ov**v{<XS2
z2ql}+7p&Ue*@wzch&b9R5)f!ol8RbZ(Pu^WxD=NW%}1gmdD+=ho>#BCM=>&k#zNPg
zf#oNRnTI8;G&8~H>O+N$g`}HXk8Xz-Pq>7IhKdWf&T&hF-cL-p<k2#8*E3pW(KSS4
zI-Sh4Xq@tuiQC!Ebdhmek6$^3Ei`uC>HAzd=Rwj;JW6*g+pD$M;F61F9`oTvFDwPz
zGIW-FUNvd;7pZBxYUAOPYCGk4c?x~Kq`t7WN;n!PH`iaYu^Q}2I)+I_rSZ`v&`b7`
z63Jz%if)xILaPp*>V@y}vmbAl2`I77xi#H)0_h<tt4y)u((Kx=GST}-YhZcApBMm*
zL?^8w6SR;jtS?C@vZR^rLTcE$pJWV@6a4|-GV$iZ`~3VH)%I>ajtFt$s?Frao;35E
zbZN~!q^y)>oS7Q)o%=35Xh2{ak`ZLxwJ)5XZ^y*CBHg0<$HV{IhWp>F^|X*s<TjDV
zm=P4lc@$M5PF4DF`mJ0uHlEnWa{*VvPZ`R%sE4^D(wns2iQRHTf!{gR{Pat8(i`P&
z`!858g%>IpcJ4WD9KN?ct@UyOfz(d^jAziS{3MO55dWFoRlokpiWaPJAXi$m;UM(n
zcNvAoH0fLJJTR>{yBNIAacOHm6tr_xV|XX9{f2s<>K>vm*fPsqwa4>HJdj7h6Z_H*
zJ1IWi3e<9tj698K=ZBLP7~kQ>Bp-F=7-URU+OADCkcumpb?qXw!d&)8izs?l?(R)Z
zhu4jL5Ku85{gOH)mvRouvN0i6265Qjlos^hGJ^`6k;n?odc5d$%tVLa+|TWB%(F&n
zYi{EwOumqH?UdJioBQ=VGmjt2AQxddzuvdtFK?|#?*~}kg8}@Gc{~kNyz1d`PwmOo
z?*zts#hfM<nmN}%<RHxf)5OfJfZ0i&OVYc9UB0O(9Eh8qZNn$@%iMz6cUWMzI#e&1
z?+{TY%`A>YRkqGN20c>JbFQqaTCCid%pZ9-^Q0T%u$Y$9&v-7jFgOdHRau{cLk<_T
zHlVw#{3XxZ42&V!TIbqk&AE(TL0Zi3W51|7`S>;W^%S5X7b{=QmRms6qT>2XI5Z$i
zGFI|KPG!17Dxt;d$P~{TF>}+tNO_w-N>*2Kxv3{UApdj!DP<+6Xxjh{m6ZbSM&X{{
z=b0<P&%5#jRUO?f&-PAdHjhyGgUaJjySyyv<E$$@8ZNH8TFCoGmAdn~mMuLZnvX94
zf4Ki_SS>Z@=4`T0UMq3D%FULM8WJvn!;o+DED+>Sl4h0m&8$*g<KA`Q8oq?fGzJ^v
zg;cxn)5m#bTb`HSoNalXEd!in7ahxwwQ<^!d&t?Fqlwy10?oah%t7jwe#fcV*)pBf
zjndax49<-U|FYAZd`BKh4KB<+0dh`n?W$}AumM@+bdLffI{E&)kg9iZa8Ppi^Cy5i
z`j}3fG~lbG9s+ZtA+MZ#nAxLqi7!KsmO}$~&>Zn6gmSV<*PrieSgwjj>aGeiU@Fu;
zZ0DyKn^Am#O51j;d+E)?TBS0dD?2+oBY+*ql7cf^lFt5;3}yHZ)2d?Xzyqz)RzRo3
zC3>1l`4<v}g?&<!By8pVi`RU(EmTqZ<3|!}{JkG&tMWO||3Iy0MfJC=eZOnJJ#U6R
zIIqhf><i7k-rDLZb?sA;yw|Su!fpSf01K`GJs0Goy<YQ)U}+G;wHNYtreLu1QN2r`
z%^c7Bsf7lO2?Si$5R4HFFX{{a!w$Mk%I}!6x~0z(rl@~|e(cge-lyP#jqRxe+o=&m
zAE)dy(~#Q)JbI=f7p1LZT~Ce>)rh7SW*UEOWQF}rK#OUAV6sj$EFU{Ul!Ni=QD~GE
zoW!a19gTa2t}^1InSjF!%Ly+wyc>N|cd|Y~9x<3I-6s*zEt5!`hYm-B`IB7ti`lD`
zp*RL3PmNZKRn}q!uQwHb(Vq7yKF;S0q8M%kU;W!&&^EtI41UTL9lrPO!`^=3Y;$Yl
zaL;Q9B{)S@SXkC<KdVs^W_PY+&{~WP$>c0e(}2T4ji00I65paYInE2cNn?%?g&?;Y
zD$np~eU>h)(5*lU=NIy7_(^f25+UyFm)faw>jKs;0G-&eLHBXA>qtE|pZc(w3)-VH
zI(8qEq|m1vs$Af}oT;c~vl`4zAJ|%8%E9gc&YUr(h$k)Q_<7DYy}ekq8^8pmG1DiH
z&4&uh^lh^Km+)<S>Ga<}zPldoW$vLWgn5+?68QDMiFI8I<LE)<s*VF+^5Z-)wd`0U
zrTa*CtjR4S+Du;PlNwTI^g*3xWuGF^lxhX;VpcK%S8{S|=r9t8p*-;KA>=CA*xFFf
zo9qQ7QRBI;gHg(d*QANQhOmX3+*I;bfZeYB!NG=C$G@yxyN3@uW}lky#swGBlw{LW
z-COT-LSbuPZvld3dBorQ_}}9+JL6Z#OUEi#FHlPxU5d`LLyQfydx%C%u%HrAm=%qH
zX)vF#`kZR1cn|xL#ZTgH;8uQMev>RpmZ@fL@rf}Zct!SM_JKU3>A?8#t;}I2fnfVz
zw%s3gH_m^U5^k5G`v+_IiT<y;xMV@sKWy*)<&qEbi!lqYP89S2j?~+;iu=L+kE>O}
zv0!*_@IKKylQ;lF)TNci-bFG%VcCRxKW(%<G-Evu{8qTGJ)2Nq><BrU5ryNy(R}+y
z&(PhzWE%-n$=DpAH*B0NUov&R?crc4H2Eeu*P@z>9r#_9t`q%d<v>P9WK!dV@`T35
zub{_yBE<gT%tYIJT|lm=+=xeGRm(%OXVoccRhE-JSCS{)uz&8lPXOz+Th^B!I94HS
zB)Gq!yCjL9Pfvg{?dnXg!xAuP0b~;ZM7$WqgV~hR?78i;zQMOSv|Jo9W^hNdXQSb3
zb!{m=ZatmYu-Ve&eylQev0ByCfV}SGPRcYNCg@Tt!8gU1<Y_jVqJXZ<rgr>@bf+LL
zRZxwCo$2`a_^VuU8p=Ic&$iR8rT6p=n-Wn^?PSYK5bzXEx3_0^I$dGB>eld32?V?G
zw;)9U^iOr;iy&(3^E4ZZfyXOSBg(z2D%=avr&o#BQ=$-Z$zHR-<Z6Shwe^F=Pv?XE
znZ43|Np}~CC(Dmzmu?v-FS11KuiG>ARO1e_iz$~4dA*c%Pdi4AkF>*M*DbIPPaT)+
z3cf#m*2U{+EuJaFjl#fth!R>v$a66d1`Q^4ZKZF)kDyT?CnxS$un^Rq>&oJ;zy<Up
z=%W(tI*2aR#2~EGC?np!f~OL@`zt&3fbBA|A%iwqNI)kJ@LhInm^2u_PLwc3!Ra*(
z+_mKT6fqc$ik+kE>}*u}gcaLzMd_xsg&*70gB6bjk6yu1zH7FYOo+ak4K%989p|oC
z@LC=eWNemcXlUrQ(9zzgyLVp?p1l0v7H%+4xxj$PxkKx)6PjEDeLs1sA`ttYpqum(
zTg`g1Y2!#D<yP^UnE8`SHSe0=(2V3nyFIM6NK%Y1PPUZDhF(x79LET`?8M?x)k$QK
zD2ewj%F<5>JFYxcYPzoC-~xDIRv3qn2dWMF)%XEZ&=_w#s{Lg3L^^p{nv0>*l=@F9
z;-BuUzwLt3@?n#d$dM0|Tw%md0zJfc5P$s*qy)9a1Z|Mx*(>94Oq!<PnVdl${GkWl
zXMcZIlnxTSqWnfe9xnYH6g+0hEphQoAj<wf3t;UvSTM0I{4F@OwsnUqDnebkGx{_@
z_gy>A;>^zYAW#|}Zm1cZZ+|0b>~_0C%3Q}aI&)}(UJUxri3Y~M@EpBS4z9S2kf{KI
zIO3F;syGDDj01@#iLq<Lds7-0b?6<Lz`tAM&6-B!M(ATRT>mM7*d5+9g-v@JQm(Q4
z+d7g);3MOo<wnX4i#h<PIk>QS7E4v?ZLpH4WsOFAG|#e+ot%W3mCfz|H_QKijY<?F
z$~B~Tt7SV##hm)Y-v<+@dp>`1M(N=9@855N39HjbMyLzi=t@+jtd^RZ+LSjdyJOOX
zud1r5dH2Jct|xKj?hYc6yThC%93Pm~mCCDd%O^mZGo?%EdH>qe9{#S$=e2}TVhq}o
zZ1sS&b1Q$&Gh0;mRg4)E?wkiLCpd?~@I8sHrwq&UyjMDTMP^1R2IVVLJ`Rt0L<$9H
zsVV<qoBENyX>$zGRPUdhzA9|v>*~^&<z-zZmS=wYgM46Jktq607lq-PvtK~Y23I~Y
z!;BNq#R`-BH!|5#e2zps)Jd4_J-j!A!z7)_d}AVTr;}8tY(r4>DN8w-Z1Zuh>rU1c
zC0-Zy=ga$d*?@X_Au{8)$1Bf40lV_CxtSWZ-!8S4#j~`pCEG)?c6LXJ%0suher~mP
zdr5{)sKbYauA3JSfju~?y*YmD8uX$_NtigX0JHufWX}?p<98RHX=;Vx<fSu#GC<H`
zP>ft{W}&MZZP7;FP3zXAmG1iiGUUVN9UxF?cE7-HTTTE{w{sL+n28RWZc9Rt@zY1^
z+1m$4Ry;~qQnBOOM1tRP5PzI~-Gd(9>Xp~qc3ffkWovr<7aofGs|d8#RNK8hSZb4b
zkY$Qa!hP|#oecoO5&9HIcm3^Z>ox*fNvZ%oi0DJXwvJ8}#OfyfZ8gD}XoGSSSl%S>
zJB<o-UiGS3ub#X-daxyXf(78n#e_b@HlT5eqxC=Oa)^)`Z1h2H<=Etd&@I{1weq6F
zj@o69b$Kc7i-L}sCNtXy^#@JvhvDSymL<94KiQo+)l=1G<8tOdrsLBtmfMJCUa3r*
zP^MC*QxO*i87oZ(z_3h2pQvL@rM)a@N*zukR7yvq4?X{9<5_c>&7P{bybam=dGu~G
z0I^VGzc*O&fyFFSa);UO0omflVU-1=U43qC+CX;XuGyVkUDJr%hljtFn!PAN+%>ht
zek;Zbv?)T%1<%AT)t-d3x?DmJLih9g7TqxC6hp4twBAoc3sdl;{7V<k%Sd~?O5i0K
z(Ug*3_*`HoA>@U=Za++kzXyKl)#^F6m1>0|Pd`=-KXyyf`PB@|H{t4+2a475@yb5H
zW-3gf>>bu%XSc>(cf$0uOu-YCsS_a<F%aXGk>ur|hzPaOdik;}7|p$9_A49Zm$%A1
zX{vf}W;DG0VLYVmz+xK%cjk?o^K>P_N_rgtR#9biS4Ap&XhzhcbBmwP{90{k-pSV{
zZ2RWAt=-zpxLoi~HC{w^D#pat|5;HcIyDto%-F&D$*BZSHQkvd>(n{Leo(p*tC)O`
zNk`oF7Ls<Q1O!=D1SUX)$Uj19R#hx%=pq9O@qrZg(29fne`?I#o}Jl3`DNommu}FR
z=A>&w_(+F+!;k%3`pMokFmVtb1x>^c<`yv<1@={4cPMzcP^*y22I|p6^S3<B+Tag&
zF7kXvk(Ei%77{`&en47~m^xwtc*c$I1)R70VK=$;=6C*5oPA(uoOsZ>>pSHEZy=o0
z_K&!<9Y)%_;MLP{%joRfv~RwjNBJEjY^ts^F{S6;OVJSTg2jD+Il^4w2_V%VP#TI$
z494^5)1*8pw`@ScKu3PmPmjD|wN`3c<&@Wczo*7ldRH-d*vNGVpnTQc3S<`M7RvDf
zM_8;LA7yN&)lg8)?9;!Yp&`W-tBu9>ZEhP>V^C(71>-$LUwnK#;5Gw4L=#pm{CFiu
zWs*JpEfs_N^+b8vZ|+zku&j|40Z7CV;@N&p*n9`7(!WKE=Vm$Agn=mX<_Yj(ET7$r
zI}_!kmiyRQ$?PHE$~=s{2ybe|Zi%>l3oa~kR~2B3+<YblQ&UlC!U9Px_rQRSec5DJ
z8D5@7e@=flhCZ*1ox_n?BXQcW|BVgFRZVK!JiO3kE5HP8Jub!L&mwWCNmVNSBE^k+
z@ZytI?*HQ7hm>{#Zo9b6Zhu%bOX|mw{04ca8m#h{?WJOXd$4gWUouAVC|D&qP06LG
zBpVIN9`}ySsM0INzoo*`(UzD3cf8#2gF6zzw=dZyrfHRL0#gAW(ODTaKB2^skD6SI
zGoEJI+gwNsMVrE#Qdh0*oXj8cy|0G+xf$Le=N$39_%wa4HJQt<ptR8LYeneX!%=^p
zAZ#DqYOsL8J@8#jH(2S$g#i6mcn#cB9S#(?(1e$3XOc=4&zlE-<fT7q(eP}`Zix(d
zw9aqmJQ1W$tOoN?xaDjfP>wm&fmIb}uclH6egh0R6h?rOy>*f4G5^t@Ki}JH0i{J0
zqzzBF2)6-_d!U@8ef2N!GZ1r5;-l0-_@Evy-?jM3zc5|a!C?1%O$?5fUwWjNQQl$?
zN4mA{bZ+ijgMg9}&}nBr@Y91#&7#KFOs7n+Hi^GfDp$~}=^E;&U&_BX0lF7HAtY;!
ziFpr{oz^XAYUbYjK^Up?h+N7^<4Y|!S^f&tuEAxk6UwDvko;ILXs`aW`^Q}s8o|+E
z{>XD|iZR$#^--Ca-JhR7fkC$Xy^uLM+sq03G&CwonZ{{SNQ1{nGrvM;@lDAw(Y3KH
z`+&Z2zD0j&q8fG&?I(~$6X5ZAtLM`=?&>Z-scuaF-E4m&^V&#1@p^Pg=D(jy085jc
zu~eq@`+oRJc2H$A*F>)7-$S~;?bvqJ3wD1i?1W!<*?g-N-qm&eYc|O1mDlQJ7k%s6
zi(jje`H2ua2TWDQi{VKttf?ef<f=9&%o)nj*lZ0Zaq8y!MsFZxT}m=cOsm9mnYdiB
zlOorP{Km}r+@li^F~R$KrYOF$I?UmU?^^q4Zq^3S|A%v+%$xz~R}EV7=}_*<hQyn^
zBLHt7mt*OMv<XtilmnX|ij#EV^#}gB=Gt;pgdfZKH5pp@wh(ZfZYU!+k2<ikDBg+`
z&lR>F-ccw1_j@5Lv_%3rL$F%<2{BWDykTLddaTCSjx_Q);HGfM?yAr4am7@$wyyFD
zr{5a`3Ij{aiU%>~>3ktNWoS=>>8C2>l3(uAD{*u=vo-g+`o!>y-A_~sbGjNv>^ogu
zOp;Q&c&{ZF(k$t9G18iFX%pz8&lPcjBm`9nZo2iJP`38(pHg2b-g7pfej0KSidVP*
zsxZ0=`Ln-u8E(e(@85W>|J3PrzE@oL+CT(9>m?Hm{&7KWpFLp}{WePjb2BLmt<Wb%
zi}~#TMgwlMax-C21z0EX`)|;h)Y-Arb4@l{L%)SLF57eg3l4ZLuX2z_*vJKSQlP?#
zmwWE%pMql+&Mi)adxtJpud;j5Q>`KMtMN77?H%iRN94F$Q_bQ2)Y(f+l}0GeXgXgM
z`MQI)5>HuG)AdYmDjbV~qjf<2<d`3H>R@<j5}apH=~Cz<iiy;g+8f#=8tazVN6x}E
z%@zn=xc=+s-;Z)E>_QHxwT1;L?&rW)5435VaWAn}L?;;I<l@hj6(W)YD;`r}3rB+;
zhk@iIxvi$zwYk<AcJpb!ew!C}swb*iI5G<^Y5X{Ph_SuF{~a%`Do(++Kg2i#QMG@!
z=Z<zdLZ1dtkL><AJvqYv4)3&+;9gb~Bi8iHb?j`!=(rS?RmR0?I7|gDKNV97td=Z$
zH@D^Sf<;IflV1i`y2xo&ohM9%VTkOAxEx21nMqOo*p`}0=%jHclBJ{tnAc<wj_^z7
z-2iD;Xg&gVOI3|`Sdo0;vDD2oG%g{bI4b~Gp>WuUt=2mionVQw&%^+c<-l9;z?uV}
zxZMC=V9-4@Ua$V;HTMh7ZWSlSNjIlkDe(|t{#U?x8jB%t$DMbTly|ETeB)9`ad#4l
zeEYzEr!%-5|A>kbk6cK0?694+aGK-KuTD0`b&gc^<}-NO3O4^Gf7LoZ`B7v2w>|pQ
z!an%ucw?*9;jdXkaA^7zcGbhH_Qu(WFA83I-9=F4*`tJ*esu|To4m-<3=PanC%TN8
z&-)j-^x&EpQUmM!?KvU@SU5ZEZXbdfQ8{0do16S;Prnh(FC7Cgm-FqRQ%!T<Pk@g0
zFYRnk5J)L|-XTK=NLo|=^G7+3Q-PB+>uD=#gnHCQ-f3lUTN757iZngfX;p{(LG!8j
zp0na>IVCB3*%7D^SFW3mD;vC$_9Z_sb#We-L#=0TO<Dm@^sX*Shu{B;;70KVa5mch
zm}#H$pBoy|)ffEy@fPiI3^2m0a-d3MT5fVTEPtiWiM}An`$bvTgfD){1}cOG#H#IE
z`I-w9&Ul{~cJ86xkVbR#;bO$Uf6JNumaUS_vs*yd;=c*hV+EmCD?cDL;G{-GbV95V
z52J+fZU3xlvq3`6Dn7_S{eQh=(EMWsMA^9go5_~4bPYwvb~Sgn`N2h%PrJM21x3nJ
za+9F+tU=LPa>qu<1u)#Z%$Lvf1v&*m;YCTJHmLG|fQ+5xW>^0_;C8+f$5N}Xnx|g*
zkG;*w6{J3ahRXtP3Pn@$r+Gl9pvp8q_OYARKPJE0F8v8SUaJ*mkxIPVTmwI@**R(+
z4Y00=z3lRHZ?Rrf;2;d3o?Md>5SP3CF-28I2gKRT1YNjjTEd1l3q0l%N(>&0jBLUd
z_<b&*kOQ8lyu89n!NVzdRGE*%Vz2Mr+?ggR;_<)H2+zEI!?WK~R5IH_*o_$Q{LcPu
zk(tK|eLo0(_C6;%hfQ}%FO_&x^&3laGJbY!9J%Ms{BKZjB9Juy$n2oPNa+geL=vxK
zDSlT)FqPtQ2mps<qw-89glDr<U?AJ`aC_3ppEVP%`dQWXAi>EE|C<d!zT%uG<_@-X
zj=J0Su(sU2DyK4ZI=pk|P|H0`<qGK0nA9;ajJ{&!EUA^>M_#-q{{+UfLxVU@HDDLu
zB$><_EW0tBlmtv8|M@p{gQz#vm_Je`{Kf_8apON>^UlNV?V7$CT!qw&p#~X{^yo{g
zy_RN!@$dKE)C_?@75GW3EWk=Vn~FH$0V&P_|6xWt-ebjE7gD=TQ65&afpaQF2Hlmw
zd<!Po<2pYn3Dg@&4<O`thm%2v*Pmhr-J<>gH?A6xEvOUh9?EXPwiAe}NI&Ds4a)q{
zA_rZz^x_V`JZ&-+(w=-v>E%@1<^k*X?34|`>EYTBTvGTrsjV&XXUt~yCw+H-)zJxQ
z7UkI4ChI4tN_$?1&yzJc#lJ?l1_nA;)_YV-?I?O($tVptEE5buX;)^-23#?Oo_ARy
z+$3)r#%K7AH)x9GmQ3=i>n+ECCqC8eY&)PLPKFi~*w|3{Rs+28(3Piwfm2c~dm&-`
zD@$)~3#4FY-CvQt;pvGrcf#R)yd`PA`={Li=@@b-A0t$%2WRIDTg$ykyuup4(|Oim
zu=Cn%#3#>u$eB9LTg|_G!|pYE<hY^~&oo)YRaqeQ49Hee9o_Y8wtn)wyu7?+W}TV-
z9rNs6BxY;L8=}#GeI6MrD_cZ8_Z;u1(D#Htu44l-HmY-()DR5<y^oE7Q2B&ClIy8i
zX-vgtB9JIZ`N^qV5^5kmKKZ~HwL*A~*gCkqK~R)pOh+Sox|f0in^O=>oMzu^LN1x)
zqF!c@x!HK0JC8p>n)>c{xw<&=W0LDURZ}vfl0;Xf|0(i2H=wnu=fcf18Z)|sl3=x2
zn5YW;W*&7$!4(xHBtlGrpy-9Tsxo2*C_gT`y1r(s$NX8f?;d8Lq4b^eBK%htxan*A
z+p_GxpPfXU6vZ&p^U*PssN*>xV8u)9Z_+Z@nM|N9S_BL6z{{uY4(p3Mnvs9e%5CzV
zPhXJ8%AaZ#ax8>8mFt>)*7g8E=IwhMw}aouYG*}iohoXVNvMHwxjrQyD4hm9sK74A
z7Y<8*#3?~kr;B{Aj+DEvHe5cgVlbb&D>v*1{S8gp<ut*2Z+F~(6eYG|!=$q@6F&B?
zO!{V)Zb_2HlQ3F)5zVsrfdn_YVqALIL=<-InykFJJCWiejb0`ACaO#Die^jS7x65Z
zZGYT|KL`w5{#BZJy0=^oWa%1?%Q1pB2nV|=`dVwPt)VU<yZa<;i^iJ=5(}M2F3q=#
z@oWeA__shP3?Z(|>LPl3|ERBJ&NF^u&8*7hnMZ??zDe>Sb;VYU_?`EgM|+k3MNpxu
zUF*QTq+OMAe9i;iH42}vB`HhG!?EE-$bL9KCBt_>ld<tfXf?|@URPjYDLi@i0qVk|
zD7V)c8Zo?KKT*0cO*-MOq(`ssamFtLL;Sps{l=)Vy>`Eps9YVL%nA@LW9V0qiYFTa
z2{mG3DA9OnB<k#vgssJ1D+~UTdjDk%_H|>^T3)Zmmd%Yu^BFhN#W6w|<bnj0CT)1{
zC0;2;<`RW@$+Q0N)Y)=T#PP4&jHaUd*vozuUFU7U1H(33PA8qhCG@|!n>E0_^mY69
zx}A@&g6vk$+p>%)t^GcK=^%5iwd4nPR5SOE0y0MG+ow)Pce|^0WzTD}edgehzksB>
z?Fom`dk-+?G*qRtmE*-(00rUuAmtjo@pVHjK^IQ$A(&7r@yHlGoE56TK^SE<Sc=!7
zgB-aS`+wSqly@v>lq{FlcckVftV{3H%5TuVt_6u9y#yEB$v{fD<LncX4{RlT9RIe0
z(_8rWt^~1aKmcj%%h=VNyju^9t|}G)0G$A9vLEmr=F#>-SeRk1gJjGMu-bGaq&)?3
zH9nm;DM0jlI1sRKOMVH-x%w|ZaHrho_4|s_lDub11qSFr;QUZ7D08O=Ve$BY=DA)@
zI&~&vT%p~=(lqRBVpU3k42V<A%54Cmkyg$Q`q7W*>mwh<k0>U=VMV@7bg@E@D)HWc
zsMU{}YO+s3ywv=bVe)pe_`TM&Cs`Yj+-<XqHj^eba<hy3Hz_cpDq~ISdhB!Jy5GmP
z*3?hV*K)_|N(u<c(%|2h|NJ=}xjm+B@aJtr*VUS-4Il#g!QO^VY<I%*>%|%g=p3by
zT#ii9>)KQ_cV9Gz>eI9BS+4~-^VkQb^mNR~Sg_|8ujc9oejt$ktE!c(I?nF$pChsN
z-D+SbJNsu|DHfmiXJ51>a-HQzw)Hxl><-R^7QnO^id&ENx|g*?hn46-#tMA^dox%G
ziPq@RFwJ3NER`VQcpmYH)qRj9nlky^@w>pJo)m5Dl%hm;&L}V1$ch(Zd+ilU>|$=K
zCwp696JOj?(3S1&o!HN&?>4yox3LRSz-o}XMW1FCdxzCBAM$rAc~+=LSc)<M^Fu=D
zx`<k5*pWi%y9W}5MMa%wr=iYr2*YrZ#egxk@)!P|Uj+pg8WBD2d62P|-6RVPv+as@
zDKlcGuONj2Fp{62xWU9eOWEg%2=h~Z9b$ncL_Puwong0<90%d$5=Nh0nV@I`{Ka#!
zzskFZs_ecl0Q4lqU5qHf^SlY$EM+a?tA7sE6<XPdxx$3c4zE&Xss!OPbkirU7elNr
z(_T-eFdZ$Hy90#-RsJda?_E_HzbXIc;RCqVIeR9b{q#seBX-t<l+vB^dl;Wd59Q;s
zc0Hq=9gb=?0~BDrjS$BZtOc4bvab=A#p_5-K$ks0qudMM8T4y)`S%Nan+rJsfbCJQ
zh0aX0DExdivXSoZt*t_9!CkJDn!VkP0@_c2{HmKOf0*$0ShL_yH6`<FWOl<xalMY{
zm91B2ooT`T8D3E*OtcCA3sFN8>vOHmwo{rBH4Ye3a5RAlBnl^T>T&ueC_(QfCV}+y
z-h=7S`_esvgPAyAi}5qizX4L*9<0AEbDt3-#ws+eHR`fBXIoRJ$z?mC$htYtBGrhR
zy~;h0u=mSD0j)L?^MHN>%!ScL^~VV*H=r?Wg^Ud{@<BCsjO2ekm@}m%O#<^0-wBwI
zrlyRofZI?2lBbLhtTeQ=rXs>lkIC4)qt@2EK+<Nc)$Fj+Lan(Hkyc)=(eOY*4Bi&r
zysRkvZS6^w%9oiE%XbZZn*ma>z{2O&R{zAcsZlesjcxrgShV5k(f*c4ogQM9ASfu1
z^UqslbzBGNo;pCXLRt94vFhH$pI^uC-NN?ZDu^2KlR0HRR0WDXbC)jkR(^a9hEAHM
zLb!k-)la(Z?r+WRtrzAlsC2N!wjIEoS?EEI%tu>(De&M?8S&Vfu^)Mw%@XGy7TUGc
zgdVJJ%~G1RZZjB*r7H9R?4|pDmt7C?Bd_LzZ@kfLBPA!mlEiqy4vfvR2`BA};RVIf
z&(-fLZjVloT5b26Ei>vzVw6pAbe?G}oy}1{2X&9>i54HW_mZWaP!<Y)Du}c-Ry6Y!
zoNYbxY`L@XPj^7{Z@Ayt&!Dpn$|&->v34aM{uZn~Tp~>mrQ={){Sb?W8dE?Q=}>Oa
zNIuI*;YE!k26^G)_4#wxbf6vr72j2oUZp5yaXt-VH1rZ!$R0j82&5_i1B}lRO_-zZ
zB~zxbqtjO2<=Ub`fdx-OeQN3kEt?0PS=5e46@PAFJ%1C8qCKXPH)bGDr<yWb^pVvQ
zgQ0@=w3UF_zqLl3Xzb=uc&D1BV<~!E#cr)2C^z>8@k$)D2Z!U3?gN7UFvduXt*p8R
zj@OZB2ua62PBIpCZ*W-+nNfbOKz!Ypfzp9yW(>Nql4sU!U`u{ANFqO_(BQ@^ptGEu
z%-U^O%E%R^5oDNR)~VlxOF!Z?P!%Tm4vH+#>OC8+%)Y(kEOEEO6pT&sIyO{WziGru
zey63O&8>Xx)kXuWV~hHH1fJ&j5)x4RE2m2%a+Kv?Za4k<f)h7OLBmSrX>AALdEYj5
zhx;oUTtqFs6Wm!lye;QQXTOS0>o7AAjs1Ebt(T&e#m6INuRZ6ugqmI0Kvn%i*rt_0
z)W_z!1+I9z55Fgw=kxB@%=BarLqMO^ync1_7<}DJ^y;RbiO_qU9ar6{jmRRj9Slu;
z>yBqD@0Qk=<w6Zi#p-6DB+oNl;!?GHI$&mO5s9WJf^?X*lbF-^{3_j{FJsi95MFI*
z$cu3ig!7=%Va}^j`^igh(Z070Um<{J><QLSxe%R%oigh-Oa9`mIPvBj=tN~ST&53k
zcj98_DbRBI+un#V(h?_i|N0UTmJ~&&0qe33<&Qf$8fjh#qYP7)6WD=r8t8BKL#O0`
zM0rd><8Ye|X*D=}8jxFoA_@;kzkoL>KggxQ>ln~#oB94K1*l3;aKYiSPa|~dm$zK)
z^kE2u_kgDMz%ViG`or2O?Wg<~V9wZ~l5YDe_gzV*RWdtOdfc+6zpsKoQ4mohp^^ht
zna?ibbZJlf5yTvn$QyN2ha_Cd4$tH}Jm!lru)PB4PYW<Dp6R-|<wg~5B+?ixJFn6s
zuMBfF8;{b6LXjt`W?wJJQNfVe?5pEVSZk6~B79g?Pc=K~Jz6(brYyq|kO_(JtZo8@
zPdAW#crFs&tK4$SPg31R@zTKM#M!-|#yBrWYD-~t)rv(0eeGgk=%_f8xLw}hUoA52
z@MHF)@IA@1%l&P4?Ayb172cJ6esK9!#Mx<n#8GoZX!y)_z-_gE<L*c#r?)YWBWEN7
z;GDgKyfi}T;!$9rO}#EduTeQ(6Lk^)y20N7Dx6KPcfJDOPY=1v<l<D4;ef`4=Ry8@
zMVw#~>)i83JHrL~mMDS|rRV_4tH}_*h$7!KwCWwTKwE(Hj?r=FazJS5!W&(PM&PCP
zKq?~~J5JQlpAskC*a_1E8s=ewugH7PIxxIBOih3_th3^-<2bM^NF3gXfVpniz*pp$
zpLf&}dk=Ssc!hj@V(CNK24L<1$mnsO4In=V2(wGkr1uPL1!guKX~9iYkIHpJT|Jny
z(?0ql(AP8|Mn^}@w%_xcSjPKH0@nbxpq`pZfES)GL6r=jXNPA;^EHm4g&luGWvyLF
z{^&v8OTzqE0>*r(b<WeGSWf@BsD?JuTandusLN)}gy__d*EQ~+<h75PFz0LkVLmhx
zhRF-gJC<XF`ssxe=s}rRR;!|bRXZ>cFM80AQ0D$<l|li&pyT-764&cQyj)^}AFC*g
z-B{`3wTE}1o*^=|i!Jm2^0|nYp{drGU`&eV$tMfdb!_ATthDw9xeV*MaOB~22G07c
zX%o`EoA)>BIjN@ONtnUNf2B%&Ii+~Oe?K|xj$d|vR7k`lUuS+s@#rf}o$?BOi`GN(
zMOnHzCn*?-`VPW1bgUBfEc@CX`hTkEb7K&NnGD2g_UmAr?`n1xqU_ZdIlJN6yxmT6
zpjz|lCJZ`7N(vajtMdJmG^XV2=uc%lFAZUW#Rx5an4WgwHDF_78<!K3F>b0ksIP6*
z$Jj31Oj6Jo^x*|+D54SasWL10gL~`rW3hVLNo(LFc}AAJuvO-xvUz~UO@v&%2c(e2
zFE1}U0%1l*t$LthK*pG&2LW-PESEynIv+O=IZMT8BUT7N<IgQ?GQe^EQtG%-{v+Vz
zBb1^uM`jgojrt8*T8xtLO<3`lKpKd{qgBpJ?9j-`8Qylc+d#TC6amJI&XmE0TAbN{
zEhhHuR<h@W&BxlshKHD4`Cp}FQp|CRWt_r3tENel6RzpFzMS3=vW;iU1W;1oJs)3o
z{L<Mrj4*=3xFmB?E@HpOE_3}q3&6xe&%CTS(rvF2qBh?dwz~`{a3_I+Nha?#G0A$l
zC6JN;-V%uXmulT+&wy`Q%<V1jo?HujD2O&<xjNSP{QD$FctUbDU)xA)_?qFo>K~@9
z<}r~lQt$VnW$t5(A?D77tAAzK>N{+!mT{N#yEz>`Sy?Duz~mDy@g(44Dvea0Sw@;_
ziIMP{uSfyterdy9Z<Ko<A@c3yx=;PnAiwOFLdH697YRnrXCL#7*>TL8NQqb(XXJ3~
z;FX)?aUD)n*wpRvdq3eya9fly7zc;A5}lY|8X5cJ+ZOTBV`bE8=T#seGV#Zq;@6ct
zA_{#*FHw_H<e;6|CXxXB^U^M|kGGODGXqx^Y;KiJxM;jX7(4V<{5);ic#rs7*dr}i
z@k&+8hj=zY6dV|b$Djb)oA(~odF<e%BqBVd>gdsIg9fhKUaIu#V};2X_Xv~{+cI$R
z&H^Qm+0JVZ#MCSTC{!Giv@niI2!4p>7WD-OU4?IC9ydcD@5MT~s^1=^rc`;*BH^Oy
zP40`r+Hlg8IA%+l*(yJ;{>C?g12r9Y?EYG~1t)4Or{B816Z094zv2L<OCUm;e8LMI
z4M3LKkjPv<(G{Q@rf}v~Y#e%Z9syCll%_x&N8|>>BP0l#W(j`j!GBOzI?8iu8~Xzr
zzkCzKWyh;l3;KEB<9q&#c=6du_SeE=UB|x*!5eDIHSJ{ix6VN7ZQ1e~@Y=04l#-G<
znp-M)lb6sF>>cWI-HDSa)}7QudRvC!!7kh{fkdb26<vBH!h~EpIhh5zenA`8dx_!v
ztJ9;huu2Xd#+>JR%uM(T#b6|ou>l>K)24<uMaN{&fpT@33Vl)j^OAoFetAp7k!F1r
zXt%=l$qx6qD}Akd?Vr}Oi^3TZ2Sb?~R!~hbO<g~J!@iud9hr1PpSiE8yH5N!*!|#L
zM`i8}lTZc`{`jTS(+*K$Rrr&sJDqJ{cqZCR?d3+x%r|CG*uu4MlvKg$9|`#1+uQm$
z`@9Pvw^?&-A2~qFz+2tSI$Dl8X#2r~9oL(WI6da8{E8LG8giDO+WU_Q`dKrCKhBCo
zB0Zc^(b=+m4tFPJ4XyZ+@fyRsHYgt~MYIA^;+Dq^@-4ZZ=y$UORNRD}+PIA*lqtm&
zmo`iWOy1p4TtR=j9*eBZWY_S(&NS5xYHt|9cgE#X#ztY;!2)RJVZLI~C{c!DQKeX=
zk=+N1mob8ZfLeBXG_u^M80tb|iW15Jr?Fc`R{SAY_rG`U5O|m<YS(DEu5xQB!@iY%
zHPxZBR=M3ybG7>C?+M1vhCYj)(=hLEFq;nI%;d*2<z4B%zW_C}F)A2wx<)GsKLosE
zR-h>Aa6(0)#Bk`6tP2eRsLDR_ipQGGrCdnn+or$pRA{-7nGRGZcPDGE=yYi|;$(^q
z8mshg4Y&KcOeaLpp~UDTjXnyL)+Noeh-`F=E5X@_68bXUc8aF(R5EZ0qiXyC(xWc?
z654EKo*ASX(;*9GsAPZ?#nstq!!^No-LLu?z*5JPG<a9Vnt|OLib?3f2@hf>pxrRt
zC7NcYb^oepm{(If7g^t=fYT<f+P`jjYj*ldArCOGXIy}%biOV484lV9czLxu7RmKT
z%Xh(JfmcDVC#wm+eIkDFJU<#a*&W~gUJg7RO=A~g`jrIP{@V$IRxvR`V;(0#N)8)_
zCQyus;39{%nF*%T)smiDDUK7Qv%R(HcV#<At$VgFWwMlL%#h~Um+mvSybgV?(EhcJ
zu*-6anZ`t#Ixx|J@W#(Q$K*(37x+vDO;nv%A>E3Ew?(>ec*t;q=rwjQ945oVR9{p+
zZD=L#I(M@AzX8<hUJcZM(IQ%#qPsDb&3etIjf%N>PLk#N&(KtK0gp2MX`R4m1TBb*
zDg58Zv+}E_>zGcJnl~}|hT*N5rgZ%P{-+ud9v(d1-nQB2lY}siB0NA%D8gdLW<K9t
zoXMFa?|HZrZX1kCQ&syoGuVKkqz3N7SEhgF0`mpKgX(`I!<upnVmTWQJo(43d~#=Y
zpb}${qQJ#UXMFp=;eR&1BE{eD{kAtpt!BKI*BHE#@#)8Fs%8O9h*yIdigdj>QNVSc
z3x!}})E_T4qAb68NJ?rVauOT-ZnF2Jwbb12p-^t2Dr>e#69@BCGCBj6@Jt7W$gO}4
zg5TuiIt*kA8`=e{I|6c+M~r2*fmwk*d?lk15x61GHRE~E=Qig*uGsRCd0E<Ey!Bv*
zpN30hV7~{r4k+3s4N>A@6QC%w#piH<J|m=27+4I_6eod<wX@B_&a!qJ1;%S)wG~<5
zuFpWAzAt#+*+R-+6kyCCH&1dLJZAb(H-S2ziD%ywpz4y%sa7<b1^)~Fs9^A}DLOjC
zF%cd&P5I&XhhFEJw$o~o1cOuD2SQ9*6M{P3ggxr0y>gi6NT+^5z3Y8v0>oxls+o0l
z?=Qz~f0$j_4FE`LJ7oG%n<6FHPQR0Rv%P(HzYs%R<4&BaKK>1}yYsi~3V`Z3%~L<c
z0Rdfrb+2}|MawRqQ%q6fNtm%DnPpYP7@^n20wmP=9M?Yvi7|`jKv$6JLT~U%92^vC
zW#Ep$&bD&T$0iLVG}b|UrcXhi5XNow7Oc8r&jgo!C5LLPu^$|}5vRxeK8fC!i8;rQ
zzKPlxs|4&!h0(<?nrtCi2@c*DZ_p)=;e>nM$8JvsPFlfWAnnSQnu4;mr6qf^jX6qv
zg>i0SVX9b5``_PHedfDjW-II(NmOzTfWyU_iUsZDtv*qiY^ntglS<F0jqIC%?HUg3
z`}x^DK5hbDTKYxDt^qE$e?yhb))me`5i=MPS3K^*isJ5~%#f9dp|;}>NPh5T>EqwK
zqkTE8M@M;xEc7Z~1AN2frZcqaTy(V#IiP5Q_niWz@y_e1K>gVjLJGwZY>au~2e?GQ
z2r=)nROj(GLN!eACO(5>1Igj=5_CSmc1p3lR3c%O11+ZHr-wkpIZbrny$}%tV`1Iu
z28IhF+_=)rH&)Fl_(=_*&F*~MU`|AG(&toHEe0bx(TVMABILXm*1doNZ)5B{&CkL!
zzjgE78JJKD*&~{@snRB1)gI4VKRGGbTHLR2FMOWPDf&i1i`|%cDM<OwojWIcou|Kn
zV-}c0I8<ay=fh{Ag_yWCbt_|x2Hh}L)yYPKe9v&ZDm~J&(dfh%qi`Jt%+^yCdgIx=
zqoWnyxlEah$t9fM!S5^7`RuzS)XRhoO%hk+;!E)9=I4y2{5LXxhtF&Uyf~l-HGtxz
zM^SGZvwZIgMfr2=c-244tV6&^4TwBk{P>#(k^=K8D(#!)?p6{!a7`jNs&e~lHn47Q
zLW&aVMap-TV%UG)>#eK<pRLI+t8Ce3OHG}e0r(>(=;@ka#0)ktY~dF6mcHM(+|kLr
zRcI$!jinsYeQTj@=jb7r-BDPW=wxsn{8|>(uLOfTF)96x6kUZgmm^HlMWfklTwl1|
zgxnn*S$+l4aK8x(`w6UU^)Y~B8`5yYHpzZiR1MUPe7yoRCPUM+nkI<$nYt3$$C?+y
zt%I{Oe^ldDw+wgXWY{_I8SE9~*aiPG?#FZv%w6%pNlMw-K0EM2d27E6jhq^|67&T=
zLy1Ss>SbLXC`=4S15AYyj56_w#6w29_aHsm%E+)Dv;X2_+u1$WsumC2gL7U!>}8P)
z`LOfMcpdT8dIvgsS#x%)7_ltxMiZ{Oy|5}i$<A_Nf|uRQ;E%q0r(&wLQ$BaPNnLHR
zh_kFQn6LxL36e>T{V?js4DiIN5r==q4I_@$ywtqZ)UxrhNJ;hBNbyP(LgS?LdQ_TU
zLU0oEl~sVYWDsVOh&B0c#P44Ifk18yX!k6*B%vo!IL(s-j^brRrt>Fj&Fa}-=5Wz)
z0S0%@0mtf4360+L;i~(j)}?gL#zLzGZY_6|5+$Z5QS*YSXv15mmUHH$$PJEY$a$We
zvNb2xz<mEHIp|;fId)ehGH7?-N3j5+iL3J+H@t_KRL~Dq6u|rr7?T3M=O60P=&zrD
z-Bj|(m0M3V_7j@O%X6~q;zuLggmpeHVn;3nqWjU>e6$DJaNP@{Z%Ya2LYJaS(Q3w+
zG;R9VKa$^S@wtcy!80=)a^eh&><D8@H`EMg+$x=z)!{-8E88H`c>$&<vp#e9g#S%&
z6xb9!pri8=|GCO<QaU?0FNJbWSV3Rb&=J_3v8p+XAzG?a6BKocjTo7W{gD}p>1^|<
z;rlN{jqmj<5i@*;!SAguGNRX*qj7hO&GTMzro1QjRB$yEjG^eAKth9{*uR?)4k0?(
zH*IULLY#L!!)82k*X!5cS)T_K*Y6*|-=Za))P<e6L1=9kNhAPN73fArJ|MovN$ni;
zzMsw$=+M~Ci)<NLd3Z_5&Uax+CS>I>om#9JtvkeTq*EzPN8u>{_iw8F?6~OcU-sGG
z+UzZb(&8$@WB-)M1_dq4ms|)}svqwwJo)<-6GxlbhTX0rgBzTW8W1={_V@9@oBv1C
zxyLj8zyE)PkZLqJ<`iWknNue3974<?=DZwoJ|(B*d@9FG4$XNE#hm95bI7S2CZ`FR
zcNWsHcP)gF^Y8Wf-EQ9-fBMVzdcLmbbzP79J+RZib;g93yJeNf-9rbaPQK$#ek<;E
zG#2#C(Q#D=E&V_;QTreEt2<8w`9@F1`|mQo0*r`TBev}RBu??z(Qu*)5_#Eh78oAO
zj(9<`0yDMIYZ-Xu3STwopwbY9IEMFM=$bEwY<vzsd^<g&pF%G9#>>5oGly<0_AahH
zg)al_+&jng7-TgCpp{?N_5@8T?E<EX%IP0Zgsnz*B7Yy!X|w|ZGXXeKE4^60wQYz-
zpD-ruXJ68u>^0_Bcoj2?DM-)CB0oy;UVRWJn|;F$YyM6-WlNPyVZ^O7uvMVasrbw}
zEeuL|u3X#pL2b6T5Vb9BZ+kPekpcu_D<aaYYJwbCKg7$U^(&lPUO=Ux&r7%;7MLuY
zb@vpUZPydKKMkjI86jQt@9-&5o~|Kb!Ghg6dM=ybCesV>N=^7f5vBW5x<<N<SoFD1
z@86VWOnFjm-1vWl&WY?sd;}tb`KwD#H&~=bkhQ47LVo^Iu<2`*KGKXsXx2d<RJHfD
zFFW65%sK$D#C87%;%@$H&t;H{_}y@1sPj!RqGE0h?Vt4<udVdk&!Y>s+e>S3xUno_
z9=Y$RALeB88xiq3Tdo5rK8~X`Ow2J&<zuq{y|rYL;I71GRHK3$TNAT|k?|nSjH!+{
z<C<Kh**xSGEVV)gKY+zsK#irEede5YKZu%nr~Ev{uNmh`c4jHULo^un&cofUY=WK{
z!Y`|u!l2`4hF!ypn_iD8skmq9kLaivD1DljhIo&T*{nZR2{~5HOwnO_M9$Nj{e4wN
zLLoyS?C4<khSM<oeRK$W5Lm&MlTX|jB;5bKND+CqSfeL`(dDpe!~&(aKxTFbjPl>@
zn6zN{D!6Zd2H*C$_jVQpk8P9(_EN&fL2<sn!n=WqsS6jpvMyT-7?YdkwH5k8?RFH}
zs5d|s)T|f33M)FXZ`d1V8L$O9?iK3Y%+HdA$f)SBj)h|05t20NExN%}99?D_T+SYh
zF+hyq<u6b1RDic4J31imCA42)XGgr)Y}!0-*e0oY>@KL(!^vE<0Ebn}#kKXvxo)y}
z$cF*_kw+?poYhfvo1kx-nwQL=vOMN-A3r@sSvN?a233D(MT8erfG-n_r<FqXLeN4C
zTzE#J#mLyUx`!3>d*&v8nB5EPM`0}+ZV9lMya&@W$+^SkH43cz_SYLuCI}~!v9Aq>
zmOw*Ko2x2ApQ%w=R^Wv{;>Pb^(+g{_c7J=xs=Jxa2v;y^nzk1>Q+`<|1z&`&!&z41
zgkv@2)T6Veqs9B8f6nb+@7to&N-7i9Cwg;zto5q0R{>JCZH^N^jC4@$QTqsLIs~(|
zsdjELb{e*`oA#V4wH!_e${!U@dT$CI=J&-}4v_v;n&>=C!JJ`XP8-PqciC5hky$<V
zKJ+AkKJ@_jwA05?$=357stlZ!2~BC8_@xV=xyAgwcsd<(a38ps0l)0AnmX*7Gd*nJ
z?j~QViFsAyp&Q4v`g~XD!c%*s)QTP6*ahRn!F9AryC?DUUG&UeGV+D0&rrbEji;3M
z+?$R$sFy>u@o{7J*Y)6<XYTB;VJl0|gHljGY4i4{&OzJX^#qjCj%Rk8H+o~bzu@K<
z7s96<?Ce%D)<Zh;-n61`t%iOz-gXd@M-$WTo?&;*eoD%mc_v+sKI7rbfLN~VY;P-y
z{XIF{*x2h_?pE{$_R@;MVimF-PYC8OYI3x142rH0mY}2QCMIdY+~@@L!iu=-rN2kW
zO_b=Pzd%-?p5g-%NQ%R(+r7%M3AB>Uv&qxa47zM0z2a03s7A;F*bzbFPbjN5VseVP
zp2Qcd-FrY*+{42I?PK&&mK`IVJ|dPLORsd9EV;LOGm!*U5V+6%(c+7-^iIjl*Jbew
z`2t{wL{UY*1PZp@zHs9NpK<8-PNZ-+Mmezq;$$@k&Xfp0Jvj!bP{8uqE#Y+WL^oTM
ziJsy)Swou~seo&Ef<g+S;)(jpvmsB&`=mXfev%pSk7?I1=~s}u#!nX{Sbzb{`3A;p
zTWQ5>giL(-YqOE@?z~t$PW9!-M@mrFGV$EfyxDp0=AUzVH|sEoZYd1QHro(As64Eq
zJhNqwMgBfOP&cN|c1BZMNB#p>0A}x_{UH3#;~4C#bg&lz=ouH(ue~#Y&a|HAS;gMv
zqK<#rAJjdLhwXOjU6rufoDmeKuC;0p-(|P-drCxiM;vNB0F0J3Sfv}yDp#(uYsa)&
zA`|jnCV3T?1)Z#JePN_Gq)LK{`;#jIC?@?5ub603tN!0`fpW|&ZD8wejoVc6_Ii5E
z5#5PDr|~mF3QU>NC!h`4ldrey9}Cw|6DaTcctj4x{4m?mDNS>7%)gbi$eRK1kFp@)
zzAo8R6y)x|8&A<fE`;(wOa709(&KT>{+HdISy&R@>zeYjnzb)0RL0L`Tr0ESG8_h1
zM44#4NcNu%nVp>-udzmYl?jNg)Imn>!ouS-HQ2<DAlH6xUs&I)p8H;;?xf4qcOU%p
zJ`e3aNj|t`TS>pT=WivP<-X|QwD{hz`RUYcnpe!Z<d4@kiUQTS0NT(gFiYGF#XxiH
zP)PXTk}4f#J#H5-wVJ@EfChoYb7fPPap(9<9_dtO5v4%(8uo528)}sY8M{gIzsE%#
zLJC)7{@!xDF+{6zY?~4WVA|@)VGqX6kbMSEg3IuK7zCqxCpn8si7nr5-Z?$!J(^fN
zKDj*|T4pg~`}!@qEEZy=gBWs4$tF2r*AGv&wnh-QZjS!gC?}%kY(j8}Ks4`9ZI83v
zUBG@4Y!6TfN8f&VoCfSJ&u(v8%$)^!Z>itDEd;Css8fs$?1kLP;`qYC+QY-nfa2ob
z$jqQDe&GFFp=&eOYFPahz<p8=-De)P3JptDf}kX+c@Z`pT~7r=E~zq4-%{DMl@Q~8
z9Em23lGN2J9DCSeMp;2&;0tYt$}DGw?+v%jl+tzDhp5=%nwkXr8xES~HRt>KLl<v*
z)TP16)0lEX6BLi%YA&j^6nO!WlMt}g2eD}JH))bVA2EnZNKThgk8jHy*ucOkpRRPD
zYfvpFIx09gh|uEfH1&=%_V*c}NBfQA0}X!b&Xs4;JnZSZ5pK&0+g>Fp7C!%q){a!R
zU@I3f?3$K3uh|tq>~D{pyM}LW*q=P{k5(u=9^~`(1)H_|lYt)Q{Ncs_4IBP$(l$fu
zVkD~)&vELPVk>zJ#QMs4y?tApR;6U&gWT6gN`<=7A#*<9#)?T~Y6j?1gh%ILCvBr=
ze|@GoHxZIqlmm|+M3mW&CM3e8U$Cc2b))zAJjNC72NYB5ZF8yz_{}@I+W)<B0V<cH
z<S}gcE4+8>iURX<_6I&-_{!H%>+D>n_h=gKs)P=Y=KQ}BVZuZ842-hZ|4*i>0EZQ@
z;|U~3_|L@xU+|g0+AVp8eb>)VkK3sC@=FQ}3xU`;Is`uSc!qbWc{FI1r()1n<NT<?
zS$ETNT;h`auZs~If>Pna7m~rb+<|YHr$dLh=J?rIQFt2Oi&vX-Q&Tdk;kK7Z<Esoq
zCi2HIBe<MXz5y~)^(ODqvA%fSrOX$<%%2%Lw5X8LWfo)sCL^h5XF#z)i3#jrlRCoe
za0)45#U3`7#R5pn!cFp(V+be{SWIWxE|4t68^>%R{>zs0wO@;wY2X;=r`v|{$6tP0
zm&82XKVr+~gu>slmr<DQ*5nL8OmUvW`>(LuH<<=YF8DD<pI923K6@587Yt-Vd1ls3
z2w=|Kf-{-=MRg9WnkFJ|w_Zut?6ELwmcAPMQ}Ul~%w=2&3+zZ~@eVnV8@k+1-B{?3
zIy}C(IE%}7MjF<{y42o~vF9AhYnPN1Q{XZUl&f~luDxGn^-kmvH6o8u;|67!m>lB%
z_4J;b@m_fvq7k__e|WkTbF|ibS{pO1YKJlzJFd8{kVJbs*J}J69nkso)=d>g_Ava_
zpqntYezXJ2pVQ*`#)y-t8Ilm(<Q*?>nbwHytl#JaplxdOb0C<-9EHS@={zEiF97DK
zfCO^Ny?IhE!408t`*{r}5{>xeP2|ZO>R|u@$4gjPl%`J9BH$3OVC4M<nzhj}F&!O7
zh?C92ML>eC?X%V;gR2zB^h0tCWLA8eHAL1m*6WzR<!xi^FfMp@u`|3ZS0$65aa!5C
zV4dZlE1|e#O`(x|V2#%~o9!7^+ho|*4MSi>4+`P5H_J7*O1n9epP_wpA-Qf2m%-4B
zq}L?=ojfz0gI2?Qdca7=VNWx1Vp<j^&b|sWONzD8lpM-(wnTyJOP0<kS{Wb%I1~kc
zTBJ%^Pt-ehh0iotC7Z?uL2cW^wTruMiDW!TN1XnMrF+piG$`eN{cA*VzUef5q?c~_
zOxcpb`Rh8Y7bW%F>%QI|)Mnx26>F4F1zQI<T&gO4>%d5t`g=8W???C2E6#oK*T?K8
ze+P#|VWBn37n|e3k2Mwm>&R}S#^)J3x&5Zl2RW>!)_yo<97+z3<X!U6EH6+Q3i#w&
z-^w@gLt;>cEm`}cxCfz*LK1L^Y?d;?#T=$DO2_s79lhB~=krD}!*k0acJ?KXj*ed!
z*6QU-iX0sQHA$8S*sc4Vc)S!3ly33DOeS05>i7M@j$3ysKIf5IAG=XR??iTWba-`|
zupHF)YKVXvu_)g@2-K-*#KvXS4e?JER*{Uj-wiCaqM>iR^;$o}_Mq^pt&Za29iZyo
z4;#y`6Uq4?R2Wn@=ZLIsmo-Il1gMFuZ>($Q8T^o+R!GQ^%}qead@RkP;1^akGsRvh
zl!KU5=!E2Qw_S>GP8M<%*<+Nii&%tOlxAQq%Mk_Y??`8hS)H}Gh}0M14w4JPNcJHr
zafZkQM5V=KLRt_xFRM9Om5!9_dsq}O5>5w$%qrZ(n54=%@L8>|2f~<(SuD8q^IcYd
zCTF71IR;Q8C`Ig2AES^lTIi$W%7m)H4oD1O3Szl!kWfJ&v?S8_-~E8wmIn}#5kCY}
zg#impySSip(AInGfv@s?KqCa12)JRbkgu#*;-xhO@gQl5Pjj%#-)o{@f~04}xWw=l
z`GZ_WsQIaV?o!G7(w|HG6-xAel#uZ|*|@(<+L^g-`2gH+2;3)sp>y6uhf5G|;qEo}
zlC_T~&?NRD#?4tw!YaR(^|b}%8M_fpR!gGXN{}vG$`kue`l@abob30w*i4w>7_;5K
zq#CtPpO}!lEp~&Yc1`X2j^F9ehWZA_3OiE3yNNg{+i5Y|_-BIW&bgAAbwSxrk;LN~
z=aH)(97jjr`#SWX*#N+yzGm~1H^Gvi0l*!$2|l>Jo;5XYpcyHp*zrn+HaN&CF7om&
zxx=eq#ycCuDQ@E<bFCF<w|QIQd0;&F#C0Hnpn4a=Ew~$y&*$fRArl-DBD&ZUrI>zq
z`1NxBCI4#|48*{?jJLrxi{VnxoX_<tn%=5L$6xZB>^V1A2U+RDe12wD=i|dT#K*Up
zZM2gEps<^odOs>Q?Z-1_9=3^O!Pp!xYVM?i<JR1Z&Q(H~-iOudGif@xuZHCZy#!UY
zOzGxYBrCnfVk=P~1nHs7Mf()XaxfA@Q}B5R8M6Z$*!nz432G$qyHvP|6I5zvx{Rdo
zsUEriL!x>&UpCGRVv`foSXI-Zyl59xJJR9Z-((CO?X!DZBjGVf_s{?1Wca;!7!^%v
zF{ZZG3(5<W1<yP|*i+E6Kn|zdOz%~YgU^n?;+^A%$f9rOu2&sjy8pJ)V55omD2(;6
zvj1(5K@r$OJin9rzn`cT_;O&))1SZ6HOpb@6<9@BO>6lZFsGI1kD*qoAcN{|V8~yQ
z;l3Db-|THyCd^b7HY|(x$|iQ-_NlXtI{JI?JH$~VCM-Ij`^#hN&wu%Idh9pz4?-h^
zv>}PD_GwqoKun|*u@ZKw=So%BV@t7SBLxSW%rzBWm{!Z!uZRaPARrfGTW3qf_V#vM
zZeCDN*E;}hc%8cH-2&)<vjgQo6r2A*AZN^VTLS9muS#^(jHOO@&}};C+sTPTX?z}}
z%FVVMYuP&j7o#gpj4ENfz&hV-ZN6s-)wWUHoBwG(e>>@z0zKbR{wxuDMxK_{d%Sy_
z@#nyKC5?pZdK1u#G_)c8Xw(o%-(Hs&9Rg3;p}s+MHGK|M^9XswpMIyn#SITCb#uz}
zK7NyiC`!X}HnT4?kBu4TlfHQS`JVaMA<1U-!h*L(Qw#h-LN+0YOHpiak?Z*Xb^*>9
zj#z4F$>7D@L7x_62x*)1;WF%xw#J)13b%vas^#|eag<`YkX{5vyWT5jSRY<}QZjT*
zCLQquZuO(w{WmRZ3zC1juW`y}A8=v8viGq|Z5S}fmoDRlZrCk0kjdm$4{A>U$!Yq}
zf=~iQ^({%LHf^$?E&wTW4k=%z$>biM@iQyti&^@qvIn)Y*WkvmGiF-p%FCp%0?uvq
z@$|B;cfXJb*cvw$^$yDuhz0X{Dh)8Ni05xVzu>3O!I3Fefie8uYDQ6Nz5WR*B`41I
z5q{~L?deFtctF_R($jyhEE3v=dNdxtOVbui>{`4*gXff|1=wkir1vNh$Mkfj%1tjp
z!|nbakm$G|#JrCA2*?Jx^!|TK<}wzgX<jKGR33NETfs%}*lQ0)w+h(OnzGYu8-S<U
zSNo^5XB&0tdAIPLhePH_Px&PN{Jq07oILN9gp+8|s=oq@QNk{HK^M>;whPAxZ4ZyW
ztn6D>-gpjM8-cL+9M3;Cvh7^|4%p~`6SLB<xVuaG9ZsY3SIZ_lE$R#c53cO@S0{`5
zUG&rV+S@xXy6d8UF4M80HCaqz;qV=<?wa<B*0<UPtQ#AiI8_iNCxHY|1ifFl`hi;_
zIU%{Ld7*{YE@`Bn73A*fBDito*+YXqoFZQiBo~GJHXx;U8CaoFl*od~mK#kI>}aXK
zA#Wx}_PW>5lFUxb_}41_1J~C^E<MZM#InTPc^)-pdH?Dq(XqcGO<HPl9nu0%BP8YZ
ztX<w$X4(t+Yyd9DpNG+%w!z(N)Zpxl|K7Fw-lpS-6%{kyEY289PMrCl_cyC6m!Mxy
zUS%9wPrDy~4;3~X2DFtsjE&RZYi*0&(Ewgk=;F}3Z`$v%f%6{ETu}vBckZf>q68Ea
zF2y8C@E$hv^@h7NKgR53X&VK!Edsm3S02ssr73Ef$S@5f0`s!{>RG&?d#+nb<hG4P
zL`2KT%^^4bRcvx<+M5FRvK)x&<(EJ+nMFT&Ae7cMOZj-_VOFxX4QA7q`u3x|u*;aM
z(TJCW_H>JQeE$;Qc43SQD$n$K5{t-AN)(lz&4o*E*mF=K&2GL>nJ;e{@0|EWDrJLL
z^HEz1*A2MT(`ZlB14p(4G%ogscHNW$FY{OM)5mM(9~JfjZ^b**xtVvqx23@RhSMtI
zxfPDj1NS;xdPPtE4uyz+=o+9Yd7joVI@xUQzAqP#a0sTU?%C72E#vzTYugGFWB7G>
z0HW}X32!m;E8?TNW;xF1XM+`CqyV_8tY9H#)YhF+A(t*+;!|Y)SQ!7y>T);Rz?W%l
zg8Z7!Tv>sfTB;MHV>kn!mw0^^f<YnW-T3OStt}p{!~hKRaog;1O~dv!N<r{^vZf@v
z7^?iUB9b}Qruv<R#<DVtNMYxF=OuW<PgRd{4AL?z9y`*{!)9XkA_FBbw7(wh(Q=uL
ze!b^QBLpu*ICka&y&jiGiy<B!e0+Q!h2yQhc2wJq`QeVu4<37bev+rkA8dO)3lkH}
zkrZ?pc5?1PVRvmpr)5P`+8&SwAKz3uzHEw=(bf9`IFK@|(A6xmczF+ZUMW;8mn~H4
zg)=f~Nq(H`4WVi7yY~vU^<HiN!&Py(a-n6j+O)ZPbh6)G=LbPf7d92+>F^=#WY@Eb
z&x*Bvj6K5=D_YkgX&fosLAG_l^X@b4l-q4+U#5o~;`BOfsl>2`z{(1?%V#e5L9My_
zH5Bh_UguwF;>Ni9vBY<g4JZ)Mh7$Zt8OratoEBUKu!l7wBh#M+I0Ry(R{EpA^RI^e
z5**jLYeE3rq(Id8@Aogw9;A-{1eL7X^|j>BhkGV@ZT2)d!~o$R+F{6HJ>sI*!o?)1
z8(e9DH9v%}^$j>HK}}y^n)GD+2ntCX(Rqu#F);xF(E$Oro#Q*<SG235?*+d^bDo=e
zE4#_$W!jxxV^h)8x(Vc1Z`|$A>TC^KP<WteS}mfTA|A`EJ(54&RnCvqC)@h0)bYKs
z)685y*zt~d`ZTPmqf7W@(vRI%#^KGF?U`+ln?wpTDzAF?y&X7P9>QIBdmt(7(fF=L
zgS+TZ<6m?Au<oC!!QU}<zTX&cw>}46LP2Nd@fY~ZB~75Wb!|VZ8YLaaHG>qOx=5ii
zqKZAWxTs|D>({S<FLlALCwxD0Cd8Odn4xsEdclm(bI920fa7&D^5Y<4{|((ZhvN!i
z{l>yy7ed~Y_a6q{{qu+EA)@OS_6})Fd8;;l?;dtHndtBUqexq^1aOevH<TDjfTKGk
zmNQc)3(UmK?K(UJ<hZE+dY>eYfO5m`jJ*PBzr5n`==OA5k<_m`#$>t0wQoI+z5k(^
z;)cg19${8d$)0&0_Ww$OtRMJK&OL7P(Xq+NtITW1?ahAyG*#x31r^W%d9JGxJYEES
zZZ8zbzZFeo6bdWS)i2N<_tN?#es#_2P|#$Yv%(t#FBe(n@}$Hr-$JASLL}YL2BQMf
zwzR6m;>@R8#Q1Y<P_0P1%_?FQ5|?Qjm%QC#f4F$`^Jt<cG-vb*tg)a@>e|h`VNa!#
zwY7T^B|K4k2gjk1DPx-{;VOu^&KZH}KM$G9^D0aEAFO20QlK>6_FeFuuL~k`Jsbfh
zE9I9Km5dh~oX4h>DuLo6?yXfpf)AfJfsn_7w~)@io8d-=GdayZS&RvNaF3z<Awydi
zmcWzhsoUYdoCVyUtCUnz$>+RW8|&AssB8PW)EzON@4{PKzrI`F><xVy(9MeHyw1&p
z2Qv-6uf8cgAOX6L6_qHlk<f6@9r~s|&KGTj(D;yaDHHG^XVV8+LEsu~DQQW|MF;Qs
zQGHGHkAbW}1N^cCYbkq0A2e60JfI+*_Gfc<{qUAX*WvG_UE2KGu~V<;%b_2tvf`2w
z&ym>@<W5;uc1<(6eDO+1f+iH!H-^{eW|6R@dirwltYjIEWFSm7kEwf$r<*$`yLZx=
z6o;hlIvJxM6e?b%2|Ejt;5o9gO|DF01g6G5ICnL+FM-4CRV(?~8(gy$l1DTNe$$po
z0%@mb!TP#fHGtf+NvC^^-0j?Q{j4g7>_C0$c$}geHrvp~D(xzl+%FHw%rhLpKOofK
zY?x@Hb9&}qbJfY{VLX0ZjL*<c?(x|O*{j`wRch;yZMBWWVFMMLoR;h#yp7R#2y1zO
zgUopWZH(9({kUXGjq5JC4Zw52a574)97HqArQiZmt50XoIk@a7hJ7etB)@l`zGx;_
zq%s<iVRNS|%5h_KsDFNZ=V05K@8)Clz2Vz*Umu*7wm4IQQ40h#?fSUqWOaV=Xne!D
zQNnn-qmVuuv(I<hx@nKpWp9Vje3vZB+sVWzs$XYoaI3u=+;6elnlo_|7)^@{r{AMT
zE;b;umQ(|sbh^jHWm8qqP|HkBN(6zp8Qnc!cT0%gt?<r^+Ui%!+6}g7%D}#nzs*3d
zE~%1(z~a|<&()InN)eaY*5<v5bB|T%xwE(Q3im{T9{H(z#KP&y>0h9AHah~7dyj%q
zIap0uboDitKR?JxBCNU`T9vJT2%S}5Z;F0$g1R2=aeQ%8Yi6ruxQd_2{hE#*NL9d)
zGJYeO1>x3({2qG=-lFnI0tLCc?8Z3?S%3UL>*K}QS?gSDzT8~CiIPRG{?KS3?o#nP
zVFS0x#tm#%X8*ct7bY9re(vwTavC2*Q2@v$>G*g(RMn(kbz)j!BI~Uy`Ms{{5KrG*
ztbVDM*vB8a_qg#4&dzdd-s|0myl1WiGGErUx}8>zMd_KnaI($e$Lv_iSgPhq40*xl
z9PAzIXA8%7?R;wd9<YEClEtoz!?K12ip;K$k16jkeGE{Q3-XML2n(JMxj~n;1BsEU
zh|a6t35~L&>i2cRyB#XAwRd8vj}!bIvV8240eQ0%f<Z=&1oH@K>sVN_HuzEzWC`aq
zTa$aN7%Th5bQ*uopqh15?#2GK033@ry=&PhIZd&rNt}fWLt#-4Ibp>~Q%=)$DYDuU
z#+08%Zcr&c6M<Zt3PciqKp&LPQz<zV@T1Ez9v<M+y?Jd=S6s|2Wh|j+d%;Ccw|xLY
zXfmF*b94x?zx9%)niz&7s`%Chx)UtP)%r-NxEZoq;SDFdi8-^Cz9%Gg3}K*;$HMk5
zh!I=vN&s9|<Z}tUen*A)fT_fFkcFnJ-Sl1|YGf!qWJBZRo8Zou2FLEm9lHlesBKy8
zj)U*j&DZa*zCW9m>9{^A;vtn@TdFbHb1bP4CrUZ6gI;Gpde2?E2XfLyLZvP;?f*Cx
zGWD_y1jf(>?u2nwE<k`2HT}1FdwgbQ5K!JZ9t}Ev{in05y-U6KU!{dJ(i>NrVsWvp
z$-$vJW&eyC#LCclw$)z(otx0@)$#e`d4-AVa?d2jIWzcKvIEIH|3Q#E^>#{{b!+JC
zN02y9aKlFz%_k&K?DoqHQ0zGw0wD-gn$}7xwz?x#$xruU%iw=QTs=4#u{qxD@9gVP
z6O4C5f5!!BXF^_C{rvuA+<RU$<PaFS1MT=-d%vO|hn9<Nq6@vF32k&CQ$g;<-qXhQ
z*<@9&=j?)akpezP-rWE`%XXFdQwza2lI!*Iue!a3h_mD{_l32mAcYA<iN~!%+0cJL
z1MOHhTiEyXd@~>J>Z|Lt(Bvi?AK;UBN`xdBCXWJ40u-CepiLX%Hp9y2a|Pt#OJ-X)
zF>D=j1P^hw5+Cdj;I9xLRLNyN_uQY_+PnW#hA`3?6Vu~uP40>Dsi3`<G(o&|)+!iU
z>hHV=caL|)4!*+SP%P6*xpuIH(u13-ejDo=iEd54GN|z*VQ>x1P77;jB3_ZTEeuoW
z(TBn-P%RYH3#*#72XtYML@8m?T{d@!2hbC+rwY2nhZa|Q2^Nx04@RwHcIh!sgM;zP
z*>+mn8XY3f&zmr`!vv$#9o5%hqK03F5T9t4jujeALnr*}*Yn<AdMe;=Z$Yt%3U>i>
zGr3>RdA1ylyTeTeCUE}hFFWS}b1AU5)D>}fGSlF2vN{pH{c|RD{3)&5aj$zuS%h()
z<09fp3Pdp#)Vz#BCGUmo0ds->0lhZ;Z7QI0P0L)Y$;qbe5RfUlMAe(?x;-0nB!7IX
z@7?nI8cmJxR%{^uSzRDVaZySM6uLp2M0=qu0;@$M<qTL*oQKEV$)MyZ*K8(76iHZ-
z$D06V&7b0N9(+2V3;24d8$uo>8lAQTN^q|c(kH$zPc<O3U$t~<A#Cl)y*mvqCvHRM
zyz9PM&ZvuUxSaMRBqk;*DoS01+FBcQMWV((Vfwm(X?jo*Vi`;Fs!@%v@X}lkRRspP
zz<S4}957v&j;%~gZdtdUFWmF1yjb?O;{nr`T#9n=87D4ppmFFAjUPex>v2GDl>4NN
z_Tkswjn-}h^PvgHsF%V$sfP3@T2b?Se4MFi^^ee_-HU!FC5zE}o4XFlEg{B>hxM$4
zc<FMfWxH-zyO{0U5t4iY_&ZMvQJ2vtJ4Oljx#3lWQWLo_t%S#RtB^Zh%uPTC`QxNy
zQ`J=k&uC^v7Tn;L_W7Co;DM_g;<|-@>l{!X0+}{sb^ns%lclgnVoQ}unCn`HSCvlh
zH7@n<cqK+y{CBV)B+-ZRKKr1=@=5sSL_g0r?11@*L}|ABDoRrW`+;4!Y+0SFzj5(m
z1F$l^*L&Ju3&_s8A~(P9r#eRMI?pTj5Ep`<%*}zg@mbvW<v#*DpKpP`r*70#dPChD
z+=mCz4f^m#tQ{v`1|}=WMB=?`i(GyXS;~OgN)96!lidm`IPItO8mwhj`y@K%T>MkS
zu~|V*8~1ZmWglVv)L?ze)B#A#BpHa|B!k6F5i{TIkR!eu4<4_E9j%XdO3CU0`dL6g
zE3|Q}J}%DU^G~X9`d#ezqFZy6UP&IN*eN|7J6bL{P_Cm<MU5Va8`@rbT5!#Y-6?>4
zW%n%JlG?h^rrbR?U7pPel6X@SDN<68oO@KDCuEKU%!>J1oVhyE6qw}Kx=scikaRA-
z?Ekage>i^<HdffPlUxcByj#jz`q>QQT2scpmSM@^rq@EJ7OuJ5JL7UVROQUa$P-z)
z@0-MUaeUEx(R+KRzjqc-chhOl=G5qsvwMu0)(vZ4>Xi#;pfzVV$_*<f;{a&>B!b@E
z)CxOOfy3m%t`o8s9<}N~==tXs7Zxt`zwfK9*fuuTS=N#(d&ZO-X6E2iMnsis3ZRez
zWhplA0cq+^_)KsSu@#F=6)SKQvl_lRtrjg3xO4yau>7vqGxe3RO8D-NPIayvk)fWF
zuUsaM>Y*G~7J#JuE$Axhyo;ocnA7kWkFBKaC>5B;M;`BN)HnR^!j%e0pvMQl9BdtI
ztpecupJ_7`8~h`=J~3U+X6Xb3-AR}fU{{f#+XC0EM6TvYlpB1YUC}R>w-CGz0fAQ`
zit-e%P87leVC;NqMU-9hsjDp&mb~n~$}geGec27d&27p)+IdUkNmNWwR9Z4{f$uyv
zZA++cq6jiEL9@(XaF>U^MHb3$XI+~*`2PK9YYT^1sbg~DU=r2;DOr_vr&sm51t3kG
zS_=KsV}^{N8cnx+d6XDnYTHQ)BKLhSaw9+U#59p+oZNR_?EyVG*8BSDFzw2g^*NPX
zg^3{LWpkY!%v(qT^FWn&AS@-}+x{rM#=P_PtI)Z%q<;Pexmy&8nla{NX3h-BAnrJn
zM8?$1*r_acAL>r)9vPUO034{^AA+}EPCvBg_;C^~lBjegake4m?=E%Y<oEoVYIdvb
zt?23CHFqFoEdolhm~9a!)f_D2MyFM|%EYHA4|%&JV0a^1Xh2j#EW!;XDS=;ZbVZdD
zz0xEI$PolRJ*17S=3}HiCV>O4soM$-1w<l6%?G19fSXpm&=cU{K`ksC-5zbO@T#+f
zBXep(H&e~dreCF$KngWxK%sW{$gQ;!^(}CIuTE67+SYN{1iDvudGia38$*QD6Td5r
zABl1MVd`gGY@SW#KrpnUL*N>)M!mQQ1f@M19C{-6zmMMR1<ru5St4Vnf&ueN&1=G9
zn=!P|Uf_#-7yzgvF8+*THa*YIuau4QCPSF$Ma~awuy0T{P~9pfv0S_CW`Z(_Ujl|g
zjnr{AOT6imN|Xj_>)#*CKdK%2TW4i$`KyAODc%M5eC)>zzu?b5QVMQu64UECV_<R^
zz<+V*;!r<GjJmeE-|WE{Ukz1F&ImSH?Kt6C3(q!GAw9J}r)@ur$F6T&)KQw)1}H-A
z(I-dyN)v|cp4i3#NLuT(l92D+WT%uFyI=mQ3ZpA4QW6x$SNSp%%?veqlwjhE*}}^I
zDYGPm`|O5ttyHtKT&&2pvyZIk<S(6_q9nw|MRPLHV{sbEQ_fIe<M6%~lH)?E4_T0D
zX%6-eCeA;J%F8|Myz=Mx?Q&;le<=U%VgJd~y@O8Clcl!PzbErU;4Hs`@%^2_FZdu}
z#|l}^->*JiZt_u?kWD!sWShgPA3mF+&m@ng1CWG4tRWmn2&NQFGu2l(3*h$NA(r~V
z@|8-)({E)>UrfF8xlK^!R%86E0U*;({N$S|*0($+itQV$ecUg+{@k{#rg=Q8r@Cd%
z{(&}I^11T9b<ur>gXIT_`~Q8q-}_?-zJBxAdXf3JR>nK+SHGR~jGnx~&r<AkL_FQI
zmD%j_&fPR@@9h;$TAIJ;7qZuh+fp@#y6M1lyKae9VFgJv^@*hZ-%InI0Ni-U2_V3W
zT$jK%smVHDma_|lRhKi5=`L$&SLF2A4G5aIjU`K7H@`PEC+EZg&pCUSU-KI(P!6^K
z1$rqnh>SSPilHp<>$1GZyOuqn{_XMc$yN~FqX?E6lSkDrY^(EVEe11oMua>H^+2dG
z@pvayIq}CT9(=j8t}T9o_+T5JX5p7-ve4SUtZT=@VpL&-&K_Vp6FW_r<Mh6qnYwKV
z8t%ZAlmJo2`UhbfML~KDQ)h#Y0!ZjaZNIg>i`-~nM8pGI3wR|~Lc)-9EZ>|HaYjOh
zH}L0SF*uM*Z)s&FVZ#$@ZWPCjg;yz;AyWiqPUP3t6a9cTtGqGrPd`13+1sd_^qqFV
zIkwhw1ocG3oNo3XYaAVG952S~Q5$0RlIEk61qvQ_&)L--Y~SoT;xULi3hj*lx8({n
z4fzViEKfFH{f@gHi({Vrq2uPRQ};ZIKn$o~o2zG7MfEx~H2Y)VNtoo!ATBK%EJ~Iq
zHzSCGzU50*>G8b{FqVR;<9hLTZ778^K=IKNx_@-A`qk$Ady+Svm-F+h?W#`OiPPu*
zdKVSlfu!G8auz+a6_CBvu3Bwm5&e6z_M`CeIi~$ZM&B6oU&&QbvxMwZs8|9k2)QcS
z6LY9FJ(Rw;*c%-b7PV8@&~x;&7N`e8&5-9g&NCyS9>%^aKIapY<Ez+{oG9oA8~U}V
z%lbwvfC@4X3%hP{$qT<9$MTy!)erz&5h-bt9lrxqU+Di2O2+@J=1(6kbh$uxww4zh
z?!lz%Q3Kddb!*<N?Ux(;lST{Bz$8K5G}kkzJsSr-XUHAPHS;wX+kJAYan`RQzs_im
zZGT)46j_^^%IJ4$$i5?dVGIB&g#<^9GmEoWrGV3vgM&<wlOq=E+S5<6oq4n&888f>
z(~1wnT`Sx1CKgmwFL$8{u-A{?ovPk!CSvc3k!2QP&t*OBU!`cuC^#s-4BDU9h{+9Y
z{xUZ+SYc1pluwdRu!-mVcWw9k7owfL!~Ej;lHTxLx?^-o0-~9X_9#UC<oB&p`eOI~
zNz!3w|9bR<7`b6C?Lh<Cs@9lVmtXDMncLtn$bUC^TIn{ORnyBDnVnVXR^aSU!SfqJ
zeP{PurQYBay|Pif0anJ-HXa60(OjIORTol=jfwOMo1%j705_paO3g^B8yp4#QBR58
z>b-xrMjd-2_alivG6JDS<&0fs&>e9}jeq|1s-ljEWujjknrU1rs@tfWtB7+f0DY)_
zd~zCYU>~n-oCgBcp!SwG5nAtCy);$hyEJ|QI{_lV2G)8shatN-UB5g~&d}y5P};YJ
z4D~zZ^T|mi*mNV!<zBG!4q|hp+yN^i4(S^QE=4jT76H8$3dsT!;paZ5$YZ&N-oS+v
z0}UN<7L<hzQVunICsxAFFtIPe(5e8V$cziruZFEJgL7z`;9Mw))oiZy$3g3xcTba|
zY@CgUC=rXqWPWE^5dI_2GllSor>l{-F|;8nwcb(O%;}EsS^N`n81bi0JXS(mE+KV*
zU#s*&^v~DT;WBuj{uHl2xDyXHM<O&{$ePgFHH4ip35Ge&X>wA~a&j162{u|~>h+mT
z6ElU|UTW;rSSPuS)G1Em8X@@Xjm{u$##&7y>{9Og-jiQJ#*cf29xpCNAMf01IQ_la
zf0%xHl)e~wI4)W#rSL60B6|O5aByaP_oy#KhQ%`P+;&zVayWePiM_s=kZ+NU7!u0B
zDY9{U_W@9NERsyL_M^5s61w(uT<ZWDv}B@PN?CGj7543%nnz)46UC|^I6DQ1JNnjQ
z-<mi&+DGp)9FGrXONvVTS`bSSpx3KfV93(hrFU~d|NNJx-XTK!{pwrzyPMVdmr6{p
ziiQ-&cr*VQm0ItG#Az(naz6W>)Fvj$HkoXy>NIZ&fH&mD%wFOl;P1k2wil9Uzt@1q
z&#`FF@wi{l!LMdu!RRE6dSH=rabrO=$)%_oS&s#=<WM3m=L0?5JjFBGgs*^iEU+NG
zQds`ZrzMj}jg5aS!lVdw&Abf$yZX>GvD+pxz7Ko|%5$IXzpS6s`=TGKb9)(^RxR`A
zYQAW(LL_8uD~a6AE1G0`uwpd3qepe)=m!*)|GhI2DlxRpiLDAmFhgfm&KQ9j=W!hU
zKxp^S9tki~>JDZO_e8lT`Kd~ei?1<}@t-gtO&|M^MmVW|DI>_X;nu=o#b(Ii;c+xj
zPTKnr#@)9Mb{LG>TC}I}cBHy6hG<OvNfKWsNvDdz%S|JD7w)I}Sp&OR5hl&DL-M10
zeo1Yjq?n`mB83tDmG0oQ4N9S#0n34EBF>eHTkPqGI9@vy$zfq81aVq&#l_0qbo6$~
z{Mef2Q!t<^%2uXb*4Zcvz3x*-d@2lNmM6$<mA>)%D?9;6WHq{e0+71`ve94P`v7z#
zCjwB!huM-_siZ?-#cHgO-^EPOCMS#(zknbpfjI$i91BKeA;M+Nd%pKzruJsf-^ga$
zGfvr`C(&1#&&g}lT@pnb-!Z7{dk$jPNPAy7xtS*^I-?fT^Kbmwcf%zw$4(O&d<(C`
zbN>1B#{b<klgDe$8<JX85>Aqs<QE{KnMJTQYJX|`Hh>)hmNdKCRksO6t6ur^1FdOV
z*EyyXNjK0ZJ(<3QZDGEIM2;YGLOv)n7NIbkX2QyJ;wefR8|`9OkNl(q0^jB0aYja6
z1epdJAZ!WextXN3ebU<4%*H#!;;h0Qa<Jc(ULsgo=RkrkEmjGJ7(*@r4n?|~aQaZ3
ztsNsp`W&vrvEJ$*@ibaHb*<9t*Wt`N$BmE(U08hMmq*^QYkP+~?v`g+wv_-hFgB~X
zXCneHO_F4eT72Nq9rPTvaCmqaLD>27^bq*0`!`jM&0hdGG9U!k!+1n%q4YUpwqKwU
z+0VhU75TJW{Yf0xozg!2@y!hs8G_?K3Ul9M%J07wzg*{-^I7SN$4BwVe?<>w+-LUS
zI=(xp^jnexpdK&OnAuj>0HzePnzt*uNYM(QwgQJUjpQX*IqCi2SVPyffZoM&zY_E9
z|8@cVg3-^CRW}~cYg{&zjP;ZCN{Wi?fzuwJr8}S&lBFv3-L4&r{qAzl1H;6$A<XXW
zn~fqfDu@*CH#Ki2p700&RT9)z0d(y8(3~+fbnmYgD_@NF!+nF*NK9^cZX{;x;C^VG
zd(7s+AkSX!iMBK1_1e$Qe;zV39JIxuEH!WScwgTgLm^G1_~h(tpmqHK{tIaacD4h|
zO(GW%ZlG`24*y|R7G0gj3was&%~(iKoq{XUmfp2ZQAJ70qJ=huTrldUqvi(6yth55
ztuyF2d8nmjruUU|pckGqDy2>S%n%<!Q=(QN(vBandK)1oruC)cOL_U-lASJ$b^);i
zC%YW~7@!*4ND2U&R1P`wz*A}hPw|HWe3Y8isI~UGV9T!o#n%Xy)LX!w!o{Q|pwJ1Q
zjn%|d3dZSM_ZzvhVM!70C!rC*`AMPN$b`ES9cDRvXZQH5bGN%}Jfw7?UxZTir*S-n
zmvMAYBF88S#r7U&Jn{}A^(fE^{yr2~xg^S*DgJlB0Owt|MIDt9gC*R&+0a_sY&Qao
zl2ttV9!902;jvScJzwh6!lyy4|I}Li@G7Vy`p#aUfh5Qs-dB7vO~?oz#>WA*dq_)#
zKh1m-KFy{c>d5MvV|4!ISWTdnYcX;wEvUY!=RzD)9CnK2iPz5zCLyL<dc3;)gsaV;
zR^JMc<4WcgIRr^$z?#kb2`_`b#r@nd08{d6^1#tx-YS9b+=0JsxK2-1nRu93+;yBG
zVv<_rFe2Ce89hyq4YZ7?*T;W%6;sZe!oF;A&GzL`cQaB(Gc$~z@o?NK@twqE7Ro7O
zOp4UL%>4V5XRpHerTq}mbG3LPw%T;&s#NCN;Qo`-(`CKCy8pg&GK72?uc>F67TCq^
z-;s=!LrtAO{AXD2iM%F+ll9xLueXC%&@%A$r^^D!!E=4a_^eO6yn-$T*W{<=F*@bM
zp9N2ecHBVfzLI9(&wTzN_S&_Yft<USo;8#I1&lpLrm@Mf{3%_N<^@Pe*dTg3)Q`Zi
zp!Rt#uMZnoPlWl>a7kgpbOGRvXW?4I%6;*$9|)F*H}C&mKco1-FKue#5O|QWD85uy
z3G#MiOw5G-*r#AZ$ZIShX|Y2BQxt7=7E?UrVRC@`GO)EztGqu%n~VUYTi!$@{7!F|
z{Qtb~MMMC~4Hd-a)FWQf)bAHkd0`=^D`$Iccwu2CUH@UHJkw^P^Ax0o9%;JP6R{Qt
zV|Z`83-a}*zBw&Il-X8EPU%kQ#t4=UAN<kbOJ50}X(7nfe-7tQnpO&ZBJzlAkVT^X
z2vsX8Q2C55Nw4%Oi0$AJAY?+zm>=SI01b(%vbe>=<G=sj%&px~Guc!ZIFaRP6@&<V
z8u^UOlVG;M%l@oqBoAMpGbza$aj{JPqsZf_7gbRWL;Z9vwrG#^z5mTI&lmc7Cw2AI
z@ix7@XdM?(G|n9RxGUHF*zqMn<8;sQAHxYZW(CkC1;uCAoa+N4z01;wdIGNHeZ0J-
zdMtx4(t`DMEZUb#iSAX1%DgMy=YMKXS;gA0!$5F|CL1K{EYnq?hvg#(-T+>ClC%XL
z$hQ$Jp&-{c1?Fm3(t%GQ&BcU+sfwa{|9g)FX9wvlV}2==%UB5KN40v5+-Aqiy}KMZ
z4rey6Ht>-jVR0cg@dl{A+`9;j4JZF~DyYC!WL={74RA6|O0T4GkWmKx0n*U4q3KQk
zF(?IPj$8Etz?pO}VLj&pQdoieL)S#GV1Q*dIRoGgdfy-cjL@;&gH_s4URE+Dh}?k%
zR?gLhVUy|;dezjGpQrnar-$?N4<tnrQv?b=mGkqyYAcwsGnYlA1u0lrSJfJ)3pyLH
z#G?TOUH}<jA#D39j(O!(YG<cpnh7xq9uf?tcwrPOZfdD<aV=z9RlAz=18Ch5$cQqF
zrHS1!w@bA+&j|<S698`+-XAJRpA74@Bh2-<lsS)q`005*tU8)2Q2^F+Azae5^q|!z
zvOfV*11|W)s);i<l6p=dC+@fhb<QVJZbd}|MKpKY-?S>)WXoI4O3riD^dBclYr5CR
z`WGKxu=C-Drsx#tyZ)G2<6|1*v*y-OB1!vTDNs6;T!qb~F*cswRlQ$u4+K)XW%}Q<
zyrTU!PEf4bYMI!mdpXmGa_l3%9Aj$R!tKg@-b^PW|KfjaIJvEv#Wc0A0pzABPF{Eh
zn>kawf0Wm)Cb%9+L{ZU<H&UMmogaGDmpAk1`DX?Zo7Dt#6jG{}vry$|r82g1NE$^m
z+h>x!6ykAB0)=2E(ZE6CHFLId>ghE3Aq&n+Ot4Q?Eh=-M04Zn9GGgpsBBg&xQjkqT
zP3Cnz9UI9G(!69$8yEw;Z}zi9Uqc<J)a$vTguxGh6TuS?_|{!82q}NLcz;2*8s%JO
z5E;Eu)b{wxo|Fd&Pt>(QOtjtl-;zFct^DYLT<%<cU-l?&>*)7y({l}0J{$H0%|1dh
z+t*uu<eZam7E7o~t3Xbxo~Qjj`tztxD*=uV5SD`8$QYX66qnMm;GC&yc&s_Ad}H8A
z(;Y#Rv!*p(T|pw;GS95tn>)D2OD_UZeG1C#wKLv^y9yoj!T^fLLXMz(mv8>KrgSGB
za!xTFp*#igeK5<yJkXpZYXJh)C&z!ZU@h@D`6BtR#!YAp)67)D=!u$XOy<A|PvLRr
zg2U-QpgIfiXWP-hFt*G*#iL(Ja`=x%c-*Lx@ddaN69{JCc&eS9%*6Te4<4N&w|xCt
z)qttvxIJ_1adf(L{G)M=N{HdOw#8q}<ZaMHXI)OS72MuoH#|Hl#0O(QlujV4y0rkd
z5y^)8I(T^@rG@N1;OJC(xu7=BQu;)A$cD2>hSGefV%HS==5L=Ijy^C(@^m4a`^b7*
zB=Q59t^-NDq&uquJ}EyTkl#f(F^=Ta{KeBH5DG+gw)=B$(o}geo2{UO<S-9&Wa^-^
zFq<ZJtcC(}sRVG{fLUXjMgsuDvV0FA;WP2%&WfMjgrbV}#Wmb^)NKFYEoHj;xT2Vs
zx=@9J*|Z7*FB*LmP)vus3bwM-^_E-s7w9&BY-gDqz|h!1Jl!a@@C~Uucc)wCwZ$v2
zHc-O2`ULRRA%(wrx44nlxDoNj852M@cmun0Z9traSPAvryIRxgwStr;EbkC@xWo>_
zr0SGq@Z6@arE~T<XSyzQ&H5Do=V6RxI7j$C`AzHs)@yCuDaP!e)9i(nm>b#01=o8=
z;<z)o$?I&O_w2;WZ<@dTVN_;w^x#QhFrb_j+Q`?s>`34>gEK4A1D$+I?%#8+;15DJ
zVVU0t2FwiZZjVfvBKN;dSTN!9pd<@JA_ZnqInBX~_KEsUR`XR-1S^;s!(n=5*=8dG
zK__`!)ysBo;glrz;??6#)t8EAO8cM{)2cj7Wy}_`SKvA4Ih0`u&Z6RjY_rI>jV%;5
zVym9l8PJHdZNn5sR|igG28qM$le}#_0BuPX7U}$bE*Q10MlYz)igglBubfumvUp*o
zin$8E3Q9>WN0B3ZjmTlR3Vs&?BuLHpxwh2jQ{io;iD_X&C?XpeZ%@m=G$#vWAfemB
zE*Rj!`$P7^XIm{GTnKszoJ29DSRw^j2M}O<+KZZ2vY$0ja=3oZ)}u1u6Y@VMtJgen
zALrMKE{cGu^$!SEXfFxQg;acoT?pcB%jL462F)r|4F`c}rK3#}@JLfpK<4DVri|!>
zx{rfr0(Vk+9v{qp{<Cx5VFovQ&!Hq^cK)@3{o>N;?8l>td$P@TtByz5{A}So_P&X#
zC#1JNc*bMNFV_@Zq`o}^kvu($N?*QJA_OPDV2VfeqdL4@ih?P#qXu3W-r{cvN3~jf
z5Oja87~o-If*d|qa!y9{+Q{O9nCUOhGQ-%@_Q+lX-=e5W&$!3T$B41ozQVAgY7&3Q
z%_N$9js+5r-4+h2&o+f?N{tXHBS<eFE^eWAwX5Dh8eIi2SCLrWdo10)3r&cN`t97=
zV<$K0=JUU9>~c-&J;skGNaz<5J}=f5syvkEtbV>92s(BJd1Rq6RaoVMeBvZV`nH`>
z_2;>#_Ts>D6h0o^X3U@_mfndB!&QbA02%U7K|KN{q*wqvsW!yB8pihiT0A(C{k0dh
z!fPNtjvMk2=pr*Dj?Qa7N0toFSeg8C0-Da<<sgMCzam?~A;vx}lO#`HS3Vc_jk}9G
zbNOC*#UdpxIBKgRI?@G4LC2bRtS47t`kE)Llu1g)J_JiNlQt3#JXYm@!g9Ovh9o4I
zxwDT_KbEI5%@5lD@EPcnay$<Dv$OMjXDjlHjyK`-%9px$nxmR}TrxN#IS|ST=_+te
zmp(JiPIyZa^npaq$7{N0z&UY6)mzG7v#a9Yt!t^Hw{-CquM7JIYwUVPkjkWF&NO9`
zAXASEro)v$M&ENW_GD&uCnKSFqH>M^3WK+(Cz=w!&FPww>9kFyD@ll%k?gpX5u0Ro
z-dHwwx$N?>Y4r2G$lVS_zSAe=4XE3A)7vhC#X;m|_IoH~zr5W=&8Fka!usq!(8?tZ
zQsv1H+EDs;sT&Ijko-%U(gX-l?|`|hderX>26$>qBhI{6GR9MehVGfYu=NQdXX{^O
zE+e*jJ$U_%2mY*J)iceDTF+s8-qK6icp4C}X=zcP`cAX|hfWDXPAkDpZ&*Toi=^CH
zTF4_~3LSFRm-Gxy!SHyodW~s$K_8;ZcUpbXHhFP=KG@zm-@K476-rtz5>3+b7TM?y
zU0cN&4rjyej*oF>f_(_@G0A8ziyBmMg=hNRS!JZbgDqs~q3yHqaqAy%b_Yfw^0qlY
zXO!X@`TMYI4#TZ^1Gh({i}LbLPBNkH;Fz^aE+gHFFN#c2%9ibrXyU3}>Q%g{t<T*{
zfiUMH64!e`7q<Ciiu_ucXd#iaA<YASapgGp0;dFu_dUBNBWMVUX90ark=^oyK62gO
z{@{a8sm>`dcXv(XTqYmG<87+On$`-##<1qk&r$gwyn10KP<zALl!zQO`uNG_;uxL;
zuxbEfHd$~5+-Sw4IDlsSP{N|HR;B`6-etr|g@2$*Y42Q}@z}ybp?q5fuIGP84E*N#
zsliv6H16C%yF_mnF1Gmoue?uIH36s!-c&2o94F!YeYZC1<HtzC!XZ+JDCk2E172l8
z)WRFmlHVew|3?(FAz{0$KO~?&V!yT$CU-;Cy$QLacp{K{Znb}&9B=vxE7oBvM{SLY
zj;_}P*oJHG0)!2b_SBJCIcuOs`4QXrHXbZd|EYFx%GLuzAPT2*W1o_*0NnlPLu%(O
zzs?Jw(#vlt#5I8of3mkPQcGe=Z`Q(`4EldGop(6Z|NF-eQ9@<r7-f`l>~Y8`MOHaR
z9LG8zdmkrcuZ)!Jl8%fHLdQNNj<PE&>xjb<CnV!klI)$|tKW5f{m*sPd%f=aIUZk|
z-{?+2os*ObnQ<gk&T-&h&eHxkci`qPxi3PUSrli2Y$(U-O=R4?XYUX%c_=ydac!rE
zGZSt38@Rq5%yRZm_}txDwsG<ITfNf8lz!L3(%N0UcDtHxB;Vu7*>x#(2_S}ojCq}r
zuwpz47WBx^gd3U?#A%!S>F{2{pi6Z0?_Xk_mmnh;-4cC)$e1)W>kDzA%lCb?sasb^
zIjZEmj=J1xXUa-dlU#68$D;c-ki!45!-!@ufe+3#UVCvPPa%!UnaH@6JD0KE01__Q
zmm@=zLPw4Ta92HZcV9kO2}L8vdMVoj;pQBp+6kV7<L{H_LZC;(UZ?4Cn^F3?w5PXX
zLe<X<-mmjNDgNu!G54vdFC!R%NKH<io*nSW7>$rgH90ZQ>qqsi3K3nO;H4JC%M@Ow
zF-*wbq*qH7`Ru8Z*2QNB{vstt<5IXfGh`<;KhHidFOT)Ny?kcK8(%^VqQ``t2G;PK
z?R%#p$F6F&iJZCt4D#+G@smDprk6Xb(e-*ZQr>iMo)7@1bK5XL$Fq`gAHjfb=`G-{
zKWW^a0!y;E`V7Sv>-tfd*Vy01`AIlIRTQ&G;NdpRJ_7kbt)t1XvXy37>Yo&#5b=ak
zJc`He{5k(}2U6sYgwB)L#m2d+W@ebeyx+Yq;9IIs!mH~0Yp{HJe{B2EcxwlDsTp&t
zP1#xfkfb8XR&}HCh3o3d+(M<_l-m1CQ}qQua>Pbx0bQrk0<sw&`y1H#@?<O!F9o4m
zcIxfO)(~BMrhvtk>Le@pdRdFSXT9;n9L<AS{5Ai&taTaJBgs#yQ`Mib878G}h<AXp
zr@ESgMb*#q1Dn9cX*|sv6GX#U`NN2cc}_>%)w<-Lv;NuWyN+AZ7__yPq1NZZ&0<f9
zvm8x;oqc@FrdvtBxvqpn9^1F&dcCwn+Fy5j6EVJ2YMHHlCZ`y`x;@V!_K>STo5MoT
z`s=gBd$)7t$WU*8N{nY}Sa>*yR&V~MT-kbk<yY{P3NY@Rs~P~~I+(@%DGHe!OrbN(
z5zP@>Kq+qx3k}_#i5H!y2R>CDDjeiO_*&M+WTxwvCMPG|YX!T_)R0UOlBvFTU0ML;
z19aL8;Q$$IX-Rmw#np&CL&*{*^6;tlug2EpE5Kr2sk|bbc8_IOtwW^52J;?+EBCkv
z$+nm$yy=oE8XUD4P%Uxbip;W6d$c$nN>X8cmEqAUuTcHCPq~!X9Hshq`A5$Fw_v6h
zRgrv-?nG5c>q$f1^(nv=QA_`A^_8$nJ^~ZfI)5Rqs*5A0_oHE#Hd=a(KZ{jew9g}O
zZ&l{5w~@i>xzPJ_gW9ixr_6|W^RhVPadFwk)-`X~MxZ+9>~|eu7iqWx?RjT-89@d;
z9ku;k$Mdc_;ZgFad)xHYYuBP$5Am=u?GKVi#SAE9Wh52?hE*9ilLlFVRI(c5<)^A=
z!o-!p!ynZ4$K6!y*^&=r9OiocZtEKw4HNH_09Y>csG$;2=mT*iE$v0sSVLmAL%^aG
zv#9v!((_a_f5%B4W(lSHqrHMIBZ|fa$B84YIDdJ{xPz}6B2!_@!8xUGe)Uq@4y~zH
z<F$9hN({g=dDCS&*FgRPnCWhF0o)*{uABlGr#+vXVqm~~4_yPsF#Na7y@=~L*Bhas
zp=kqV6BpA32sav_<^gUGi?NAN^6>(T-jUu9SJAy(W)wG(hpwCuE`FD~UjU@171KLL
zFjwm?#_qOeE?El?-OW=$jq4AdJyX3aITjZlrxNw#TPw!V<4Z>LHGyAWj7lv!WOS7s
z@LY!!j|;XDL3e7(A5@pjsVd(S%t$%jSlqNKm{#VcMS2%Di~pW?b2o^&+he=}&%8aJ
z-QTY?ucGp>JXF9gX#<0MlB!izcl#L;AC`wK8+(-r!%(ic7bE*C;plSx3T#$XW82~C
ze8DrJyXqn)$x%arXFQ*Ju|Amp=`Q5b%L+{$Quff6*Xap+6ace`EvNlVUAxAX<eBQW
zK*hQOnBz=jDLL4#4O89aw?DIX3iP?bQ+3Kl6D~E7SIZ1xV>yTirpWO#TgIM93VPAK
z*2Y&2BGyRt6M6II4XU`_TNn_OvP`xKNK6$5tJ)pfG`Y*w9D+$SDglYDD*A1;1g|_s
zF%~raUAw#ecG72TF=$#LZpaLTOG1{Xs>dqYX8?2#fb|-_gLb*adOAtzbk<mf8>m2?
zyJCg3!2x@oOo;1n;`u{M1bo8U1+Ugs2g(mxwmrq9T`ISjxLpXDeHL`JF1Eu*B=S@|
z%Ab_+7WuFouZ%G?*P6-#0TU)IBKc-;<<sL8=!8<&A8F0@x5u6x-*1L73-o{6of|_e
zZ3Ie6-w|vG`^~pMd5)J`;eD8a^PzSCD+T`|zmxwaJ?^8_9m`9pr)YvjsWs`JL9Le!
zM2ToiS(kctxi&qpKwjjUy1<IF224OpI<4>9L%jdh!HcKHp1pvC&#F`Wjvn>q^NQo7
zDgp(8@0_CYSFZ-_UY=_3!E2j!5X)>B|KdZV&-<UiBxm^a4%yu3pu)NN3!E1)xyp9*
z#M>VP^UXodlmZIk%JA1s7dM2s54XEP+1`)%taFMV>A(tyYxpzb=FSKCwFN5XKLth7
z>p8(X??<3Artgxli^kcLc4JCw{xzRPH`!j0B^)m()2wT#bq}-O&`Gzm15&!a<DU+>
zH`szN&I)CBqdGb=B7zZlE}>?f&b_j;lP%cn`!aEOD;b;9?U$qkdhU{0ymA&$NElY=
z7;fob^y{ob3e^efYVzPg#a1hb!1@Cc%ZN1xf|0w`aXUrQd4+3p>R$&!3ClZ7a%34W
z5K;N4vXw@H6>*p_21I?#C?iG5n@aZnr@|dw)_FCNXC*n>kM6A95pdeMoKUqadiX0i
zwco1EM8aIn`A~}c{q|Oh(GETH>0Z*2+$96~H+?FC=LI6;VqvU6<~QQCoqj`FD<lhd
zo7LO9RMvNSKE)NN1is7|wkoI`)`!6v2+^ZvxrxmQ{upUF{?bB@`NKvw*9sXTxJc9=
zESxkUZ@!Gx)&0Qe!!+|ByH(4XF=Ab7HE3@m$!mE>wL1Cf#ft)0l_hjMg{HT^#wtAn
z%q&%YS7yllVh7n2KU2XBp>98@yBU<GEe@|3UESH)**e^fKG}UHN9Bu=E`ouQQHkdQ
z6{fR<i12?u%3WWke4f|mg8GNr@!Kzd<+<3(XI6}|%e%#qgF*Gu?lt&(sN6h45yVPr
z`sS74*Kx*1${pWk;~yvd1d;MQ4~7Qh?Bg2}^)&E%Rf{f0>8({`GK?>h4i#g+JC~N0
z{$Zxb-Vy2|uH1ube9f5{cM<SUbtSbl0D7#NI18X_hu2u&-TpH(*0#H`v<WhNT5`4o
z1kouAk3y6{14tG)NeF{Fn+f$GqUmbNm*u)b7lf@NgIxeWT%uJSiDiJ|v#AJT#^u^Z
zRc2oFJ=vAv!c55r0^2w2JnS5N{BM`{?OzEcb~WEQyB?HV6gYBTzD)Vgw5D=&RqRZ@
z@A)y!NQ!$~p>jeJX;|o^;3$+{FK+Dtz%RF`vI7#tK$u%j(Xjr0J-=5CqLS$8l0l1=
zwv+j6MTQs%|BxW*w;HiMyFvr(b@3^${!jIhV_QO_cfNpiD4tWxQ>ez#B(5$%DI==J
zb3%UXXWXSTy56qZRH?XIw+8jG9!6#G)Tf_CWHhQZNP)eAf{d_7FbVSl4AMpx5F~fD
zx99)<EzlYjx_)m6Q}mirWhql2g7>fYUvBhiu-*OSS#tkW$t?C!EqN0RY{S|3t_u>6
zW<67W2qaIg@k&UK7~LjVl;X<z=F_wMWhb)0e=u$WOF&lj%?}GjT+S=@tLyT96GC4y
zMy|}eiMsIcy;y8)_0=0GCZATcS?zIxcKPW(=ya|buhd~P!UtUb6+(q4E;1ML+<A|f
zesKDqC)P{8bMH^{^gN1Q%&oIrwa8>GOod<1(iz@snVho5C2ha$JDRe+y$+zs@9Hzk
zXys;GkqqrSG+_o_$>{D`hLb6dRV(EsTuQgI1D$;xCW&m35nA6R;78>nu0oWbX5F+u
zXD%IJ6OR;Efd!c;{Rqn4X$+h<tot+{eYkemT3lI;>~#?Np1ICrAI)>lp2UJS;6|)G
zUHF-5A2K=M9#m^<LozH|gBq5lw`UrGosOid>o-*5&9o|Hzq3HP;j`gFT8@9C4=)Px
zG2|W_-rS&!{S5XIdfbz`4T(W4bg3>+wf-k(iRYM~s9y?ih}zrKX|wK!fg7*YoTk1k
zyqsGr4!0LXf3HNG-7;otIyjlY_sxqe!Hn~UxoxecqmJs2!R^z|#!<$xQ0e)uFvze_
zlN(3U<5_Iht&X^CfrCPC`bPKxU_Z7l`}+83v!$N^g~J2x)U6g&QVgFn^#S4OFcJs&
zxY;+qUEKa>MXtxW`8y@m*vaC-GN|YS%BCm@Jm0F)!p$_$H`qhlr8hN=hLh?j2$h(c
zXZJ$(B74i0FdFoVr)U=CMIi`R0}XAMyWp2sOfXLwvd%@8X~lhpHd$Bu`1mwcSz%P#
z;Q;<3mnkff<;-r}G&$wt`-T>=C?bBMy$l;0P`~*6(*s~pNJRjyi$cmLc<M$yEgWjn
z)P9zU-7K!0q(ozOmOh?Q-^;93*?_X3WT|<QQo6V*Pw8WcF?@L(*L!;S*aP2d8Iiq+
zB$_~{DsLL?BOAB@*b)+uaxY?-O#5<(C_{N0rWeDEcNeSHHSZ04VBKhVC=0=3RAIXC
z{-i8~Qfd9ll#mC0RKMt}rkLL;0b33;L<PkfE~c0%o%P&$jXR$xr_4L^tCyJip2L5D
zE$MiNZv2Z86e`>9B__9~Vl;e6t}@7*YElxa&iVd|J5n_{UxHWI#X0G~zrmJNMw^ZD
zO$jgt=E@3*Yw8#2fRoIj694I++dotTfNsoTHZazNly4FiOx6~KIrmJ%IJC&_Ztqkr
z$K7U`#S%VdfjWubdwB_J&r^SWp)UouO;1nxv}r`Iyx%w|T)aXetAZCI_N->q_QT`O
zM*o5$;o(T7CHr9TfT}ylT)lctK2rvF(ARgrwjPU#%L<s%)Sv|5gJXRn$2Jl^*O$@4
zHO|I|dFi}unUnzY?!p{i5B*JaJm`eP$@UmFW2&X}toj08Mo{;c_F~JeGLHonnF^FV
zaq;wC`!!0<(kmV*@Bcs^xMZ0WP%-M&G$~!gk|6Z(z4bY-0zL-P277w~%r>t<7jC7B
zF}2F70-J|U=_POk`5jm8g1N8>I!ihd$-d3ZmX?CJjG@NU&k~oUeqI2Mseaj7mBG!!
z6sfh)IloWo@YvR`jS!CuobR&Jz(u#jRsDUP_~CN=|GWSmhcj#0I~$wQ?fXQrbxps$
zaQDB{%ui=90lkMjW2o!*^s{{~Fe_o!Tht~z-6*qHvl|w)%Lq$rr94bBM7Eb_N+D+b
zU0|PJTX=cv=KOtw7t$Ibo{*TthSOD}HiA6Efxsk4viwI-wyqxQn@7G2bX<QQ?vXM?
z<txFaDDeQhLf=LsDz_NulORvZ38{3ISk)N(V8O+uUFv~ZoSoS&(TvPTDPt6@441Et
zl{1+qNzP*`wAa0<b#fAq{PH?r-PT%fTUtgj0CrWs+&JJqOW@tsU4TK}-4Qaas9O4m
z^K79ZRs51x!0B{zlXgXc(?2d;q#J2rSsr+jj3VLzAseB8efR;q79;O3j}aa!V=KOD
zOm(hN#5|r=e^jIxYT3uieD-Abt^8}CE;(7+7{lB>`yNWIAMhvN&T)s{dIxyQ!eOdR
zQ(%aWN0rld4}c%&+Fh~2gQ!~_i%Sa{e~<}50*6sfYxhh!`o`n%3C<~GOGf1M76pTS
z>RH4B%?wxA{z@97iAl)J>v%p_V_9xqdygqn71OzTYNw!D>vxbr-<5_7_s3ZH++3kC
z%ssg4;?i1ig-+^Y5o38B<jz&i)7jOU5Ucc+7Z}*`T~FI-a$jfR@hOCGGw&AKQ91*4
z`BcP3=W^ZiQMSYHs>yhXh9io1Crc^Or>f)}bsN*LWHk&Z839`=a>KZf8hz<sWhk9a
zug68I^XkSsl@h&*7O;?*ut#LH`yDVq8=8W`BmC<C%H9hyQw&sPW&HZu@82fdE8nmZ
z>t{$CncX+S;ukj>S6b&{IT0Cw*j82JS5q0NF04p5H&<pdxGsQ{T3Bd`jN^LXyt}=f
zknnuqC?slQ(V@WXbwa8Vkj|}_bX-!d{yIfO|5(j`)E*q+Qa7Z};RGfrs(K-chACGi
zcJ$lPFE20q_$Gb_McetB(O?(UVmcK!CjF7H9$%UsFok$yE3fvPjDD`XZ1nlhw{7Wl
zgMy9YDo$_cW|E{-xC%=gsNNV(Jn`Pp&JG8-nv0DxgGV8&o%1_LSJkcuT(MiB1-xUJ
z0E01WX`+;5WWbS7TE9?*4%?K_Mb@h-A44?^OdJHga>t<DtrAr?xo%c0ZS)?Fd)?hg
zXkF*17I}P_czY8S%g%lT!uAP%Ju$433Fkdle~qPL=n6f7R5NUp@%7i63e(!+el4;X
zw^ypI%4j-A@}^l?V2!VC2To09go=6k)m=Okm%E%Z;68qdgVEf9I=Yaasw8x?NIb?V
zrwgku*86m;idLSYgbZV(D&@CnY;!&9v!KFZl7+5>6XNTA^8*8^A1#Zqjcskyx77f!
zsV`GO_hqV${ORu58BQx1H{D0~`a4R8phX!Cg?F!oig7&y0!@Q$F&^ll-JpN|A^3yy
zU<)$`?*5hEAX;~83&BwD_RAs!RLmy{I-6)g?>1rH9o#xR9V<hQk*H}DGPx*$L@4Y|
zAu|0Rt#LvEQZy&0L%dH3<lseKIlIWvAB+sHX`FMW2Tp}a2;Jzs>mGW=!-b&3*8jU-
zq}iGYZd_|En^Qc#d<rq|1clsbu<Z@ccy>YM@vKzPz5Qn|*U2<|`rHMcQl3riXhTGX
zbs+2~|K(l*e-PkCNb7r2MwNLx@r?wV>t-yaF$qu7*zT!1w`@m9=?Z!U-3y=`DPf8s
zYVPFhO50mo74-7gyB!TOIsNt9_=aYnyS>mw433yl?_O&Ul_NV;5uaf=h^<SNLsJMP
z)<Ro<SVkFITJv1%>mYkrCnuTb$hjB8H}7n|)gwL#IByny4{L^-gnPGrZ>n0HsK;K3
zlg=M>Sn-+1`xDIN^{|uMUFtev`b7UKsl3Pzh-1qw7y~8W@=RJn0gZh2h--kTj(_&!
zN8s*Cx2Qw#6-Ry6gF+RW*nOs}w_F~LTh9{K#HF6pg!$&;CKlX5WPTv3?O04$o(>xo
z?)~P!doMb_IFfDW0VPtYtF!Qwu}rhGZe&P=M<uC4;>8h2d1c+ia_|QW&n6R?q&dwT
zX>?xK(ov1ZUQJ%SY(u>>!+A6G<~0PTj`Ys_kFYoN_t`sNSp__EERQ<ocRA&G;EdRu
zYOHVmr`IuHOtrtM2_))=Tod5Qp<w86r-&x+9QPIwF1>g{?mc30T<O5Jgf03e#fSu#
zz+>iR_4uw0Hk6R?s232eqSrJV4}J;hbs9GHU1i!6n+v}nT<;L{Z^@;r8pnCEZnDcB
zb=0!Nv}dRUlCNmZ<v)L{SX(z<oh5a+RlAmuEuA|Wit%Sljaie`zRp%0)D_=#*@bep
zRZI6KS~A&j0o@CA89)d~TyTTqjZ*q6Q<*N9LXcQXM>gb4-&q@^p04;~ww?9}(YuOB
zUJF;QSTkaInjs7<myF(V+R-<Y<4~Z0Hp@Syd)DdC`%8AoFU(=`+bDKvxd)@Dk1W$H
z^sNK9F@h1jcd-2C(j{#u7xLXo=xsW9dtTBk)_vktAe5}Ck9)~pYKki|<rlN4Ak&1B
zyC7@9O|0s|KYKe^%uEzcbIj;{v?-`OF*Sy4#~Q(a3e(e^Ir;mJu}$upcp$_=SOlDA
zQ}OSIe*v=Q;H_Jc)4smGz+0p-=sVRa*D%~UpnEMDo*kFf*>5-260uc<U;Utv0EEzl
z{q610=;&&^vc6zZ8CoJe$8=LRY(ZnNY4XwWiFzQNzp-XZb!@H}O?q*eq1(VCU;J7k
z;OSR^_KJG%TP0LtQ*oV{F5Vn8oEZz`sC^7ePDt+5zE_MgfWM<Cy|9GFZcRybTGnXm
zyT;xHZ*@#tu!7{@GRu1bKO5*}Tv{LV_ItN%ro=O(xq5aa@yuUk&J29i->&_{E%du$
zudVrjaV4MeNPMjVDC@C9{*qN;dUE8K?-A8Hie2Hp&$}WPpZr8{5OV?^V%)xz4NV9>
zWl9Jz$v`rF;<Wv)EPM}w=Umqi%^DsV%52~+<x75YHs%*~ViBSD<kd%4JN+s&X`@~7
ztmvaj^-4?Ofo9D!hDHD*fuv9bS;eGo(&dma#6^<#pDAd7y2wQRneLk705f<h_6UMe
zNd|3$pm())s1f_0vwN)eCu`s1rk6c9k;3gcf|-3AfCo7XzZMk+GJ0%<C?BO-mIm8B
z1&3D9XN;hDd)AHG(Tnl+!A);`r?>3(*4JNupL8BN)gA~CY=#Nj2V2qpQ);QaPfBEq
zOG+-1Miv(IKLj;kRK53B_l;OkMry|Yf`2pMHUfo#z+gJ;^M?1pDrJSf+=|l<xSR{1
zo?CmFgf*bwaydawkOgX}U?Chyk+=0=^FIkd4*&)Q$}YxWp%-pkgg<?47jE3Q!OT5x
z%>JKsV0q|}KGMV*`6Re55FEwQ_6wITFH!>hNA+OC^(X$Tsgk8#VVo(irY&-ECfyq^
ztTGJ{k4w6Tgc)%rV9I*68j=ihKB~MeWnK}fFhXv_*<hf%y(}Xu1`7QoHET<)`&r0<
zcYPNtosIsx8J*f+&99ip;5v|%9bB>}^7X!`!FUl-Wo-8MZ+;Z`lWo8h<1U%Ain%9!
zWDZrFb$+yx?VXq$zoXc@UKUyHTOXA&KfF8743G1yw8)gsq_`mL{=7%@X~nny2vtA1
zrkjD+_D&&FFjj_cfM32BRlp5u6UTCx`0X!DNfkY>U)s|f+wv!xORs5ETMDD4O2(T)
zmR*-9YrwE0hRqADkS2c9;H`aAf4ra{xVbSdaifbm-!qdpoJp04yrb^^w50pjr?-fB
z(92p0;yR1LO}VZQA%B{t4}Jr3+GkLJGC5g*diOOqIxKAbw(rCzf=N+8RD&%M?@VaB
z8}{iapw4?LyLlxjxj$L~I|C3#zM5+i57aIlYIF3K3Eaj?uQ2rF$Dpfc9~Y`N9IpP^
z--ZwRU8dvlT(NKCZ(2VrK5l#tA<b<t+S||kcpgs*0?%tU1B9&DAj9RO`UY4rK$x}F
z8|7(H{?Fp1&dvworN@wOy=U(Jd2iP^o)+-%gH#VmNl2B~1N#&LyP#{S`|iW05t;qt
zO%KapaYuQ{ZfHQSwlt5Mu8~sWkRdXF0G1;DJ>8&2mH-SlnMVEk|B3Erysjqy6~1xd
zP(nTK$;*wnhXJj}I0bTKm|`qHhd%yjdz`z@OdqEkOjEWheb7JgLfiGB)1v?rm<O}A
zHoVuGqf(lOmkV;7jpKIR)4@=mK`x~se%~~ItBDUVhLUl+dTy~Fp~P0^MHTtla)`p<
z6>f|A$YU|>cTlp3lF$|_BKptF(%x1Fd@wP)v8oCDM650Bgl+wq7l#|OIf-<y@fG29
z7n|uzx?$>r0c9Cp;4rtmJ97u*?OQMgogWigk7r<`zwny##s)CXgH77KSinS-<r$dt
zxp=d`ZNIM#^n->dElm12Aniz&R5*B(7Mzf)o$&G1jQ-otNofF_y!F|~n*D2k=KJoy
znsZ4(SJ1*6tO*aVJ7&~-C)(iTe6&8`o<6R|BVj!a2b)X(>F$H-<|G5$xkpH2s_f~O
zoAfRKYk1VIuK46C-6L0WDE$<No<Z*M1k4>Fgi(qT<qFJ3hi&zM%_;N^UA&MhPg1=E
zds*b<ta>5a`_osIK%H+`P92SsUwcHncNER_DO|xuhv*MuH8=<0QYe7Yd&XBbhcPsO
zm7x8rB+W@iwkV3;Sr{5=fE5CLYqN^R?TWdS!!9T2V;#Z*>a}br&d3wovXUo0+}oj#
zW(#OOslITue{3(IRGvD;6cgtVC@CBRWmS|yW3Y1j!HOm-GNtD|&MMxQuzW$Tr_i)n
zQnYkc(?1v8bN!Z(Sq9_mX93tFmZ<rd^H?1c+-R2ThAE_!^6pfP9)}&TwwQDBXSv2=
zZ?dwj|J!kiF-%xe&9mVkpnX2kKqAwqKkDdblt;fdMelb<e_7hnJXog!d3<Rr<jot<
zn)`&G3O}K8s{PNY!#}5tsrxghqF>PvjJ~ip4`rMp^E^Po-A1G+NDGCe&w_5iC)uK+
zqM%(#)A*@Y5vunrc#j6Wu{{%f#fAnt$p$9(!t$cmo-dz0dlu*xcP^g*g3{s!26oW?
zIKOg~5<wjCuen26YP}n__1mrm+5+_6{5)xkxP_lZN}NZy4}My;rB|a*4g$B>m#L}0
zi*0{#l&}^IM>r@Obynbh()j1ud?{W{!FFGgu!gLF&cgMWBI?xI6|ZS%-2DsSYtd^m
z<6oUqoNFbfAM??zlD9^^B*jj11BL4b-X*w=4&t6@=PRBhyLFCueHlTq9P))(J1UE5
zjMhin0D09>k!)$_>w-sNwLR5&H6Wrn$JerXo)LDw7?otCt@(z{Fyq`+IMdbe_1)JS
z%|4C$#@sLRkCpIc$HENZ%*jq)+>+YIOAVPupigPN`QE<<1g|`;<W0y5ka&@v*x{iI
z>pYruPi5W~x6^yUk}+pNgbf8{<<I>_9)vB)#$fI-ml~FlE!UIMSQ#S|bLbQ@@pQQ@
zvS+PF%GJ_2B)PQH&IG&E(y~tD!;$T$9&qi$S(n{LWF-KHmO=Pr+f)Ts;=5a#`^V5D
zz0ZI<79GQelGW$OMZS{QT=gC^chlNtME_-gpY|C?($x^5CJJKf2erhvb!Xv@x`yUI
z!u4i6K+?TAtT>olj=IFzu2IrN56Qn4`FF`TdJhDK>0V?%iZE}dSO6K5y7r_Y_GK`H
zHu3e~aOYq-l8ydc7@-0_l>b%@d@e%WPaohYJA2D*nf0ICYk`CeW~F7IB5!W4%&g4J
zTz_|~CldnUM#4%>SB=E0$1sxIEiEl%T5EH2r~ugUs~DT{u_|}SJrH9?hr2-qwZ#fc
zN=oXzttv8H>tj!~L?51ofMiot+tZjH=lDp!*Zh>?p<+-P62x<B0^wUZ+$-e5DdsN+
z8!&&Q0)dqp@pv)HS2qlM&Sfs8pmGutzsrWls$4AKdZKjtv$Si`(7`y<&YO03hpk%*
z?_r+@H&U3NJW)~Mw)IZd>iOkWk&3ew(7t17>LZ>h7JI!|T5iTRVU}=R(7npp<HE_i
zrErK$P@)lwJLAhnDN9=7MX5h^Vp{&)g)6DPx1VxkpqK#ka^4x%0tkGkTY{!+aQ8CU
z?ahv%{b$1R{L7TJkgKz(^isjfjaGnP2Wyn2V0sXMTouZN?`@JoWws*Qrk4}H(|y|_
zxA(cUwPI}3L4IkrlGo#gHk5(LtR!O_-M3bMrEGvd4cwz!fP4=wa0$4eV1WYgxVq~=
z(5?5@{QL8H^x>AKy31bcf7P_-8w;T#pdF?-dq)p<0A9y5Oxxb?H(k~qOCrgYQIIT`
zenfn6SXkH&;1Fb>0I}1U_rqFWvZemz)9s3N-ZCt9*zAuD7efdEqSvDM9J27~G!M6j
zQkq-^sH-9;)0=pnppbY;-I1*pZ95rY07$GMzsN}U!uT$Po#yjyo7U9S+=^6~V@GJr
zvu}cc(X4u&$qk9ssSFGQn#j@b`6XM>(hEp=ExvMIpL)wxyj5=XtWQ8I8ZH#`Q8iNE
zai$sO>8<}a7{_fOMZ?G(_h?d9@-y&bHrtd?TybMn=9aOz_x;<e{n58`La6B4%WF73
z`~3U<@_$k5sU9X@I{DI|ZyOzf-%i`HnDA8n+DrJ6SK5x{h>{#b$@6h9&;>b$N430-
zSWov|sL9hIQkeQ;Vggt4GcMp`LY2W#zgdip<gHVp?Ns41D=fxBXyF$Cjql!TTG(=o
zSZ9{`NRpwv(n1!h-$oG-j&Jr;c3PJOBHL_bb?DDfnH3pzvxYF#nj#QDLN)%bJdV~7
zIXNA<m20`X^1}dkA|`+^t8P47hpCQzL7b9F?fM)w?(OSKQpM&8ZZ|Er(wF~TT8N@C
z6>y;T_V@ey9a`@`fq<iS33!hdgZ{K&J1ZnONp(V(fB$~y)ZEr~xbWN;DA%*mccZr!
ze#6i1Rq1tv<?OclHkoJ_K69?C?_zWN25cN<L@&~V9niF(YZnw9?VHlj(vtB84I+!8
zQ_;X}1Ciomt5M*|yiW))!V29udWR;6Q+qx@f8*Pk&dWV3((U*8wh!d%hdb#}I_{1&
z9DFZ3gev%oZR==uV}Rg^^Cp3#bbx%96d#emdjxKL?lB%i2oQ&3U>AHMXDd~@Vzd#b
zt`{lki+eu6_!9tK!9PU_Fm<xJ{Bnu|kA^Pb7f^;zxX%FSGOmhf`87#-RA*uOU3NkV
zgrMflHr3#m8w}`8o<dk_whL>S=hkFi?2gTvE8X0)59irUkB)t-_#$iNouqnoTgZhX
zs@`pBHYr8L>oDR+NV;}|tE*|s2LeRjl@%$tXts!v;Z3@6+#>y=B~!Fl8Dm(g8)2V*
z_i}P4IZJ?<`&@a{5C`@okcFm$B6)?1PC&efG_Z_ru$L2<vT<}T#Vpn@$NHwcnb?V{
z!T9>@&VRUki>D^`LnqqHd)G(ELpSZ|b&Zd4L1HA<8R7kI(Z6XZI8988vNjVc6yNSu
zTV;FwJ>ZPA*?5ACmQ6LV&m0Mg%=EX!D4b3n7+8oGjn<6=yGCgDDN)UjJGB@eXCoje
z*1<W?isn0m(<fLu2VKZS8&;v6b1p6F@iHIjhUNw(S3OmQbGjsPb2WXE72xp5t-1Ux
z3l&It$h80!{k`0>rK`%2cxPk;UJiV<s%JB<<(;JL%zK&pgRwavC4*hX)2(^Sm>%~P
z2R!&(gR+H$*JyaUVrF^?*74!<=NpPf7(p}=M<*MP$yI^?D1qm`Kkb}Etk=Xs;AN&)
zTNJ3dmjP@PMF`*|I3IQNy}xz#I#~Pks_Q@ynMt=({Pb}w4|1sRv!|$cWc{T5gyLNc
zlo%bvXO}bah7{E?l)qe}7fIFM>18G5{rRG_!5?n|<?2*hPf#$6mBCd%t}vRpC+<U?
z4<wW&FJy1a%<l_`_k8$tFg`e!FcS0nMaFmSua&H`h7LC;QY9}E>q4f&d{bE=<pjfQ
zXF@l^Ty-Mcm*mIJe?;1}-xIG-)WRM$?pL*Xl7L5hRl(-7%#o@L+upF@ne5$*zE%b5
zkRDHE3HNtVL)BxrSrOh#tv_;33Nrl48`N=n7A>~2&2NZv>AWgR+7vWbah6LNyG7Xs
zoHNEc!BmDAR4A=q2_td|jrX~vMDNdvveu<dg~R6WsEeG8|9Vh}BWss+Km37yD{q-x
zysRytJ(dt3Nk8hs2LZc_3{>f8W_LG;v@Rn_cGJ_EQHb1!!1$1QomfY1z}No(rI3e)
z6A@~C*=K&-%kFM1{<Q&Nf=~9NMsBCL!w(OSN!77;dGSvqV1u6;e_rfu-h68m`LUet
z__X~@r)8j+yu46cdE>=fjon~8Bl1=Bjs@wVoe3FT!9)FPF-g_F)xUkJ2{p8=#&YRp
zLkf}aLNKLg8(pN`q1VLq+QbRFQG-WGMKC7x&b=#7PUaYY4I1DWC1;dmPjk56rpE=0
z!UrWpo}ie}rFTyHiCmP}q)Ct9v3U%Fi3t~?WFwqJmX_R#%tYB%U#b|jG@AF9Z<=gf
zK1N)3u91qXeBD}(oXJA<=;2aeY#;4=>!p&0W0Z*49RL1riT`RBTvK(5j&t!#r&{84
z<zf9gm(FgQw<%EZ-xO~hF<(eGG$5#C#u{lIFNN@bW$yT>T`5*<o`1aLc=FtN%PDk_
z8$oqS&{r?NQ>X&}?Cs9<vI_q&M<oXY!Uj!XO)esXdf>jEvP+pp9-r}bnY2+hc5VY(
z<y(Ou@~LeiZXC}CyW~xkoxs3GR%gT&nG`$mdgb@TN@N><u-}V`+C@g!nTWGq^sg6}
zkbhZMRZ;H!pNE|jGsGLtO(ZxcA<NQ}NtH^)i%ot|bCV#8|2(pxd?ybQ5<ocBTbbVx
ziEa*>@N};FSzfi+J9?m)baN1H%<Ob523j<78}%)39nS$HCiJR5>i^Yp3jwqr2MZ-V
zGdZ5sm72u`k$a9U|ByDDpaB9PJHV?XYI}zs0`wLsU90B<0O(v^-uU)yc=(rjBTTZ4
zu6m?2W+O5);5F?9%C@&;Fux?qT0XO|7?zv_683kv&fTwVZqe>AauWgXjF6N3rm_iH
z<|oBFvUC!ruEb41FXEnaeVCj)BQZ5Sy}Who{Xh@rDSlxWc5dFS1F>F(UD?AMx`4<t
z9BFH7+Z?_Dj8G*d9*fe;GA{ibaWM(5gog<Viyc@YAD?OzyYlr6(FaB(*B6~f3>_xq
zPh(&wF7W=)uGE5g<Hd^!N#F41{YqvqUCDgbwH?lau$_&I4(|lHc0CZw@V$LM3-QXQ
z0(EkEwvsE;-&N*M9b!}?>?4|gT{Q_a5SDw!T_SKy%>33j-kaLG1F1EXMieqdyz{0m
z66d|HVNCm8zB;uxVFl7ML-iCP8UHV<{r&v}R{ux+^Juv~uP5AJJ6<7LwnR0Hs;3^s
zq?B<b3)j_J3Nr`-E->l-+o}9Lcf_x<?Y}OsP>k>H?uI=8i>sqm%?d`K3=9Z5an;i9
zzaQE4#>Oj5DxzC4vZs|3jS=QB1r!L;ZbT}?45r_@&vmaBJV7%rdS04+cv}uaGQ_LA
zcCQEXuO()EoFC<v4hjm}nK{@4O<Glp^78UvEDNn^*$0RDi0Ej|LF&fFh9alk*g@vu
zVjJ5h2_i^hqmWILKK}}Tj*&K;YtqyhZi{lAk3e1kOarGh_d$SP8u8HD0(h0A8;q#u
zHA`EUT}(h7*<Y#cD3_GL5F($FY;LhxjyKUvF(g6pqz>B*YuUvk+B3a9$E04p4_R(C
zX!zLqB;ZL#{}?9egP2m+NYH$9s!~7oJYD(v{S4Hc7BfUzvh<xEUCns50x9fwQ&}J9
zi`QNdY1im)SB$Tj!yEP^l=q?W3M-pWp*u<<GlNkVFVey<LL--RN#%|9P+Thav19u(
zqrciNDres^wRb<N@A!$P&frel?$(o3Vh~;ys7?@=7Qy+0t*)&02@_<**lyIq&Z?r*
zxxrpuz}x&1@;+!X@~+c%J^etl!U*qwlm$mXCB1b`S6i*P#V~T5uRZZT@qJkE<A=43
z0?-*{nOAHe78f~Yy!K^eK#}wDt;g+m8i#iJmoW9o!8KfB3Bz7F3~e`&lGbHIgm@6E
z<4b%FICNhKaDUL-3c`+?kqROopzh=LV5o)`$*$Pz_7df)7cs)AY~o$u%ntlTj}NyW
zXIfbmlF1m-+59}8s_OZ$lkqy{mmtUsrMh}^be$|FkZ(MqMXlePtXgg)q^oZJ_+j9a
z)L51H{f>HqOl{pGXBIXHc)FA>uAG6z1@vrfokD=9uagPT^&70k%SXLNgAS<F0O|-c
zEsP2Cl22Dkkq95;RgodqeMnC3E5_Q}zI*vvOu}ztY42|bLSGN<3c6XoF(=4K3cHl|
z_FZb(nvi-ZI-u?v;9g0r&Hm-waGP$4om4Znu$V}4PgTMQpTLOUF%UO$xpcB!;{*bH
zD&C12crbKBK&)Tkj{^0_PPM0t?fkqhV)?FJgu~%ssu5SYlBv_s68Ev2r2ZZ+%hS~t
zr4xadgapqgp8oDOjZqe`L|(|Z|9H)og<m(RfX|=eNv!)iaqEazFQE6~d0*8%k_}M2
z-mjc5rlrv6ILwzX&89xe?r(?JR(cqA5<$eWQ)TPd5Dz~Gfz&ITl47mpL|A;nEF3UR
zjBNdDreJ8NoNgc_yl;r-YK;w`{3q%hNbyw@E<jdW${bfow2<KWNlWH@{IdFgUI0M@
zwi)0qgB~?7o$6CuJCBkjq~FTdRJbHV3QSUZaHnQ6>Dl8~6??61(V^RWZF@~XX}1m1
z2u=^0Ziy(thet&L3w$KNRo&2y?Q@EWkB@I%oF@YhVI0?aX|Ss{M=oxJ*N$7`SRHRy
zUR@#8F~wjB+9^(XiJyf$NOtm8V`G=-OL1bedcTbzP$J(CllgJiv5TBM%avr4*c)D$
zhKvq(Dk3Bzf({=zI5=o;e|lcu2|S8`B?ZfMrK>R~2|X0=u=y^=KDclR#-v5BM<bCv
z5r-1PxH@gL?s;5)uMmzO59ZF32Vb_Rp9h`#m6Z72RrAi|A3wZ%Mpa?4k!o<arz)l^
zPlD>Xv^X)Au|-zv5=v$??L}WvKF-7vdP?@_)`X`PmtFYLqq_QBjPn(&i-8mCcw6Xa
z>pqB-Cxpbh`<8w+9%gESEE=K-xsaZynI(1r(?SDY#GgA`<AS_y9J`q7klAdt!>jM#
z%c|csPCz?3B`+3AOlwTLm+&w4g-d5v;xTm`?k0#%u#@d~tUOcv1HFPNB6DvBPr_~4
zvIIj<uBktws#^ug#eiaQ;HBM)YMbVm)7xCYEFvCETp^9Bo7j!b*CwVlpM77<^e#JB
zeSh$9=TLdgtL13SQfFryC{S~1^Zj|5Ap$%sEs;^-$`}VbJFMGolvW4mH{!fcu3tW;
z6-)s`4@8XyaL=dyo$pGpQB2hm-<)ea>6YxBjlh_ak%D&{n#-*y4{xxwx3{fZlIRp!
z_@b6vjLj-2|5<Fq*4N-Ipndrm*ExL@awGC0AFm*TBd~1qtZ8T%dG04ZJwc`JpHUI)
z-_Cnr7^IrQ2t36<Pw7I$rfvEldrU}^oe?+X13aB)&X`{Umm&fo^1VpcnXfC8UTh%?
z0h>NHVGSNH-f4=|x6w2Gi+#JlGb<UK^%tXB@yQx|gCpHiHkES%$fvPg(YGjfVXAFW
zQbEq*i)%+H9e>QVn$=H>71rgvu5;{qnsY%Iw^*)5Q#Mag>R0h{OAV$760?&NynDQF
z5Fxy2=w3dR+&@*EaaoD3YL$ahqJDR;v|-{tva`nbFhqw9L~l+d@26yQ4W8ssxb!Bd
zo@e0ry)1Eeo(+X(G&Ihb$S19%`4UQ|(Hhb@#6~Q5&FeSo!f-kIuW6t?O+&QlQFgpj
z+S!!Smsz4`e}iR+*vMQ4;a64NY0H<uxuX(~=#m<lSqANwqJL+j2@B(ww}9t_1PXEa
zr8oZkNkg^1eVcxljFF2g0C^?T8>vd5E*W^ms3UOW5OwxYiv=y_Q)vq4F)WXP?3AUD
z(A(i&Ye%9*PM?^?J2OMd9)L~hSy9ogy+}5*N4iuvGkFkkE*Ab&!bXC>I3&2i_Bfwq
zA?D#{D%_xtL@9Zc<zl4E8sn1kS}fz6Y{#dqmZ17Focr%?7Xusga|85CQbwbRA!-Pd
zuUC*lquDGI-q1WD^3>3*l7bGc21PE3{35v{e{DE+HbxlT)2rBm?I2Z|<Fw0*6}=db
zlogA4nPpqaW50>(w5f(R&bG`CwyW!7qbm77uZLpqz4QxVFrF;`cMjE@ICxs7bX2ec
z*AWT_RM5B&a|F^)A;|-Cc_Z5A#w!0Lr;`C$ND8}+)~g-9M1{BKTrYUnWttx2d;h^!
znK|kAEpC~gcN^8o!}>V1wLh&34GhcyFeP0a$r^?vL@-iSwXg7@xgeh2tZy$S420$J
z7v2mSF>ZfnHx>u2^s~zRXKec1;!W>us$LYzN~JjmfG)2DsRs@Ce-uu?`^B~B9l!u{
ze>GP_s8uV*3OB&G{D$fe6mQdTWl14}gK^(~t^&$LqYt<O8N;YO1D`T!hfxa)3-Jdf
z-QA1NaS{{DTN%~oA+E1r&yGnni?x>@L@A_aZ+x3;v|^9r%HG-CMH+=ZcXuK^MUEmE
zc9IHv-@a*sbp<SLbMLB(FW7Oo7xD2t4X7%YHly6oeLsC%T8G&p%T`(31;PLyEmDxt
zlTuGo-B95vws#bI+J}|UEJjV$A_{4ghy?XYC3Cs8w9CM*M$0O$inQn{yF;-cZ*^JU
z@0Wb|BlNSexdZ9~vYgNP{if@?)u4!-r*k{2GHmh|5AL@P2j0+qViiaUcNoo}Qf&US
zVYntr^;$IgA6__`U=r@cFk3zze1lWW{7Ry|H(adPHl;RWYa-_Z-vZZy4fogajT;(n
z^I=GC8M=h@4@!jKXDODr7pYZ*>bn*e6sR}(C@Z?d_F0`@X@)jSDpD6HP#E3-6StfN
z0tW<C`wzn0q-|`OvJ8Yl=`HPrHp$x}!fZkzuI_ckhJTCwe>lUQn6J6j<w%VZdU3{x
zSBf|U=WU)WtI1od0?dEoIhGcqBgXVPV>{lOfQ<7_uomYO;0^GmCn>xGd!x8Bg=UG9
zuSX)3^v$a8)vA>_@`GkCVk5Q`k3n6nrR{zWYQVQHcVi1t!A*8-eoZZ(CJq31o##%a
ztX+Be#O*PjY;99g^H`TDY?Xa%Q5CHIr7FN+d;`|$Hrr-h*ILemrvGy<*|v7Q?dy}_
z9!Y;+WR1FcLV`0rlgJ8rmhO@wk@+Y=JL~Azszui=DGeioF>U@d`ZSc3Vd7y=)N*2#
zZ=x@mSPIY*XQmZ71F~2HD(mcJGoLSQ67Rb$+|BzIzMP@f<yn$iFJ;*!Qk)*k<36s)
zX`UaTUsM;1`Zngb4VY7ME8VFN@l=0b8yqRf!p>${#^Jx^)S6Ix`M;!({jg-|rLn2-
zY<8Iu40mC_o$hJ7*hdKgi1FF7YJ$vYHb+PfH@8v^n(qT!BFqaNwDhy_v>zL>rVJ;u
z&%vl1qFFQSD7x?FSzymdq4IGi_c&xHJxszxZZHQ^c6$F?>>no?mrBLXx-1ZQ_<eHR
z$+pMsOl6h`6?f;Gd1F5~H>4HCl)9??jGS-QLEDxpo``fPl|nO1$Vir;6Fy%)#VBhu
z+H}LcrZ3Ii7(MftIW8(H>ZCZE#?5Qd*-1SN_Z03lIqvb^<k!tHUmrS!hDRNBN~`y#
z!rRrmxH3=z^uEWU*SPr$U)xtt)XPaa*xU8)yFedSE!zW{jk-wV?8@K2e+AmMSs{4T
z%SV&TTf=wrmRi27gno~&S=6=dlO}4X=xAD6+%HW?a^#ep0?*^*WUlEH9u?p21l<kG
z+uHMh{F%DqVF&{+6~(bBj!4}Eb=2=Js6$<>>pA7Yq01gAqnPB)$GWd8m2Q<)m%jx3
ziBqA$)+3lJxB(mHJ=PK|3BVhzJt~z-E3a3OM%nNm6g&9*Iq^K_jyO9NrZcUMIqmp%
zUCeJVcDQane*=5#$q$owYQ(bFBH^Zd-b0D#bIPEDa#zMIPS=%Xk>K~bpcv1ajLf&h
z2)oN84BN{xhB4xICC~Phl*%@|u%uk^Xh9)$qamM!%)vqFbjCAx?ijOzCvW3<ClPF1
z<#+;e#ym4sC|iub(EP<|cb^G;S_(#3>>E`~>|6{g2YDO}XmhsEKP)z2eL7#s`|Wid
zFRC;i!6!X6+Be#(zS!dXbHekfVRn0Eofn<9C*7$Y-@u0|Rikq-T1-9WU)z!_k&CU%
zZC|E^UCxT0b#?hWzXm4nZfwrU`1>i*5UunQU9t$Z*vHf*rRU0)M1`Na$jfg)*7bie
zRx#Sysb{j&9{+gtHsWI0JI%;l(ERlOJTHL5OJ%+%2EL{@VTon;Y$bp?1oV2)$h4**
z`uGNMB)kP7^4M++XaHbq^#EbL2$~-nz+i2qE28}gll+7ma#P{eqz|jPc*-km4v4~;
zeLAE;bDjBOuEX@auswCVm1-}^7ruo7G;$8`f|s0^)CJzU<YYN+8?Y+99)mAba)<7&
ztqBXpTrw_7<<@wWayNz6T5gIpm4)*-GJhm|gKw-UKJYVweasQ(mzGRy{n;ktok#Dh
zesf_ef<aiBvY91R{G71JsLcp6QA<9YM(}>ET+6ui*4$A)j?>ztxTY85lKWJbsYI^)
zsQT#FuB^6>6<ASjP-}ULT8tJttH4Lt8_#?}toU19)nZN=M2YzbXe`i$UUXz})QZCh
zx}=227c0lZx~S`eR-^tc7`aSj1%av&hc}0HaK=s^nZqLqI`Vor3yZ3%|BA?#jjI-u
zBRr|fZ;`OncBpw}ML5}pXygQXRO1mTYk}$_0I&G=Gjc_6Vce$47Dzl~CClO)%D3^8
zKQsoZ8V+{$usFa5{KOi6U~l<oR<T!7%Kiz8r8Q-|Zs<VKlhln(_qOf{i}3T)I2%Br
zFM$%}fm+w*ut!D!^$Yd_lanM3ofNa+$jE76L~g9=_5-(1a`4K0U*_T>P9lAY2oFVp
zQtPP&0+5oL9*b)B*6Zxg$v6O;t9zQ+nsW{QZLd;1f(>oaX#RsIb%=<c{B09+3_?KV
zXulvN_O68T)hG2UxH_I2{NvvU(Ry%%CF5jF;p5DJ*0-N~@rLU!^7HfO@mCnq%jT5V
zLP0d75yqu?t82m>rTW_5<0~f&b=*&gp=i?1<?@m@;RJ+DD*xh{Xq9UYn+pz156{oo
z;8OT%H$}34cYnmA)_nDfJ#&u~DNl@T0MC5&rB<Ih^2B8qQq4)S{KZ)uH)q7kGt1rc
zC2O-Lmaw|s?We0xp6SJttE#+kaEYG*=H96!>1Bc*t1TOM#x+9+TsulI@7bABd=kuE
zf|P3dmyGKA4D!;Csp@7u={s@h=Exox2g``z_t5GLGvsk?Q6@uq(AD8YLzZMUwsMGv
zgL*a=0Jj7%H*=UC)?$>OD-#%fQ3(|Tjov@`0$}GoA6vd8bSrge=`Q}Wyq`T8?*s*7
zVYeUp9TK$TNu6+-4uWXu8q<*<_(X=`#$BEx;kEWEwYQbyO43o`dkX{pHEc>kF1xLR
zWgTfCFtOLFDY9v01vY;AAWRmuv#R&@a01G0@mX_O_wg;-ZhAF%&DuDDgPCPcdz4U1
zMYVi2-JM&TO&mm1!S)Jz4#IBf)HIHnb?s}zkmMB<B!{`UV**URy~;8~A>}4$m+2s{
zI&1dRb>>cwJIc!hE17Upxcy@SdzN0R<-;?p@*O-@9oRVgbEB1b9&hSRE~LSHMQ^Uz
zG0XoPnkKCDndY<B)F10)=~H&<T(n+%NQu$<!>Ao^d!ojjHdFWg8I<czVU7Nk8h5gV
zT~lv<K=IXFE%d`0$PuY-&cbtn;YeKvtFDQ1pNZh1%4dDSW^b098z`K!a0(T=fEC$Y
z`8+^XA9OjMh;(!=$_OyweaJV;!Nql5=G=#uM7$AeDO78jpmZTgwr!Z=iH?c!d(`T!
zLf``@-3e=E*&ljMt#h2EV)JNKW7ZRemR%iOdj-pT7k55_nm8eJl7IGWN{oI5>aC*1
z)R?hLU3N)>=t6xNw^@PzRPs%Pw5{xE7_jU3n?OX&nMWEvDXuH&lh&QbX+b~$WV0=`
zSG9bO<!qY#ySosa_fSNqN?UxGy(MIp58u@tzc=V`jhKZ(N)pqxO%Ut%10G3%8a_2|
zcBk)q#pUJYsDz9y-XV<vLtInU8YPU;<<$K4t@^LcL297-*#IOyd1&|NY7+b5A5efV
zZ;=r|Vg9qWw&qV(2kq9tC?JPd`18Rkifk){=KQm{MAr_~5P@h3p9@s9`F6>B@8<^2
z#a7y8)xOC(!E7CF3~nN0YJb4z<xSf7QgD;?NK<>j*coCbZ=lK88K5ei>IM!^OhtLs
zd5dE8ZZ5a4cVjJJlK0ay<toJF(J-YB>RhZ%xMB8pTRXeNDNzX@8ZH|FB@wTa!0+G+
zJdszKA;|n3p`z42dqGI*6Ie<>w8l$ybz)9&@D%47pZ44b2n(Co^MKPc!9l?l={NOa
zm@DHdjaZcR<5ZLknLN=C$=0l5P?jS|CNC{_^&ho@#0EYzh5?Ct7wVB>MuB^`V0>u;
zR+p;nedT@YHtIK%N9(IjD=lCNC_+t#VroE$$m4jYtxrLFzh`QeAK{CbOodcKiE);O
z5HTZ7v6EC0?K%w3gUWZrIB1fGU+-5+2+cInDMwY>O4y}R)(}}>+KXp)oB0r<q<@En
zwrAU`*saXj5fjq|J*wChwv0mBjU|668i}VBu->64y)Rf^2-~Ev5>XUg;%bI%X^_R%
zL7KUQbnHnttwpa3?#xVd6>(l6Tz8a}#b}{jR~FOPg$4KM&x31sLjrJt#*+UPb%7qA
zt?qX96xdPU$)$~Xpc58H!Ba9TjI$WppQ_$i3gf(|gY2J&L4B5g1KZRD<KGe(7-!F%
z>K?0h2oOK<cJg)|Ds^pEvC6VSJ$}P~<HuS_lzK590EO6{64u;nch-NjtM?*<9>LC>
zoSa-*0<q^xn(kb=G^4rUZFB2C^XFQDFd!UV8FXrz<XTZ5NFE6PepzWpxZ6)8u0rdZ
z39LKv4Sis(*;c-~x(Y;?&(&76E;olHSdWgzKc38tSJ1CWt{{=sItf%P{^Bn$L54KZ
zl?Z!&9$QXEp_2Ok8uUsLM^-{dkjJk$pDd_a>`P8A2OlS+wVvfqmrGdh$3X#NRvkBp
z6xEU>-V{n2LJB4zy13r`&{cW>W4weX?WLkE`&nZ8*(vW{SKs;N%$v{vQIU2_gE1=8
z@I&9+d{WJOJ?G7?IFeG25e4~<yik6DPb9tw7Q~nD7yCS0v}p3AyMc_`Vm;`PUD*8{
zWOg*e#@4pdlAa}AT$sh5F8zNrop(5u|NqC2ktBN_CF77f$R;O39MZ|iG0M)4lf7k@
zajeMRN;Zd#W3Mu^3x^2FIOP}#+5Fz0-*tWe$`$@_?)!e<ukn07o^Z{j0EJ{fY~Sg4
zSDFsbIk1iHSe`>yqb~blmYH4cXU%RZXy29e#e}>adK1d{L9S-RKpi~1T7T<RX(7s2
zAj<ImLRV2k6ZR};0m}kDs{uq&vdR$RVexS1&rLZkDHa4KC&iX2)s(el#W6!K$Un&L
zXLDJd1ms6fl2ON72|#l1I{CWXzufuQpMG5KbyIS4871u_>?8O`wbp3|YT>W`HwGyd
zVIYVOxQ+E%8^2$%<<8BeVXMNG%++|=^gmmQ%dw`k!f9zAZg1;;m<x~<PxGF5oI*Qo
zQ!fw@Q%O4e6RC7^G}XbrK`1X5wm3{qd}`b4w%$xXTGPN62E>8fllgb-acs_!P|j{>
z&)*;a{-tKzE>A(PZEu4pCwmN&X+7bpHROZC)oP6g@JsCA1!rnu0Z=jD7lJ<{-jS0k
zzJOu+Xx?UuiglcUU@<L(Iqs|IK!LF!7EM6Gw5osABE1ZzAg&7B4OwxDc@j7o@%Zrq
zyd8`$S;K<YPSI1l-X>N}-?%v2D>hRrRP%b;Clp`QpUcq^8io}KJ<5x9XNbPV!Kz{x
z$zZxK_w0~wcg`b~zCM5&k@41`Z<N4=<YdC1Cb|<2?7)J>YkzZiwk4~)*{Q8TYh2%J
zPLzGdAiUZf$3CbfVoS@PUr%s!F;M@hsc(M~l_D6wQOCV%xthSHr<r^~{j$1)ekMvA
zp(o0lIED=Q6}y)LT3+ih2b9`aO0NUB+fl;F{ge>F#7z}QO*d_Rkoa(v<QvBN6!hCM
zAtx10xVjy)w&Q2pTwt#=s~h_6W%e3G_nJNzqkK0oq=J^1IT&Dh^QG6wz9M|Q^V>4|
zPsM;`&bYnTpTWV0xCwC(eEQ6q)k<#)Y!<Z42EPY$^#L1jy#iJvBln2d<vb;eE9GGQ
z`>j=R@P>7cOi8Pc<$tz#aY!U1UgA?5v`<$u<tcMP$INqCP}+Bi7XW@TfNc$L1)m>-
zgX6^(4>vckteu{=RS9{_YYe`&>{tM*&(caErg|`k0lfg5fyS5LYt7pJW|$54CICY$
zEZ!D~3@_=?JSzA-BhB0fy1I@9>Zi)^yIOrv3MnvhciMGsQ1ZV2-pg!?3jgbs#t={;
zm5t>e0Wba(3BRr{nS_px@;*L=5dpex!;ZgS(Tafj+)4*Q!3X~<mp=K$%u8!&mqPi!
zJ=yd^T&0C^B=Xu*8Z>2=^<QUvXf}jQF75Q|KS~Q+jhfnJ6Nu-GqE3PC<V^7acz?*B
zKlfX|KW4C#ZBRPy`D^9jb_x`2K=z_EE0PwXY0CP;9Z%Vv{npvo0$-in<<@VSyc8w5
zdtGNq;h!bfPX+qO;-LLj(reZ1;%xpEl?$Bd1D96r7bYjVTZV(ZIocTX96KmdvSfU?
zy)vY*Q}`I&$YCQQko7eg&E(mt?Do!;&rTzGB@Po_^5{`r{!5=kYvw^kq4LQ@Y<#4u
zXm@8!&)>;8v++8RaKzKc#I|Nt0A+tr*j#yGL>o!Cf?Ic^l{9AgUZrp0Zcg^&!$NWP
z-TZPPH%abdc=5zuTM1)-yk#aaotcS~h|;8@eMw*sG#gA2`SmkBU((R15^n_&l!<%i
zs0%|zqyk;;3+9KCi@qQY3TzRq@c!V7@$n>awIYW^DEq0q?l@3xd5wd2c_29IfJZ7(
zqt7ki{0zVr{?ng^iTK=`t%te8?dbYc#qRtPP?0~BHka-FZVJvH(?Ki=fP^3-P%qdF
z54}E0uVHYdM&7&Sw7np9q@Rfc88%c1=qD1Zz6y$W?_RnI^lJwP-|L+~(czT?s6@WR
zuzRp7<cJCCv-}OEe*-W0S+h@pp*yE`q=!+3`uB4=T#B6#!nXesS?fOQDJ%L?r)l~d
zjkU*28Aqh0yxN09Bh<BI8zx2hoN|tdxVKnH$IHtnMy{C)C&j_-fv0vaj%!!^YyTLG
zz=tSm42|RUDD~&3N_Mx$M)ht&p2J_eWrC4K@tK@w-`Kw86{54!e&0LNSLrauo7YiB
zEJFIc`SLZG0u@c_n=Hl%b-2I)^et~fm5_B#A|fF+Q>VcY-qf9}ENln4@Cc$IH`_`1
zOu439e1ADnwpXaGiFNU%qmxzaydP#xjvFNT1n-qwc$w{kSl}WMW6tT4oGLf;bJ$dV
zO98T+DC20-bp1+{=e<9rQo{J<p&>7`stPu$w{JaG9TGW0uxL{RF&2*~M5FW!n8x1Q
zs$FQT#NhM+^g?2M+qVFzx$YQ`)d-<kDN5*PwRssU!4TO6+-vxM+uPf~RWaH^w9I7J
z0vT~v-^erpE&2IbTfh0|U4x(ED+;fdCMOL>{5lrI(!ld~oqQPh3e82>fo6EB<7_WY
z%!1OM0wO`Rbviev;<!{vdfg`qV6s}Xyg&PNcpjIpj0XLaB7WZr+HY}N2kC`Z3nv!E
zDIiRAT{r(U1I;OB2$VCRw{XP!ZyzQyrW~<Dkgkl7c|yu=wwFPUT58vx`|s8?opcmm
zVKhVsl8)%UiREEep7fiL9+n~|MckBPyobs_iR&}I6E8%B%SoMMFDdb71ZCdRkyEJN
zmfz5@i3{dF=Z!u+j8gClx=E?a7ADp6H(4rphvD4QFVH&k`kf@AE3{91G{rDw>Ox6b
zwufSv>v}Q5wtRToZ|Yhu!>Q$ZvpDV2bY%P0J`iEymy4!Gg;MbjXog?*CFxwedpRFc
zhn{~dHvA;^9V6$4ZfMO6&@fGEM})^(Ip>FPQs1k6u&qy<H!llesU{b=`H05tvr%@#
z%KLXbIcdqPfV+7xSp{nJTOc6f@9v4fb!UUeH^{7T>4>5yrDe;XQt@9hWh96R5KlfU
zc0N8PTrc!}$jHi%k)3R^I>KnnHKs`e+X@+o*_43+{+qM#mKwx8mssyG-+Gq8=vY=}
zh2%6G=0gskN~M?eYkXH_ob(>!-_9R?7yGR0Dh@K_z=H}1LrSMhN~crj{}v)F<+khf
zn5k#Gx?X*c`b$f`?FSxu0|U~q`Ue=QG%G6$$dI8+paANNiHZ4dLYuxq3(~J9%58=H
zL<*nBT@11INyaY%g+f=?>G=WAxz0$bgAnp;JnyU^*^$F(R@!27OE0!YZ7BTq>?Cj-
zkX$-WWr=_sEkb?)^dP-ZxJkh>yIZPD(Dsh?)Lx(xkiZplw^w3rXih;>2;{oH-}aNU
z?^iQaU`SlKAmWjrUz#05Hi1RKU*AbXUXMaWtk2?mIbwy<^7L!}B=sRAFZ~&n<5N;!
ziWjgvxP!7dy93M2Yda2iuaA!+vKIT%yela9c107L?m45=(p4P~m+Ddgt=Xwtuy1;c
zVpu0AHH)fWCCZ3*cT2poLesbxp|OP;i`li1h`LWj4&h@00akD&clvn~mkM+l<Gq0a
zh&YGsSV-f2-h6eoMdZ`bLh8!M&~yW`pR}4`Ap<wJO!@kaKCG)5YrU_NH5RH)|GK{r
zs5D$#Yj^~+*2GHm6~rm0Cx21*Wf*B0XHS;1gHU2(@v@L*5U&J3FYp9_EfS?LAh&}i
zu^dE44*_q~>pqa_3a?~zYce)-5+macV@a6yx1iy(nysJ7NwBT9u`4M<IV7Kkw%Ub?
zUOM;a0DgdT;Ld6H-&<n{KIn4C``^0&I{hB2?F~=_><91rBpTxhKu<L7+#t~lY61-I
ze79Ih;tR-}D=TA$CU|UuBjn#dZ)gO#4Zb;Qf=aEP@L(khTRvGsLQ?!&u2c&L9wCBb
ztr38LyKynyJ27hyIIEBbJ5rIfa%h)x!zg?s&!=m<@!NCCkLPnf3!g<$&%O_dz}n`I
z%gf8Hr)0F=r>q^BJ6;5=-$HjSJvfanC;wx%6qw%i&?Q-|SN5(cwT2E(ah8^o7+YLd
zqNL?#Be)X||B+n{D{yK12J~Omis?D*O|GwCXQ%H`jFS3~_`iutIO`QlYJ+Tkrv0U{
zE$<y^UXL$#_)MJs#WyKF|Mc&FT7a#ibazo(Xwl~MH6F#-IqS?<(qV9Q)B`5S2Ur=S
z0olz82>&w`>G@u8e!N4g6ifn>G|?dz9!hQ-s}dgD3njL?r5@M_(0)224>xAA4Q0K9
z(HoFZw^9*T7nY`pqQ+{3qUYt6X+0QC?~jB~UBH~d;4o-zcCAeB6YJR565fGCWWP>2
zXKy#_UH`+V0k4pf=aY_wVX8wz`q9!ug~`Q4q8pd3n(W3tsNwR7!9Qt)fyQK&u@0U8
z{$29S#{N(kHl?aVL9uRd&-;a+9M>u|ecJK1-aoCD4~Fo&Bm7M9OUr>qBJ5(U%k5iJ
zq`lifB@WyI=2YSa1`dU`>@eOv=u*cC@%#k%0YTK@9teW-;J<P97-U|6ZToXsozc<6
zKjmd0QySbc=UW7*8%qu0U*LJw`B4?XwGfH^U_Ks0P66??V7U(Y?%aT!@S3ZZ@0BBR
zsnCuqtfDI<2&IKa=taNS@q@Sc%5wFqUDtc$h(P)ZUNjviD`FQyKHg~IyFSzL^7;ot
za`xl@Fbcl&8!FU5NCBk^<*_m=hN{Mvub|ll+@mmsWo5>=DfsoL_4cv3&vFO`PO*fc
z%$#yWSt4-En4x}G#8qIKDMId8Z;tG69~yTrnBN(ys?8IzHP1d|G#D{*AUeLUgRP>q
zUj-_brzWE{WBoE!u-3r}o4I*ia=dTI$VDA8yTC%3OC=Vr<-v9IdHk7sCo8Mat9}70
z({L8}z~3!?RdvaMl6uY~OPVB=Iq4KP(G*E-kD(}cUDT^jTzW#=KYvENvC>3R>PO>I
zs&fF?nD@(48AwcZvY*@ElDE?JUUlFmc`pj{tb*`YYt7G`w5!=fgtS)M-18hz$1lnC
zCcC4^y`?~elvONsqZv?zbM=)vIO?ann@<iVk4tNPl5+!opuq8=aU{}d*0B)K8NpUN
z4&MOWkTW1243v7Zc5TN0aU2ZF>vYg)S*@M3(-#&7v%{;uf0veGGVBr7=}+K$hl3oS
zwR@qm1L8M`1^0DnN(vsp-=QA-2HCh}jvXMO_W(?mfCCWl&DvU;nm8lPKimUVLTb$h
zzz~4roPmL%<|7CDY+pQ&+VJ7rYy$+K2gk?9{oBrz&KE(f&A(Y7pUYT)<(E{4LB~HY
zb!u5NCXD&FZMT<|_Zkm&=l4FXFcK-xemDS+H(DdNb0z2$Gr00mcs%{n&c1I#CW~#X
zl~7-{oXq%XdV9EfD^^1Ax;>zD2^Gp=R_IW<E}6Yx<m8Ygn1?&oPR_};6%yL7c=A1_
zuT+A73Ga68-DD$`2oy5wel{&(4JEsIBFwhF5R`5GH(7)&|3mnNjUd^phqX6kB2Raw
z=~R8z>5u0&5!$bWG9HRra`!3rK4C7*Ml)Mod^dos4hx%Sym|9NRA`NeUnn#oJv2Sp
ziYoV^9pteAp-F#00mvW1HK>snsOxG|FlHpRfBeJ>wwEu{tEu8^^3c3Vcg-}@`5h<T
zGQEL%^d=|CQqjB-g8TrBL3Sat1-=rXOE=C{kEzLF8T#NwFuDj4dr@l|T`jnxpydJL
zaJ=a~VlP2r2~TzAf@yEqd3;8sO1`$nf)~QImiHebZ_nOhQLCnCY)=&`PllZzfh#iG
zlmGV&T&HpA(;cProzt{qnrm<CM+{Sx{+-sC4R=A|kDJxIO=&1Fxbo&Gc<-G8Ry7K3
z?ey$HFgeaUKOw3_m649X%qrX3Z0bMnL&3E#QB%gC1psI^0FA|L_<;YNT{!!PR3A5f
z@>b;`(AfZYXK(tR|E&OhK1bGk>#19rhSKtSsN+-1HY&{AqO0$_lQ`A$U4<tYXXnaL
zHF=k+Wc5ccVL)+JQnq$<G-Gl*^0%$;aiUYf65BHP`De5L{;mO486y~_Gv(m_ZV%k7
zUQSv{_e_+Oh=yB^U_t%|(#_zdRN55?YDDr5{uvtu$Lh<@m+VhrqT$dUri*Ix#MXwB
z%Wb{E{Gt}^NCnc3uDs#UGs)P!mh(S4I{Oyhd5YKC0~F_jbN`Kc_+-<M&W)@3_(oe>
zd`j+0wthOGT^oUPuo@}B@)B8fzTX$3VN#y4Cbzw;GW5;=hUs$hR|PHf;OD;~QFVa&
zCdwXjCZ{<LRpEV`^jLa;DvA-yMlMNyGn@)X+sNwZ$BpxxoIs=@05F~f=qtKoy#2iV
znv7gf@c2=kzOKbx4scA)ykMZ^3qw#IdiJ_apsr%j+Jq-tfj;YyX()eK6&gh=(VbLE
zl6!sJ^=|q51YTDC190Deyu}OjU{!!lVj_auKL+Dm6zQ>#5A0q(KGh_6y=YSo@^ns`
zCdDTxyGvZNlhH$wD}G1%s&xvOE3UZnohJX_B2!+MwwcwPD&A0X4D|DZKbr>XxX~TW
zA<Ntgl@R;8&L0<O9-u!k<~P0{kvF+?%wjT-4l?MYGeAP*Qdd%EATm3b6GT?JD{$ip
zv|OLkQH>p-_}B*riLYDr-1B<<fuLZ>BP)?xJ&x4(;E3vj{6$_d21pn)uiBo1R?Hrn
z#Bx2nTW=o0UJ*x-+^2#FGOyA=u-Zk-rGB}#W+H>+cIx3Zv126(m*gl`67_)bR$>Kd
z%9wBosrNc#^yi4h#T?drr8m@QBqcR<MLJG?n^7%y)PGB8t9-`aK5j`WPLDa{5MWTp
z7~DF9yV5^(Bbe+5;Nh3_)O%uY`10Od&W{m|rOdp{EOlS>XFGkT06Gl`dCK~h&@b@P
z4JdEm5aksvrXF#O^=!{4leCB5?rvEP>DPS4zSZW4c_z%_Mh3IGpxIr@dlSq6buA+}
ztYKs7lSNb^)B8<hb8~z7W}mTM&`7Q%^bL%P-wt5JUWApk-VaCEVuqx32-7Q84t4Yr
z#`bFKvSGYpm+B;+9a*NYeuG-qvDc{3hGyU-h7@A?A##{Dk1p{cKIng2!QKZW!;8L}
zh~S;!+k~0QT@V1Gg>P(ZwTW=Zj&K_qGRELMMGzypb@6z-fu6%Mqun=Q>Srb}z1|z>
z5qM$H!4gl}V9GSG|HQPD1cYfwVBH3GO@L%+VUVBW<>sb4wHMT})vRroMVOg%-23T!
zy`1%s!}d1Q>iC&!+dRx_fdOHwEAR|xXHVUxBN^9<;K^Wbu^;pQgSZ#RjvZi)b)O^x
zOV%VbK_jx0So6g4L#<XX+(;S7#DXf4GjhP+9_MJHaJeWosjmgLnplgbVZ6-58-2M<
z*@mfFZeNl&C7(ih%<MWvv?+i7d#hTBUgM-&?4pI@<Wgjd7FkCpd&_>QQA-?8Zo!yq
zt<Kz<J}KeibP(guMI*ZuuhA>SG3vqJd_uZK$Z-nvggr{O>Vnbf0zQUje~CUBDw#8b
z5gLjYqGq}b4<C6#O8$yi;Q}JLf@jIHBg|6d#+bI9SU@bVRuWn)H*u=FcL5Oa%?w@;
zO;;|^^2=GJD&M-!lGD%#k+6RsSMj3)58_gP{<Na^2xc#<Bjlsu>Q0~+p!|#aY>e5u
zOOc!%PWG(Md6o(+xd?<OPCx4Shr27{bO%Ou1XP3lj30<t9o<rwbu|~(*%7&6@(Em!
z`MLR^liknIo#2zxh1*&?r{JmT>MogY^SfaTim{$#^oRjiP()xO+?3<;`zsh%9e`ym
zpX){_pPwBxV%Uz~lWx%?XlKVlK|ukVJR+@SHuc%4wWTGC2r&7ypj@AQ-XJzi-1f~T
z8a2!Fy}Tr?f{v?@=zjav*vHT9Kha&|a~xacXSp~@Uk1zX&R`L<u#ye*bX{Cz;)Sf%
zj+s3@Jr|^klcSzpiAa8R^JuxYxKMxOQ)jBY2ID_IN~=^Z(VwMgj_5ndvg$>6*ZQ_k
zN!P63?a*Xq^yo0ylsH$Q)t7M<y7P$lVBZwplssgrjCumIIzwguD7HLIL$D|_r6lbN
z=X(%di1EtUW~VG1&&XkLuafFV;r5P8vy$}EI%NXNpG;A)h>KJ(-3tn8AJ7$?2%`Q?
z3K&%DMyN>PBM0k84iHAIwz9G~8IV@1XD5kzucCW6Zrl(<K-?Z3KLd}^RqGPg-j@)4
zl%_5d=6W`RQ`{s9lW@q6AmU}zIW5CLG*@*AzTS>zM~)WQ3~J{T6cyvF&n17u1d*Nu
zcp>V}=OI)xODM0<^)#^Lot53;LPwXl=Gtv#SF0;tE=-{kfphR8FDPe7>gv+ys9f#+
z@!$xORb*-Rt$)f3SJ&L$e6}JMe0VsR#`r1tVA#bF_!qs9C#?%I?Lqsi8{57WLdAHa
z3U<Ex)m#jGT>p+$dS0aIWfuQF{H^=focaqi@Y5w@;V%cEsxNXt!Qm^UERrP@PykMV
z(-d@G$zLZYfoOv4W+8h__|3k@^T4ildIs3F(pq}sbtBE``6^P8O=TdWlL$fwXX=@L
z^OqJrCfSZl6PhdKX*}OKJ0e;4SL$)Vd^J&Hb_c93Ggq6IKhct#TT}scbRTq8e1!|I
z`_+6P8QnXRzk3<-+a>_Q4AkLUcUx`xr7CnVW{*>L%T@C4LqadIeF-7l=>s16&*gf&
z_j(<|Lu_KpvZ<CGt`Mtr;6-R<vYS1=iTiTzsiDeI_{FI=rPK*z7D5lG!Yiony~B^(
ziGQn$al*T$lnYrH^cpRl=*(!hnTdLR?uYAXC;pIQvLY7@4~u5JtSZEM`4ZdsGy6I%
zj{ymcEnZR+5*sbiOG!B*_g*X74SG>o;mx;XELBF4(<Qm0Cs;Dpw<^m7p@P`X&bJyG
zFc~4emgbt23*odvEF7=j(ZY)u)jX(J?SzJsJsj88?5iw{>=}-U$>a$Yw?96!P5xTK
zs`43V4i$p+Ldh9Z!ivf`w8|f?B!?vyF=jQx;l+$OUh{}Y8re-Y;m>gDPY2+Iknn~q
zFFk|P?R0B}2iW?_o)uf_B>d{;9?sAo+8Y_!=i@Rz={0_>Wvk;@HTLr}lM>dOj~k|D
z98}JBSNNsgzpRvpI)P@OLbl3cfwNGLhJhizkTG9Uoqr9OD2#D&)r97*MY+*?XLV&|
z*`Kyu$53>E_Y0-HhV_GvvlgVaPInKU#?|*iaWi(7PK9_gkyPO5Dm8(bi>C4kKs2f~
zmrQ9cpB(#6o4n5$5T^zDZ50&k>6B03UA^|^=El}(#-4W4Ls9S=xVzO_?!4s;Pg`1i
z^mrb+w|mg|A_zDyeHv~L+CJ2O1cpeHD=Qat-$(+1Foe6;GFu&)aOs<P{QL_NZOZcs
zCY&IXrt*amd9v(DulHnlN%gFO$69lawkXjZ);ifi?{5U0VI~bR9a|HE4z+!jD7Au?
zB(o7k*i#vnjG_><pC)a>0R%}oB-WIMBQcu3kvEiTxMo0a=9zW2)JU~#cLFp8-z!hd
z@fx`^`soqkym)H(XYw_*c#1{{6GQ?cWW@`K@Nl|SIc7{j!KU7O-ZP!$b>ExI;br}S
zdjmBj%2cCFtyJG^%`g4@-1^8;UoGlq<|W?Lmd2Kh;a79iHIsLVwA{XuNg6iYbQVL3
z$LuQPstxlJQZLO^MDa~&8JUrP?>xQl+%{$0R!DnA?&^Y2NO%G^$1RDx_#IEA+m&WA
zy0->YC<$l5h@yrtiTgtn(uKdm@P6$Rf<G$S%yioKnQ#U!M=tzuHiI{gc6<V2ldbFD
zyqa$tS8%v%3gDtkL%Ta!p>v+MyCWl)nnf(yTN}6g<g}OM{F{*r4C9tF_3n3aQvKW{
z2I_GxF2!kSQ<mvKuQE4Zlf2=12S6!wX6xxxw|Yia+!eWslC8_xF6Gc|ji&)d3>W>y
z4tuTyN=R|wlrb6O)A-GUl{5>`h$=81fu5ssa=Lza_%G5c^R>1eWhay$77i+SkWboK
zb8y!I=_;oQ8`isOi~-GLCI0zlf4wNq0Jh#Nt!0ftqrBX|{`Q<9Y=GgVMd04#sM7ff
z7(^*>ThoHM<bsJX7-LNC9NVjWcd*27dO1*!NW9FF(un;+_cP%Ul1x+I#A#?KRBzzy
zG>8e7@c#b3;rBNh=lB<@@*LqADzvO`Q7LHFumnnjy3&%h;W6cp5NdMC&2H(P10hw<
zz&%`^bo_HFy}e~aYkCQ{0c1sNf42LG*=B?y&>9k3Umep8Ey>M2Xn3LLU;OpFQfl(*
z`;W6i3z5#I_6<<Yyrx6xjtTT&ujbb)>1sbgQSr!f{{@@)_+1apLIRC)FOwX!afPG!
zJDu4=A#IV?m5?i6z09&4F~hZ&a}WsnE;()F`X35N$h)fr2Ykd_Bb*G!kObnMX(66)
z67hQ@mE6Wolyki$aQYWDGMb6=n6EEgZ^kInPC1OY<JT@a1V*h2T6(w*|F)o=NSE&~
z)b+u^Z~Bm;duj1UrPa76AjZ@3wYIh%V7%?i7(b1Vv%o;D7mheN+0ikd0x26n7k0Lj
zcm5pb7rxHSSf$~yncgKwk6gwHLgW%xWeuHCe*jMwKnRcRiSGfbIpdS39HSexWhOlq
z>f&ri?=Zk!5C=hp;S5F}WfJ|2*m+8hu%B)P5WMtcbnfo*{PesWzY7KfE|HeLApJXa
zZ*lQm@<z+nSqxUe;0zoJS?7YE8lI;3@26R9M!v(>r_eFwto~kD66JO*%0K(Uh{kx$
zMstih!<Q-Jy<=ihv*O;zL^2I^aio918)I}!o$J&nH_f@p`D*UJFY%T9Xx>=%aqecP
zDaHy|F4!WWDzOn^A;|2O?>>Q>#|dc7Lkpi(X-(JJbU>faJG*M`DOU73j++u<>QJqt
z8z{>NrOli$cGTmSmbG4Gh4E#ir!zB$gpvu(ugcpXSy|j6%AeAkvztZThXSX7*@TzU
zU@kQd=3(Rc_;(hWXY4z?|9xaSV*gsp^B4-Li}bA&OUTXQRWS;tA&}gvbTBdRcJ1Qm
z_egcMYg>XU4#SLOaad&Gq$3rVN_6Su+F#cD9AH};Gttm6WjOmg0QSkH{cQE{FtB{s
zL$IZi|EJTexrK!uN=(cGlHGG>Ir~3YLCM;-FUYf<C7|oOEFE$GaYBR(kN9Sc%kgyt
zta#xsS))zMDPx)O?4+%EaKZhf?@f7$;@m~1-oYQwf(QCJ*F_FTrbUHOoB=~CuZolj
zc&(>aK7{?GaX43<n-V>w`~5UM{^hC6&`!P({5rA(&rLr*Wf6Q$<p9vcgjIr1_c$0(
zz%Z3d^qZ}B<62w=(dzAOQ8&Hj=3;E-2+$?4fxyVLMe6_Iq?XE$6d_x;iSldrZ+r;P
z;tc!XGKIbzLbdwCt{eF^GquK~Co`WfVfNQS|Enm6svAsh_p>(l(-z#GL57Dmd_v&8
zQ1tFjqH4d{=282gS*%3i=Kd@l#P<qAd-~9G9n5)-2g7%U`Kx{L6#R*$^GPWMmzaB?
zSn5#Y@?+}IOKOPjp*IQ21``1aSoIJ5j>vxHSPAs6&S~-GAUOpEVEtR#UIZr=fWk*s
zk{F)}lZ-P<q}fz#R+Cj|KM!dadz5;uN3teqJd|Lhy5H+}PQ!=1-<$p_PnJ3%v1R1z
z+~UZ>@6D!F%~w#yYC?^3%rgwW^d&+H$`oacX&M~&b^RmNEB)F!X`q`=O**{@=z)NF
zoSS$@YrJL%tmY6U;1t|;Zwfft{k=*sit5)4KH0u#@Vj~B5~O%MD<kSanT_i#qv%T?
zA9C8*y0@<{^1q-)?p`;A9Blym(Pncs?Y_^XsO4oJGX7gXOJwjT&%vJm-8`K^$thz;
zoVE))lZ?@nU%UCWaqo)h+fCMGiYxn9=Xv&LXGv*d9pD3C;F)hQ1b8U$TT)3c${AG8
z&rVywV(C<=<903hH}Cu~FKuuo9yq8X8F-8_J{h*tmnV=&F4d85D;IIH1~T8fl7}_b
zI(dtdkF!;x`Bt;jOYwI`!Cf^%1kzW>xp#YvR!?E-YALwrdJvZT1$U}yL(Vw9+Dgf!
ztERjff-HIaj1?NCMeFVT#oW1!jJJeSl8=9WNQ5jjT_x6RVWpjPEZW26L2Q`4M)}i0
zVLeIjr0wU9;lTXaGbK9bgi5_9lbQt^T@;i}hon*(atW5JMV+*ddg|cJ64hi^5}O=Z
zITJz~AuRUGA#knnuBGuEaMhO{=W!QXPubp%kh!4NXyo8dTTMFVI)=W7Lv-ok#Um4r
z4u7+#y1Xem2@1v(E@yf4jq+^HW<KmtCfwjm!QluiTl-3Hl)k~$Ua~PPxx|as%P>g~
z?Hu9-Nsm}gNcluE3m@H*s{)sPMd?TysYXOXUFu->_kYk3;1~lR_=<lU`1l(dZr`YA
z`LN`9=RY`89<b1WZ?%em97F8#9nEuX4$cOGDRm+UF?gXlR_~-Jvu*kHmeA<G{LTtM
zUEfNx)m0TknO!~n_it4MvDMbre-UEvjWFqwYY8=F&Oy5~|1>LE5s=^i;Aw3V`Q$E-
zZ7zqM_aPJ#1jGS{b2}^kh&=5n(xkn3WEb#HHsM#>9q0eC=nnY(I+{vLJ9NLxO}~|!
zoBqsbHKYJW-HC*e+i{;R+mb_k1@o7xKalDfnTC}O&{*0rN0~qI@jhkc8cv1DPIL7&
zlQWK(5ocTFN4l!h4oRBb>#8oZw=ctLd{+iSf%ytVN7As$6;*B>JO66o1DBWT1RU0K
znq?hM504jK49@Z#dGC?aC}((k5R>&lLaFhfcZ+#HXXqOQ?Dn5l-S>>Dn)oPANDUbu
z)iQ*O%>7s2G+mdpVn^`V!5NrSw-iT4ez(_a0s<Aua%#0^^E3jgeAvZ<310Zz<hO@X
zY|_<x1<BU2``OHm+h+P|yWGJ}+Gi+<m249hr9D+@@Ry-SzBzq4{Y3`xlDhX2Eeut^
zAFA?4SBPbD%`{uIS09B?;7UIXK=51PHUbp)PQ~Mrt_q(Yk%%NOsu0rN-_!kb*SldI
zRDHhY=H>wxn;(%p?;LXf@!Ha(X{h`+{DadR@}uZ$*%4Tu{a25fiynoIN#Oi)&4{?N
zAWe~3!-rm+H>8eRCmQt9TAF8XX_WU2^UM)PEYkD%k;^mmjc%lMLG)6VH8unIRDpkd
zKXCtDKUnUkAA-H$>YY(@_hV5N<n1|fh|evQ1b2}`W3}Zq4r)HGqR%m3q3??|4(MrF
zAKo&jAq%nRIed1cou`bX4|__fp~-cUd9T!|ePpoJS-Z!);cK*SS=<#0zIQv+Ig2Zf
zY7l8+YZh4|QyGy0F?<~;X=b66@k76l=Z=+ZPo{Fd#s6?xaA~etsQcC-7O?*yhFHsT
zd|S!`^=+u$c8{i)RzHlo1yGK5np1Gh7dIt&>x-0i>DV|!*u)t?lOp;$va4(Sn1QF`
zv@5UuY<F*G+&UOq-2OPlFh(D4D?dE7L&}QsMK-nMnpZsz9!MjtxFgb>FvF)P>L8yY
z-h846U??@`GpDz-Ht>*)xz_${taVNM89_pyHemmt&~$n<tS>c^2v$R83v^v$Nd0xY
zE9~wgod<vaGFw6Lm0L%Z7OA$mY5#4pKwu!4m(SDcMeiuY)PeVD_Goc@o}zc)`QaeZ
zFXzpN2dAK-LbmEnAGcra<?D5AGe@H|<h1#jq3JvM^-cyUmcN2ee)nwwU{}1-iEo<W
z3*u^VtP5L}%3K0j)Cf_}Y30CmdZ1q9vC8wWLpJ7>U2+q~l{+hUEQq8Y7vtddk&CYO
z6va1x-AWMaeq>@qD8$oHYutntI`jS6UYy=*3zg8@lw>YjI|l3h_ve}%nay8FJ1ssz
zh~ved5rRQMA4Na49}WJ|?v97-_pmwOQ*F%%USwgw7@_Y$eZl9(6M>tv1mo*P;34}0
z&)bm{o27}Ul+sT!45zjpAverqZ7Qt{Y;1b<DKtG4%2Ylue^=5^h8{~(^b{!#Hd^3-
z)}<~bZ8rJJbNK(dFLj)z(Yc_i2-1G$sb6>Bc}u?9I!r@#oO_X%KH^Ee9hMQsn03#A
zm*&$wi3n$n)AZu5?d`ek!=<V7jZuKJ+FR`EE8gFt?~<lFo$wjrb($sE8dZ_JjHd7!
zO}S!U%Q6XHQE=F>rK%E5j)Rwy%qbU*1Y=S#J$&w|0aMjyr_mFe_HUnGXpwFtOF6XF
z%(eLI(`W0=gnneb<Y2_k=2dqIlA$`%RDb6hJ>`MFzdU!*sD*jQ(OP--->$B%-=2U~
zI8V&hshT2PU?e!nj0^sxXmf)uXcz17DAg0%fx80wiY$A6-qaC`?HUU{_%pvmVY<Ua
zp7l|z<D|wJBRs6TayJxauap}Y{X>pUs^wX^tXsATGT_#vp;{)UBFC(v2ye);*S6vF
zdKBTzYv1NUg~9Pr756l?me;eZx~`UG@TttOy!Q!=D)XO~Wj+<ewC|m8JA%9OXK;;J
zor%F(C?;&8;4t|z)9Ixb_o_t(YesgO#X&uCrKDtHrc7T4!#?FaVNCeRDzR@+f^XV4
zz#`;&{rH8*B*>%Jw?AWTsD7zu4Y8`aLL}E8-V~SL<Wzx10QLNYEj{0Aj)QB5wgSoI
zkHxK*XB{152#r-ERr<pcA#%=}yj1k4m&*B#vQeR-B{#=JksB%ld_V`_#?=cv>7HEl
z43Uxd^E;oFTtK35C0X~JObpnZjBPMzr0tcyYX|gk*oW{kc57-r^3Gdi%-AOdWSPh2
zQ-%g!vxbmAv`R=C&DPnx7yI-+?_PE2Zq+z96sEs`M*Mi+0ezq8P>aWDUEyQ-OQ)d^
zo2f?^wzajdWWPDsUL<1z1}O0H`~^NzBqX^uP<U|de_8;5&#jt56TYv28oR4&`>;#?
zSdC49vJ9<FY(O{ojK;$p1-oCreyFqzMF`Yufi&_abE~tl{kfXqB{>wf-MOvIv*lK>
z7{Y$*VVnPB{8YnjNJ*h-)fCv9@_khpZ9mJ=%tE7}Btw;jL-fua!hZ1%Ea$=2Ml&|x
z@T8FBF?9p>h*9st8f0BEkGMDEHMi}{)vH|)9o?0yD7Nh}PQi*s<>vq14yEo4F}@m>
zo_Nuln(3Xf_LrdwyyC`dy0k+PA>71FW<~@w0y^bo5CWyZQ~>09l)e`3?b9VeA$Si|
zb!vap*-g)hbHdI_3+0qM0Zl0Rej@h@7Sl9F9;(-k1oavvB=p-&YDOqyL}wIl2ouel
z#BUv_@>dO}n&-uVhr!<~+TU68+CiRub!K5DUxvaY9Fho*QgxkInVI`4c^Jl}?=D+{
z>&v&YeIWN*?@EMQy8CU)*qO4)IO%-pH)@VKVlIXzPUVhnF3O(5Y<6PLx%{1O2N_a-
zyoj;1|7-y9=n{SWl=(}I$fh0C<!6O)Oj%~Nyx8Gt>q0}&ExE;!p-$<2L=WT`KmHxn
zu;tIRWyR*~){ob32zueaFFiUHzoi6Ng*cM8zr3H{D)NtQhQ|os_O@%Iso2m77(j^(
z2IMFO?tOlI2qNlFLzNWnYLD*@j&^tkF8G`>C;^?~A5e^8N=0+;7l9xIvJic@#Q4XI
z<I;zd%PZwAETC`ph5l=Gs@F+b^ly_xZ?wRAsi^}OCTGy7Z9C&6kAF1(f)WtOfHw1}
zn}xoCZPK?K18GVh8fjjOac`*WVHboI{1y*qohm$d#=!*YIKY)4_T^``wYTSLgIXjK
z$get1jyukGPnE6-|9d~K#2d_iR&mrGFY)po)=k(%7(Z$3ylO^0?e)zkb0ex@Y^Aed
zXmYlX4jz$QtMjRHuqG9cyBeZ4b2}juU!<+{$l#tdQib1|-g%6kdokd4n||$a$q#30
zWCy?Tg30cWSAWlgrwUz$7UoiG>=_TZ|It}Hezn2%gk1M-x>_9B$1utRWah`)j2>5B
z$8)(4-6dupE3OXp*BkD5u~}os>`XD$f`i^|<~p_+CJvg@EB&Yu)#%%86&c`9syE!a
z8*%QlkkQ~A_KfH4)pTjMew#VN8|Fs^YYk^vhi9p$wF|;=SuUB;6|;te?A9ZtORR6H
zUk-8<B>x4jwX?B4*1Uzbaud$t-^F=B+!5~#`h1m<1h2q=0EP9SaJozU0KkEi={@*!
z@S}N}xDRAq!MaTJABTX>O@V7cNeOHx&hk1=H^jA@2A9NRyT<g5oq&`fi<l7^;@ZTc
z+%A=~u|W*CaC2rITWPHLx`!yXvD0!?@>FEq{#7|6B%$3`ip$!+e3pG}%L`p@ePbVU
zc<|@Zpy5M`&TM9~6yrfd#%j_XnVd8=1&n|IxA&X6S?U1a^Ru~~ol&LJWlFPRN>J=o
z0kL#;(fIFO?>kM)!}3FZxq-$@n73OmC}s!jmhT*Q50RSjhN@V*`jnq}Z|el@sI58p
zSzg_fiubCpQ%9PVPLWQ$5h;RjR{>T7`Y#He^vO(EsKJE_G6BeLliU-%Z3R1|G=;vz
z2dJ~|uj7qhA{SbCT!VQ2j4>c%&x;jzg5P-0w_~X<wdLqBMBCaIkV{D<X-MI-$N&8C
z3^@Ot<#N8e(Q$qpe7uvl5WKgyyDJ)haqa%Yrs&H2p10AJCf7qdzZXgi2<l<79!S6k
zS9bsXJ@jwF8p=pWl-{-w`zEZ@LCMAZCqob8WW??^i@+b-S=&MMzRWfl=+f~u&V)FJ
zj*l2L?q~1Yt01|&g96HD9QnK3uO7Fns#>8WHnLNU)jaQT8)HJiBN}|NrxbK{2p$EZ
z(;RT7G*r%t#}-Zyz?M3f-g@e~Lt--+a-Hq|Q%53-0FcvbE_XpG`0(U#aa)3@U_k__
zB;8Po$gb@_;2Oj@E_i7b)U#v3ihA2uK)`CAu;y|3wm%_f&!Kqy0TQ5kro7tU&`R_k
z0As@I`&AWSV~U9HdSpT&rNY%)J@~Eseq)qMTi0&Dp!eW4izzmUhqm|9eRAFC>cML)
ze2bQuDzRUY`T@>BfHik;ktxm38K%0x(DlJND_(OYq9XX@kL5bmqd<9J(j#O(pGEze
zr)Ez;;*)X7NA5vRc;@^*7r*t!61lpz@+)#-P_ObCn?6919l2eL9w4k4V)SApVwd>B
zpA1lGd`L1I!}0CEdAD^%P`Sao?rP!4ZQjg`T8ppTHr&>lnwkh-3115rg?~vtUH^`s
zN6h~E8{8q4!Ov^RR7#HI^A(_g$tT6=$EnHz0HIRg4xq}e{6{_Mi_eR&+!auwZ*{^5
zuLLL#?>xuX84v8`+ipUSkcNbfzs*Bc#<!hFk`_~>=VRT^O$gvkY21C^{B?)laIKO*
z64EF&s7dxQ;fVppX|Tpzw6?67X&i(&`A~DmUv&wHK3~~wJ||%G?bJK-hv`;_JaSZE
zI<}OO6dmj;KO8cRZ<!4sdKpIlD}Wis#r@UuTW-n!c%hhAh%ffhf%lLUfPz4Q>x|U0
zb>aYA$$6t3NDX)~mxYD73M~L_!a=tEfj#xTtk#_Q|C#}yemUQ9Isdjl*ART>@zgwZ
zWy%5w<rMBfN$oXdYtqV7u77XsyiX>lRaJ@|?;gUlEd&kL1RNcFfglZxul8<BTCCN-
zn#L!enzrMT&={N7U}V}(Fm6tk+fJ9Kxrh3eN~dWZZKgR?VaIgS8=-r%aA?Z!%KZ*h
zMEm2~ofT$P?8i$!KV#oG&5l&L^!-k7pGgf5QTbswJGNhRMb6WVSnyEwm&e6e7+Ot#
z!k!IXSl{fFHTVe9Syt2^wAd2rRJszh$;;c9pr>A7jB@JX<6*>x-rcDJrj_ficW&_~
zk-Znz|FtQs;{1ia-;(ET0izz4iK0(*4hV3)6qe`pLm<l8YZoiI$Zljd-K%&><mH1u
z(nBl%?5^g2ZAIP9w}+J|2vSfCI62sR9DLvcTBxPR7Qr6SB2n=y%W`A(oKb(oqJREI
z;sE0Ll<8=jD8qx&Y)`*08x!?A?*4%<PQA=lZFBd(6uyiu?KF<Y`b*<NV3xF?On-lD
z%L!>3k?MB4($^)e)#sLpUXybj3A{~jw%OvWY$vYY&6uBAC+O4qMOgX1*y3sov5nJ%
znyY#G;%iFnPd&;XHMR5$G90N{-#0Kx(<hmDydGct)%7_6bV&B}e7);^#i6DBpbQ7L
z1)Z(=;j|S1L7p8S-|0A=?KqtZKI4G3ogY}5G*q=8t!^(?Ps(cbSp=V+fY*FMGN=JP
z{aZZEI+pVAr|}(U7Wg{wy#Pd>HBjIx6+7bg9dcXByP-J?sz^Q?!L>-HH=R$R5olu{
zOm1L+U_KY~Tj392V4p*5tSoO4ijmI^e_BSWah{zioG5I>372rcwx)kj!26U}mhDTK
zP>EwiZu%X1)z^MTsWp`Zn{Na#nUmv6=cM3&^Dv23q?fg&m4K7sWYD7yRe>m9Sb`=v
z%+@Dc@lrmbv__80j!t#k6wQP|3Je|M_?g#7l!fvIdF|f5QCa@6K5ba<Wm0I!LdHgZ
zeZg59f8(`8c)FaVn*gjA%OxRLmGb7vaAqdcm4x&wZ<u5Z_^A<y0-b*9Uu(>YyGeZ5
zC`SW`)YS9YE$Aild0hcJ7@59G$Xm*1w3=L2D8M%!_Y45`k<&<qEu}!<3|Vr!)68(K
z-VUc>^mgbGf%m#bRK4J>OZ8+k%1*RYPH#4hr*`h-O|76w^_4N$k|!86rrf~bR)K~l
zm7oyj8^QKlJsl&+l}|-Kbi(7+HHkYb0nN@Px_b{9JVwF<@?mITuf!R+ElgL=f)w(u
zxuAvc%lk<~O0Cd*i!$W;UtLg9A6@vluFaFD5X)d|URd{z#|lin#cYj^EhmH``)*8M
zf`YBpHToo-Lx%Cim6a9Gb_K5ZGIl*j9N!Nx>oHzianC6#-P}|0Y(8lffnQ(!AQIE^
z_zu<h{^|Cg4_(~Yp>@|1iW`c|yT+Z@`*9CwKN>xg5R~%RogDgQxV&%X(`1eeQ=Lwo
zd{{-=qbZZ<<>F@|G8S8E^1akRy`jdyVRRF#exfG7-JS83q#99-aIQtoyU;Scp@9Hn
zsgV<|`Nn14DX+p*LlX_Rwh{2g&+3Ku`Zk%j7Hl<(t}N$xfGtX|Q`X&3yA1m(Go~N@
zZKAbl+So?S&tQ8(D~C><Y8;o<Q$ZwU7^})tNw$W`{8{epQbkz$yNpaeW=>0tVV3yC
z*I&e4m!T}o@a88EAC_AkXA{oVII1#@9syx8+XdOK7KWmvt?$A^y2cW`J7+BEpP?|<
z^`B#Or_(x1o=}FaE?+K&roku{$}(6HUW1LvNzDNFK!Ep=v^a&NwamD;f8f$HyC3X{
zBvUopoX2@a?_^6}7QJz+l<#RB%z6BXRDX856}(^J+raSGd&M_Ed73VuO%7h@J4fpH
zXLyyV&BysT?T+k{Cs&o-)`cvwv8#QzzO&t^6nAf&9$bf78^r_@(gtl`ywH*e+SzDG
zBYpRp6ZfpDs(PIq#t7clxE?mP+4>F74KJ@JD~E^QHq6O7tF}SuytI7)hGe$}-4(c6
zgZ~*%(Dea!N6Y5~)tc8&j&3dxv)kD{M!LkYA6rF6ig&yxx*ncvEbt^}Orjkz=)uDi
z^=^qUuUwGi;Kl3j{~||BVOP~mR>o_uC_|!p|2#lyWS%fQs)*G85)vX<JZ_S<16m09
zSn~*NeZ`>hQCF9=l~1!d%BWd1<6A%*<0rY-@$vV0egz%Ekju(}xLJi86f%!4er{u-
z=gZc<(GWC>xJbV$xMr35^_t=I{b#HFJdunpov|9_yt#?b+o31vc7jY>fzDENuW-*b
zD3u}I>;9Oj=HJaJUcy7mJ7_ky@wFBwD`g%XW(pYm%33ZRw!|@vmhu^85hSGhxiTN^
zDbxeY`giQ^>%O2XMGjYvCE^iJ_4RRC)Y2DlUkfzK1*4xmL&xxDI8eB8u-@a9(xv{m
zb;WME$e@5t>REo-K<LY<?`2olpQ?`_3j4W6h_#uB<L|@;$XIk^&2Po~+wYnNi#A=c
z92+=xqKN!)1?f)5*yilt*UrcFyG08UpJ(m66dOAnij*IFNX{7!EG~kTgvUspQpalF
zNI6J|n%Wzb?1PH!^hD(>$u-ZqFYJS5uwXu@`pyrP&WU+vyTw7!AP^1JwHSgF{JFH}
zI+&rLnN)n$@BLTDJ%N8MC{^e0-SPoWc9l={zgrUnu84e9fo23>U54eCO&YtW0nHLg
zVU&7$f6n=`;|m(==<2N&V&8q8sj;u_AQ6fO3bATa`!3~?*3!Op2|}CIznb8Jp`xN9
z?lkcnHK&XZlEmZSg@d#3m9y94E#13S!KdZ&EejF?_SYi%CBoacC@$(6r4~-E)<%07
z-M#;w)B=6~`AqqwRvRAC>HL0^Ej4eQDnf&+#z;mlUl|)sRfJokOZBdzNU@s<%h$7*
z=&`j+MN8{duMR182w>n6VGfz!At0M-v*ja1fs+!F6$-x@Qfo&2?G_qh#+PkH-8HQQ
z{I+-Rf<l!cJ`%KNU2bd5tky_rIDP_OVLNLGFZ?WsS7xb=$RAs4Hq-1b$dDG7&{KX0
zPuIX`89d!*BcC*UI7cur-g%iHO+WsT)?5716^P`HXSzFxJ4SNXZ#;{es#bLDFt5rb
zy18ryew#E_yTUY&I4N6uo-R+mEdT91)gsq7>&G#hXL0M?Zljh#{L-ex@xkuF;!>oS
z89=ukFN$kMeue<3$bt{DwGxARNB9f)_1p}RU>edS<AL+a1g#Jy1Ws%xK|06D?(+0Z
zegzA!z=h+W_K{k>2a%T4mO4&<+x&x1eVpTX4(Ty1gGm|8))-uJ97Xx>)*<|JtxOFT
zC%aT~ei$R3&<vgHEZn-oahst_*@{#HTNK|79n<Gbh*D;wQ;vhYx{r-vwu*j(z|PcH
z+E5SS4ak=nwbP_nFiHOnIc*EtNkONF9K|e5Z)(Yp+bvSrn7H6i2$T36DipT6A(c@x
zlTwH0A_YY7b*^lfXD|xMsxoA@)-uoYvbI8jW9*}yxR}kiobjQ6?F5fGV+;vRaPoNf
z*(n1LZ0DNyK8|4%uxk2htB1|S`^+imR?kos-lx=9=L)}lpN>&eh@7jY!`fdtZ-zc=
zrM=it{*_J}tE>rJS*f%EMpRo*Px-qU&Y(;PRbF^g&x)MVqtusz?ok;gOU=LxHNuL$
z3@b5qGRS(48<{P_Hj(lNd5z1{25l%{WXjs5q~`A{P%F#~ieIn_db$qk=E0ipWKYEC
zO)v&mndH}g&5rIDTcA3&_nwYMZU=92e_rib%yHOg(SJ90cIy<d0ao0bt_Gk=MJ?fl
z5sU!=iB|ejF4TxH(%#ygsPW&+)}Ba(yiw$GkkyEo+0<Tu;_>NkPOnq(Zbo-OJ<SJZ
z{}%gGlf3@e87^;?gDl+42uriuQd)c>_<FPn9LJiMnSMozX{Scy3>{g?zwig=g~$@Z
zhB}nm=Gwm*So|DwDEM=0Q0%%=591eyKmgKV{P?`xR4?s`W!7WT@zUa-t>D9kw6w>%
z4zS|!tIPqXyTj6P!0A#5W_iYCb^nA}VE!3vYvig=QZwFP?R(4F&6=(<P+D>I!lt`7
zNsw)>{#IYBJZ@fkMYF}D?BnM3Ib$h)RdN~n&Bu^^?mll5iboI!V-q+mS7H(Kxm<|n
z6vCJv3YRK%#C!_L|5|n+OV8)39mwQ_L<On3(@GRUt=toMi%-jW`oOVuI=;Ov7uS_w
z{YSn9|FwR&DPmUAg;eA8P+0BZ8^e#u%F5t6JDI>^N+tQEsPg+8gEjEGX18D8rI^H5
z45AxwsVFR5lI0Ncbx3rlHN|n2Ycm3CHqw6GDwb<{m@^?Ege!9Qj=f7oaPfGDgn|j?
zcw(?cBro^4todC{fV~XkJNfpe`2mnAvm~EQy0E+#a7lvkJr<&i`Yo>Yqbz3DlQ@_*
z3hC7()vsi?MsFT-4+Z!K<<U0HkrvL+_LCFKHG@u1I3ch5tetR!-;NtBq3GDzdOx4K
z7QVEf9LJ}3{o{#dx0xO!iTcde5R92Vq|(?0>1A?omxZcq)?`RK*{ptu1~;w-#%_T6
z>lJ2h`X$TErwtje+QgKT37bX_=#htuUmYoGNdZRn_zIGOh1k?!jVPiRU5~2>nejqU
zrlQ-A)>tG`olMfgsmY!jt%Bu>Tw&j}ci2CRi%%XJ=;nF646XA<SkyaN3k1hIPsZOq
z=p#<c(^5vffaV}V4Gm5c#mAx61wXX;yZbd;nyAUh-JfzikcxcALw-?)W4BL!u9$#+
zsOnlAYFKZeX5eMg0Pgv=p^p#>X4eEpnA>ZK9$;@r^YBYJI@$G-wM@i;D+HHxoFi!c
z;~s`ELN6tB)=fATA-oaxG(+9agqLCDj&`aGVBpHDvq2$Fe>0!d>L9Da9WhUvW_yVY
z@|GZorf4wyP-&v=0N?Ob9H+DPv;k+L8&u7<E%1R}n(f9$5H)hSt8<|XfsofSs>jJa
zk)-XaWc<<Q;DDQKj@03yzi6@R$|8DnV=cM*+SloG)bHbUW3H3|&A}SkB=8X#>e@Nu
zqMxC34UQ|X_I=z+LW4J<{PxVy5Z8URZg37G?zSZ}r=N!WS?D!ce#4^-`LUl>E^&Hm
z0r%_V%i(z$KDCCd@r&y{q*WO%)Bbf?dPa$}tqhf<n(kBo{oOjJS@)bsH|Yi~m}Irr
zY=wi-Lo8Q*{OgFClo=ri^AGo&s9zQ^pIFuC>WMM~$UW3uC$TahXQ;0TNvLrm3926d
z%}~1AVKMSpU)V%91wg>_L7L6cT2~)v<KGefc?LYGdaQpPsqF5Fm*JCH?F^wzkh|%~
z8(pWTm9x(I{i)2;q<SZlasSI=61PR8By0sPi<k(1h05_p8KdAmzgjO-YVb|tuDZME
zUy!<7U;FZ9hE$0$^_vW@eKy`OUMs#{8zi6Ix)q1sf)}Dkxtm6l%5i|~3wl|!h)asE
zOyibGIo&21Ls3XKGU7+||Iu_7eoa2!-yYqt0aB8q{QxpbN^&%kqLR`n-6<f-P^6r|
z01-)v(G5dlgfKuv1~N)oQY0mx`}@3Jzx@T<?mG85?{i&g$&?BwS2Js3g@oqUywa8H
z(Gp~o@QT^y!hXbAyUn8AVrOrFv4DknFjkA?C9*0>hMHMyxXaCG<M4M>3SU@_);)Ds
zuTcl@RuqTg>QV*l?&cLAF>ix4r0Ih4EG4Ry@%x)Re@@iTTe)F0WXCHv3w(3;eVe_v
z&AV=zf9Nw4Q-qeb=H0dZVjksWSb^SFO#BisCO@8a7@k+!_iM>~Co+8}qI&s-ylV|v
z-lx5b(Hb9UfN94<RPxy#1Gv{#C_tw-tycFxbY51aY@6@1r!~6H70mn;Re|Udt6DaV
z<yywL3Te`SvE&QJ4YtN6tE~^P4S~cw!00u1s(+lhL2@T2Fw5+bh3x!ghVY5wuK-Nm
zSXsBaS05DBcR1Mr95cTDRx$Mc`6PiLPn-BV7BoA193WaEFOGvyXuKxslb7{CAjso%
zAy)t{QwhIi?&X&8pXi<J$WYxw{nrS*_oRz|yTKT04ouVCmvxVU!{E0zzb5E}FpYzY
zkW$87J)tEsAB!9EYQbaY(S1SkekounH-_8?U&WsmqbNU->&Dp|i-N!&c;yB+*5bWa
zjqu?eOaiJ&s09D8*@IIPWT6hsGM(ny)+?yhnljfSZ1E^3KlAsqaI0GktY&|TjEbRf
zYFKD-lQw-eto4O~C}`=$<OR#9t(>$*NXF{e-7i#!`<HP918+1t-_F#<ebC{ny|enR
z>F$MwpFUK#t{7Upw=Wj_ZJ)kbNG6Ka6-TpcFuih|JaFi;dmjDo_-lR$ubuNL&4PF=
z&~FS~JYX)eo($jL%0*``r>I<)W-Ek#SbW`8-bvQwEBPg6pOhrAob&4MyZ^u_s%CQF
zY1s&aymuiYU1$q4%Wk|SL;B9jSx#Mm{$W=C9P@u#FCLAMyU%4Kl76S46rS@Z*w^w<
z{JHJ&aK4KUV#|gj#qmjI28YMQn0fEoba0M5!rzLy{GE7nF#RRO_D%`C=0*{3mOo%_
zy8Igt#CXD@{G{4>>MxWJL%^{kqL8bo$CLP-YdSdPkYS!9b-GuuJotW24{cWP@k1>r
z<ICB`?Eoe%HPc(cp{mm)5j@4vLJO@U?SJ$Yquv*e$!MQY+#HivFOarKtCup@hqW?g
z>Us-_mw`p#r>kb~+cQh|EOtpHTE&UrjP<RLTYPT)!~-*NfCVw(RScG2uO4s9tVgL?
z@Kal85cp9<Az#Q{9a9MF_mgD!gfyK6cFsY;eP&!pfQ`L|gE!$_Y>RiNiT0jpw@HU}
zlC=<O5A23^2OTO^(vJA@oq|+6{x})K@2k&WG+ykU6BdSkn$ki4TC;|<2!*Z)?rTK{
zOnQ>dh&LmYWs>f*{!Aq|W?#u|yxYI&Edam`mS!PsWM%tl?}spTM;5{lvVZ!EEq*`9
ze7L(Y5_6a<S%CVy_3bp{dwVsZeSmH6*%Qdm=4LU2#kJ}Y(E2K$&<SDuu`*L)x2L}D
zcC+Gxctq4uH>Z{NgDpF760w?Y-AMWNyhg;lKAFif$hGVcmCX>4M?b0J{=3clrPamn
zL7tEK`PT<mr`%_2Y+<4VAa2!O9T^^u+Ne}|e|})=TQ}J!dA5<^IBc5&V>BZ<bPjpS
z2;zMWD`qQ9|7k>y;H&-YZ5=$;9B67F>VxRH_c-Uak_!)U$54-fq^X_<kHwyFJv&Ih
ze28x&<+B)2h4kL6)ZB#bb<Bj88z^XNkWR*eQKfUiqGU2M9xmeB?dU)+bb00@EsF`z
zS8#tZ5^7(_>lvAue^JCMYeBNg)}zWtVh*lFH_mb}mPsgv-?UdxheMi>7Y=N>PbjHk
zaUs^?P-=x<alKg`!!C{}2$Sh+SlJu{KtBh917na6rC+JYQ}*P=>crmMHHSD1;8(kx
zqeH`I^APfP2{5JoxyumQ1{X_ZtYV3K^V6YgqEpPr5ZJ4wm_yg~=Iz&KXJ?f5)@bga
z4`x4divVJ<<@CRZ<1=0!g@yh?VCYFdxq5rx{(6*0ueUa%le1%}z(L?@m-O?*`Ta@W
zTWxk@hf&8#Bl{?}P<Qlpr15lhiM+6@^>p*CmdF}wZ?sg#ZPq_@8=b=c<?8)6+C*v(
zCe8%_sxJQ(aAbE#To7QgQ0-o;?Val8lA}HlD1Y|5C)w2WbQa)DW9vPRIOZRJ=p`x&
z_`<Edw(GMw*d!raKJFWHE%kdm=hx36aZ3wK&_Z8<=evd8<NdtM>D!&S!>w0lr@_l+
z*ozla^WCu6U$&67KvR%fA0AuYR`JRm&a6<HO{`-sNwyBelZFx$OlTqOReDa0bhK1o
zac$Dp|K<L8P$F8F(_HGRZK$?odI&F|*1zzg=6l%<bIW=F^QR<20UZLbO-ACR91%ZS
z1=^L^CgdETvCgW04?X;=9g8JO?x{tQsgVFr!3r3*`;(se)NDoWrr*+|+?o+Ekc)KC
z8Wgx<J%tQ$#U5`74ulahl~mO&?q<EYu~nt9xRo9-b{&{k)8L&On9=!=rp0gs&#`Cl
zG>y&IDckHnppywINLocI5BC!$B2zspCS}@aQd*k24)#uK4^ert%WoT>zVAj*#~Agv
zw9FjkjMB_5BET(*la#czNMct?d)tjXJ{|X-(T7}<ch>Ih(iN6}_8dc%eR|dp_AGyp
zBU@?RZ*8K3h<i)L4mybw<)r<;EWpfi8gXs~%M8e#&<w<+%*L=j$_zmGdQ0+1bRgJT
zCq0jm5&uY?V3t#HeYT?d<?6)vY1bu(lMr#D@OpTD>F@cD(2916ThFq}1Q+J}E`gCu
zld31FJ8$iq+W>kIRGX;}zlg;e!kfKqr=iQ!^S;583ywdwq9?r(8ZaTA)JVQW1b5b)
zr<avNLY`E^#Y|yEWAh>>jQkpyjJ+obq!oS1SGH9Bo-z(>=s7>!?hRa{jupwp2@gzv
z!27)yrpTPIc8So8cfU20DZ!{bn;f%2QT9(n3CxhT*Ke#U-S+O-<2*PSt|W;Am^9(9
zsnTz$oj&3)5HIZ2WoE~M`276Jym>yHCs{XdjV;G4DbQ{nznU!QjNECj-j5JsELU;t
z%IX>GKAMR4eON~Nc4f1r#JX3(Z_7sR3r{rT&YlutGv1TL#M|1^;WW_EwYua?aw+7_
z{_nlhj2V*J^DYM1IkGpAXTkQgZ;9R;PU^bQUC=waf4Ad0%_peWs&d1+o$-6w2GsG6
zS!J^;`RCdyub<S!5#OR|iRfCq4|gU%oPNPyg~{=Ee;D|@b*f4fH&iciulH5C6@Z~z
z&#%gl+^`n{RZx~AWJ!)29V}!g*;=b;$mkQIv&=tAWHFsPzjr6d0d7UZ>FqYW)wYmX
z&2**b1JO(~)C}L(M+EQdPjKcuoutlO7Jfxm+}&F@zl_S?0*<rpi3iJ}_Kcb`lJs+-
zwurh+shT(CAhyAowWt@8%9rHuMkG4Zle{D4i-kvq`AMH6;k8$*R?hA!comqe@@QhQ
zY5XOzr4NQ}TC}WyJE!+ZCvLkLFJv#W{*&&4aJKvT^Mm5|yRKM6fd^QRVT+uK=6Qdy
z1i%Bx#uR9X&5tW{_xgDmB3^=gWR{#b=#-pJT<)1Zds1i<8c(SeWRV<S4%4~?>rn|+
zIE~X-q!TRxQfmIRuqtZ>AZFY0t|Fp3{YP`+akEebj=6}xWa5H!kxhlG`9tqs_2h)s
z?U=w2TkgTHJaxu8(S4z|tY*bv%J_>)qJleT<DF<HN?b~Aq~@~qgpSadN@#uD+;DOA
z_C&JCN%ZuZIvgyrQRP`81Jziao@PC?%pGd3Hge#DgZvDt0|NIfvr6zBh)e$;j|~26
zV);24k&{C+W%{7!gvc1()Hr*hqF3oLuU}4R_daaTwCZ<$M^4V!S6v}Y4}-odpTZ9}
zCsC5Qp03kl<7TV9{K@#q=qm~e(XVBGU+}$bv~dNQG?~Gt@WJeZBoJ?}2MUb+;dagF
z;u+(~UsB^E%|xIQ-olY~1Qo;=t?vcSM$xKUh)U@YgGdf8iS|L7v{#aFY7mH;PsoTW
z+esI;!E8<<;#H1*iR^GlR$!{HD_hn;d@cV+c$7=+=e%qsh?P0wf9d`Tss>LdS?IJf
zH%#EfQbTnHK*_EJ53JH3br)ndWj3RIqO~c%`P>%($vcrhXL4BLiue8AD4G+ms}4<}
zx%*qO%xACNC{^cZoT|=1!LQ=ZVbt$)iB{qBdR`EjnVd;?f@x6(-qXyQHVI&!Bj;sC
z+8zF67qFQv>l#k}lJ^btdT$PjRq>k+R^r&+r3lRWUfK>2tS!EAAxZw!r@6P(Ni~4w
zOQPJIfDNPQW9kIoOt({&Z};4ie}a+keX4jjd~t_W=r)GBW)_VhQKG=C22K5iLB;be
z!Osf;z^{V7cE+j0lUij>U$PxGzt1Jewg`>17dE&Vz#1gnT<LMpdN1-(T=M*$t~EbE
z(epXc%};kNrDBQ|{VW%Jm>$ydIUp12iGb)8Gn2{k3#x_e+!}r)Yh@J4s@C-EKg4je
zPX?5)m8X&;8^y4QDvYlhd5^L}CqHR<9h-R2>I0k(2|^F78V>*c1$G%n!VmgH`m38l
zFk>q+<y-Y=N=X<*x@6`!TAxZ^z57QAb5Ra7EvIqT=Dnd|>@YL#nJs?gAERba8WlU4
zed-sI&lONlLqpMGEG!3=p=~r=Q5ZY-usDeWOaYhTFHSRG@BUs~o&XM{PA+WHHNRzH
z0$RGcUc3=sn+sLpxyO3mV&yfD4;HsB*Lp}t_rqHvoz|kCgt=3Ht}I7IOHw*3h+L!e
z3Q8RZ(W8T}w&V7WYc;{Tx<iIQq;aeAt%Bl*jM#a_1@GHAp0pDTR;T-%Wd~<xY)%5}
zKf<}WZ}UQ4a)Qg7+i}1O1kVuxi0egRZ1CPB!d-8`K!aA}k6VkeCBWqf@G1|1<}Pk^
zc}Ha~O_w8(^)JDL{+G|&A{vAgGFA;u?n(!yBH+Zfqdw^<%U@l)w@=S*p1X3t8r^eb
zjZN;Gr?;4=kPQ`}&}c?JBub(TReGp;MX!`h$UJ7ep#l{q(8Go0sapC3gKZxN@}`#{
zKcmd`e_e!_rH|RcvI07~P?qTX1^eCv4V&*5tv1zh56Kp2tD|whyr1MnMa`|qu@(6e
z41yEXMfsi}SW+hCDz+OSk`1-)Nxic4Ri8g54XNI!D{GL0NSL-TEs8F9F)?WD9yyD@
ze8SSBQ+xzh(Kg#&wWf6?p}CESNHKN`an@iJnUG1b2^AA$g@i{b8;a*Y-|PoC1B_nm
zDaDy0h(c9bv3Z7B`=D1?0mg;_k4!qZcukqPSnTBWvdplerg;&?*U37U0^@6Q<Tv>0
zl3qq`;!9@r%iv;6hlg*Rjm*6)UJ}W&CGrz)=khv?9Xe!JvqQ^<SUy{+OaO@_X~?6q
z&)Y1Ufr2FNxnm%V+Dp_EL8q_BdpTJ`6E-Qc?(Rp{_(WFHfigS6BX`*2rsi->1dvwI
z;Px+yB0*AiX@}dU8N8-{g1ssw3*IhR$x54>TX=r}JqRX*hMt<me_UD`jrj4dr#LA`
z92z^;zEt4O$29^~c~Rj*7%&u$;<)dorb1}uTiy+!8G9hM_wJqKU<CZ1{en@5(U=}7
z_^S5s&2Tf)5RN%@YS-(bQ+AEumd?1iTG+b2USmN_ckL5Sh80d1n!S~TDb$$=&4arE
zrnfgjleO4YejJpJH;8tlC4VFh%6^(i@+7Zf&wh0gH>#~Ots{L8!ncaFodTy@f<gA+
zjFo2_%oHHW*RzOEM~4Se$0Gz_8+jFJDeuBg2%F;p{ZYLhyaDDsutr0LCM&?RvbGC+
z=ordqlndW2qe!ngpQ4disibS+1!<Z@7_2|zjQ|l;Fu>1T3H8b^$G+_X_FDR|^gd@e
zt@36}f{30r4<h@CV}E>P<vcoZ_%S@->)(@*6|8f?f;CNUlig`F0XS5N@es(_w~5=l
z)bg;GFX#23Nt%?9bic17mx!Vj*t!%2{2hOM?$`~#hMLaj$oF|)I^PSd9Y=KK=c+zU
zcvel>D8WiB_i||KK#zfq==&eT@C^~-l|CB@R*iVgX)IJq=7|AP`VH2a%HVH3(#5vW
za2NCT(?u7b8IE@R&i!kJxxy6MDvd@ENE-9y`2*423l`S~v}~sHpx<#-aEtewJ|&-C
zHWHgJQKH+P74Swe14FS<u^GFA2ctW?yKgPIQ&WMd*v-h7OB&FR_Nn%@Jg<4&vt&7K
zk~FJR??`dMe(9u52_Oce^^)_kW1f5|V5BA5XimO{?S-oz$!xq2d-lV!aj;qWP58&c
zJR%US{SYosKZW&2<f8QhADmdmzg8rOx8^5~*pW{olN8kK9qsPi3yuF&en&d^wojVA
zdaue+lW*TqK!*x<DrOq_U9fE7;%cQ25-)n|z0uA`d6Pok)Yq>_2(-&YsD`3X@VQoc
zPv)&hjv6dbVr<-s^zLf0#m8s00vVDDaa_s&IWpXP$kN7J!kD}^LFlR~kz>tCFb9D}
z*`pUkDvEZ47caW@n=JMf&v}tchQ~1Q*8)C=ysQI{Y|D&<?>Az;;4~XlnrMHlNIRlh
z^XXkZORg+Ye^<>Vq>EKNnc6VlNQ4Ri7UY-Lbj_6iCD8hlO)=u$J$Oa1FGe-r*qkgD
zv1wUTneKI)pA($KCR&Cxqb_6jiYB!1ZezA+K=AMFc5v*~Ho!*56|8({Qk2$F{D8np
zv!>TP{et=OB@v%IwBjN0-y2;}oB#R1$E(XC4T0!3yQI%No_Y|f&q5oVk`dWDF&8Hf
z1}S^{{F!_lZr{Gm-~6p>AH<#T{V-?#^nS@h{c72MeL6fJr0!4G{qc_F;t}|ri4DDS
zE*<Yn-^+{7CF6Iqg$_MFzuaN{E%{2-xTWDJ`;E2iE13EZE%>?wG~BXa%Kk2}H8MJX
zw}o&O^IVymVxDLI3IOcF98v_bm(~>EVSG9T?k4g=Km6duG1W7_MKq!8SO&m&Qt3&f
z?SJqPFG(Q`_hV&wYZ934;D8vyj?|0QfA&I)QwEwo+Dv|y&A&J?xG-xi>e(lrV(<+8
zb<=a!mgG~T!>pAzCUpXB$@73x1Lx=p^(Ttx)KD&FgIN`<WKzUFG%FNLmuAg_y=r1;
zkc&+sqIGva!!m;Ge0(v3zx%UB#G9kBlFf4VvyHT_^Cyp$>+z90ngRg>dDPMrdo8I8
zK)es&kZC7uyVy<}0LHuaVn!|90x{9A?`trjY6Vzf@pT!mWL9=xK;G3j@T9|kzTXvL
zy~lZnT<4x)og+1)fn-P+(ky^7O4BkPbd`<Bw%lpiT!V7((yQywwXj6-gMgcmo2-jD
zp#<?K3dr$-t>*{bp-+?S7oXz7Fm|Kb?k<ReriG4vS~)qps{F79hcNc3Z}L$Gp7SgD
zN;<oyeL9-A249aqrJkGszOVu6*S9Yb4}ZmS2OS~fAD(#)b6DTAQGPi7DgJ47Lt#p#
zsEW3{jrLP>ulrxyv$kasOb4FJv2RwEoH+&`(*taqd_#zdxOR;w$3*+|qubuUce!5H
zD7e`rd6;DtA($W<&-ff*z}t&m<n~skdB)5i*Y&Q--UEkMTe@4XE2?KtA8%s@Lqg>r
zefr?|{6)29Vn9Al8^l|Te8U9hg-RL>dst?f>DPLL>r&}I>D{vA@236sFwt}0Dl(K<
zLwhys1D`fVwPog4di&wO`KYUNS?<NFn45oxk)kErGpBSQq=Jggn1Kzvj@i=-ji*cl
z7AcBpLFneXDc!!eFI$V5Ygi}`Gn}9t86#)33LE1|BsE#bT^~O<C!dY8$b4@04+c-P
zSF6S>>`oS_##pn73|a@B*78laQw$g+o<tPRIf2wJ^O1}S^jr!XEiEk#M)WRz`)?5!
z?s{g}HjZq<T~b{Or@=8V`;`6l`z&sWh7`O08Hq$o4Svs(4<hcb)To4aMp53qDuC(q
z&pe<5^$^&aTB<R~TSO5ieH1BtYMXm~7;o#aN_q=oFzT(D{!d5`@`)5H1)HV<l^2Jr
zJUK5%Y<tT>AN6L;b9pFJh0+`BB|F1B4>#jnSj5J^+u^Mf4BKa9B6-us%qOK7JT-+k
z6aC#c-x#rzYK3^K$Ff|6<|cfgQKOhxl!ks0LzC!^k>0CW*wLfguJ#&O(#>_s>N|$a
zPc#TEMUkq(S9R8|;A&l~X&2kOZL4{IBP@Me2xhJ!g&nE*#$8R!X&ijo#kAX^>~o&r
z?{9-E6SHb?5{VMAk=K+!TF5|8C2M~#24gqfr2KSz<B-b!lPAL>o%0s@OTMv^AL3I4
z#s(q!+CrK{mN?I$<=4&qpoo1YVl~k(oL=MQPMw{#H*8L%+3Yl@V!NJbgyg_o-g|rF
zpZSeYGhcrtk2h3%nLzAnrmIP4eOhum5@!@cjGkoxT;eP<v$3l)3w;laUG+Aw;XOav
z<LPUdkc>kbTm!qE7y+tVy3dAMs{nOd5*5a-#*78xgQjv~`+%KhNK9zhdZWrsOCepE
zXz8U~IK6#K$MeUQgH$(e;=gt!s&b8cI$WS{7D?ZTDpE`n+g`A@|NI04K?R6eT-i#S
z<TPyX^27h>FC(8EAA})>)&hPZ+f#T>Q+<2$q$L%47cR0+Ps1QYncNj5R0->Wd`xpE
zpPl$`h32<Wgl-663r%>W>tn3k@>Gzx2A=?7sD-A6qXd~I<?Szg?hIQj`bI2}PeA$u
zAkNK<%%3e@?>`47`g!CIlkOmG9tXACT`Pt=K5ztlkmbXNqa?Tdg8=`607u78F;+c~
z>|l#v$tj;A<l6Q{i;FFP$Gx>3=_Cx#Gy8iDl&B=mscirKNG|TT9UqF4!_r-BeWtDL
zSmZV42eUP<!+>`5!eW<=L>4DG!Kw8&pVkO1MKxQKV;W!4Z1QkO7aMK-&?*(`!8fTG
z25AZkcifM(^33E8R)%?3vF&&F_xE~?bwvTJ+Rf$oP2L~lu{vYoTkcH*U)oevGlnF&
zFw^ZV_~CkxVrwNmh2*!v@zjNm6g&ObG8Q_wopyrvF@SzT16I`$Ia2`aoN^k~uKozo
z-enz;s1;FF%wf_|IM-D9>6yVexWP%y^lGrS=3&z(%?C;HS$TpJ6CDw)-Pv*M4{BUY
zr2S~D6-ju79LeF!ey5w(^RZyiWX8+z%_St|pM;-|huEYl^Afd>k@kvMcmJAoBoUw9
z`QMY52w;Ep@E=k@!HvQYH|Uo+6ql4i$z51^mPq+v40t#PCL5+ak`@|(jb=anbk8|6
zFHk~+nEulDX8g<O-(*;)Hjy8GZN1vZGhyO(yHdi+SN}I-_@DFXX-R$jf_oGi8bNww
z{7ktZ$NaW0@r=$(BzbxPW83XVa!m8MDI#FYm;+4)qk4x}&4^c#ayjuym&-BFKuTWn
zWvl|n#GqAq!lBZ|bE#U<`niBU6w7?q=4&H^Dm)^BZ9ISau_E_gj}^Y?HEJ@&U5B62
zkGs)@O7tW=9O}69OXSr`*L;h3tJc!>{}R+Zsw;y+>GJD^I<qIX*@K%+7A$*BKEaD8
znA4cHYJ`b(G{%meoLqIErzqI5b>2s`48PsA+k{u)fS|XbVs$7>k?**oXSur8`V<+Y
z8%^w~2e=qjR<%pf*x#%@iD0C8m9oBqp1$kJY%^YIDM*1NzD<rvSPv)g>$?GGrUW`z
zImbBA4LYnBKn|DnZqh=6p~PWu1H+=sL8k2P%g)^ul8@0I-4y<GNHc^9W0nm<FHzgJ
zuUC%|QW6!W{<)m}pxCeluR;DYc11Gq%}11oM*Xx6;~P+GO8JWbnhT!SNyK~*$2$t~
zwPKwAC6T_I0P$sS#`Kzp(V9(Fg=$gU<58UJwZ3GH<^Hl|_wmRk$PzDjhqI{%Bt}x2
zv|R`au0*=mTwO;=*e5tE4yuceWCfALR%1@9@y+NpT<=d?y6~?f^_>b4KTp(jPNNy_
zCOyA-dQ+L&0~g(Ju|<4tIk=7yES$Jt%L$}6_^e<_X20J1OW?;Vc0R>_3aKi$gdG&N
z1CLJsi(vOJY^vapnO5VC*mn(lo1d`_3Rvz@;bu^Dc05LqpJfEhpQc(pzr1YQ54L^8
z#edDjyP&E<FQNYUHmKH{FgX4(5?#8ru1F4RnLY8=#M*Gi!%KAXdLDfoFUxu9?zMPY
z`<0GPZTre>UF=Sm?!#jh>HdFF(@x3L+gb^n(5s?+3Q$ARDECxCQ>1jPK!yQ5S-gNp
zqCY99pa>=FRfW_N)38Rx@yX<&gYBVEO-U{_WCH`&$5?2pZ@R+A0aP6WJFHk7MwOiS
z94{u!2?Bc~_~M6XU1({O>4%j-V%r%3Kn)y;9?8D`&+oO-y9DGi?;T1>wlMEV#8~j>
zc31}IeJjbJ4WfHjX+5JF6+%!ALqD4Y(_+p@@30?DASan1bpZ<lt@!1K`VuZ}HbCqm
zczs=nsxxdeOeH^fF)M>pgbgU2@lB}`VxT>ULG&G;Aq5zSv<@}%uJ~`0^4@9c?nb)=
z_H1zbUzjpjusVII3LAU&1z2b1UfhUiE6z(yxfqWe-toC*lCgmV+y5{^l(Ibd@q-1t
zytyT$Hx~0-Y@`VBR+v%CRt6O&|DZqQKJ06E+;aT<$8n~0_QWaAAf>tpm3O2nd#8W{
zCHW8d=LyEBBm=OMn;=tQ=bIC!F*gT&IQ?P7XH6ZR;6<l*2_0^F;gKIc@y=ct`b>So
z90!`0Z*9&mZ@6!IxCzU#+m`<7oJk442Z6k08oEDEqOy;355qke+$_qn8SdFeAR48M
zVk}u4_RwSc3@|@=Qn8T$?cB<(Z*g=NpP^=%^>+AzAtqBBpNal8<d@Fpu!iQTurq(=
z-nho`JNvCCgKSXeb%NKM`#k)6k{8s55;3~WD;3QW26w0+Js|cZcTAPreN~!id8NXg
z)UT?zUw~hJUU+V6uW3re=dh=oMZ4$s9z-HFqyRxKSM$w(lbnb*L(^Q}|2B<*L<8=P
zcM>9L@;Kxcgwfte4u>-;3Emc0oYLKwf=e)Rm&rXC&Z*4ZJ{%0Roxc0j2Lk|m316n8
zLn*q$tt!h;6e=$PVqDT@NC$+8_w^9rg5ci7uwq<alC93ZrJIDP-sTX8f`xJf|Kr3q
zGDW>M$IolV#B|LwO(jog#NLBR^%zgoxvjiKqz?AcFZUe&1H7MuY%ALr7eFBiz##a6
zEo;^9Isiqk%UgYgxPeFYIr&s6e)k~i^6=wxF&EK&c6P#MYU+hoq_~ToSWWvh=KX1I
zaS*`$w4+MOj@VXMvk8cL<rJqex9Tv?dT~ep5fEW{wIgxnF!ACa<S5`eEs!+A%mHkg
zKsPfQv5h&N-J0u;uJwDy&1Gf18#{7PZiJn|VK?adl;2JxHq#Cu5E4-)LA?wpZSdc)
z|LL%<xOLU@M1>{8<G)5>F-ZcD_&yK5uA$=J-8O_Ki=05C*Yy5+lYhR>zZ58o;<f-k
z;F>rN0qok&Z#O~a(&w@)iXR<B6}WzX#hm_<(3QR(>h7kZ#XTd9eX}Hkj!V4F4<qgc
zdAU2j@Un1zmsr;1EMd6nyn<Y<ICd=o$5s*(uM4i3MfmEjsuiW;Z-cWkJbe+&95S&d
zQ5fJRGq7>>J|O(&?+LI`UgC4S5@Q_B7wf=M@ZV14?fdPb+GbPJCyev~b5-vwUck2;
za$dn(2;R1tBlS3If6A{lw0-0MiS2!rmqJ;R4rIruZoE$R4nJ{nGYah7$$tE%wxgdB
zHo0*KFuf11E<*E)tU8|08Av?(zIh&Te?D5T9FLyLuWxMs(mW0Pu2ziQ_{G&!h*V99
zSjkS!?s3=;j6_=jVW#qQY#sVHN;#=j>}8VD5k68^FO?8LD+{7*5{8j=H|$2nva7$&
zX~z8Vvg{MMG6t_zMQ&hp1fbNVn*6nJ;JD4|ggN~5DPkaTT8=Vw*`bV(_sLO{zXd4*
ztaBQ}UP)2+cDd$IFGZI(CCikbwO-I(DX={>oy-?@y~G^`O9vJ!lqxGZ$;UgKwwv?I
z(#;hgyKadw3bS%~L!kIa#=NW$Ivj|F(J^IDE%9W++RH!d&xG_ql!GM=XcG_<tB}9>
zb8~TXmHRUK(@zsR+na@x1w}PnR(pGU?k9edI7V6>uj3|6K6=lT%bQTNrvw4(oE)}G
zWU((vuEAr~k{#DYZ#m1|vmm=C1A;#e!!%!9K_U+D5!+Y53CVr(mmH*U7lUt|(;ov0
z{<Q$njDRuICLOoV{foiV{qbq1cGVWeRD#-WTEMgX=+s$5`0QpxcKXLnucJ5^LnA+#
z>`pDQ&)a-7&&k4pqhka<lA&Yx8v_#*GSpaDu(1MMbfJE>nSzMmlv3My=7)(Pe%t7`
z6Kv_-`#d~Lcx&OtPfkD1udnwi_Rd2(;=L-TY*Btk3xxc7kR#81juDt5wAN43vdCGv
zT7@FP{&gFnc|UbJ(0yOAx!F1l1{pxDQyNIreLgE#*V+YEKI1-MCxoy)8GMDcLNwRH
ze1dujGuG3e>dH%HnXerO_zMwOhE(4PD|AzeO8m&$y59G-0Mux6MY&W)ZYtghdQ5ZE
z;L*(_h|{y;cEa70DPnMqRys#S&dh0?@`PGhW+7=_#VL(H_VQ_J9^5_%Q}IOiX+H_Z
zoN(A2sL6~**PEE-JZuw@fe+W$Qu6*|?o8`Wmhv|lTxsCTkYot;%g9R@;v9;jtoCZJ
z3bzF)00L_+mUpvm!}hIxF{#x<_nBq(@(p0pu8`1V{!9~--i`00D8UT@y_3i0IU96P
zMm>o)pX15aB53T+ep}hQYRZ-g=ozBP+Ac-ZNh0XnedMm9e?&j$LvireQ$nTGiX(V`
zmA53vh;me1TybxUVFhE@wusdB?`v=r<=9TkKD!Gx4UWoRUs2DY6V-g!`D<HUMrq25
z!S}eSI1lHYOuuO##}FHtM?(@~pm(-AI{)B(Z31W(mrw$bP`>>vn9ejX%1TJM=vq|W
ztJy8lteO5#=iJuj1wu57BVv%<GBV2QjI4VgQbF{B@0<pC(W-S|B2v)NpZ5ow=vcGf
z$1Xn{Aa5bY@u-^IN&AX48tN>AMT+OLLpGG(2^$Akbk-koFt`s6IqRCdyn1(a1bf%_
zPJ~fMZ%koBQ=KuaSfI(H0S?cAi>2{>0}rA|KvJ*r12<cr&rKZ#w25^VBXRd5zMT#8
z!$+L3I*d&}&6vu!0AF`Z#(0qfiwrNBTxcz+eL_Cdldntosh(_9dLfH2)<CbMIM2Y6
zC0#57&ItXf)UK|d6exF$e?@=n;HK&5`YR*BknK8)WtQ@rga3^{dYXFPsGZCr=5)F_
zE^_SOby&7XrFd*r(ntrE=cgAJ#XlMksUh6xlx<Tk6G(r#z(?Mlw(8wn*WALw!rT>r
zx>o(4{NP0S`M;5;przvo;7yf{kUx16h8>X#bSg4?ds#KTy*3CUhZL0(gIr&8|9wLA
z+g(~8Y0-w1EPk0;`hQsf?WDe7i6F!Ws=Y^E;w4qvj^zGbM;;Ju_zx?bsx2IM1bz}R
z?=*J@{v*O*FK)$nNH|=%ane@qTxZJZYNF~~BroPw`=H9#FnImPV>D0D<hAJ0S|?SJ
zX=?5tP5~&CCY{SeH9<!F4;LtCv!DlFg5*apO-C&|M;ofOHt|}0C>m+yTdAPkdXFL_
zy|tR}Vj17VLy8IWCu*QDWcwH;*S$pW3jAaCT0k#cuF!<fJ_RuGAp7U6_I1Uu^ePWU
zi?aqRAK%+1s{Gus4H1u4j$#(L7YZGZrKd#o{q4n*8K#Q_QqNgDL8OTawFjNt*;@kJ
z9TryLmEHl}ZwEaQ^u5r>ATFnxrc)Ke3%1A_j)k5-+YhfVk>jaDxF-DU?53^oqZAzH
z<R{%);#06;6UlDpdzZzJn0so@%bm>XELb+4{<T<~ffdx7i0%31*#W=?<WY^u{z)L9
zkuHm;1w>NPkeu+eI7j0FKwzQGmJBockkv7mo=nlPl<<bQySR@YIxKMRTt@{m<r@sS
ze{Sa=3NrIncVl?NBu#UJj9xUplx$xNwvC&Z-|q4%mW~5T_I4Tr<n!ntS-KpVD2}d=
z-rSsj*rg3N8HsYpA@Rm3XKf+EcVO!%%A4cqq`f@heN*$W>^*QgY8nG2Uha_y;TLe#
z6Mfmzj_SBWoEDy)`s35mK<v;Qj=eh(IK@u9-|)TV+M!gGi8%Og_#>s8%9pc^r~ZNi
zDYw>#&g)=Myvnz#uzm!kBEtb<GP6_6g-^&_Q^WjrY0}GHR62?t2@^~rT&y<g5<5QR
zSCcXUFZXWhMIG4xlY%jp>TXJ#_}!;VxG%!o&!uQ@<U;Fxzkqn+({Y_arrB#ww`_z>
zW+h20m<ZnA>P^^g`cSt2v+XCWv3qEXf4QKI``1hzp=CGN&|`EI(dRTBbFn+#dqk6%
zSM!ci-J-wrj`+gp%F4e%p65pkiwiyg5|ZK}*v2zd_&m7ygQ`h_mf74#H^|>86(@nf
z*^-ans=2BKH^>Sr;B033Oqz<R|48h4p(?*W)Da)0{UA;M1Cag?26@Ieq<ub}Z6n;D
zbPMY-V$)4eJw2nb>>D~wzZH)*`9+kkgE%C{p1R7}$2vOZKbQ|1e%pHs^4rE@<7Wg*
zqZ=LLji1WbqI@&y+`n%$nd6*^-n9;N?=Mj?lBhXPG*4)xBM?#Y2gc-2_C+|Es}CjL
z8{>NpcH@(7S*0C{pt#afTEFd3mVL*HB`H8M`f&Lpl9oT|W9SXE1oR3!qZDhwjKf4K
zkVD#a^&hYp*am(3M{t4$bx-%ViBXS%-`PrSy?!L~I)<`yIKUGFbZWsHhRpuPLpb@W
z(D`OJ->Y^TP(f4kG{@8Qcb#9psJ2Y2oVSZ@x5r$Z16rq;$_p{|D>f>|iRS%=VKZ;c
z;QLkyV6iZ-JxvzR<XFY*#}F5e4o+r4dpM@&u~E&tt-}H($N(%iK=Ilsnx4Sz{C~eK
zl)7Z9y;{L|p=#8moAWW=&AmsZ|KUm;$p^w;fvaxV{E24v8_Eq7<CHDV30#Lv)>Q|q
zwu?$0f>&}aMGVIG?x~n%Qw}PIVe%urK6bniQ4>h2IKjI?p)gQ!-k3EsMin}s$8*EU
zWP9(iz{fy->Lm^cYSL7Vs~=bovX}z9eTOTHC_qWPBg}q>n~tw-n=129JY*dhkgqhC
zQa%me#~d3~Ou#RFaXoBW*poLkej0lRMuB531V9m&JdqmmqNsGY=%e}KVSZwtnJ}1%
z)OkJF*4(IVwSBslTAtd;GnKWHVSOg}z|(Aup4+w7m8G<gYo~MEqk<+)1MNh=$uiIl
z>ITh5?(?_HY?CX#io8v(m#OgNBae)pdMSROYd-}bYxuOZOz3D(38|%SFR1qbAg^fO
zrnlEoD*oJTPNJ0+<eK7{PGkSJr)#+7DJFI!ETkP4PNO~R3bno}Tq;Qhog##lssQxM
zvkAfUT#xNu#-ga#XX?<vafRpqPPqG03nE4gb9Z5Jw5Z#lBbByR8TP1#_pc{O8EiGG
z7!?AjFJq%tsvA7OI8hhn^*FaW3iB@B4M>b!9>_fW-he!z_^`GtocnnD_!VVS6Vm*f
zxu+LwDh)`eJD|AumEfe^83w?3KGsCFEmFb-`VzJiBHhq+GpwV;fDH7J*|tNe4Eaaq
z^{;Nkqn?LHVcoJ{pd`Wc57w_%xM}Sy-d0;AR+q<WvN>Xn-rT>MJKY2sOWYe0;~5Lk
zwCMX!#<S2Lu@B*MY+FZ@vAuZliGRp!<F_2cu)v<m`DS#6;EG$l-`D=Rh<)^lKzP3U
zp3kdT-aiptpy&SN{0)*NQ9|;6oZDV#eQzYNp~DMu5FAyV6Tu1C!VZ)YbmQzOYeaC3
z3}S&fzGLTT(X^0_(zWs)KSwx8)c^vtg_ib~i5^=s`74}a2mVuqLWu|&;1=uJ2e7TG
z^i{qm!LPFeG66e9Wi#HIBo?p?lKG2C-1|5b2jS-<BPJD&lv~<2%M9B50-=3Dj~@%q
zs?d%;3-|x*xpaTydIvK#OJD59I7#9m(@@a4(vvD$vU6dlACibygrc`2wx~#A-=1%&
znTyS$TPrOdz=`e7&yW9u`VhQq?{4tF4o)-Uhmy*~ZXDj~_>Y`ekCB-1ow(dUSXVwK
zSfG8r+7Op<<R>7%9cBLCNG}`&Pg;;@Y3RNXOMQK~Kz~kX<12Fh)+eUQVM=>;g@|!1
zHT&DPM`XY0cW8pK^PQePbaCBwnQy_g<eN#!LLG&7x#$dc&G1-8)(;6zwVrIHSU1E>
zZqO=oz7z?ZG_Q+P@4MczY7+Iv10|k%QPB@7u8K0m_Ltc)gXETv^wXZX4~Hwp@G_E*
zkrh0;2zdnK?UYzcC<Uo$`}!zGyxmN752Tuy(t*D!&XXR7uzuZsuaBBnfI*VJnUJVv
zw9WDkJR*2S9*b)*6<3nS)xPaAe%m6H?pMpY{D-jP#Or9835;QYPk~rI5-F*2y`g&J
zK~a>0s$-^X$Hny|+#dR0S(pAk0qEq7yH&o0OnfTF9gWlq54SlKHAiG<5Zl~Jmwx{N
zVU}Sc`O!puXTjaGutTYqj%J~=Be6z>Q@*%^;%+D>3%8%MV%{iiR8A9T;pWfW505u3
z&HH1NjE@!~E5+r=-`M;WZ*~!o#i<&x&9-p*GnBVqtQ;WRPwk@x^(Jcj|BX^yXu#u7
zpI`T`uyST9#5~FTDV(%YW#lG@OQP+MOeor$nNx>9k(Zkh^*$zXW^^4>ezkkS-NMNQ
zRdF0fuDpKZs6HAr7N^|ZCNDZBCD06h$$G1>{Fvn{y`0kXd-oR#Q2rUjX$Y^%JqfXG
zm$#ny`6AK#Ut&x|&)GbZXBJ>py)SGFoH#HqP)jwM-Yh|wJy-npLWH@6Pyn?aTdZE~
z(n~=I1>JWAI;?w0x~qvZqq?IXwD4g-MjqBc^zU1@nyDAXKBmc9OiW7Qm?{Mqu1TZP
z-sIM#ZIzSN@+#Gl=0gcGs2@XUY1pz;GItj@fu;h5%H8<$7$_u`V}%RnHzEUSKMNkE
z$@bGI(Z{?+o<HG4H%Wh!%YG_6f4N!ex)1i)suS;fzdiSM!uf+Qv9WKZLerqr{J41N
z9??aOkd<3#R?1U!^Vd+mX9Vt&#|2gCB&_5RP@2|~UpS3)7>M%7rG8)@YAB1mfW6YX
zDJiCi<!v9h7eE0AqeRmWj{bB<F6oBX8)xtOSG9HwP_fPEUA{etbZjyF<LYqW;rh`$
zWt0Szdf`<1==IRACK8V0^`M{l7x_ks+~;CwNL-j_snZ=6VOO~OK%et+(4YD7XoB_g
z<py^^4a&>Q5y4Cb@}nd<^BX0Jo#-f+7-5_j$nz0OeDLd^Ym#nIke{)FsbW{HfTIw_
zr~<u=P7o<nVAbXkm^}{4kqm2O7fQz#$;t|501AYX7Q3ex&rV6E5JG99t1kSXYxu~F
zXkfXXoZ}8D3xofIQWxe|p)vX6u?`^rBW{OabW_@vAa-_k<zS|TE(z~aj_I-^bnUx{
zs?mblkh=SPg_N6nXcDJ(0dIbrJH}dzJkKxd#0(I+#0j*tyUP3zWgqGa8{iqtaca@a
z^NAhCJDz7qHBN@aaE=do!Sa_G{<yQE!{nPqgnroPMyHn5Jga<GDTp_LC0SZe9SAdl
zoKB+iT;QCI#(~mO%KyeQ^uMaJPW%Qbep~PH-!Y__Ity1r;JCtKu2%dM&=uD-{y)mf
zr#taRt!q_$eLi<f;JQhlF*zN=5QyAq*XcyWL)6%-o<{+c!Z}e1DcJYiscV7rumO``
z2nbOT(Dk8+S25e+6`Yi|TE!+wau^dJU%$8?s_Z&qz9L0_hw~Gplp+UM4!o1uivZ)L
zMd=zmIs@|N13GL#v4I?=2l4&t^Mp;jMWUj7teYOtwHv;Q@pWY*wlq?3TVJI|zinMC
zS^Z-oC+k2&8cNX+LphU{q$L82MB+wYSv(Uh@h^}!t*Nve8W>~)l(UG>hwc!kA=ChZ
z?JIuv@E`Dam+vnm-8%)+tz*4kuKu;u>_1(Uc+BM#>Ahr>=n!K_gR{L*E6yvUmN2Tf
z4|}Ui$GNg2y+Xyk9}Hk?Y^Gn(gk+Z1aV)##8<^9l3dzS#jyJ_V|K4>yUH>PDae1kH
zz^u9{<rD1aHpK*~aj3HSU%gv?CrI-r)o0Jw_Ffcmx>g|AmZvsW*oX7|uyvLVmUC%D
zD;u~C^jWxO{?n7r-7D7B!~gJd@pXkv3cfqB4s*)nwFiIhwnar>lq#0O3N`h@zq%y<
zTB3B<OngzH(0%n!cRS#O{@}n!9Ky|u_LSaO6)osRGX3|wT4#Bh6GF#jdcM|p)Q?jk
zJe53%{k7!j>Et|CbUJ-#d3qJ~B^9r|U%Ay@tv;!l?j6b2D}RDOeTDw~mK(lrMff&R
zRxBb`VQ3nckY$7akN6eq?9R@p^%F30fnv6z^q~nBbI-f!Ek;MQ#MQR!>7-ZW```yz
zS_nz<<ydduxR*=mrc@yRr%Af#DZ84mZ3hfQN%{mxGR*Ct;xCRPY#F)-dd%A~(cv97
z5`u0PguT>1=;k67=U=pKgk(R}vT-7t=zo9L4#GO^Y7UJwu~wC+W|sWIhV~SKukCc+
zWS8+`g__rj+xdiMzM$8$5y{TK{9IR;1XbI72QbMW5Aq?LLKf4GU?D=hsBZv2&-H<F
zRBVV_VPI{QAE&Qsku923{DZ(5p#4B;08DAq(u|My(SWB+7TxF?$%Z0^)99@+?)u|+
z5dFg323`2cM;xP&#YU2ln7;%ZLk${f=e7UyQQIW<Th*914^P!GiW3z870`K-DJV{J
z^BrlZ`>*QJSi{s03R<OsAs9q2JLcAjbU!Z6-ttkr#}{VoxPV8S1Y*WoxU@Ah@2J6e
z{NFrLL8^LF{xahmce$LzNKW>@VJf)YpXYMgHRAYDwj!U77j=AmuYq)>=Tc+WJaszV
z<fmBVlQc3eJ9IPtTe`N4N4=OqdyKyyjaO>>>1;ba!rDC$>bMM0cs~Wx-7*6?);Z1J
z_nB3D(3`X}L*5`q0+Q7%yt}_|AiCY|Ls%altQYh3oo>DT<>mm>l&O`8M9ri=@~CEm
z2XV-akzB*QVlK}hav`pn8Kf5XFQ;RUN%S%h6=dDnX7p0tqWyCyg)-)gU1ix{OX=qm
zKL@04p`uK0oD)N5Uw)V#D?1TOUJ%<tL@&};J)Nf`Cn|W6TAeBG#|7_P+;=4s%Bx8C
z_#Z=|L^J8<Xd#+f4Uui-9plV$UgpC3Vh&WYVx8Yw$rDB5niBs=^`HLW7vtU*GfvPb
ziZcy2RS^;l{R^8h&3-Sbf22&JRc=Xhx;k@9Q>noj2i52eM`20O=wlyc#lU0>eNn-z
zL#NN$GO573lI4>$Duy8OZ_h%=LAQ(OJ8Y`c-xq7Xu(Zu&Ox-hYQ&$Aa2%qT^F;~2`
z^yylFsX2*z#f%l5Ih2oAUu<mh@a;{_&B{|1m3&q1aaAC^FnIMZN^8#pjRr1bFGJ^)
z*w3yCPnq1LgHrue92qko4zJbQWV(<oA3jOwz6fx20B0bbzm~76khf+b56uv$gvDy#
zCAFan^4JyvVK;&a0J_Y3%|O~n_)zNe+s(UsV`9G;hoJ_dSoy|823=8)&6#F&GY6A{
z8a&Y>G=UPKs9i}nCs@{5oEAHXJ_Dx5K==Y!&Yujw-^C1~o&NM1US2F9n$>CZh@y4D
zCtMWrjT9kTHhrQG4HsQMkHUEF$9~hM@Y735xY+a#3eC#njLObY0>ddL`g-XKOYZUh
zD5BrMigixkQK<WK_0LdY&Ft0hW^a0W#4M1$^FtsM9sLDlO%h{TdjiH3?wSpM4o={8
ze`V*fDQx%v2wBFq?g!`SMkxx7Im)_fI8X>WFeb7zw^ZZ=THzUAR#NKxi%8%QZM!RY
z*X7d^2`{BE-**_LY4(fq+pXI`S^qwRs58~mHA6%YX5N%SS%NgH_k6y<gJE!xP{=~Q
zz)zo+7BQ)@=;74lsm3jP3q-*4)g<8Ic3$%Yq1syh9dwEu$maA8RDp_EK+ix_t$@7A
z>#@a)YVz3duhc~;a#5i0>4`>m4zNk#LsH6DZ+)VF4A5%{!1#%nhE;F=Vd$^gd~2#*
zjSOjwo2j#<57<lyLvxMWYY~<w^B<CGS1sy!GuV${jrT&?`r5ZS-<LY4jN1{4225nc
z1h(w7&PFaSfYqPU<(|%#r%x__Ca&f!E-sSLP<7TJ|AuwukGr9BQPB1+qz;%#DjDzP
zTM8LykGhy_X(8mk0GeF?qLlBBXwU<!j`&qSQ5Q=Z2npX`8_!Qt3OaWF72M&}XofW`
zwh@Suvck8V;EjQX{QMb`U9P-SZL2WyWqK8Z8hP{kg{U6_dQZMa!XsPq15_-KY&h4`
z)=k7qXR{|ocit?XL|_DxP=h={rxIIz^0@3&Cqe2oytVf{?p4Zy;=WSfU6l_4WT1Nt
z=h-|=IT;NCJ~a`IZV@cR2jdrArwhG;c?b~Y*B6JFYT$o?HEgW3?RUIja>BloG~m<5
zni6PT-aRYDoVKz}flS%6(?Pu0N`LFYQDbZip?;r}qwcj5++8@MoLnUVWND`N)9+mJ
z$AYc^rMNZ0lP5@75Eu@vERB+p9<Pn$=C({v-l{s~Q>I!)z-e`{VnPX65v9((@klmH
ztrRY4rV>o3Tp$$257A)+Qy3r?&Ow~^2$9nbFIqz6?)o0DniB^-Z4hrP_)j^1tS~Bn
z2!VwAMLetI&Up;sjP6BaaT!SfEXh^RlVyVT`T2>sU)Juw^KZZQEWf)%)0im1&FW?g
zF-ec4^$W894vs(Of_>w0N}k}q61dZs7dTUJv~YdW@|;z#WYxuX%kFv9jYCD&h!*_3
zS@mg+*zbT2(&-&%j<a9)o_Ea0`?v2$V%Ow**!U@L@m;84AN>b0zU8i8boyz9wteBW
z!Zm?8S;U;?!{BD$B`b<0g-Sg>FQ9&Y>=*Xui#S8un(3!xXdWj;hjtr@91DvMk4nul
zq8qlA#{x#(!suXk2cyv>Q~rHad6=F8slQ~<79VXNA=8qQvy}aZgKKpBHH8cd_fv`x
z;`8{&oZ+UYMj)ZHkFEl3NU47o83+@K<WD7HdwY=lVdm-}7AhN`9wy>g*reC`WB`RL
zBcDdnZM!}Lsj%KXIP+yLQKIFANxTO$<IOR)&Pad(l9WJ3TI~ey1Zl-Gj>=FgkEsRS
zBVlDxJ*ROOPnlTg;6#{;Jtns=Fp(lId^P>E>v5pHei9J~n*YdR6q+IyrvJ#>7qj1V
zN<R%GJF7>`bOn+tmV?1C2*Mg1$rbAo|B+Yp(#dJ4eIH;ase0n>)Jy}{%;NPG&&2u%
zGPA~=iE8XZY~Sabkd8GQjo)0+OVhrKuTlnA_~oY9R$_pz{z@b+P9W*3c0mc1WwXju
z!rx9A>WkUEh{@Q27w+b$#MV_TFW#ITFi}nB{H|rV|LJjqp0bHFsMAK`iqf4I4&{hm
z&9L_7TTfBfLy|DLnmpL+6%fnyc1o^gcw{ckUqbBS`Xe_V3u8(7^WC!IGac9W_qwOv
zge{c;5lbg2_BAz2{TlSi`ck}9MDb&elo#LANG$!Yuwoz(TstpWS^08DQ~Y1}w~C4$
zm)Gb3;H9)IuQx;Z3H!kfXm7$D?zOAK!3cuuyrkgEN6q($DQ1+{dZB5I@3=op;5EPK
z*-0X|gZHj5L!9E7{`gyF6;Q<3#rS=0`Mt!K!_Jf>NdlAp3n$XvFBfpN)Fn6F#_Vx{
zfR?l!;SgEDZSK>|uc!bt{D?FDge%Kde@`SX;vekJ(5QTXNb*yG=@6Tvn{pR)fPBEh
z&E@SZDgIl;Tf3NXzoQ8*wG3y=Y>(}x<K|r@W141DFX@)!dWmgE*O7V~{H^<K#+ZKp
zBTvOSXv98@`8Vc&X?0nndf<)g9Y^!NHBVp9bnvZpJm8KuEfOJPhUf)!%wM0EsY)LJ
ziRF!L7gxbD7rOMy`}yP96MgEmloFe$kC2(~UAxpF)-}MSv}$oc7dlekO8EAZiMpY<
z(bqa`qZpayzIZx#cyN6JObWagmxTsD-Pa$Mr$i*YwA7$?<P&mbe7ARB*XZfO7r@f7
z+a#!0;m{)Mkp1MmZX5`Va~J);0Cf+F@at3SsI9hTT@uUd^$IgPC=iBjB^SYLW@_47
zH?;`%_UtEq8!Ow?Ql2<-0O<e_qgp)7sZL}rFy_OCaq1r96Z(NR0{{XDpqZwW!;)iY
z55)M~Bs?K!F>Ad~ey>@GRCJ7S?mbfre1n+)xVH`rl7vnP&gshzVeKW+93WvIW1O|g
zQO28@x!W`%W&{Lu3`+z62aPpg=$9*TN-UDxMYwk~pFL5CV8SKz^Bg;%yTZaq616m;
zqK`HNa|(y9&*uauCL;2P3q)bLlqG)p<#Juu>$+TWP6pol2$~-qiA#H{4#1t&oJg`H
zNkYVCfq#LTW=ZS1hU?5;>!T}TLWHOf&x3H<Iv!9YPOau1`pji1Ij5K=ZTpKw%mqSd
zJ4S0gu~chF_}~8ffBQfG^<TmKAOG?9KmPeoLAu>;C1(x$_Awnk@EAx2(;z-cTnLdG
zwC_6+{`t4xOl`go)130b@0p&fiAb1;`0;p{dlCr=pP9PZUUxNRk(`fkYlud4VtOeh
zVtPKGLC10T#3IbFgC0`mFt(DznD4;ir^Yf00R&*8oJ(Zs#vX<YAsw`=(SL?_>+QM%
zfVq!6qO78@t2YDiARdHDE3}=_@7R%RGAH4Oc~)GBB3Y8eZaENI97A8vSIi#g>STsl
z!kF5K!NVcBiAe)QigIkiF$R;&eQ0x-Y_2wxkXbnAlu{O9!W2AeCN%e2E4X{bK+elj
z@K90v%kq-qqcf*CNzKDz#$YHoAS0*)gGfS<NcHrCE~`Ivm<wm5Nt5hj#DM86^-sWp
zj*0QSV{#%#)aeSZZoPMjcVp%T=I9E*0O4FtEUu=iNu-n#9hXS%z1=_Vh*;L8lx2<w
z!Ar@dl#5NG2gJO{y|x;ZLJ|%U9UY%3pgbbB0cRmJ#)!i5=g*&bOnAaWAf?n=9BrDC
zTrTU3{V@xXVQ_H(;J4p?`}+R={_X4adL6z0{qKK&Jf2@J*MI%je{HpGuUGhVrIcQe
zSL>Y)F=RMp2d%mH_Wu4JQ3Ch-J=Dx$ZW5TGA7lDH`o8T$$5NKW6xV4;egUBFb?9*S
z>-Ab|MZn9tMtT||rkuC!WoALs2`Kpad@>8q5lfLIVTKf&(+;L}%1L$R+iKG&Oy+k%
z>gJ`C%k`qB`?jen4MM_w+goj=6eNuQ#Na`ViamK$l^$)9qN-`KL_}??6X6pH^<#9E
z=Oh-6dF&WnMhsU?B#xnVOtNT<VL2Fu<lr;6M~8NSq%;lM=jE$&yi{wOPI*kK!OQ~$
zQX5Q?vXrvK;BDKsWr1+4<0Nz>e5I25p>$8{LPUU2_uWjx@-sT;xMuLo)XJIpWQJh)
zV~m*n8UTPK>0{cRf%_P0ZUPb|#=h^P_rSu>+c=i7yMt;XfuUw*4hlBL5OuIN%-oS3
z8~|Lwq3>Il<4AL%-mSIn4v3smUYBc1NwVZzM6#Q0wIWg}iy};C8uz{S`~41Pm+SS*
z+gk(@-mX^w*z3O68t-3qJnma`Eb&m{{oQUi_>|eKs{1}I1p=S=`SYi$zP-Km(V6M8
zuDRr}MPAo6s;rNnKWl4l{&u^TR9>%_n}7TE?Q*%)ZF@eSU3+WI(f;(OKYi{f+&$-V
zyWM*4-@kv~_g#cj&IVR6?{zn~x7!;FZ?En7dS2GcwABO%>+XeDJ`@{62OeJidL~sz
zOl7*7miztQb-cfQNjaHX7__$5SR|MH@$;kgmP;9`fBW0t%>C`{EfikNtU6ln(Z4;P
zPi9`0g|k@G)_an4y<DOtR#l1~iBL_^5NVQgTkm|}AG3NQ)ZKJ67G|33G7#xlRZ&g6
zUQhhQJC9$g8b0ge;Oh`gyySBur)Jx>CBSuAduzQnM2tL(F|@UMxm-#q?hs^m5qZ6~
zOIk}=RMm<dQMy^xRPFhk3~CW6WlfR@$<++Ppv<4oXSlTN`~Ix^vMkr@RrqSEqjodR
zk~k%F05K0b5A;Y4a3TfACEYG>MEq=fs||s}cBJG?EWx|#wIhL>pO)gwy81!q`rMEQ
zx~Xjl%sig%#za#0s^AU+aA*+>JnZU8%naPe=wo!#6%vYM5stsI_SRZYX^DunG1P2R
zgj#FlTkd=P%b)*zz363{wg3PL8A(JzR9=HwUt4Q?{r&gfb57<S$mAHKw~;u99TNaV
z))gO76L=Z{k5Nkb{r7*y-L<Yuj32Mp>+S8TX07ev7I(Q^zWwRj{o~`~<Gyd(>-DNZ
z5E=UI{p+8;eN(f)|KlG&|M(-)crKUq+h6{4yWGYY|MP$T&zW*Z^w+=s^*{dOKca*G
z>tFwhh^_Z+-?n|bte0?1-M5{EZ?`v7ZM{LqR%`ssT*9hQeFCVV08YPJGMj9w*1P$%
z#vQ%ep>n?7t`i{?kx>4d*4A0rY=Mbbk{OpiLd|m$!Qmk3u<(K_0K8sXbdrcjP5{8f
z2#6FLNlvQj(cN*$nGf&AD9M_`adn(y%;kJdQJ>=!riAs$B>K13p#3t1n7=aw3=XPY
zgxyPkobJv{fBMs(_;Bd!Ga86XDI$po-G33DYOS^IW`M{seio7KwX5kIxgUZaVg^D2
z%sIpV-_*JFw$bBYm=tvyd&Wsm`(azO=>Pvs`z;p50-F>~8pocKB$9i<88>&ii|rXn
z6#2f-8+;7GAU%P6^rplVs1;Qmpn)A&q=@bfTNJT-4G9Q&a_EuJ3L@u&$+=U?A%$g`
zBLsOPQ3e1r{aMcpcaOwy=%XV<6qTmxz4uL2L7Oy_Zvp^r8@g7h<OsThDg+;M&V4`R
zE(35avaXATI)zYFbzT-kN-4Q`YZ&_Dk*?$T^!#i^c23C_+b!Y2o+Sibro}mTcX!wK
zy~V28W3aEp%)fs9vJ2H;fBmC1MnodFuFF;uh;})@e}6~hTdObU^S}S~x2jI_e11Kb
zWlcH1ySu+XorLA`dKu?wnx=s6!-o&2(+Ln3ULPMHfByV=)5jhTho`5fVHi%QlR<sP
zalBqG(=w-=kNpt<#&Ig^8bauYejG=`5Y|=^(f@H*3pt`p)*=GXT5Pe=UOOyhEi4kq
z!oqGChjNTZD~7u+dven>3xFxvykB%zqNbc~a09T}sB<VrSlXbH*2!qKz3skiM}olA
zYKn1pqL>VLLl%V?4HzrTh`5&G_f504Kf)>46~caxHZeuPO@(h=J>5w$A}r!<cEa4G
zx`Vlnq&eptk|UQ=mOlg*1rUdH=sQH5=XstMmS$~}?vR;9SjbzQ=R%0JuzmO7$?rbW
zh?`rTh(ebU@p8SQa5x-xbNp=Aep@*#0()c9N`{!CR8?gctd#JMT<Y@MU8z-RrL@+Z
z+v2B6DQ<V_--?U9<tbOWW*<CxMKIfwZ;in)&|qmx;`VgD7*fuuJ9Nk6G41ht<9MmH
znt<Lp1lYdhFbsyTR@#zuORc3eaWM2lKlJ3><@NG<y)5%mOPSZjT-t#=c^Z!Qhr_`X
z<R(v7)nOQxWwHL1wdsjSM0uak-IU7HG>!AbzlyQ*><QJ{0O0-m_c^8zqq5BNT-MTR
z_1=H~{{4O!rfGV9eqPHumo4?cvH<Lp+~41qQm)sl?lA$&vNYx|A3p%V^V2g68~opz
z%y!~+x!YejZgumNnT3xU*H*XZ=LkHw>X_N2+YPw!9zY<hqA^6n2ZtC`;f5Oq02@)7
zs*@^t@*-@hE#w?JRQzK^wsIO&eeef&0E?1pytf_|P}f}#2mm35;AvjwoN~OeLO1m5
zrdhwK`I(!|MQjn$W}pkWoAkHB^-bX9Z46^Iwlarp#Amu}vMcvAO%|GG`;NWMrL6nb
zPhq2Nh1RO~B+eNO9uad+T|OFUuT=)eZZ9Lv&nY`xv#u*4ywx+|j+v)7>;+I2(Z-Aj
zNX`MWYUAbv2s|^NU(P-yJ6fi3nWn4VoNG1jbG2qwmvh?#RP9H@{hyL$(jg$CuOa|~
z;A{s4093T(+L&TWDaVB9)^)L4b%@@_5JF5TBAF1+v6W<HEu~ZyyRErE$HPE5bul?|
z%et0Y%398^=XF`z&euSPfqV*wo9tUvyRPf|-WG#ZCdcDZH+)WTj>d7U2Ia3!Rp)sE
zgi_aOo@%K%=Z_yh=CnUfhqV-LT-SBz2T(QA-2blE-@kvi*6!ZjfBE#`;o;%w>FIFj
z`o8b`;cz&-yu2(sEgBJDUtiDH%dtN`JUj@?T8eWH0CP@Ww^dYY%Q=S_)@AV_8<xWD
zo)2RwIU-AgVi80Kz~o4ribyThM5=39L-0QMwXC@JLWD(Bg7*q)vBJ&{80Y4Bwm)uT
z3uQ$_RBWxSWu52Qe5z)i0!H-PRZ~UD0c_n}jKR`@!T~X*m~xga)uM??@-YN|LrZQq
zpf^St-hE7V9$3TK?I1imRJZeUt89TBrWhTP+Ms2ZD6H!mW4Ois8IBtOETsw&+m=ew
zVoautucgk@WG<o*l0#x)1xUDMmWhZdsF=B}tDW@#%B>aaGI~;_T5B!EISe6^RqwlZ
zr<NK*c8aBz+8QD`a;2@gJA!lTyx4~iDF&{sf%jW5QMHuxz3jimG;Y~G=vr%l*i;bF
z3J<*P#CG7C{%c(pu1%OrDbdHAQ`dFglZq_Myeu=T3O5BxDIWX5ZbKob)7@RpIpjF>
z_Y88qULPNSo`1irwUDP2qKc#xot6H~_R<@1M?_Le@7}#L*|9k@jn{lSokZmM`2}|G
z0uk;V>gpUS@H9==>uA%q*!M_|Yn$hJ9H&+r0bI_ni0BZ1wFV+X-+%k|Ed>9c|Nf}8
ze*OCO^XJcq`1ttv<Hrx{1~c>dd<K9ncVGVbSwUaUFFEH=pFWyy&JziXctOPBG+0~c
zdb!$5fP19eT2@ou#Sn~iXkB-^wgvB5SX5ZpgD3JarR()Njgu7%$Kz2!%UVo6M9$gl
zM0X>YCm++M@2RCCx{%T|O`Ep}(9p&zYF>)X4NM*Y97w6f$Uy2n3)fOkcc<HAZ~M*p
z4Q+YHZMD{{r;Qs8fNL$Pp|!%oo_v5{;S~G!WIY>;!F1#t0j3bhldzct>DG!X#XPaw
zP(_4~$KD#<n>v?C38rb>-rV5(VGt4TiCHLkhYmoz0XGm!s~azm8;XDhoNNP9)A~50
zC6rQ_mFN$H)9|i#gGYm>cv9Jvq<udKz&MWQ*K_cRJm!=*Y-#hlQxt8=aI2O@q?HPy
hPE=SFp{Y3M{tqBbP<2*&HmCpq002ovPDHLkV1l;j`IP_w


From be997fd654243a8633aa059343665cf2c88fe609 Mon Sep 17 00:00:00 2001
From: Alberto Leal <albertoleal>
Date: Fri, 2 May 2014 15:33:09 -0300
Subject: [PATCH 0170/1265] Keep previous Content-Type for res.jsonp

closes #2094
---
 lib/response.js   |  2 +-
 test/res.jsonp.js | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/lib/response.js b/lib/response.js
index 8260a73b579..786833cd3a7 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -230,7 +230,7 @@ res.jsonp = function(obj){
   var callback = this.req.query[app.get('jsonp callback name')];
 
   // content-type
-  this.set('Content-Type', 'application/json');
+  this.get('Content-Type') || this.set('Content-Type', 'application/json');
 
   // jsonp
   if (callback) {
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index f08a5adda95..21a961ce331 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -242,4 +242,22 @@ describe('res', function(){
       })
     })
   })
+
+  it('should not override previous Content-Types', function(done){
+    var app = express();
+
+    app.get('/', function(req, res){
+      res.type('application/vnd.example+json');
+      res.jsonp({ hello: 'world' });
+    });
+
+    request(app)
+    .get('/')
+    .end(function(err, res){
+      res.statusCode.should.equal(200);
+      res.headers.should.have.property('content-type', 'application/vnd.example+json');
+      res.text.should.equal('{"hello":"world"}');
+      done();
+    })
+  })
 })

From 0408e3727e15b89827ab2e4bdeeca1afc08550ca Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 2 May 2014 17:02:28 -0400
Subject: [PATCH 0171/1265] deps: debug@^0.8.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 1f8811e0f42..2548c851da9 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "send": "0.3.0",
     "cookie-signature": "1.0.3",
     "merge-descriptors": "0.0.2",
-    "debug": ">= 0.7.3 < 1"
+    "debug": ">= 0.8.0 < 1"
   },
   "devDependencies": {
     "ejs": "~0.8.4",

From f92ba6d0cf3773c8ce5e4f36177a0dd805fd8d72 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 5 May 2014 00:35:43 -0400
Subject: [PATCH 0172/1265] update connect to 2.15.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 2548c851da9..4439519f13b 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
     }
   ],
   "dependencies": {
-    "connect": "2.14.5",
+    "connect": "2.15.0",
     "commander": "1.3.2",
     "range-parser": "1.0.0",
     "mkdirp": "0.4.0",

From 0d468cbe6cf64598cb82a6ad193c58bd522dbfa3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 5 May 2014 00:42:30 -0400
Subject: [PATCH 0173/1265] update history

---
 History.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/History.md b/History.md
index 4b9066f4e3f..a2501527c3a 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,24 @@
+3.x
+===
+
+ * update connect to 2.15.0
+   * Add `res.appendHeader`
+   * Call error stack even when response has been sent
+   * Patch `res.headerSent` to return Boolean
+   * Patch `res.headersSent` for node.js 0.8
+   * Prevent default 404 handler after response sent
+   * dep: compression@1.0.2
+   * dep: connect-timeout@1.1.0
+   * dep: debug@^0.8.0
+   * dep: errorhandler@1.0.1
+   * dep: express-session@1.0.4
+   * dep: morgan@1.0.1
+   * dep: serve-favicon@2.0.0
+   * dep: serve-index@1.0.2
+ * update debug to 0.8.0
+   * add `enable()` method
+   * change from stderr to stdout
+
 3.5.2 / 2014-04-24
 ==================
 

From c99fa6a19268e87b300c1775f90814a23095f199 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 7 May 2014 14:07:59 -0400
Subject: [PATCH 0174/1265] Fix req.host for IPv6 literals

fixes #2102
---
 History.md       |  5 +++++
 lib/request.js   |  8 +++++++-
 test/req.host.js | 39 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 51 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 4b9066f4e3f..1d472ddbc98 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+3.5.x
+=====
+
+ * fix `req.host` for IPv6 literals
+
 3.5.2 / 2014-04-24
 ==================
 
diff --git a/lib/request.js b/lib/request.js
index 3d41617ebdf..10c1421aeaa 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -476,7 +476,13 @@ req.__defineGetter__('host', function(){
   var host = trustProxy && this.get('X-Forwarded-Host');
   host = host || this.get('Host');
   if (!host) return;
-  return host.split(':')[0];
+  var offset = host[0] === '['
+    ? host.indexOf(']') + 1
+    : 0;
+  var index = host.indexOf(':', offset);
+  return ~index
+    ? host.substring(0, index)
+    : host;
 });
 
 /**
diff --git a/test/req.host.js b/test/req.host.js
index 22f5e147b5d..5885a1a9f94 100644
--- a/test/req.host.js
+++ b/test/req.host.js
@@ -18,6 +18,19 @@ describe('req', function(){
       .expect('example.com', done);
     })
 
+    it('should strip port number', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.end(req.host);
+      });
+
+      request(app)
+      .post('/')
+      .set('Host', 'example.com:3000')
+      .expect('example.com', done);
+    })
+
     it('should return undefined otherwise', function(done){
       var app = express();
 
@@ -30,5 +43,31 @@ describe('req', function(){
       .post('/')
       .expect('undefined', done);
     })
+
+    it('should work with IPv6 Host', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.end(req.host);
+      });
+
+      request(app)
+      .post('/')
+      .set('Host', '[::1]')
+      .expect('[::1]', done);
+    })
+
+    it('should work with IPv6 Host and port', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.end(req.host);
+      });
+
+      request(app)
+      .post('/')
+      .set('Host', '[::1]:3000')
+      .expect('[::1]', done);
+    })
   })
 })

From fed0d5df5c72fea3fb4a7344f11484e14a98052b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 7 May 2014 22:57:05 -0400
Subject: [PATCH 0175/1265] docs: use SVG badges

---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index e1e3f7e9862..e0e2d571f39 100644
--- a/Readme.md
+++ b/Readme.md
@@ -2,7 +2,7 @@
 
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
-  [![Build Status](https://secure.travis-ci.org/visionmedia/express.png)](http://travis-ci.org/visionmedia/express) [![Gittip](http://img.shields.io/gittip/visionmedia.png)](https://www.gittip.com/visionmedia/)
+  [![Build Status](https://travis-ci.org/visionmedia/express.svg?branch=master)](https://travis-ci.org/visionmedia/express) [![Gittip](http://img.shields.io/gittip/visionmedia.svg)](https://www.gittip.com/visionmedia/)
 
 ```js
 var express = require('express');

From 35757ed1f59c5544b93e47f803e7bd80b6ed61db Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 7 May 2014 22:58:16 -0400
Subject: [PATCH 0176/1265] docs: add NPM badge

---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index e0e2d571f39..360e7fbc152 100644
--- a/Readme.md
+++ b/Readme.md
@@ -2,7 +2,7 @@
 
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
-  [![Build Status](https://travis-ci.org/visionmedia/express.svg?branch=master)](https://travis-ci.org/visionmedia/express) [![Gittip](http://img.shields.io/gittip/visionmedia.svg)](https://www.gittip.com/visionmedia/)
+  [![Build Status](https://travis-ci.org/visionmedia/express.svg?branch=master)](https://travis-ci.org/visionmedia/express) [![Gittip](http://img.shields.io/gittip/visionmedia.svg)](https://www.gittip.com/visionmedia/) [![NPM version](https://badge.fury.io/js/express.svg)](http://badge.fury.io/js/express)
 
 ```js
 var express = require('express');

From 4b646c2f8dd8cb9b9b97c55b86b962a245e9aab4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 7 May 2014 23:08:55 -0400
Subject: [PATCH 0177/1265] docs: update core contributors

---
 package.json | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/package.json b/package.json
index 4439519f13b..426ef46946d 100644
--- a/package.json
+++ b/package.json
@@ -16,9 +16,21 @@
       "name": "Ciaran Jessup",
       "email": "ciaranj@gmail.com"
     },
+    {
+      "name": "Douglas Christopher Wilson",
+      "email": "doug@somethingdoug.com"
+    },
     {
       "name": "Guillermo Rauch",
       "email": "rauchg@gmail.com"
+    },
+    {
+      "name": "Jonathan Ong",
+      "email": "me@jongleberry.com"
+    },
+    {
+      "name": "Roman Shtylman",
+      "email": "shtylman+expressjs@gmail.com"
     }
   ],
   "dependencies": {

From d58ca520c8d30f65bb506dbd84009c405bd444e4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 May 2014 13:42:19 -0400
Subject: [PATCH 0178/1265] Fix res.jsonp error if callback param is object

fixes #2104
---
 History.md        |  1 +
 lib/response.js   |  8 ++++++--
 test/res.jsonp.js | 20 ++++++++++++++++++--
 3 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index 1d472ddbc98..19a8d822424 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@
 =====
 
  * fix `req.host` for IPv6 literals
+ * fix `res.jsonp` error if callback param is object
 
 3.5.2 / 2014-04-24
 ==================
diff --git a/lib/response.js b/lib/response.js
index 31c79c0d5b5..cbfc79f711b 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -237,9 +237,13 @@ res.jsonp = function(obj){
   this.charset = this.charset || 'utf-8';
   this.set('Content-Type', 'application/json');
 
+  // fixup callback
+  if (Array.isArray(callback)) {
+    callback = callback[0];
+  }
+
   // jsonp
-  if (callback) {
-    if (Array.isArray(callback)) callback = callback[0];
+  if (callback && 'string' === typeof callback) {
     this.set('Content-Type', 'text/javascript');
     var cb = callback.replace(/[^\[\]\w$.]/g, '');
     body = 'typeof ' + cb + ' === \'function\' && ' + cb + '(' + body + ');';
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 76f07c1fc1f..dfd891d3949 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -37,6 +37,22 @@ describe('res', function(){
           })
     })
 
+    it('should ignore object callback parameter with jsonp', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.jsonp({ count: 1 });
+      });
+
+      request(app)
+      .get('/?callback[a]=something')
+      .end(function(err, res){
+        res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+        res.text.should.equal('{"count":1}');
+        done();
+      })
+    })
+
     it('should allow renaming callback', function(done){
       var app = express();
 
@@ -212,7 +228,7 @@ describe('res', function(){
     })
   })
 
-  describe('.json(status, object)', function(){
+  describe('.jsonp(status, object)', function(){
     it('should respond with json and set the .statusCode', function(done){
       var app = express();
 
@@ -231,7 +247,7 @@ describe('res', function(){
     })
   })
 
-  describe('.json(object, status)', function(){
+  describe('.jsonp(object, status)', function(){
     it('should respond with json and set the .statusCode for backwards compat', function(done){
       var app = express();
 

From dc31ea34b858f94b79690573db3f2fd632074a94 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 May 2014 13:51:26 -0400
Subject: [PATCH 0179/1265] 3.5.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 19a8d822424..b2a26bfa37e 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.5.x
-=====
+3.5.3 / 2014-05-08
+==================
 
  * fix `req.host` for IPv6 literals
  * fix `res.jsonp` error if callback param is object
diff --git a/package.json b/package.json
index 1f8811e0f42..afb91f6fa16 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.5.2",
+  "version": "3.5.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From 92d37671c52d89b37d1546677ad4f48b9bdaab42 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 May 2014 14:42:44 -0400
Subject: [PATCH 0180/1265] 4.1.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 4f04b576f2b..eb812c2c5cc 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-4.1.x
-=====
+4.1.2 / 2014-05-08
+==================
 
  * fix `req.host` for IPv6 literals
  * fix `res.jsonp` error if callback param is object
diff --git a/package.json b/package.json
index 2753dff5e93..0e3449d87e0 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.1.1",
+  "version": "4.1.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From 165578a1dad1959b51453bd32ddb5d50bae3e382 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 May 2014 14:48:24 -0400
Subject: [PATCH 0181/1265] update history

---
 History.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/History.md b/History.md
index eb812c2c5cc..f7dcac6ae36 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+4.2.x
+=====
+
+ * include `ETag` header in `HEAD` requests
+ * keep previous `Content-Type` for `res.jsonp`
+
 4.1.2 / 2014-05-08
 ==================
 

From 555ffe37b290d4e9bb010f28417b9eb560f50201 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 May 2014 14:57:44 -0400
Subject: [PATCH 0182/1265] update history with dep history

---
 History.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/History.md b/History.md
index f7dcac6ae36..17afa978d25 100644
--- a/History.md
+++ b/History.md
@@ -22,10 +22,31 @@
  * preserve casing of headers in `res.header` and `res.set`
  * support unicode file names in `res.attachment` and `res.download`
  * update accepts to 1.0.1
+   - deps: negotiator@0.4.0
  * update cookie to 0.1.2
+   - Fix for maxAge == 0
+   - made compat with expires field
  * update send to 0.3.0
+   - Accept API options in options object
+   - Coerce option types
+   - Control whether to generate etags
+   - Default directory access to 403 when index disabled
+   - Fix sending files with dots without root set
+   - Include file path in etag
+   - Make "Can't set headers after they are sent." catchable
+   - Send full entity-body for multi range requests
+   - Set etags to "weak"
+   - Support "If-Range" header
+   - Support multiple index paths
+   - deps: mime@1.2.11
  * update serve-static to 1.1.0
+   - Accept options directly to `send` module
+   - Resolve relative paths at middleware setup
+   - Use parseurl to parse the URL from request
+   - deps: send@0.3.0
  * update type-is to 1.1.0
+   - add non-array values support
+   - add `multipart` as a shorthand
 
 4.0.0 / 2014-04-09
 ==================

From 17a739e35f0893a70bba9d06d98dc0bdf447d363 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 May 2014 16:25:06 -0400
Subject: [PATCH 0183/1265] update mkdirp to 0.5.0

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e07826e0d90..c6509338855 100644
--- a/History.md
+++ b/History.md
@@ -18,6 +18,7 @@
  * update debug to 0.8.0
    * add `enable()` method
    * change from stderr to stdout
+ * update mkdirp to 0.5.0
 
 3.5.3 / 2014-05-08
 ==================
diff --git a/package.json b/package.json
index 060015b23cb..8e59b47fc3a 100644
--- a/package.json
+++ b/package.json
@@ -36,8 +36,8 @@
   "dependencies": {
     "connect": "2.15.0",
     "commander": "1.3.2",
+    "mkdirp": "0.5.0",
     "range-parser": "1.0.0",
-    "mkdirp": "0.4.0",
     "cookie": "0.1.2",
     "buffer-crc32": "0.2.1",
     "fresh": "0.2.2",

From 417999884b1cf040625844f083ed773b0d48adb1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 May 2014 16:28:14 -0400
Subject: [PATCH 0184/1265] update supertest to 0.12.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 8e59b47fc3a..c7032793081 100644
--- a/package.json
+++ b/package.json
@@ -56,7 +56,7 @@
     "should": "~2.1.1",
     "connect-redis": "~1.4.5",
     "marked": "0.2.10",
-    "supertest": "~0.11.0"
+    "supertest": "~0.12.0"
   },
   "keywords": [
     "express",

From a8bb4bab2b480b40bf1078310fc71be0dc150e45 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 May 2014 16:27:27 -0400
Subject: [PATCH 0185/1265] tests: add test for app.delete

---
 test/app.router.js | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/test/app.router.js b/test/app.router.js
index c2bd082c720..980249574cf 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -1,14 +1,15 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert')
   , methods = require('methods');
 
 describe('app.router', function(){
   describe('methods supported', function(){
-    methods.forEach(function(method){
+    methods.concat('del').forEach(function(method){
+      if (method === 'connect') return;
+
       it('should include ' + method.toUpperCase(), function(done){
-        if (method == 'delete') method = 'del';
         var app = express();
         var calls = [];
 
@@ -152,8 +153,8 @@ describe('app.router', function(){
       var app = express();
 
       app.get(/^\/user\/([0-9]+)\/(view|edit)?$/, function(req, res){
-        var id = req.params.shift()
-          , op = req.params.shift();
+        var id = req.params[0]
+          , op = req.params[1];
         res.end(op + 'ing user ' + id);
       });
 
@@ -328,8 +329,8 @@ describe('app.router', function(){
       var app = express();
 
       app.get('/api/*.*', function(req, res){
-        var resource = req.params.shift()
-          , format = req.params.shift();
+        var resource = req.params[0]
+          , format = req.params[1];
         res.end(resource + ' as ' + format);
       });
 

From 40a43eb7534808eedadb9582c6febbb429920570 Mon Sep 17 00:00:00 2001
From: Oliver Salzburg <oliver.salzburg@gmail.com>
Date: Sat, 4 Jan 2014 22:05:19 +0100
Subject: [PATCH 0186/1265] Value parameter of app.set() is now typed optional
 mixed

---
 lib/application.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/application.js b/lib/application.js
index 865e1e02b1d..076607573e3 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -242,7 +242,7 @@ app.param = function(name, fn){
  * Mounted servers inherit their parent server's settings.
  *
  * @param {String} setting
- * @param {String} val
+ * @param {*} [val]
  * @return {Server} for chaining
  * @api public
  */

From 6f9e9276338a8a83bd811cda21192c199d28823b Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Sun, 23 Mar 2014 21:07:37 -0400
Subject: [PATCH 0187/1265] remove deprecation message about passing path as
 array

backport commit 6b19e3dc0a3b303c541708860a6f9de2ae281b9d
---
 lib/application.js | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/lib/application.js b/lib/application.js
index 076607573e3..ba5b650b862 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -400,11 +400,6 @@ methods.forEach(function(method){
   app[method] = function(path){
     if ('get' == method && 1 == arguments.length) return this.set(path);
 
-    // deprecated
-    if (Array.isArray(path)) {
-      console.trace('passing an array to app.VERB() is deprecated and will be removed in 4.0');
-    }
-
     // if no router attached yet, attach the router
     if (!this._usedRouter) this.use(this.router);
 

From 8dc4ff26f9ae86d031a2af5e5faf6716d1045218 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 May 2014 19:00:36 -0400
Subject: [PATCH 0188/1265] Add standard deprecation utility

 * deprecations ignore when NODE_ENV=test
 * uses node.js util.deprecate
---
 lib/express.js | 22 +++++++++++-----------
 lib/utils.js   | 16 ++++++++++++++++
 2 files changed, 27 insertions(+), 11 deletions(-)

diff --git a/lib/express.js b/lib/express.js
index 4f61cdbd4d7..fdad68210ed 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -9,6 +9,7 @@ var connect = require('connect')
   , Router = require('./router')
   , req = require('./request')
   , res = require('./response')
+  , deprecate = require('./utils').deprecate
   , utils = connect.utils;
 
 /**
@@ -47,19 +48,18 @@ function createApplication() {
 merge(exports, connect.middleware);
 
 /**
- * Error on createServer().
+ * Deprecated createServer().
  */
 
-exports.createServer = function(){
-  console.warn('Warning: express.createServer() is deprecated, express');
-  console.warn('applications no longer inherit from http.Server,');
-  console.warn('please use:');
-  console.warn('');
-  console.warn('  var express = require("express");');
-  console.warn('  var app = express();');
-  console.warn('');
-  return createApplication();
-};
+exports.createServer = deprecate(createApplication,
+  'createServer() is deprecated\n' +
+  'express applications no longer inherit from http.Server\n' +
+  'please use:\n' +
+  '\n' +
+  '  var express = require("express");\n' +
+  '  var app = express();\n' +
+  '\n'
+);
 
 /**
  * Expose the prototypes.
diff --git a/lib/utils.js b/lib/utils.js
index b30873a8ac7..fa76e041a33 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -4,6 +4,7 @@
  */
 
 var mime = require('connect').mime
+  , deprecate = require('util').deprecate
   , crc32 = require('buffer-crc32');
 
 /**
@@ -12,6 +13,21 @@ var mime = require('connect').mime
 
 var toString = {}.toString;
 
+/**
+ * Deprecate function, like core `util.deprecate`
+ *
+ * @param {Function} fn
+ * @param {String} msg
+ * @return {Function}
+ * @api private
+ */
+
+exports.deprecate = function(fn, msg){
+  return 'test' !== process.env.NODE_ENV
+    ? deprecate(fn, 'express: ' + msg)
+    : fn;
+};
+
 /**
  * Return ETag for `body`.
  *

From 0461e55380d29d357fdbaafcb2107b27e535172e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 May 2014 19:16:15 -0400
Subject: [PATCH 0189/1265] deprecate app.del

closes #2095
---
 History.md                         | 1 +
 examples/resource/app.js           | 2 +-
 examples/route-map/index.js        | 8 ++++----
 examples/route-middleware/index.js | 2 +-
 lib/application.js                 | 3 ++-
 5 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/History.md b/History.md
index c6509338855..41038608d5b 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 3.x
 ===
 
+ * deprecate `app.del()` -- use `app.delete()` instead
  * update connect to 2.15.0
    * Add `res.appendHeader`
    * Call error stack even when response has been sent
diff --git a/examples/resource/app.js b/examples/resource/app.js
index 03132e36ff2..849a81c905c 100644
--- a/examples/resource/app.js
+++ b/examples/resource/app.js
@@ -18,7 +18,7 @@ app.resource = function(path, obj) {
     obj.range(req, res, a, b, format);
   });
   this.get(path + '/:id', obj.show);
-  this.del(path + '/:id', obj.destroy);
+  this.delete(path + '/:id', obj.destroy);
 };
 
 // Fake records
diff --git a/examples/route-map/index.js b/examples/route-map/index.js
index 31d25fce829..1400ebe4bdc 100644
--- a/examples/route-map/index.js
+++ b/examples/route-map/index.js
@@ -29,7 +29,7 @@ var users = {
     res.send('user ' + req.params.uid);
   },
 
-  del: function(req, res){
+  delete: function(req, res){
     res.send('delete users');
   }
 };
@@ -39,7 +39,7 @@ var pets = {
     res.send('user ' + req.params.uid + '\'s pets');
   },
 
-  del: function(req, res){
+  delete: function(req, res){
     res.send('delete ' + req.params.uid + '\'s pet ' + req.params.pid);
   }
 };
@@ -47,13 +47,13 @@ var pets = {
 app.map({
   '/users': {
     get: users.list,
-    del: users.del,
+    delete: users.delete,
     '/:uid': {
       get: users.get,
       '/pets': {
         get: pets.list,
         '/:pid': {
-          del: pets.del
+          delete: pets.delete
         }
       }
     }
diff --git a/examples/route-middleware/index.js b/examples/route-middleware/index.js
index 696c3d344ce..c4d1d22f69e 100644
--- a/examples/route-middleware/index.js
+++ b/examples/route-middleware/index.js
@@ -77,7 +77,7 @@ app.get('/user/:id/edit', loadUser, andRestrictToSelf, function(req, res){
   res.send('Editing user ' + req.user.name);
 });
 
-app.del('/user/:id', loadUser, andRestrictTo('admin'), function(req, res){
+app.delete('/user/:id', loadUser, andRestrictTo('admin'), function(req, res){
   res.send('Deleted user ' + req.user.name);
 });
 
diff --git a/lib/application.js b/lib/application.js
index ba5b650b862..10233efffce 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -10,6 +10,7 @@ var connect = require('connect')
   , locals = require('./utils').locals
   , View = require('./view')
   , utils = connect.utils
+  , deprecate = require('./utils').deprecate
   , http = require('http');
 
 /**
@@ -429,7 +430,7 @@ app.all = function(path){
 
 // del -> delete alias
 
-app.del = app.delete;
+app.del = deprecate(app.delete, 'app.del: Use app.delete instead');
 
 /**
  * Render the given view `name` name with `options`

From 4e1e252e17d63ef4a70be79819b732f74a391d4e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 May 2014 20:30:12 -0400
Subject: [PATCH 0190/1265] deprecate res.json(obj, status)

closes #2106
closes #2107
---
 History.md        |  4 ++++
 lib/response.js   | 19 +++++++++++++++++++
 test/res.json.js  | 17 +++++++++++++++++
 test/res.jsonp.js | 17 +++++++++++++++++
 4 files changed, 57 insertions(+)

diff --git a/History.md b/History.md
index 41038608d5b..9900cf3b46d 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,10 @@
 ===
 
  * deprecate `app.del()` -- use `app.delete()` instead
+ * deprecate `res.json(obj, status)` -- use `res.json(status, obj)` instead
+   - the edge-case `res.json(status, num)` requires `res.status(status).json(num)`
+ * deprecate `res.jsonp(obj, status)` -- use `res.jsonp(status, obj)` instead
+   - the edge-case `res.jsonp(status, num)` requires `res.status(status).jsonp(num)`
  * update connect to 2.15.0
    * Add `res.appendHeader`
    * Call error stack even when response has been sent
diff --git a/lib/response.js b/lib/response.js
index cbfc79f711b..e21d2cbdf60 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -9,6 +9,7 @@ var http = require('http')
   , sign = require('cookie-signature').sign
   , normalizeType = require('./utils').normalizeType
   , normalizeTypes = require('./utils').normalizeTypes
+  , deprecate = require('./utils').deprecate
   , etag = require('./utils').etag
   , statusCodes = http.STATUS_CODES
   , cookie = require('cookie')
@@ -177,6 +178,9 @@ res.json = function(obj){
     // res.json(body, status) backwards compat
     if ('number' == typeof arguments[1]) {
       this.statusCode = arguments[1];
+      return 'number' === typeof obj
+        ? jsonNumDeprecated.call(this, obj)
+        : jsonDeprecated.call(this, obj);
     } else {
       this.statusCode = obj;
       obj = arguments[1];
@@ -196,6 +200,12 @@ res.json = function(obj){
   return this.send(body);
 };
 
+var jsonDeprecated = deprecate(res.json,
+  'res.json(obj, status): Use res.json(status, obj) instead');
+
+var jsonNumDeprecated = deprecate(res.json,
+  'res.json(num, status): Use res.status(status).json(num) instead');
+
 /**
  * Send JSON response with JSONP callback support.
  *
@@ -218,6 +228,9 @@ res.jsonp = function(obj){
     // res.json(body, status) backwards compat
     if ('number' == typeof arguments[1]) {
       this.statusCode = arguments[1];
+      return 'number' === typeof obj
+        ? jsonpNumDeprecated.call(this, obj)
+        : jsonpDeprecated.call(this, obj);
     } else {
       this.statusCode = obj;
       obj = arguments[1];
@@ -252,6 +265,12 @@ res.jsonp = function(obj){
   return this.send(body);
 };
 
+var jsonpDeprecated = deprecate(res.json,
+  'res.jsonp(obj, status): Use res.jsonp(status, obj) instead');
+
+var jsonpNumDeprecated = deprecate(res.json,
+  'res.jsonp(num, status): Use res.status(status).jsonp(num) instead');
+
 /**
  * Transfer the file at the given `path`.
  *
diff --git a/test/res.json.js b/test/res.json.js
index b439f244bcb..198c7c3cac2 100644
--- a/test/res.json.js
+++ b/test/res.json.js
@@ -162,6 +162,23 @@ describe('res', function(){
         done();
       })
     })
+
+    it('should use status as second number for backwards compat', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.json(200, 201);
+      });
+
+      request(app)
+      .get('/')
+      .end(function(err, res){
+        res.statusCode.should.equal(201);
+        res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+        res.text.should.equal('200');
+        done();
+      })
+    })
   })
 
   it('should not override previous Content-Types', function(done){
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index dfd891d3949..f7109a16a81 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -264,5 +264,22 @@ describe('res', function(){
         done();
       })
     })
+
+    it('should use status as second number for backwards compat', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.jsonp(200, 201);
+      });
+
+      request(app)
+      .get('/')
+      .end(function(err, res){
+        res.statusCode.should.equal(201);
+        res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+        res.text.should.equal('200');
+        done();
+      })
+    })
   })
 })

From 35a66d8a1478ba07ab1a4256dee9c93debd459d0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 May 2014 21:15:48 -0400
Subject: [PATCH 0191/1265] tests: add test for res.format in route

closes #2016
---
 test/res.format.js | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/test/res.format.js b/test/res.format.js
index 98758144e92..4cf63647aff 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -4,9 +4,9 @@ var express = require('../')
   , utils = require('../lib/utils')
   , assert = require('assert');
 
-var app = express();
+var app1 = express();
 
-app.use(function(req, res, next){
+app1.use(function(req, res, next){
   res.format({
     'text/plain': function(){
       res.send('hey');
@@ -25,7 +25,7 @@ app.use(function(req, res, next){
   });
 });
 
-app.use(function(err, req, res, next){
+app1.use(function(err, req, res, next){
   if (!err.types) throw err;
   res.send(err.status, 'Supports: ' + err.types.join(', '));
 })
@@ -53,10 +53,24 @@ app3.use(function(req, res, next){
   })
 });
 
+var app4 = express();
+
+app4.get('/', function(req, res, next){
+  res.format({
+    text: function(){ res.send('hey') },
+    html: function(){ res.send('<p>hey</p>') },
+    json: function(){ res.send({ message: 'hey' }) }
+  });
+});
+
+app4.use(function(err, req, res, next){
+  res.send(err.status, 'Supports: ' + err.types.join(', '));
+})
+
 describe('res', function(){
   describe('.format(obj)', function(){
     describe('with canonicalized mime types', function(){
-      test(app);
+      test(app1);
     })
 
     describe('with extnames', function(){
@@ -71,6 +85,10 @@ describe('res', function(){
         .expect('default', done);
       })
     })
+
+    describe('in router', function(){
+      test(app4);
+    })
   })
 })
 

From 920f46ad65678e752fe644b0eee7dfbcde30a13d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 May 2014 21:27:01 -0400
Subject: [PATCH 0192/1265] tests: add more res.jsonp? tests

---
 test/res.json.js  | 36 +++++++++++++++++++++++++++++++-
 test/res.jsonp.js | 52 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 87 insertions(+), 1 deletion(-)

diff --git a/test/res.json.js b/test/res.json.js
index 198c7c3cac2..02eb5166366 100644
--- a/test/res.json.js
+++ b/test/res.json.js
@@ -18,7 +18,7 @@ describe('res', function(){
     })
 
     describe('when given primitives', function(){
-      it('should respond with json', function(done){
+      it('should respond with json for null', function(done){
         var app = express();
 
         app.use(function(req, res){
@@ -33,6 +33,40 @@ describe('res', function(){
           done();
         })
       })
+
+      it('should respond with json for Number', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          res.json(300);
+        });
+
+        request(app)
+        .get('/')
+        .end(function(err, res){
+          res.statusCode.should.equal(200);
+          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+          res.text.should.equal('300');
+          done();
+        })
+      })
+
+      it('should respond with json for String', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          res.json('str');
+        });
+
+        request(app)
+        .get('/')
+        .end(function(err, res){
+          res.statusCode.should.equal(200);
+          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+          res.text.should.equal('"str"');
+          done();
+        })
+      })
     })
 
     describe('when given an array', function(){
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index f7109a16a81..eaa115598d6 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -173,6 +173,58 @@ describe('res', function(){
       })
     })
 
+    describe('when given primitives', function(){
+      it('should respond with json for null', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          res.jsonp(null);
+        });
+
+        request(app)
+        .get('/')
+        .end(function(err, res){
+          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+          res.text.should.equal('null');
+          done();
+        })
+      })
+
+      it('should respond with json for Number', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          res.jsonp(300);
+        });
+
+        request(app)
+        .get('/')
+        .end(function(err, res){
+          res.statusCode.should.equal(200);
+          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+          res.text.should.equal('300');
+          done();
+        })
+      })
+
+      it('should respond with json for String', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          res.jsonp('str');
+        });
+
+        request(app)
+        .get('/')
+        .end(function(err, res){
+          res.statusCode.should.equal(200);
+          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
+          res.text.should.equal('"str"');
+          done();
+        })
+      })
+    })
+
     describe('"json replacer" setting', function(){
       it('should be passed to JSON.stringify()', function(done){
         var app = express();

From 3d6b4ba013b590b8804e8721c8c09682807d6a5e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 May 2014 22:08:49 -0400
Subject: [PATCH 0193/1265] update example dependencies

---
 examples/cookie-sessions/index.js | 4 ----
 examples/cookies/app.js           | 8 --------
 examples/error-pages/index.js     | 3 ---
 package.json                      | 5 ++---
 4 files changed, 2 insertions(+), 18 deletions(-)

diff --git a/examples/cookie-sessions/index.js b/examples/cookie-sessions/index.js
index 9bb8714f560..c447f7688f3 100644
--- a/examples/cookie-sessions/index.js
+++ b/examples/cookie-sessions/index.js
@@ -3,14 +3,10 @@
  */
 
 var express = require('../../');
-var favicon = require('static-favicon');
 var cookie-parser = require('cookie-parser');
 
 var app = module.exports = express();
 
-// ignore GET /favicon.ico
-app.use(favicon());
-
 // pass a secret to cookieParser() for signed cookies
 app.use(cookieParser('manny is cool'));
 
diff --git a/examples/cookies/app.js b/examples/cookies/app.js
index 7ec95089bf9..eba4b99370e 100644
--- a/examples/cookies/app.js
+++ b/examples/cookies/app.js
@@ -4,18 +4,10 @@
 
 var express = require('../../');
 var app = module.exports = express();
-var favicon = require('static-favicon');
 var logger = require('morgan');
 var cookieParser = require('cookie-parser');
 var bodyParser = require('body-parser');
 
-// add favicon() before logger() so
-// GET /favicon.ico requests are not
-// logged, because this middleware
-// reponds to /favicon.ico and does not
-// call next()
-app.use(favicon());
-
 // custom log format
 if ('test' != process.env.NODE_ENV)
   app.use(logger(':method :url'));
diff --git a/examples/error-pages/index.js b/examples/error-pages/index.js
index 4ba5d6671b7..19c5e4973ad 100644
--- a/examples/error-pages/index.js
+++ b/examples/error-pages/index.js
@@ -5,7 +5,6 @@
 var express = require('../../');
 var app = module.exports = express();
 var logger = require('morgan');
-var favicon = require('static-favicon');
 var silent = 'test' == process.env.NODE_ENV;
 
 // general config
@@ -23,8 +22,6 @@ if ('production' == app.settings.env) {
   app.disable('verbose errors');
 }
 
-app.use(favicon());
-
 silent || app.use(logger('dev'));
 
 // Routes
diff --git a/package.json b/package.json
index 0e3449d87e0..37ca16e6b6e 100644
--- a/package.json
+++ b/package.json
@@ -53,17 +53,16 @@
     "body-parser": "1.0.2",
     "connect-redis": "~2.0.0",
     "ejs": "~1.0.0",
-    "express-session": "1.0.3",
     "jade": "~0.35.0",
     "marked": "0.3.2",
     "multiparty": "~3.2.4",
-    "static-favicon": "1.0.2",
     "hjs": "~0.0.6",
     "should": "~3.3.1",
     "supertest": "~0.11.0",
     "method-override": "1.0.0",
     "cookie-parser": "1.0.1",
-    "morgan": "1.0.0",
+    "express-session": "1.0.4",
+    "morgan": "1.0.1",
     "vhost": "1.0.0"
   },
   "keywords": [

From e4302b21208c90ae86949933063ccfc1c9fd5c54 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 May 2014 23:22:18 -0400
Subject: [PATCH 0194/1265] tests: fixup new json tests

---
 test/res.json.js  | 32 ++++++++++++++------------------
 test/res.jsonp.js | 46 ++++++++++++++++++++++++++++------------------
 2 files changed, 42 insertions(+), 36 deletions(-)

diff --git a/test/res.json.js b/test/res.json.js
index c088ab45569..97eea7ebdc8 100644
--- a/test/res.json.js
+++ b/test/res.json.js
@@ -17,6 +17,20 @@ describe('res', function(){
       .expect('{"foo":"bar"}', done);
     })
 
+    it('should not override previous Content-Types', function(done){
+      var app = express();
+
+      app.get('/', function(req, res){
+        res.type('application/vnd.example+json');
+        res.json({ hello: 'world' });
+      });
+
+      request(app)
+      .get('/')
+      .expect('Content-Type', 'application/vnd.example+json')
+      .expect(200, '{"hello":"world"}', done);
+    })
+
     describe('when given primitives', function(){
       it('should respond with json', function(done){
         var app = express();
@@ -156,22 +170,4 @@ describe('res', function(){
       })
     })
   })
-
-  it('should not override previous Content-Types', function(done){
-    var app = express();
-
-    app.get('/', function(req, res){
-      res.type('application/vnd.example+json');
-      res.json({ hello: 'world' });
-    });
-
-    request(app)
-    .get('/')
-    .end(function(err, res){
-      res.statusCode.should.equal(200);
-      res.headers.should.have.property('content-type', 'application/vnd.example+json');
-      res.text.should.equal('{"hello":"world"}');
-      done();
-    })
-  })
 })
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 46381cf7b7b..1b8db297813 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -119,6 +119,34 @@ describe('res', function(){
       });
     });
 
+    it('should not override previous Content-Types with no callback', function(done){
+      var app = express();
+
+      app.get('/', function(req, res){
+        res.type('application/vnd.example+json');
+        res.jsonp({ hello: 'world' });
+      });
+
+      request(app)
+      .get('/')
+      .expect('Content-Type', 'application/vnd.example+json')
+      .expect(200, '{"hello":"world"}', done);
+    })
+
+    it('should override previous Content-Types with callback', function(done){
+      var app = express();
+
+      app.get('/', function(req, res){
+        res.type('application/vnd.example+json');
+        res.jsonp({ hello: 'world' });
+      });
+
+      request(app)
+      .get('/?callback=cb')
+      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect(200, /cb\(\{"hello":"world"\}\);$/, done);
+    })
+
     describe('when given primitives', function(){
       it('should respond with json', function(done){
         var app = express();
@@ -258,22 +286,4 @@ describe('res', function(){
       })
     })
   })
-
-  it('should not override previous Content-Types', function(done){
-    var app = express();
-
-    app.get('/', function(req, res){
-      res.type('application/vnd.example+json');
-      res.jsonp({ hello: 'world' });
-    });
-
-    request(app)
-    .get('/')
-    .end(function(err, res){
-      res.statusCode.should.equal(200);
-      res.headers.should.have.property('content-type', 'application/vnd.example+json');
-      res.text.should.equal('{"hello":"world"}');
-      done();
-    })
-  })
 })

From 0639c45acdc8333ed896bf2fecd70afe02e827cf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Apr 2014 17:04:19 -0400
Subject: [PATCH 0195/1265] build: add soft testing on node.js 0.11

---
 .npmignore  | 1 +
 .travis.yml | 7 ++++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.npmignore b/.npmignore
index 5f64c32ba84..a9465cfba5a 100644
--- a/.npmignore
+++ b/.npmignore
@@ -6,5 +6,6 @@ support/
 test/
 testing.js
 .DS_Store
+.travis.yml
 coverage.html
 lib-cov
diff --git a/.travis.yml b/.travis.yml
index a12e3f0fdeb..65cf4bc2ba2 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,4 +1,9 @@
 language: node_js
 node_js:
   - "0.8"
-  - "0.10"
\ No newline at end of file
+  - "0.10"
+  - "0.11"
+matrix:
+  allow_failures:
+    - node_js: "0.11"
+  fast_finish: true

From a2553126ddefe44c8c2d48e3b3bec185d62be66e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 9 May 2014 10:19:20 -0400
Subject: [PATCH 0196/1265] support PURGE method

---
 History.md   | 6 ++++++
 package.json | 4 ++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 9900cf3b46d..ca8390bddac 100644
--- a/History.md
+++ b/History.md
@@ -6,6 +6,10 @@
    - the edge-case `res.json(status, num)` requires `res.status(status).json(num)`
  * deprecate `res.jsonp(obj, status)` -- use `res.jsonp(status, obj)` instead
    - the edge-case `res.jsonp(status, num)` requires `res.status(status).jsonp(num)`
+ * support PURGE method
+   - add `app.purge`
+   - add `router.purge`
+   - include PURGE in `app.all`
  * update connect to 2.15.0
    * Add `res.appendHeader`
    * Call error stack even when response has been sent
@@ -23,6 +27,8 @@
  * update debug to 0.8.0
    * add `enable()` method
    * change from stderr to stdout
+ * update methods to 1.0.0
+   - add PURGE
  * update mkdirp to 0.5.0
 
 3.5.3 / 2014-05-08
diff --git a/package.json b/package.json
index c7032793081..17108166ade 100644
--- a/package.json
+++ b/package.json
@@ -36,12 +36,12 @@
   "dependencies": {
     "connect": "2.15.0",
     "commander": "1.3.2",
+    "methods": "1.0.0",
     "mkdirp": "0.5.0",
     "range-parser": "1.0.0",
     "cookie": "0.1.2",
     "buffer-crc32": "0.2.1",
     "fresh": "0.2.2",
-    "methods": "0.1.0",
     "send": "0.3.0",
     "cookie-signature": "1.0.3",
     "merge-descriptors": "0.0.2",
@@ -56,7 +56,7 @@
     "should": "~2.1.1",
     "connect-redis": "~1.4.5",
     "marked": "0.2.10",
-    "supertest": "~0.12.0"
+    "supertest": "~0.12.1"
   },
   "keywords": [
     "express",

From bc9bcb0317400ffa70d89e558305305fd0bcac18 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 9 May 2014 16:53:15 -0400
Subject: [PATCH 0197/1265] Fix req.next when inside router instance

fixes #2016
---
 History.md          |  1 +
 lib/router/index.js | 26 +++++++++++++++++++++-----
 test/res.format.js  | 21 +++++++++++++++++++++
 3 files changed, 43 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index 17afa978d25..e7eab15004f 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 4.2.x
 =====
 
+ * fix `req.next` when inside router instance
  * include `ETag` header in `HEAD` requests
  * keep previous `Content-Type` for `res.jsonp`
 
diff --git a/lib/router/index.js b/lib/router/index.js
index 7dc479e8911..6165e4bcd6b 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -7,6 +7,7 @@ var Layer = require('./layer');
 var methods = require('methods');
 var debug = require('debug')('express:router');
 var parseUrl = require('parseurl');
+var slice = Array.prototype.slice;
 
 /**
  * Initialize a new `Router` with the given `options`.
@@ -129,18 +130,27 @@ proto.handle = function(req, res, done) {
   // middleware and routes
   var stack = self.stack;
 
+  // request-level next
+  var parent = req.next;
+  done = wrap(done, function(old, err) {
+    req.next = parent;
+    old(err);
+  });
+  req.next = next;
+
   // for options requests, respond with a default if nothing else responds
   if (method === 'options') {
-    var old = done;
-    done = function(err) {
+    done = wrap(done, function(old, err) {
       if (err || options.length === 0) return old(err);
 
       var body = options.join(',');
       return res.set('Allow', body).send(body);
-    };
+    });
   }
 
-  (function next(err) {
+  next();
+
+  function next(err) {
     if (err === 'route') {
       err = undefined;
     }
@@ -232,8 +242,14 @@ proto.handle = function(req, res, done) {
         next(err);
       }
     }
+  }
 
-  })();
+  function wrap(old, fn) {
+    return function () {
+      var args = [old].concat(slice.call(arguments));
+      fn.apply(this, args);
+    };
+  }
 };
 
 /**
diff --git a/test/res.format.js b/test/res.format.js
index 5495410cfec..2c52133b639 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -71,6 +71,27 @@ describe('res', function(){
         .expect('default', done);
       })
     })
+
+    describe('in router', function(){
+      var app = express();
+      var router = express.Router();
+
+      router.get('/', function(req, res, next){
+        res.format({
+          text: function(){ res.send('hey') },
+          html: function(){ res.send('<p>hey</p>') },
+          json: function(){ res.send({ message: 'hey' }) }
+        });
+      });
+
+      router.use(function(err, req, res, next){
+        res.send(err.status, 'Supports: ' + err.types.join(', '));
+      })
+
+      app.use(router)
+
+      test(app)
+    })
   })
 })
 

From f7be983a7718d4b6a74bd5d6ba7a6073ae3bfa6a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 9 May 2014 17:03:23 -0400
Subject: [PATCH 0198/1265] 3.6.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index ca8390bddac..2a5ee82fbcb 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.6.0 / 2014-05-09
+==================
 
  * deprecate `app.del()` -- use `app.delete()` instead
  * deprecate `res.json(obj, status)` -- use `res.json(status, obj)` instead
diff --git a/package.json b/package.json
index 17108166ade..e902140b2d7 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.5.3",
+  "version": "3.6.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From b8d6d258b0b356077cf3f67217ec4e2fd2abfad4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 11 May 2014 21:25:42 -0400
Subject: [PATCH 0199/1265] update example dependencies

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index c016d547890..1c0500656ca 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,7 @@
   },
   "devDependencies": {
     "mocha": "~1.18.2",
-    "body-parser": "1.0.2",
+    "body-parser": "~1.1.2",
     "connect-redis": "~2.0.0",
     "ejs": "~1.0.0",
     "jade": "~0.35.0",

From 7515ee6a783f6d09bf6d49ed59ec8b8d7c02d8ff Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 11 May 2014 21:29:29 -0400
Subject: [PATCH 0200/1265] deps: pin debug

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 1c0500656ca..c9de5cea2f3 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "qs": "0.6.6",
     "serve-static": "1.1.0",
     "path-to-regexp": "0.1.2",
-    "debug": ">= 0.8.0 < 1"
+    "debug": "0.8.1"
   },
   "devDependencies": {
     "mocha": "~1.18.2",

From cf709f302120c0de62978036916778c29fed7d98 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 11 May 2014 22:00:30 -0400
Subject: [PATCH 0201/1265] 4.2.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 1c0fcba4478..bd021de2e65 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-4.2.x
-=====
+4.2.0 / 2014-05-11
+==================
 
  * deprecate `app.del()` -- use `app.delete()` instead
  * deprecate `res.json(obj, status)` -- use `res.json(status, obj)` instead
diff --git a/package.json b/package.json
index c9de5cea2f3..226e4608a63 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.1.2",
+  "version": "4.2.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From d37ffa1149274820d90ce363a1287cc7f8c91ffa Mon Sep 17 00:00:00 2001
From: Roman Shtylman <shtylman@gmail.com>
Date: Mon, 12 May 2014 15:45:54 -0400
Subject: [PATCH 0202/1265] add Contributing.md

Hopefully this will guide some users when posting new issues. Feel free
to close any issues which don't follow the guidelines.
---
 Contributing.md | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 Contributing.md

diff --git a/Contributing.md b/Contributing.md
new file mode 100644
index 00000000000..2c980cf7193
--- /dev/null
+++ b/Contributing.md
@@ -0,0 +1,25 @@
+
+## Website Issues
+
+Issues for the expressjs.com website go here https://github.com/visionmedia/expressjs.com
+
+## PRs and Code contributions
+
+* Tests must pass.
+* Follow existing coding style.
+* If you fix a bug, add a test.
+
+
+## Issues which are questions
+
+We will typically close any vague issues or questions that are specific to some app you are writing. Please double check the docs and other references before being trigger happy with posting a question issue.
+
+Things that will help get your question issue looked at:
+
+* Full and runnable JS code.
+* Clear description of the problem or unexpected behavior.
+* Clear description of the expected result.
+* Steps you have taken to debug it yourself.
+
+If you post a question and do not outline the above items or make it easy for us to understand and reproduce your issue, it will be closed.
+

From d98e2e74983e5ec84bdb86abdb02339cdf77bda1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 May 2014 17:06:45 -0400
Subject: [PATCH 0203/1265] deprecation messages are bright red on TTYs

---
 lib/utils.js | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/lib/utils.js b/lib/utils.js
index fa76e041a33..74d86258cb6 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -14,7 +14,8 @@ var mime = require('connect').mime
 var toString = {}.toString;
 
 /**
- * Deprecate function, like core `util.deprecate`
+ * Deprecate function, like core `util.deprecate`,
+ * but with NODE_ENV and color support.
  *
  * @param {Function} fn
  * @param {String} msg
@@ -23,9 +24,17 @@ var toString = {}.toString;
  */
 
 exports.deprecate = function(fn, msg){
-  return 'test' !== process.env.NODE_ENV
-    ? deprecate(fn, 'express: ' + msg)
-    : fn;
+  if (process.env.NODE_ENV === 'test') return fn;
+
+  // prepend module name
+  msg = 'express: ' + msg;
+
+  if (process.stderr.isTTY) {
+    // colorize
+    msg = '\x1b[31;1m' + msg + '\x1b[0m';
+  }
+
+  return deprecate(fn, msg);
 };
 
 /**

From fcc4742056675f488ad489a5a90ca000cb22c165 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 14 May 2014 00:22:47 -0400
Subject: [PATCH 0204/1265] build: ignore Contributing

---
 .npmignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.npmignore b/.npmignore
index a9465cfba5a..abaf955d2e6 100644
--- a/.npmignore
+++ b/.npmignore
@@ -9,3 +9,4 @@ testing.js
 .travis.yml
 coverage.html
 lib-cov
+Contributing.md

From 8fe8d740565bdedd3cb12bcb6d8f8648e455eccf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 14 May 2014 00:25:39 -0400
Subject: [PATCH 0205/1265] update type-is to 1.2.0

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index bd021de2e65..563f301ef10 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+ * update type-is to 1.2.0
+   - support suffix matching
+
 4.2.0 / 2014-05-11
 ==================
 
diff --git a/package.json b/package.json
index 226e4608a63..6c0caf4327f 100644
--- a/package.json
+++ b/package.json
@@ -36,7 +36,7 @@
   "dependencies": {
     "parseurl": "1.0.1",
     "accepts": "1.0.1",
-    "type-is": "1.1.0",
+    "type-is": "1.2.0",
     "range-parser": "1.0.0",
     "cookie": "0.1.2",
     "buffer-crc32": "0.2.1",

From 31b2e2d7b4774eed16a93f9a8a20a9967e91e524 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 15 May 2014 10:30:52 -0400
Subject: [PATCH 0206/1265] fix behavior of multiple app.VERB for the same path

fixes #2116
---
 History.md         |  1 +
 lib/application.js | 42 +++++++++++++++++++++++++++++++++++-------
 test/app.head.js   | 23 ++++++++++++++++++++++-
 3 files changed, 58 insertions(+), 8 deletions(-)

diff --git a/History.md b/History.md
index 563f301ef10..091deeef2d6 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+ * fix behavior of multiple `app.VERB` for the same path
  * update type-is to 1.2.0
    - support suffix matching
 
diff --git a/lib/application.js b/lib/application.js
index 000eeaf01b0..40a28b18db1 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -30,6 +30,7 @@ var app = exports = module.exports = {};
  */
 
 app.init = function(){
+  this._baseRoutes = {};
   this.cache = {};
   this.settings = {};
   this.engines = {};
@@ -399,11 +400,11 @@ app.disable = function(setting){
 
 methods.forEach(function(method){
   app[method] = function(path){
-    if ('get' == method && 1 == arguments.length) return this.set(path);
-
-    this.lazyrouter();
+    if (method === 'get' && arguments.length === 1) {
+      return this.set(path);
+    }
 
-    var route = this._router.route(path);
+    var route = this._baseRoute(path);
     route[method].apply(route, [].slice.call(arguments, 1));
     return this;
   };
@@ -420,9 +421,7 @@ methods.forEach(function(method){
  */
 
 app.all = function(path){
-  this.lazyrouter();
-
-  var route = this._router.route(path);
+  var route = this._baseRoute(path);
   var args = [].slice.call(arguments, 1);
   methods.forEach(function(method){
     route[method].apply(route, args);
@@ -531,3 +530,32 @@ app.listen = function(){
   var server = http.createServer(this);
   return server.listen.apply(server, arguments);
 };
+
+/**
+ * Get or create a new base route for path.
+ *
+ * @param {String} path
+ * @return {Route}
+ * @api private
+ */
+
+app._baseRoute = function(path){
+  this.lazyrouter();
+
+  var key = typeof path !== 'string'
+    ? 'o:' + String(path)
+    : 's:' + path;
+
+  if (path.ignoreCase || !this._router.caseSensitive) {
+    key = 'i' + key.toLowerCase();
+  }
+
+  var route = this._baseRoutes[key];
+
+  if (!route) {
+    route = this._router.route(path);
+    this._baseRoutes[key] = route;
+  }
+
+  return route;
+};
diff --git a/test/app.head.js b/test/app.head.js
index 9ba2ad9a911..a59eb898bf2 100644
--- a/test/app.head.js
+++ b/test/app.head.js
@@ -42,7 +42,7 @@ describe('HEAD', function(){
 })
 
 describe('app.head()', function(){
-  it('should override', function(done){
+  it('should override prior', function(done){
     var app = express()
       , called;
 
@@ -56,6 +56,27 @@ describe('app.head()', function(){
       res.send('tobi');
     });
 
+    request(app)
+    .head('/tobi')
+    .expect(200, function(){
+      assert(called);
+      done();
+    });
+  })
+  it('should override after', function(done){
+    var app = express()
+      , called;
+
+    app.get('/tobi', function(req, res){
+      assert(0, 'should not call GET');
+      res.send('tobi');
+    });
+
+    app.head('/tobi', function(req, res){
+      called = true;
+      res.end('');
+    });
+
     request(app)
     .head('/tobi')
     .expect(200, function(){

From 65f13c3cc62ff2f5162df73f78b4e5e451adf3b3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 17 May 2014 14:30:52 -0400
Subject: [PATCH 0207/1265] update connect to 2.16.1

---
 History.md           | 13 +++++++++++++
 lib/request.js       |  2 +-
 lib/response.js      |  6 +++---
 lib/router/index.js  | 14 +++++++-------
 package.json         |  3 ++-
 test/res.sendfile.js |  6 +++---
 6 files changed, 29 insertions(+), 15 deletions(-)

diff --git a/History.md b/History.md
index 2a5ee82fbcb..37dd908ae12 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,16 @@
+3.x
+===
+
+ * update connect to 2.16.1
+   - deprecate `res.headerSent` -- use `res.headersSent`
+   - deprecate `res.on("header")` -- use on-headers module instead
+   - json: use body-parser
+   - urlencoded: use body-parser
+   - dep: bytes@1.0.0
+   - dep: cookie-parser@1.1.0
+   - dep: csurf@1.2.0
+   - dep: express-session@1.1.0
+
 3.6.0 / 2014-05-09
 ==================
 
diff --git a/lib/request.js b/lib/request.js
index 10c1421aeaa..34575ee2a54 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -8,7 +8,7 @@ var http = require('http')
   , connect = require('connect')
   , fresh = require('fresh')
   , parseRange = require('range-parser')
-  , parse = connect.utils.parseUrl
+  , parse = require('parseurl')
   , mime = connect.mime;
 
 /**
diff --git a/lib/response.js b/lib/response.js
index e21d2cbdf60..8054e5ca7ed 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -334,13 +334,13 @@ res.sendfile = function(path, options, fn){
 
     // clean up
     cleanup();
-    if (!self.headerSent) self.removeHeader('Content-Disposition');
+    if (!self.headersSent) self.removeHeader('Content-Disposition');
 
     // callback available
     if (fn) return fn(err);
 
     // list in limbo if there's no callback
-    if (self.headerSent) return;
+    if (self.headersSent) return;
 
     // delegate
     next(err);
@@ -375,7 +375,7 @@ res.sendfile = function(path, options, fn){
  * Optionally providing an alternate attachment `filename`,
  * and optional callback `fn(err)`. The callback is invoked
  * when the data transfer is complete, or when an error has
- * ocurred. Be sure to check `res.headerSent` if you plan to respond.
+ * ocurred. Be sure to check `res.headersSent` if you plan to respond.
  *
  * This method uses `res.sendfile()`.
  *
diff --git a/lib/router/index.js b/lib/router/index.js
index cd2f2693787..79997c6f701 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -2,11 +2,11 @@
  * Module dependencies.
  */
 
-var Route = require('./route')
-  , utils = require('../utils')
-  , methods = require('methods')
-  , debug = require('debug')('express:router')
-  , parse = require('connect').utils.parseUrl;
+var Route = require('./route');
+var utils = require('../utils');
+var methods = require('methods');
+var debug = require('debug')('express:router');
+var parseUrl = require('parseurl');
 
 /**
  * Expose `Router` constructor.
@@ -182,7 +182,7 @@ Router.prototype._dispatch = function(req, res, next){
  */
 
 Router.prototype._options = function(req, res, next){
-  var path = parse(req).pathname
+  var path = parseUrl(req).pathname
     , body = this._optionsFor(path).join(',');
   if (!body) return next();
   res.set('Allow', body).send(body);
@@ -222,7 +222,7 @@ Router.prototype._optionsFor = function(path){
 
 Router.prototype.matchRequest = function(req, i, head){
   var method = req.method.toLowerCase()
-    , url = parse(req)
+    , url = parseUrl(req)
     , path = url.pathname
     , routes = this.map
     , i = i || 0
diff --git a/package.json b/package.json
index e902140b2d7..dea6c3e1c5c 100644
--- a/package.json
+++ b/package.json
@@ -34,10 +34,11 @@
     }
   ],
   "dependencies": {
-    "connect": "2.15.0",
+    "connect": "2.16.1",
     "commander": "1.3.2",
     "methods": "1.0.0",
     "mkdirp": "0.5.0",
+    "parseurl": "1.0.1",
     "range-parser": "1.0.0",
     "cookie": "0.1.2",
     "buffer-crc32": "0.2.1",
diff --git a/test/res.sendfile.js b/test/res.sendfile.js
index 30c2ebe00d9..5532a5a5c0f 100644
--- a/test/res.sendfile.js
+++ b/test/res.sendfile.js
@@ -42,7 +42,7 @@ describe('res', function(){
       app.use(function(req, res){
         res.sendfile('test/fixtures/nope.html', function(err){
           ++calls;
-          assert(!res.headerSent);
+          assert(!res.headersSent);
           res.send(err.message);
         });
       });
@@ -77,7 +77,7 @@ describe('res', function(){
 
       app.use(function(req, res){
         res.sendfile('test/fixtures/foo/../user.html', function(err){
-          assert(!res.headerSent);
+          assert(!res.headersSent);
           ++calls;
           res.send(err.message);
         });
@@ -95,7 +95,7 @@ describe('res', function(){
 
       app.use(function(req, res){
         res.sendfile('test/fixtures/user.html', function(err){
-          assert(!res.headerSent);
+          assert(!res.headersSent);
           req.socket.listeners('error').should.have.length(1); // node's original handler
           done();
         });

From 566720be15838f3fe9b30263a7058a8b497c28f5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 9 May 2014 00:53:47 -0400
Subject: [PATCH 0208/1265] improve proxy trust with ip address list

closes #2099
---
 History.md           |  8 ++++++
 lib/application.js   |  8 ++++++
 lib/request.js       | 63 +++++++++++++++++++++++++++---------------
 lib/utils.js         | 30 ++++++++++++++++++++
 package.json         |  1 +
 test/req.host.js     | 65 ++++++++++++++++++++++++++++++++++++++++++++
 test/req.ip.js       | 15 ++++++++++
 test/req.ips.js      | 15 ++++++++++
 test/req.protocol.js | 15 ++++++++++
 9 files changed, 198 insertions(+), 22 deletions(-)

diff --git a/History.md b/History.md
index 37dd908ae12..6226f105354 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,14 @@
 3.x
 ===
 
+ * proper proxy trust with `app.set('trust proxy', trust)`
+   - `app.set('trust proxy', 1)` trust first hop
+   - `app.set('trust proxy', 'loopback')` trust loopback addresses
+   - `app.set('trust proxy', '10.0.0.1')` trust single IP
+   - `app.set('trust proxy', '10.0.0.1/16')` trust subnet
+   - `app.set('trust proxy', '10.0.0.1, 10.0.0.2')` trust list
+   - `app.set('trust proxy', false)` turn off
+   - `app.set('trust proxy', true)` trust everything
  * update connect to 2.16.1
    - deprecate `res.headerSent` -- use `res.headersSent`
    - deprecate `res.on("header")` -- use on-headers module instead
diff --git a/lib/application.js b/lib/application.js
index 10233efffce..3408f68e75d 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -8,6 +8,7 @@ var connect = require('connect')
   , middleware = require('./middleware')
   , debug = require('debug')('express:application')
   , locals = require('./utils').locals
+  , compileTrust = require('./utils').compileTrust
   , View = require('./view')
   , utils = connect.utils
   , deprecate = require('./utils').deprecate
@@ -48,6 +49,7 @@ app.defaultConfiguration = function(){
   this.enable('etag');
   this.set('env', process.env.NODE_ENV || 'development');
   this.set('subdomain offset', 2);
+  this.set('trust proxy', false);
   debug('booting in %s mode', this.get('env'));
 
   // implicit middleware
@@ -253,6 +255,12 @@ app.set = function(setting, val){
     return this.settings[setting];
   } else {
     this.settings[setting] = val;
+
+    if (setting === 'trust proxy') {
+      debug('compile trust proxy %j', val);
+      this.set('trust proxy fn', compileTrust(val));
+    }
+
     return this;
   }
 };
diff --git a/lib/request.js b/lib/request.js
index 34575ee2a54..dac29ee44f8 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -9,6 +9,7 @@ var http = require('http')
   , fresh = require('fresh')
   , parseRange = require('range-parser')
   , parse = require('parseurl')
+  , proxyaddr = require('proxy-addr')
   , mime = connect.mime;
 
 /**
@@ -337,19 +338,26 @@ req.is = function(type){
 /**
  * Return the protocol string "http" or "https"
  * when requested with TLS. When the "trust proxy"
- * setting is enabled the "X-Forwarded-Proto" header
- * field will be trusted. If you're running behind
- * a reverse proxy that supplies https for you this
- * may be enabled.
+ * setting trusts the socket address, the
+ * "X-Forwarded-Proto" header field will be trusted.
+ * If you're running behind a reverse proxy that
+ * supplies https for you this may be enabled.
  *
  * @return {String}
  * @api public
  */
 
 req.__defineGetter__('protocol', function(){
-  var trustProxy = this.app.get('trust proxy');
-  if (this.connection.encrypted) return 'https';
-  if (!trustProxy) return 'http';
+  var trust = this.app.get('trust proxy fn');
+
+  if (!trust(this.connection.remoteAddress)) {
+    return this.connection.encrypted
+      ? 'https'
+      : 'http';
+  }
+
+  // Note: X-Forwarded-Proto is normally only ever a
+  //       single value, but this is to be safe.
   var proto = this.get('X-Forwarded-Proto') || 'http';
   return proto.split(/\s*,\s*/)[0];
 });
@@ -368,36 +376,36 @@ req.__defineGetter__('secure', function(){
 });
 
 /**
- * Return the remote address, or when
- * "trust proxy" is `true` return
- * the upstream addr.
+ * Return the remote address from the trusted proxy.
+ *
+ * The is the remote address on the socket unless
+ * "trust proxy" is set.
  *
  * @return {String}
  * @api public
  */
 
 req.__defineGetter__('ip', function(){
-  return this.ips[0] || this.connection.remoteAddress;
+  var trust = this.app.get('trust proxy fn');
+  return proxyaddr(this, trust);
 });
 
 /**
- * When "trust proxy" is `true`, parse
- * the "X-Forwarded-For" ip address list.
+ * When "trust proxy" is set, trusted proxy addresses + client.
  *
  * For example if the value were "client, proxy1, proxy2"
  * you would receive the array `["client", "proxy1", "proxy2"]`
- * where "proxy2" is the furthest down-stream.
+ * where "proxy2" is the furthest down-stream and "proxy1" and
+ * "proxy2" were trusted.
  *
  * @return {Array}
  * @api public
  */
 
 req.__defineGetter__('ips', function(){
-  var trustProxy = this.app.get('trust proxy');
-  var val = this.get('X-Forwarded-For');
-  return trustProxy && val
-    ? val.split(/ *, */)
-    : [];
+  var trust = this.app.get('trust proxy fn');
+  var addrs = proxyaddr.all(this, trust);
+  return addrs.slice(1).reverse();
 });
 
 /**
@@ -467,19 +475,30 @@ req.__defineGetter__('path', function(){
 /**
  * Parse the "Host" header field hostname.
  *
+ * When the "trust proxy" setting trusts the socket
+ * address, the "X-Forwarded-Host" header field will
+ * be trusted.
+ *
  * @return {String}
  * @api public
  */
 
 req.__defineGetter__('host', function(){
-  var trustProxy = this.app.get('trust proxy');
-  var host = trustProxy && this.get('X-Forwarded-Host');
-  host = host || this.get('Host');
+  var trust = this.app.get('trust proxy fn');
+  var host = this.get('X-Forwarded-Host');
+
+  if (!host || !trust(this.connection.remoteAddress)) {
+    host = this.get('Host');
+  }
+
   if (!host) return;
+
+  // IPv6 literal support
   var offset = host[0] === '['
     ? host.indexOf(']') + 1
     : 0;
   var index = host.indexOf(':', offset);
+
   return ~index
     ? host.substring(0, index)
     : host;
diff --git a/lib/utils.js b/lib/utils.js
index 74d86258cb6..d9dff89dd21 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -5,6 +5,7 @@
 
 var mime = require('connect').mime
   , deprecate = require('util').deprecate
+  , proxyaddr = require('proxy-addr')
   , crc32 = require('buffer-crc32');
 
 /**
@@ -337,3 +338,32 @@ exports.pathRegexp = function(path, keys, sensitive, strict) {
     .replace(/\*/g, '(.*)');
   return new RegExp('^' + path + '$', sensitive ? '' : 'i');
 }
+
+/**
+ * Compile "proxy trust" value to function.
+ *
+ * @param  {Boolean|String|Number|Array|Function} val
+ * @return {Function}
+ * @api private
+ */
+
+exports.compileTrust = function(val) {
+  if (typeof val === 'function') return val;
+
+  if (val === true) {
+    // Support plain true/false
+    return function(){ return true };
+  }
+
+  if (typeof val === 'number') {
+    // Support trusting hop count
+    return function(a, i){ return i < val };
+  }
+
+  if (typeof val === 'string') {
+    // Support comma-separated values
+    val = val.split(/ *, */);
+  }
+
+  return proxyaddr.compile(val || []);
+}
diff --git a/package.json b/package.json
index dea6c3e1c5c..f8f9fd1d871 100644
--- a/package.json
+++ b/package.json
@@ -39,6 +39,7 @@
     "methods": "1.0.0",
     "mkdirp": "0.5.0",
     "parseurl": "1.0.1",
+    "proxy-addr": "1.0.0",
     "range-parser": "1.0.0",
     "cookie": "0.1.2",
     "buffer-crc32": "0.2.1",
diff --git a/test/req.host.js b/test/req.host.js
index 5885a1a9f94..fdb3d492588 100644
--- a/test/req.host.js
+++ b/test/req.host.js
@@ -69,5 +69,70 @@ describe('req', function(){
       .set('Host', '[::1]:3000')
       .expect('[::1]', done);
     })
+
+    describe('when "trust proxy" is enabled', function(){
+      it('should respect X-Forwarded-Host', function(done){
+        var app = express();
+
+        app.enable('trust proxy');
+
+        app.use(function(req, res){
+          res.end(req.host);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', 'localhost')
+        .set('X-Forwarded-Host', 'example.com')
+        .expect('example.com', done);
+      })
+
+      it('should ignore X-Forwarded-Host if socket addr not trusted', function(done){
+        var app = express();
+
+        app.set('trust proxy', '10.0.0.1');
+
+        app.use(function(req, res){
+          res.end(req.host);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', 'localhost')
+        .set('X-Forwarded-Host', 'example.com')
+        .expect('localhost', done);
+      })
+
+      it('should default to Host', function(done){
+        var app = express();
+
+        app.enable('trust proxy');
+
+        app.use(function(req, res){
+          res.end(req.host);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', 'example.com')
+        .expect('example.com', done);
+      })
+    })
+
+    describe('when "trust proxy" is disabled', function(){
+      it('should ignore X-Forwarded-Host', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          res.end(req.host);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', 'localhost')
+        .set('X-Forwarded-Host', 'evil')
+        .expect('localhost', done);
+      })
+    })
   })
 })
diff --git a/test/req.ip.js b/test/req.ip.js
index 473844a9bac..fd710d7eb1c 100644
--- a/test/req.ip.js
+++ b/test/req.ip.js
@@ -20,6 +20,21 @@ describe('req', function(){
           .set('X-Forwarded-For', 'client, p1, p2')
           .expect('client', done);
         })
+
+        it('should return the addr after trusted proxy', function(done){
+          var app = express();
+
+          app.set('trust proxy', 2);
+
+          app.use(function(req, res, next){
+            res.send(req.ip);
+          });
+
+          request(app)
+          .get('/')
+          .set('X-Forwarded-For', 'client, p1, p2')
+          .expect('p1', done);
+        })
       })
 
       describe('when "trust proxy" is disabled', function(){
diff --git a/test/req.ips.js b/test/req.ips.js
index b34ca90934f..457e9b7c448 100644
--- a/test/req.ips.js
+++ b/test/req.ips.js
@@ -20,6 +20,21 @@ describe('req', function(){
           .set('X-Forwarded-For', 'client, p1, p2')
           .expect('["client","p1","p2"]', done);
         })
+
+        it('should stop at first untrusted', function(done){
+          var app = express();
+
+          app.set('trust proxy', 2);
+
+          app.use(function(req, res, next){
+            res.send(req.ips);
+          });
+
+          request(app)
+          .get('/')
+          .set('X-Forwarded-For', 'client, p1, p2')
+          .expect('["p1","p2"]', done);
+        })
       })
 
       describe('when "trust proxy" is disabled', function(){
diff --git a/test/req.protocol.js b/test/req.protocol.js
index d25671fe42e..9da22d0b4a8 100644
--- a/test/req.protocol.js
+++ b/test/req.protocol.js
@@ -32,6 +32,21 @@ describe('req', function(){
         .expect('https', done);
       })
 
+      it('should ignore X-Forwarded-Proto if socket addr not trusted', function(done){
+        var app = express();
+
+        app.set('trust proxy', '10.0.0.1');
+
+        app.use(function(req, res){
+          res.end(req.protocol);
+        });
+
+        request(app)
+        .get('/')
+        .set('X-Forwarded-Proto', 'https')
+        .expect('http', done);
+      })
+
       it('should default to http', function(done){
         var app = express();
 

From 328c6d30603202cfdf1e479f2486e10521a91a44 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Wed, 5 Mar 2014 22:06:14 -0800
Subject: [PATCH 0209/1265] remove unnecessary test/support/http

backport of 643397ed21fc7086dc5662d1f291beddfbb976ae
---
 test/Router.js                         |  2 +-
 test/acceptance/auth.js                |  2 +-
 test/acceptance/content-negotiation.js |  2 +-
 test/acceptance/cookies.js             |  2 +-
 test/acceptance/downloads.js           |  2 +-
 test/acceptance/ejs.js                 |  2 +-
 test/acceptance/error-pages.js         |  2 +-
 test/acceptance/error.js               |  2 +-
 test/acceptance/markdown.js            |  2 +-
 test/acceptance/mvc.js                 |  2 +-
 test/acceptance/params.js              |  2 +-
 test/acceptance/resource.js            |  2 +-
 test/acceptance/web-service.js         |  2 +-
 test/app.all.js                        |  2 +-
 test/app.del.js                        |  2 +-
 test/app.head.js                       |  6 ++--
 test/app.listen.js                     |  2 +-
 test/app.locals.js                     |  4 +--
 test/app.options.js                    |  4 +--
 test/app.param.js                      |  2 +-
 test/app.request.js                    |  2 +-
 test/app.response.js                   |  6 ++--
 test/app.routes.error.js               |  2 +-
 test/app.routes.js                     |  2 +-
 test/app.use.js                        |  4 +--
 test/exports.js                        |  6 ++--
 test/middleware.basic.js               |  2 +-
 test/regression.js                     |  2 +-
 test/req.accepted.js                   |  2 +-
 test/req.acceptedCharsets.js           |  2 +-
 test/req.acceptedEncodings.js          |  2 +-
 test/req.acceptedLanguages.js          |  2 +-
 test/req.accepts.js                    |  2 +-
 test/req.acceptsCharset.js             |  2 +-
 test/req.auth.js                       |  2 +-
 test/req.fresh.js                      |  2 +-
 test/req.get.js                        |  2 +-
 test/req.host.js                       |  2 +-
 test/req.ip.js                         |  2 +-
 test/req.ips.js                        |  2 +-
 test/req.is.js                         |  2 +-
 test/req.param.js                      |  6 ++--
 test/req.path.js                       |  2 +-
 test/req.protocol.js                   |  2 +-
 test/req.query.js                      |  4 +--
 test/req.route.js                      |  4 +--
 test/req.secure.js                     |  2 +-
 test/req.signedCookies.js              |  2 +-
 test/req.stale.js                      |  2 +-
 test/req.subdomains.js                 |  2 +-
 test/req.xhr.js                        |  8 ++---
 test/res.attachment.js                 |  6 ++--
 test/res.charset.js                    |  4 +--
 test/res.clearCookie.js                |  4 +--
 test/res.cookie.js                     |  8 ++---
 test/res.download.js                   |  2 +-
 test/res.format.js                     |  4 +--
 test/res.json.js                       |  2 +-
 test/res.jsonp.js                      |  2 +-
 test/res.locals.js                     |  2 +-
 test/res.location.js                   |  2 +-
 test/res.redirect.js                   |  2 +-
 test/res.render.js                     | 50 +++++++++++++-------------
 test/res.send.js                       |  2 +-
 test/res.sendfile.js                   |  2 +-
 test/res.set.js                        |  4 +--
 test/res.status.js                     |  2 +-
 test/res.type.js                       |  2 +-
 test/support/http.js                   |  2 --
 69 files changed, 117 insertions(+), 119 deletions(-)
 delete mode 100644 test/support/http.js

diff --git a/test/Router.js b/test/Router.js
index 5bb49753220..34a799fafb9 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -1,7 +1,7 @@
 
 var express = require('../')
   , Router = express.Router
-  , request = require('./support/http')
+  , request = require('supertest')
   , methods = require('methods')
   , assert = require('assert');
 
diff --git a/test/acceptance/auth.js b/test/acceptance/auth.js
index f8ec6a89363..7f884df0a33 100644
--- a/test/acceptance/auth.js
+++ b/test/acceptance/auth.js
@@ -1,5 +1,5 @@
 var app = require('../../examples/auth/app')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 function redirects(to, fn){
   return function(err, res){
diff --git a/test/acceptance/content-negotiation.js b/test/acceptance/content-negotiation.js
index 3c92929388f..99842585231 100644
--- a/test/acceptance/content-negotiation.js
+++ b/test/acceptance/content-negotiation.js
@@ -1,5 +1,5 @@
 
-var request = require('../support/http')
+var request = require('supertest')
   , app = require('../../examples/content-negotiation');
 
 describe('content-negotiation', function(){
diff --git a/test/acceptance/cookies.js b/test/acceptance/cookies.js
index 910c1218c36..d6d4f007c2e 100644
--- a/test/acceptance/cookies.js
+++ b/test/acceptance/cookies.js
@@ -1,6 +1,6 @@
 
 var app = require('../../examples/cookies/app')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('cookies', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/downloads.js b/test/acceptance/downloads.js
index 7e7b4da8e4b..ab7082a0ce2 100644
--- a/test/acceptance/downloads.js
+++ b/test/acceptance/downloads.js
@@ -1,6 +1,6 @@
 
 var app = require('../../examples/downloads/app')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('downloads', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/ejs.js b/test/acceptance/ejs.js
index a9877901481..b51c03be7b1 100644
--- a/test/acceptance/ejs.js
+++ b/test/acceptance/ejs.js
@@ -1,5 +1,5 @@
 
-var request = require('../support/http')
+var request = require('supertest')
   , app = require('../../examples/ejs');
 
 describe('ejs', function(){
diff --git a/test/acceptance/error-pages.js b/test/acceptance/error-pages.js
index bc2e103196b..886cedcabe3 100644
--- a/test/acceptance/error-pages.js
+++ b/test/acceptance/error-pages.js
@@ -1,6 +1,6 @@
 
 var app = require('../../examples/error-pages')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('error-pages', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/error.js b/test/acceptance/error.js
index b5dc97bf902..6010f2e2ae4 100644
--- a/test/acceptance/error.js
+++ b/test/acceptance/error.js
@@ -1,6 +1,6 @@
 
 var app = require('../../examples/error')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('error', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/markdown.js b/test/acceptance/markdown.js
index d086992b2f5..8c788e35166 100644
--- a/test/acceptance/markdown.js
+++ b/test/acceptance/markdown.js
@@ -1,6 +1,6 @@
 
 var app = require('../../examples/markdown')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('markdown', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/mvc.js b/test/acceptance/mvc.js
index 031216f0768..3386d8338a8 100644
--- a/test/acceptance/mvc.js
+++ b/test/acceptance/mvc.js
@@ -1,5 +1,5 @@
 
-var request = require('../support/http')
+var request = require('supertest')
   , app = require('../../examples/mvc');
 
 describe('mvc', function(){
diff --git a/test/acceptance/params.js b/test/acceptance/params.js
index f6c449ff26d..f96632445a5 100644
--- a/test/acceptance/params.js
+++ b/test/acceptance/params.js
@@ -1,5 +1,5 @@
 var app = require('../../examples/params/app')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('params', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/resource.js b/test/acceptance/resource.js
index c235fabe09b..8ab2331cdde 100644
--- a/test/acceptance/resource.js
+++ b/test/acceptance/resource.js
@@ -1,5 +1,5 @@
 var app = require('../../examples/resource/app')
-  , request = require('../support/http');
+  , request = require('supertest');
 
 describe('resource', function(){
   describe('GET /', function(){
diff --git a/test/acceptance/web-service.js b/test/acceptance/web-service.js
index 50acddd920d..67e9b44ab8e 100644
--- a/test/acceptance/web-service.js
+++ b/test/acceptance/web-service.js
@@ -1,5 +1,5 @@
 
-var request = require('../support/http')
+var request = require('supertest')
   , app = require('../../examples/web-service');
 
 describe('web-service', function(){
diff --git a/test/app.all.js b/test/app.all.js
index 14720850ef3..a0c68d429d5 100644
--- a/test/app.all.js
+++ b/test/app.all.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app.all()', function(){
   it('should add a router per method', function(done){
diff --git a/test/app.del.js b/test/app.del.js
index ad12199c4b4..d419fbb1580 100644
--- a/test/app.del.js
+++ b/test/app.del.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app.del()', function(){
   it('should alias app.delete()', function(done){
diff --git a/test/app.head.js b/test/app.head.js
index a37c47bfdef..41e12916d0d 100644
--- a/test/app.head.js
+++ b/test/app.head.js
@@ -1,7 +1,7 @@
 
-var express = require('../')
-  , request = require('./support/http')
-  , assert = require('assert');
+var express = require('../');
+var request = require('supertest');
+var assert = require('assert');
 
 describe('HEAD', function(){
   it('should default to GET', function(done){
diff --git a/test/app.listen.js b/test/app.listen.js
index 691e1a9c7d0..b6f68578934 100644
--- a/test/app.listen.js
+++ b/test/app.listen.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app.listen()', function(){
   it('should wrap with an HTTP server', function(done){
diff --git a/test/app.locals.js b/test/app.locals.js
index 58ccb854aa3..afe9922f4a3 100644
--- a/test/app.locals.js
+++ b/test/app.locals.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   describe('.locals(obj)', function(){
@@ -14,7 +14,7 @@ describe('app', function(){
       app.locals.age.should.equal(2);
     })
   })
-  
+
   describe('.locals.settings', function(){
     it('should expose app settings', function(){
       var app = express();
diff --git a/test/app.options.js b/test/app.options.js
index a6f7b65fb16..9a9852a7445 100644
--- a/test/app.options.js
+++ b/test/app.options.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('OPTIONS', function(){
   it('should default to the routes defined', function(done){
@@ -58,4 +58,4 @@ describe('app.options()', function(){
     .expect('GET')
     .expect('Allow', 'GET', done);
   })
-})
\ No newline at end of file
+})
diff --git a/test/app.param.js b/test/app.param.js
index 98332b5dcb9..6f0ee8e76e7 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   describe('.param(fn)', function(){
diff --git a/test/app.request.js b/test/app.request.js
index 6d31112886f..728043a5a34 100644
--- a/test/app.request.js
+++ b/test/app.request.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   describe('.request', function(){
diff --git a/test/app.response.js b/test/app.response.js
index 84911e4c1b0..c6ea77c820a 100644
--- a/test/app.response.js
+++ b/test/app.response.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   describe('.response', function(){
@@ -19,7 +19,7 @@ describe('app', function(){
       .get('/')
       .expect('HEY', done);
     })
-    
+
     it('should not be influenced by other app protos', function(done){
       var app = express()
         , app2 = express();
@@ -27,7 +27,7 @@ describe('app', function(){
       app.response.shout = function(str){
         this.send(str.toUpperCase());
       };
-      
+
       app2.response.shout = function(str){
         this.send(str);
       };
diff --git a/test/app.routes.error.js b/test/app.routes.error.js
index d76bb2ebf71..ac517efdee2 100644
--- a/test/app.routes.error.js
+++ b/test/app.routes.error.js
@@ -1,5 +1,5 @@
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   describe('.VERB()', function(){
diff --git a/test/app.routes.js b/test/app.routes.js
index a559ce8db38..ff117565e9f 100644
--- a/test/app.routes.js
+++ b/test/app.routes.js
@@ -1,7 +1,7 @@
 
 var express = require('../')
   , assert = require('assert')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app.routes', function(){
   it('should be initialized', function(){
diff --git a/test/app.use.js b/test/app.use.js
index 20a52966cdd..d627bdfe658 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('app', function(){
   it('should emit "mount" when mounted', function(done){
@@ -23,7 +23,7 @@ describe('app', function(){
       blog.get('/blog', function(req, res){
         res.end('blog');
       });
-      
+
       app.use(blog);
 
       request(app)
diff --git a/test/exports.js b/test/exports.js
index 8384d95ae0f..34ce505db25 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -1,7 +1,7 @@
 
-var express = require('../')
-  , request = require('./support/http')
-  , assert = require('assert');
+var express = require('../');
+var request = require('supertest');
+var assert = require('assert');
 
 describe('exports', function(){
   it('should expose connect middleware', function(){
diff --git a/test/middleware.basic.js b/test/middleware.basic.js
index 448d4779982..c3c6f1bb367 100644
--- a/test/middleware.basic.js
+++ b/test/middleware.basic.js
@@ -1,6 +1,6 @@
 // 
 // var express = require('../')
-//   , request = require('./support/http');
+//   , request = require('supertest');
 // 
 // describe('middleware', function(){
 //   describe('.next()', function(){
diff --git a/test/regression.js b/test/regression.js
index fdb2c5f5c8a..5d4509ed6fb 100644
--- a/test/regression.js
+++ b/test/regression.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('throw after .end()', function(){
   it('should fail gracefully', function(done){
diff --git a/test/req.accepted.js b/test/req.accepted.js
index 79f122a8020..5a9ec3f143b 100644
--- a/test/req.accepted.js
+++ b/test/req.accepted.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.accepted', function(){
diff --git a/test/req.acceptedCharsets.js b/test/req.acceptedCharsets.js
index 2bc3e0d94e4..8109abec44d 100644
--- a/test/req.acceptedCharsets.js
+++ b/test/req.acceptedCharsets.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.acceptedCharsets', function(){
diff --git a/test/req.acceptedEncodings.js b/test/req.acceptedEncodings.js
index 50ac9c2d7eb..49bf61c8c0a 100644
--- a/test/req.acceptedEncodings.js
+++ b/test/req.acceptedEncodings.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.acceptedEncodings', function(){
diff --git a/test/req.acceptedLanguages.js b/test/req.acceptedLanguages.js
index 9325d955696..5e2f169bc17 100644
--- a/test/req.acceptedLanguages.js
+++ b/test/req.acceptedLanguages.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.acceptedLanguages', function(){
diff --git a/test/req.accepts.js b/test/req.accepts.js
index a8fc13b55d9..1e1e0d76ce3 100644
--- a/test/req.accepts.js
+++ b/test/req.accepts.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.accepts(type)', function(){
diff --git a/test/req.acceptsCharset.js b/test/req.acceptsCharset.js
index 1db237d4c60..0d0ed8b5e41 100644
--- a/test/req.acceptsCharset.js
+++ b/test/req.acceptsCharset.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.acceptsCharset(type)', function(){
diff --git a/test/req.auth.js b/test/req.auth.js
index eac1f4ec4e0..60bec2d38ce 100644
--- a/test/req.auth.js
+++ b/test/req.auth.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.auth', function(){
diff --git a/test/req.fresh.js b/test/req.fresh.js
index e0079bb9897..68912b88604 100644
--- a/test/req.fresh.js
+++ b/test/req.fresh.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.fresh', function(){
diff --git a/test/req.get.js b/test/req.get.js
index 6e114509fad..144a256848d 100644
--- a/test/req.get.js
+++ b/test/req.get.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('req', function(){
diff --git a/test/req.host.js b/test/req.host.js
index fdb3d492588..66cfff4e549 100644
--- a/test/req.host.js
+++ b/test/req.host.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('req', function(){
diff --git a/test/req.ip.js b/test/req.ip.js
index fd710d7eb1c..8e5f9f5516c 100644
--- a/test/req.ip.js
+++ b/test/req.ip.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.ip', function(){
diff --git a/test/req.ips.js b/test/req.ips.js
index 457e9b7c448..a7d464b8468 100644
--- a/test/req.ips.js
+++ b/test/req.ips.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.ips', function(){
diff --git a/test/req.is.js b/test/req.is.js
index b51e6c81e44..24f3bd50f91 100644
--- a/test/req.is.js
+++ b/test/req.is.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 function req(ct) {
   var req = {
diff --git a/test/req.param.js b/test/req.param.js
index e26257d4479..bea8d4ca0f5 100644
--- a/test/req.param.js
+++ b/test/req.param.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest')
 
 describe('req', function(){
   describe('.param(name, default)', function(){
@@ -29,7 +29,7 @@ describe('req', function(){
       .get('/?name=tj')
       .expect('tj', done);
     })
-    
+
     it('should check req.body', function(done){
       var app = express();
 
@@ -44,7 +44,7 @@ describe('req', function(){
       .send({ name: 'tj' })
       .expect('tj', done);
     })
-    
+
     it('should check req.params', function(done){
       var app = express();
 
diff --git a/test/req.path.js b/test/req.path.js
index f12df3752e6..6ad4009c7d5 100644
--- a/test/req.path.js
+++ b/test/req.path.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.path', function(){
diff --git a/test/req.protocol.js b/test/req.protocol.js
index 9da22d0b4a8..9a44aeb54c4 100644
--- a/test/req.protocol.js
+++ b/test/req.protocol.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.protocol', function(){
diff --git a/test/req.query.js b/test/req.query.js
index 53d24400380..10547e4a117 100644
--- a/test/req.query.js
+++ b/test/req.query.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.query', function(){
@@ -18,7 +18,7 @@ describe('req', function(){
         done();
       });
     })
-    
+
     it('should contain the parsed query-string', function(done){
       var app = express();
 
diff --git a/test/req.route.js b/test/req.route.js
index 329f85efbdb..31ab6a867bd 100644
--- a/test/req.route.js
+++ b/test/req.route.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.route', function(){
@@ -12,7 +12,7 @@ describe('req', function(){
         req.route.path.should.equal('/user/:id/:op?');
         next();
       });
-      
+
       app.get('/user/:id/edit', function(req, res){
         req.route.method.should.equal('get');
         req.route.path.should.equal('/user/:id/edit');
diff --git a/test/req.secure.js b/test/req.secure.js
index 6c59a898fdc..df9ae93fae6 100644
--- a/test/req.secure.js
+++ b/test/req.secure.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.secure', function(){
diff --git a/test/req.signedCookies.js b/test/req.signedCookies.js
index d9f8c594730..467a3aee927 100644
--- a/test/req.signedCookies.js
+++ b/test/req.signedCookies.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest')
 
 describe('req', function(){
   describe('.signedCookies', function(){
diff --git a/test/req.stale.js b/test/req.stale.js
index 222628360bc..2c55e8b9a1a 100644
--- a/test/req.stale.js
+++ b/test/req.stale.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.stale', function(){
diff --git a/test/req.subdomains.js b/test/req.subdomains.js
index ff48dbb3488..ec851d2c01a 100644
--- a/test/req.subdomains.js
+++ b/test/req.subdomains.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.subdomains', function(){
diff --git a/test/req.xhr.js b/test/req.xhr.js
index 8c7b56d075d..fe4c0503ee3 100644
--- a/test/req.xhr.js
+++ b/test/req.xhr.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('req', function(){
   describe('.xhr', function(){
@@ -19,7 +19,7 @@ describe('req', function(){
         done();
       })
     })
-    
+
     it('should case-insensitive', function(done){
       var app = express();
 
@@ -35,7 +35,7 @@ describe('req', function(){
         done();
       })
     })
-    
+
     it('should return false otherwise', function(done){
       var app = express();
 
@@ -51,7 +51,7 @@ describe('req', function(){
         done();
       })
     })
-    
+
     it('should return false when not present', function(done){
       var app = express();
 
diff --git a/test/res.attachment.js b/test/res.attachment.js
index aea5eb16355..1049b07cf59 100644
--- a/test/res.attachment.js
+++ b/test/res.attachment.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.attachment()', function(){
@@ -16,7 +16,7 @@ describe('res', function(){
       .expect('Content-Disposition', 'attachment', done);
     })
   })
-  
+
   describe('.attachment(filename)', function(){
     it('should add the filename param', function(done){
       var app = express();
@@ -30,7 +30,7 @@ describe('res', function(){
       .get('/')
       .expect('Content-Disposition', 'attachment; filename="image.png"', done);
     })
-    
+
     it('should set the Content-Type', function(done){
       var app = express();
 
diff --git a/test/res.charset.js b/test/res.charset.js
index 79ec3dfb46f..2403ba4df4a 100644
--- a/test/res.charset.js
+++ b/test/res.charset.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.charset', function(){
@@ -17,7 +17,7 @@ describe('res', function(){
       .get('/')
       .expect("text/x-foo; charset=utf-8", done);
     })
-    
+
     it('should take precedence over res.send() defaults', function(done){
       var app = express();
 
diff --git a/test/res.clearCookie.js b/test/res.clearCookie.js
index 99c56c0c061..92c9d049f0d 100644
--- a/test/res.clearCookie.js
+++ b/test/res.clearCookie.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.clearCookie(name)', function(){
@@ -20,7 +20,7 @@ describe('res', function(){
       })
     })
   })
-  
+
   describe('.clearCookie(name, options)', function(){
     it('should set the given params', function(done){
       var app = express();
diff --git a/test/res.cookie.js b/test/res.cookie.js
index d671def31a7..a322b1d7e72 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , utils = require('connect').utils
   , cookie = require('cookie');
 
@@ -39,7 +39,7 @@ describe('res', function(){
         done();
       })
     })
-    
+
     it('should allow multiple calls', function(done){
       var app = express();
 
@@ -58,7 +58,7 @@ describe('res', function(){
       })
     })
   })
-  
+
   describe('.cookie(name, string, options)', function(){
     it('should set params', function(done){
       var app = express();
@@ -76,7 +76,7 @@ describe('res', function(){
         done();
       })
     })
-    
+
     describe('maxAge', function(){
       it('should set relative expires', function(done){
         var app = express();
diff --git a/test/res.download.js b/test/res.download.js
index a78f8d20b1b..614e4320c06 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('res', function(){
diff --git a/test/res.format.js b/test/res.format.js
index 4cf63647aff..be1e6cbb31c 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , utils = require('../lib/utils')
   , assert = require('assert');
 
@@ -15,7 +15,7 @@ app1.use(function(req, res, next){
     'text/html': function(){
       res.send('<p>hey</p>');
     },
-  
+
     'application/json': function(a, b, c){
       assert(req == a);
       assert(res == b);
diff --git a/test/res.json.js b/test/res.json.js
index 02eb5166366..9cefe259e21 100644
--- a/test/res.json.js
+++ b/test/res.json.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('res', function(){
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index eaa115598d6..03087ec433c 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('res', function(){
diff --git a/test/res.locals.js b/test/res.locals.js
index 6cc4049f3fd..4bf1efa16d0 100644
--- a/test/res.locals.js
+++ b/test/res.locals.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.locals(obj)', function(){
diff --git a/test/res.location.js b/test/res.location.js
index b9810d312b0..48697d02afe 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.location(url)', function(){
diff --git a/test/res.redirect.js b/test/res.redirect.js
index 4640719c7f3..f13a070c176 100644
--- a/test/res.redirect.js
+++ b/test/res.redirect.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.redirect(url)', function(){
diff --git a/test/res.render.js b/test/res.render.js
index a865929ffed..db38752c83a 100644
--- a/test/res.render.js
+++ b/test/res.render.js
@@ -1,12 +1,12 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.render(name)', function(){
     it('should support absolute paths', function(done){
       var app = express();
-  
+
       app.locals.user = { name: 'tobi' };
 
       app.use(function(req, res){
@@ -17,10 +17,10 @@ describe('res', function(){
       .get('/')
       .expect('<p>tobi</p>', done);
     })
-    
+
     it('should support absolute paths with "view engine"', function(done){
       var app = express();
-  
+
       app.locals.user = { name: 'tobi' };
       app.set('view engine', 'jade');
 
@@ -35,7 +35,7 @@ describe('res', function(){
 
     it('should expose app.locals', function(done){
       var app = express();
-  
+
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
 
@@ -50,29 +50,29 @@ describe('res', function(){
   
     it('should support index.<engine>', function(done){
       var app = express();
-  
+
       app.set('views', __dirname + '/fixtures');
       app.set('view engine', 'jade');
 
       app.use(function(req, res){
         res.render('blog/post');
       });
-      
+
       request(app)
       .get('/')
       .expect('<h1>blog post</h1>', done);
     })
-  
+
     describe('when an error occurs', function(){
       it('should next(err)', function(done){
         var app = express();
-  
+
         app.set('views', __dirname + '/fixtures');
 
         app.use(function(req, res){
           res.render('user.jade');
         });
-        
+
         app.use(function(err, req, res, next){
           res.end(err.message);
         });
@@ -82,11 +82,11 @@ describe('res', function(){
         .expect(/user is not defined/, done);
       })
     })
-  
+
     describe('when "view engine" is given', function(){
       it('should render the template', function(done){
         var app = express();
-  
+
         app.set('view engine', 'jade');
         app.set('views', __dirname + '/fixtures');
 
@@ -104,9 +104,9 @@ describe('res', function(){
   describe('.render(name, option)', function(){
     it('should render the template', function(done){
       var app = express();
-  
+
       app.set('views', __dirname + '/fixtures');
-  
+
       var user = { name: 'tobi' };
 
       app.use(function(req, res){
@@ -117,10 +117,10 @@ describe('res', function(){
       .get('/')
       .expect('<p>tobi</p>', done);
     })
-  
+
     it('should expose app.locals', function(done){
       var app = express();
-    
+
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
 
@@ -132,10 +132,10 @@ describe('res', function(){
       .get('/')
       .expect('<p>tobi</p>', done);
     })
-    
+
     it('should expose res.locals', function(done){
       var app = express();
-    
+
       app.set('views', __dirname + '/fixtures');
 
       app.use(function(req, res){
@@ -147,10 +147,10 @@ describe('res', function(){
       .get('/')
       .expect('<p>tobi</p>', done);
     })
-    
+
     it('should give precedence to res.locals over app.locals', function(done){
       var app = express();
-    
+
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
 
@@ -166,10 +166,10 @@ describe('res', function(){
 
     it('should give precedence to res.render() locals over res.locals', function(done){
       var app = express();
-    
+
       app.set('views', __dirname + '/fixtures');
       var jane = { name: 'jane' };
-    
+
       app.use(function(req, res){
         res.locals.user = { name: 'tobi' };
         res.render('user.jade', { user: jane });
@@ -179,14 +179,14 @@ describe('res', function(){
       .get('/')
       .expect('<p>jane</p>', done);
     })
-    
+
     it('should give precedence to res.render() locals over app.locals', function(done){
       var app = express();
-    
+
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
       var jane = { name: 'jane' };
-    
+
       app.use(function(req, res){
         res.render('user.jade', { user: jane });
       });
diff --git a/test/res.send.js b/test/res.send.js
index 8f631593428..98d4b8755ce 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('res', function(){
diff --git a/test/res.sendfile.js b/test/res.sendfile.js
index 5532a5a5c0f..b6ec9833011 100644
--- a/test/res.sendfile.js
+++ b/test/res.sendfile.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , assert = require('assert');
 
 describe('res', function(){
diff --git a/test/res.set.js b/test/res.set.js
index 152efd355bd..76dcf7fe6f6 100644
--- a/test/res.set.js
+++ b/test/res.set.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http')
+  , request = require('supertest')
   , res = express.response;
 
 describe('res', function(){
@@ -45,7 +45,7 @@ describe('res', function(){
       JSON.stringify(res.get('ETag')).should.equal('["123","456"]');
     })
   })
-  
+
   describe('.set(object)', function(){
     it('should set multiple fields', function(done){
       var app = express();
diff --git a/test/res.status.js b/test/res.status.js
index 0de25eb75f8..8c173a645c5 100644
--- a/test/res.status.js
+++ b/test/res.status.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.status(code)', function(){
diff --git a/test/res.type.js b/test/res.type.js
index 09653e39abf..7c03ef4c64d 100644
--- a/test/res.type.js
+++ b/test/res.type.js
@@ -1,6 +1,6 @@
 
 var express = require('../')
-  , request = require('./support/http');
+  , request = require('supertest');
 
 describe('res', function(){
   describe('.type(str)', function(){
diff --git a/test/support/http.js b/test/support/http.js
deleted file mode 100644
index 382e63cea40..00000000000
--- a/test/support/http.js
+++ /dev/null
@@ -1,2 +0,0 @@
-
-module.exports = require('supertest');
\ No newline at end of file

From 1717516a7832df763b3dc8dfdf98c4fc5498f348 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 01:13:12 -0400
Subject: [PATCH 0210/1265] build: improve platform portability

---
 .travis.yml         | 1 +
 Readme.md           | 4 +++-
 package.json        | 3 ++-
 test/support/env.js | 2 ++
 4 files changed, 8 insertions(+), 2 deletions(-)
 create mode 100644 test/support/env.js

diff --git a/.travis.yml b/.travis.yml
index 65cf4bc2ba2..bb47c1b042a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,3 +7,4 @@ matrix:
   allow_failures:
     - node_js: "0.11"
   fast_finish: true
+script: "npm run-script test-travis"
diff --git a/Readme.md b/Readme.md
index 360e7fbc152..ffdd8c8cce5 100644
--- a/Readme.md
+++ b/Readme.md
@@ -94,7 +94,9 @@ To run the test suite, first invoke the following command within the repo, insta
 
 Then run the tests:
 
-    $ make test
+```sh
+$ npm test
+```
 
 ## Contributors
 
diff --git a/package.json b/package.json
index f8f9fd1d871..b213eccc3c4 100644
--- a/package.json
+++ b/package.json
@@ -78,7 +78,8 @@
   },
   "scripts": {
     "prepublish": "npm prune",
-    "test": "make test"
+    "test": "mocha --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
+    "test-travis": "mocha --require test/support/env --reporter spec --check-leaks test/ test/acceptance/"
   },
   "engines": {
     "node": ">= 0.8.0"
diff --git a/test/support/env.js b/test/support/env.js
new file mode 100644
index 00000000000..eb938f3b7a1
--- /dev/null
+++ b/test/support/env.js
@@ -0,0 +1,2 @@
+
+process.env.NODE_ENV = 'test';

From 0f49d8062369f3782287e9e0209acbc2264ae61a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 01:16:38 -0400
Subject: [PATCH 0211/1265] build: clean up package file

---
 package.json | 35 +++++++++++++++++------------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/package.json b/package.json
index b213eccc3c4..cfab8cd5e12 100644
--- a/package.json
+++ b/package.json
@@ -33,6 +33,19 @@
       "email": "shtylman+expressjs@gmail.com"
     }
   ],
+  "keywords": [
+    "express",
+    "framework",
+    "sinatra",
+    "web",
+    "rest",
+    "restful",
+    "router",
+    "app",
+    "api"
+  ],
+  "repository": "git://github.com/visionmedia/express",
+  "license": "MIT",
   "dependencies": {
     "connect": "2.16.1",
     "commander": "1.3.2",
@@ -60,19 +73,9 @@
     "marked": "0.2.10",
     "supertest": "~0.12.1"
   },
-  "keywords": [
-    "express",
-    "framework",
-    "sinatra",
-    "web",
-    "rest",
-    "restful",
-    "router",
-    "app",
-    "api"
-  ],
-  "repository": "git://github.com/visionmedia/express",
-  "main": "index",
+  "engines": {
+    "node": ">= 0.8.0"
+  },
   "bin": {
     "express": "./bin/express"
   },
@@ -80,9 +83,5 @@
     "prepublish": "npm prune",
     "test": "mocha --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
     "test-travis": "mocha --require test/support/env --reporter spec --check-leaks test/ test/acceptance/"
-  },
-  "engines": {
-    "node": ">= 0.8.0"
-  },
-  "license": "MIT"
+  }
 }

From 12da523ff7165ce6a2d0f50450d8e902f3b6ec87 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 01:20:39 -0400
Subject: [PATCH 0212/1265] build: test coverage with istanbul

---
 .gitignore   |  5 +----
 .npmignore   |  3 +--
 Makefile     | 34 ----------------------------------
 package.json |  4 +++-
 4 files changed, 5 insertions(+), 41 deletions(-)
 delete mode 100644 Makefile

diff --git a/.gitignore b/.gitignore
index 8bbe1c831bf..e5deefa24ef 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,5 @@
-coverage.html
+coverage/
 .DS_Store
-lib-cov
 *.seed
 *.log
 *.csv
@@ -13,7 +12,5 @@ benchmarks/graphs
 testing
 node_modules/
 testing
-.coverage_data
-cover_html
 test.js
 .idea
diff --git a/.npmignore b/.npmignore
index a9465cfba5a..8c029e8c207 100644
--- a/.npmignore
+++ b/.npmignore
@@ -1,5 +1,6 @@
 .git*
 benchmarks/
+coverage/
 docs/
 examples/
 support/
@@ -7,5 +8,3 @@ test/
 testing.js
 .DS_Store
 .travis.yml
-coverage.html
-lib-cov
diff --git a/Makefile b/Makefile
deleted file mode 100644
index a1f33a70292..00000000000
--- a/Makefile
+++ /dev/null
@@ -1,34 +0,0 @@
-
-MOCHA_OPTS= --check-leaks
-REPORTER = dot
-
-check: test
-
-test: test-unit test-acceptance
-
-test-unit:
-	@NODE_ENV=test ./node_modules/.bin/mocha \
-		--reporter $(REPORTER) \
-		--globals setImmediate,clearImmediate \
-		$(MOCHA_OPTS)
-
-test-acceptance:
-	@NODE_ENV=test ./node_modules/.bin/mocha \
-		--reporter $(REPORTER) \
-		--bail \
-		test/acceptance/*.js
-
-test-cov: lib-cov
-	@EXPRESS_COV=1 $(MAKE) test REPORTER=html-cov > coverage.html
-
-lib-cov:
-	@jscoverage lib lib-cov
-
-bench:
-	@$(MAKE) -C benchmarks
-
-clean:
-	rm -f coverage.html
-	rm -fr lib-cov
-
-.PHONY: test test-unit test-acceptance bench clean
diff --git a/package.json b/package.json
index cfab8cd5e12..d225d00050f 100644
--- a/package.json
+++ b/package.json
@@ -64,6 +64,7 @@
   },
   "devDependencies": {
     "ejs": "~0.8.4",
+    "istanbul": "0.2.10",
     "mocha": "~1.18.2",
     "jade": "~0.30.0",
     "hjs": "~0.0.6",
@@ -82,6 +83,7 @@
   "scripts": {
     "prepublish": "npm prune",
     "test": "mocha --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
-    "test-travis": "mocha --require test/support/env --reporter spec --check-leaks test/ test/acceptance/"
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/"
   }
 }

From 1b3fb0af8c918f9f1400086c937b8c51ccf9f783 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 01:25:15 -0400
Subject: [PATCH 0213/1265] build: add coverage reporting

---
 Readme.md    | 2 +-
 package.json | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/Readme.md b/Readme.md
index ffdd8c8cce5..2ce672040ae 100644
--- a/Readme.md
+++ b/Readme.md
@@ -2,7 +2,7 @@
 
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
-  [![Build Status](https://travis-ci.org/visionmedia/express.svg?branch=master)](https://travis-ci.org/visionmedia/express) [![Gittip](http://img.shields.io/gittip/visionmedia.svg)](https://www.gittip.com/visionmedia/) [![NPM version](https://badge.fury.io/js/express.svg)](http://badge.fury.io/js/express)
+  [![NPM version](https://badge.fury.io/js/express.svg)](http://badge.fury.io/js/express) [![Build Status](https://travis-ci.org/visionmedia/express.svg?branch=master)](https://travis-ci.org/visionmedia/express) [![Coverage Status](https://img.shields.io/coveralls/visionmedia/express.svg)](https://coveralls.io/r/visionmedia/express) [![Gittip](http://img.shields.io/gittip/visionmedia.svg)](https://www.gittip.com/visionmedia/)
 
 ```js
 var express = require('express');
diff --git a/package.json b/package.json
index d225d00050f..bf09997098b 100644
--- a/package.json
+++ b/package.json
@@ -63,6 +63,7 @@
     "debug": ">= 0.8.0 < 1"
   },
   "devDependencies": {
+    "coveralls": "2.10.0",
     "ejs": "~0.8.4",
     "istanbul": "0.2.10",
     "mocha": "~1.18.2",
@@ -84,6 +85,6 @@
     "prepublish": "npm prune",
     "test": "mocha --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/"
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/ && cat ./coverage/lcov.info | coveralls"
   }
 }

From 33dc6629ff13a5cc6db04460cd1c6cf982a3ba6d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 01:30:44 -0400
Subject: [PATCH 0214/1265] update connect to 2.16.2

---
 History.md   | 4 +++-
 package.json | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 6226f105354..e2fbe02f063 100644
--- a/History.md
+++ b/History.md
@@ -9,15 +9,17 @@
    - `app.set('trust proxy', '10.0.0.1, 10.0.0.2')` trust list
    - `app.set('trust proxy', false)` turn off
    - `app.set('trust proxy', true)` trust everything
- * update connect to 2.16.1
+ * update connect to 2.16.2
    - deprecate `res.headerSent` -- use `res.headersSent`
    - deprecate `res.on("header")` -- use on-headers module instead
+   - fix edge-case in `res.appendHeader` that would append in wrong order
    - json: use body-parser
    - urlencoded: use body-parser
    - dep: bytes@1.0.0
    - dep: cookie-parser@1.1.0
    - dep: csurf@1.2.0
    - dep: express-session@1.1.0
+   - dep: method-override@1.0.1
 
 3.6.0 / 2014-05-09
 ==================
diff --git a/package.json b/package.json
index bf09997098b..575a10fa04d 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
   "repository": "git://github.com/visionmedia/express",
   "license": "MIT",
   "dependencies": {
-    "connect": "2.16.1",
+    "connect": "2.16.2",
     "commander": "1.3.2",
     "methods": "1.0.0",
     "mkdirp": "0.5.0",

From a96924a55501afde39d0021f0fc70638527b643b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 01:35:12 -0400
Subject: [PATCH 0215/1265] build: remove lib-cov fork

---
 index.js | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/index.js b/index.js
index bfe99345b76..3da33783794 100644
--- a/index.js
+++ b/index.js
@@ -1,4 +1,2 @@
 
-module.exports = process.env.EXPRESS_COV
-  ? require('./lib-cov/express')
-  : require('./lib/express');
\ No newline at end of file
+module.exports = require('./lib/express');

From 1f938c560a398d7b65de35e6f3077fbb4f36272e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 01:54:05 -0400
Subject: [PATCH 0216/1265] tests: improve examples/auth tests

---
 test/acceptance/auth.js | 92 ++++++++++++++++++++++++++++++++++-------
 1 file changed, 76 insertions(+), 16 deletions(-)

diff --git a/test/acceptance/auth.js b/test/acceptance/auth.js
index 7f884df0a33..2645f7b68e4 100644
--- a/test/acceptance/auth.js
+++ b/test/acceptance/auth.js
@@ -1,13 +1,5 @@
 var app = require('../../examples/auth/app')
-  , request = require('supertest');
-
-function redirects(to, fn){
-  return function(err, res){
-    res.statusCode.should.equal(302)
-    res.headers.should.have.property('location').match(to);
-    fn()
-  }
-}
+var request = require('supertest')
 
 function getCookie(res) {
   return res.headers['set-cookie'][0].split(';')[0];
@@ -18,25 +10,93 @@ describe('auth', function(){
     it('should redirect to /login', function(done){
       request(app)
       .get('/')
-      .end(redirects(/\/login$/, done))
+      .expect('Location', '/login')
+      .expect(302, done)
     })
   })
 
-  describe('GET /restricted (w/o cookie)',function(){
-    it('should redirect to /login', function(done){
+  describe('GET /login',function(){
+    it('should render login form', function(done){
+      request(app)
+      .get('/login')
+      .expect(200, /<form/, done)
+    })
+
+    it('should display login error', function(done){
+      request(app)
+      .post('/login')
+      .type('urlencoded')
+      .send('username=not-tj&password=foobar')
+      .expect('Location', '/login')
+      .expect(302, function(err, res){
+        if (err) return done(err)
+        request(app)
+        .get('/login')
+        .set('Cookie', getCookie(res))
+        .expect(200, /Authentication failed/, done)
+      })
+    })
+  })
+
+  describe('GET /logout',function(){
+    it('should redirect to /', function(done){
+      request(app)
+      .get('/logout')
+      .expect('Location', '/')
+      .expect(302, done)
+    })
+  })
+
+  describe('GET /restricted',function(){
+    it('should redirect to /login without cookie', function(done){
       request(app)
       .get('/restricted')
-      .end(redirects(/\/login$/,done))
+      .expect('Location', '/login')
+      .expect(302, done)
+    })
+
+    it('should succeed with proper cookie', function(done){
+      request(app)
+      .post('/login')
+      .type('urlencoded')
+      .send('username=tj&password=foobar')
+      .expect('Location', '/')
+      .expect(302, function(err, res){
+        if (err) return done(err)
+        request(app)
+        .get('/restricted')
+        .set('Cookie', getCookie(res))
+        .expect(200, done)
+      })
     })
   })
 
   describe('POST /login', function(){
-    it('should fail without proper credentials', function(done){
+    it('should fail without proper username', function(done){
       request(app)
       .post('/login')
       .type('urlencoded')
       .send('username=not-tj&password=foobar')
-      .end(redirects(/\/login$/, done))
+      .expect('Location', '/login')
+      .expect(302, done)
+    })
+
+    it('should fail without proper password', function(done){
+      request(app)
+      .post('/login')
+      .type('urlencoded')
+      .send('username=tj&password=baz')
+      .expect('Location', '/login')
+      .expect(302, done)
+    })
+
+    it('should succeed with proper credentials', function(done){
+      request(app)
+      .post('/login')
+      .type('urlencoded')
+      .send('username=tj&password=foobar')
+      .expect('Location', '/')
+      .expect(302, done)
     })
   })
-})
\ No newline at end of file
+})

From 787d6301570e7c54cc433a11778c3363bf26976e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 10:38:42 -0400
Subject: [PATCH 0217/1265] update should to 3.3.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 575a10fa04d..39f74e6d477 100644
--- a/package.json
+++ b/package.json
@@ -67,10 +67,10 @@
     "ejs": "~0.8.4",
     "istanbul": "0.2.10",
     "mocha": "~1.18.2",
+    "should": "~3.3.1",
     "jade": "~0.30.0",
     "hjs": "~0.0.6",
     "stylus": "~0.40.0",
-    "should": "~2.1.1",
     "connect-redis": "~1.4.5",
     "marked": "0.2.10",
     "supertest": "~0.12.1"

From b91cd66fc59790cb838b9b3dde32de8c99ded2c2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 10:40:13 -0400
Subject: [PATCH 0218/1265] 3.7.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index e2fbe02f063..29a307a0559 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.7.0 / 2014-05-18
+==================
 
  * proper proxy trust with `app.set('trust proxy', trust)`
    - `app.set('trust proxy', 1)` trust first hop
diff --git a/package.json b/package.json
index 39f74e6d477..9d0f99404fb 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.6.0",
+  "version": "3.7.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From ababa6ae5b5e2aafa183817f292adcb19fa1c917 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 15:27:28 -0400
Subject: [PATCH 0219/1265] fix issue routing requests among sub routers

fixes #2121
---
 History.md          |  1 +
 lib/router/index.js | 10 +++++++---
 test/Router.js      | 37 +++++++++++++++++++++++++++++++++++++
 3 files changed, 45 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 063b93651e6..b690ae0d895 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
  * fix behavior of multiple `app.VERB` for the same path
+ * fix issue routing requests among sub routers
  * proper proxy trust with `app.set('trust proxy', trust)`
    - `app.set('trust proxy', 1)` trust first hop
    - `app.set('trust proxy', 'loopback')` trust loopback addresses
diff --git a/lib/router/index.js b/lib/router/index.js
index 6165e4bcd6b..5e5b3528a1c 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -156,6 +156,8 @@ proto.handle = function(req, res, done) {
     }
 
     var layer = stack[idx++];
+    var layerPath;
+
     if (!layer) {
       return done(err);
     }
@@ -193,7 +195,9 @@ proto.handle = function(req, res, done) {
         }
       }
 
+      // Capture one-time layer values
       req.params = layer.params;
+      layerPath = layer.path;
 
       // this should be done for the layer
       return self.process_params(layer, req, res, function(err) {
@@ -213,13 +217,13 @@ proto.handle = function(req, res, done) {
     }
 
     function trim_prefix() {
-      var c = path[layer.path.length];
+      var c = path[layerPath.length];
       if (c && '/' != c && '.' != c) return next(err);
 
       // Trim off the part of the url that matches the route
       // middleware (.use stuff) needs to have the path stripped
       debug('trim prefix (%s) from url %s', removed, req.url);
-      removed = layer.path;
+      removed = layerPath;
       req.url = protohost + req.url.substr(protohost.length + removed.length);
 
       // Ensure leading slash
@@ -228,7 +232,7 @@ proto.handle = function(req, res, done) {
         slashAdded = true;
       }
 
-      debug('%s %s : %s', layer.handle.name || 'anonymous', layer.path, req.originalUrl);
+      debug('%s %s : %s', layer.handle.name || 'anonymous', layerPath, req.originalUrl);
       var arity = layer.handle.length;
       if (err) {
         if (arity === 4) {
diff --git a/test/Router.js b/test/Router.js
index 55f6bcff857..4d111897758 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -184,4 +184,41 @@ describe('Router', function(){
       router.handle({ url: '/foo/123/bar/baz', method: 'get' }, {}, done);
     });
   });
+
+  describe('parallel requests', function() {
+    it('should not mix requests', function(done) {
+      var count = 2;
+      var req1 = { url: '/foo/50/bar', method: 'get' };
+      var req2 = { url: '/foo/10/bar', method: 'get' };
+      var router = new Router();
+      var sub = new Router();
+
+      sub.get('/bar', function(req, res, next) {
+        next();
+      });
+
+      router.param('ms', function(req, res, next, ms) {
+        ms = parseInt(ms, 10);
+        req.ms = ms;
+        setTimeout(next, ms);
+      });
+
+      router.use('/foo/:ms/', new Router());
+      router.use('/foo/:ms/', sub);
+
+      router.handle(req1, {}, function(err) {
+        assert.ifError(err);
+        assert.equal(req1.ms, 50);
+        assert.equal(req1.originalUrl, '/foo/50/bar');
+        if (!--count) done();
+      });
+
+      router.handle(req2, {}, function(err) {
+        assert.ifError(err);
+        assert.equal(req2.ms, 10);
+        assert.equal(req2.originalUrl, '/foo/10/bar');
+        if (!--count) done();
+      });
+    });
+  });
 })

From 98d17e2293fe1a1bc55402d7aabbf766d4d2257f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 16:21:01 -0400
Subject: [PATCH 0220/1265] invoke router.param() only when necessary

fixes #2121
---
 History.md          |  1 +
 lib/router/index.js | 36 ++++++++++++++++++------------
 test/Router.js      | 54 +++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 77 insertions(+), 14 deletions(-)

diff --git a/History.md b/History.md
index b690ae0d895..00c83c7b157 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,7 @@ unreleased
 
  * fix behavior of multiple `app.VERB` for the same path
  * fix issue routing requests among sub routers
+ * invoke `router.param()` only when necessary instead of every match
  * proper proxy trust with `app.set('trust proxy', trust)`
    - `app.set('trust proxy', 1)` trust first hop
    - `app.set('trust proxy', 'loopback')` trust loopback addresses
diff --git a/lib/router/index.js b/lib/router/index.js
index 5e5b3528a1c..b4df937b58f 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -122,6 +122,7 @@ proto.handle = function(req, res, done) {
   var idx = 0;
   var removed = '';
   var slashAdded = false;
+  var paramcalled = {};
 
   // store options for OPTIONS request
   // only used if OPTIONS request
@@ -200,7 +201,7 @@ proto.handle = function(req, res, done) {
       layerPath = layer.path;
 
       // this should be done for the layer
-      return self.process_params(layer, req, res, function(err) {
+      return self.process_params(layer, paramcalled, req, res, function(err) {
         if (err) {
           return next(err);
         }
@@ -257,16 +258,16 @@ proto.handle = function(req, res, done) {
 };
 
 /**
- * Process any parameters for the route.
+ * Process any parameters for the layer.
  *
  * @api private
  */
 
-proto.process_params = function(route, req, res, done) {
+proto.process_params = function(layer, called, req, res, done) {
   var params = this.params;
 
-  // captured parameters from the route, keys and values
-  var keys = route.keys;
+  // captured parameters from the layer, keys and values
+  var keys = layer.keys;
 
   // fast track
   if (!keys || keys.length === 0) {
@@ -274,6 +275,7 @@ proto.process_params = function(route, req, res, done) {
   }
 
   var i = 0;
+  var name;
   var paramIndex = 0;
   var key;
   var paramVal;
@@ -292,20 +294,26 @@ proto.process_params = function(route, req, res, done) {
 
     paramIndex = 0;
     key = keys[i++];
-    paramVal = key && req.params[key.name];
-    paramCallbacks = key && params[key.name];
+
+    if (!key) {
+      return done();
+    }
+
+    name = key.name;
+    paramVal = req.params[name];
+    paramCallbacks = params[name];
+
+    if (paramVal === undefined || !paramCallbacks || called[name] === paramVal) {
+      return param();
+    }
+
+    called[name] = paramVal;
 
     try {
-      if (paramCallbacks && undefined !== paramVal) {
-        return paramCallback();
-      } else if (key) {
-        return param();
-      }
+      return paramCallback();
     } catch (err) {
       return done(err);
     }
-
-    done();
   }
 
   // single param callbacks
diff --git a/test/Router.js b/test/Router.js
index 4d111897758..ed2f37df96d 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -183,6 +183,60 @@ describe('Router', function(){
 
       router.handle({ url: '/foo/123/bar/baz', method: 'get' }, {}, done);
     });
+
+    it('should only call once per request', function(done) {
+      var count = 0;
+      var req = { url: '/foo/bob/bar', method: 'get' };
+      var router = new Router();
+      var sub = new Router();
+
+      sub.get('/bar', function(req, res, next) {
+        next();
+      });
+
+      router.param('user', function(req, res, next, user) {
+        count++;
+        req.user = user;
+        next();
+      });
+
+      router.use('/foo/:user/', new Router());
+      router.use('/foo/:user/', sub);
+
+      router.handle(req, {}, function(err) {
+        if (err) return done(err);
+        assert.equal(count, 1);
+        assert.equal(req.user, 'bob');
+        done();
+      });
+    });
+
+    it('should call when values differ', function(done) {
+      var count = 0;
+      var req = { url: '/foo/bob/bar', method: 'get' };
+      var router = new Router();
+      var sub = new Router();
+
+      sub.get('/bar', function(req, res, next) {
+        next();
+      });
+
+      router.param('user', function(req, res, next, user) {
+        count++;
+        req.user = user;
+        next();
+      });
+
+      router.use('/foo/:user/', new Router());
+      router.use('/:user/bob/', sub);
+
+      router.handle(req, {}, function(err) {
+        if (err) return done(err);
+        assert.equal(count, 2);
+        assert.equal(req.user, 'foo');
+        done();
+      });
+    });
   });
 
   describe('parallel requests', function() {

From 23ff74bb3f1ea1fddfc190d216a3ed5480025e75 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 16:33:11 -0400
Subject: [PATCH 0221/1265] tests: flow control with after

---
 package.json   | 1 +
 test/Router.js | 8 +++++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index a506ff8e14c..b810fadc4f0 100644
--- a/package.json
+++ b/package.json
@@ -67,6 +67,7 @@
     "debug": "0.8.1"
   },
   "devDependencies": {
+    "after": "0.8.1",
     "coveralls": "2.10.0",
     "istanbul": "0.2.10",
     "mocha": "~1.18.2",
diff --git a/test/Router.js b/test/Router.js
index ed2f37df96d..0a84a88c117 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -1,4 +1,5 @@
 
+var after = require('after');
 var express = require('../')
   , Router = express.Router
   , methods = require('methods')
@@ -241,12 +242,13 @@ describe('Router', function(){
 
   describe('parallel requests', function() {
     it('should not mix requests', function(done) {
-      var count = 2;
       var req1 = { url: '/foo/50/bar', method: 'get' };
       var req2 = { url: '/foo/10/bar', method: 'get' };
       var router = new Router();
       var sub = new Router();
 
+      done = after(2, done);
+
       sub.get('/bar', function(req, res, next) {
         next();
       });
@@ -264,14 +266,14 @@ describe('Router', function(){
         assert.ifError(err);
         assert.equal(req1.ms, 50);
         assert.equal(req1.originalUrl, '/foo/50/bar');
-        if (!--count) done();
+        done();
       });
 
       router.handle(req2, {}, function(err) {
         assert.ifError(err);
         assert.equal(req2.ms, 10);
         assert.equal(req2.originalUrl, '/foo/10/bar');
-        if (!--count) done();
+        done();
       });
     });
   });

From 9354ab62ddd1fe3e34d868d05b11ce575bf13960 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 23:02:25 -0400
Subject: [PATCH 0222/1265] build: prevent failure from coveralls

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index b810fadc4f0..03a3f7d02c3 100644
--- a/package.json
+++ b/package.json
@@ -93,6 +93,6 @@
     "prepublish": "npm prune",
     "test": "mocha --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/ && cat ./coverage/lcov.info | coveralls"
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/ && (cat ./coverage/lcov.info | coveralls || true)"
   }
 }

From 359f12791a5cb87fab6854d76135430676fba291 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 23:02:25 -0400
Subject: [PATCH 0223/1265] build: prevent failure from coveralls

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 9d0f99404fb..4a85ea0fcb4 100644
--- a/package.json
+++ b/package.json
@@ -85,6 +85,6 @@
     "prepublish": "npm prune",
     "test": "mocha --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/ && cat ./coverage/lcov.info | coveralls"
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/ && (cat ./coverage/lcov.info | coveralls || true)"
   }
 }

From 4c0f1f53d3851477e7c9af988cb3ff1e5ab0b3bd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 18 May 2014 23:07:59 -0400
Subject: [PATCH 0224/1265] update example dependencies

---
 package.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 03a3f7d02c3..d549a2b9250 100644
--- a/package.json
+++ b/package.json
@@ -73,17 +73,17 @@
     "mocha": "~1.18.2",
     "should": "~3.3.1",
     "supertest": "~0.12.0",
-    "body-parser": "~1.1.2",
     "connect-redis": "~2.0.0",
     "ejs": "~1.0.0",
     "jade": "~0.35.0",
     "marked": "0.3.2",
     "multiparty": "~3.2.4",
     "hjs": "~0.0.6",
-    "method-override": "1.0.0",
-    "cookie-parser": "1.0.1",
-    "express-session": "1.0.4",
-    "morgan": "1.0.1",
+    "body-parser": "1.2.0",
+    "cookie-parser": "1.1.0",
+    "express-session": "1.1.0",
+    "method-override": "1.0.1",
+    "morgan": "1.1.0",
     "vhost": "1.0.0"
   },
   "engines": {

From 739586f96aec6587e9fd9b7f7642c835614a5c25 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 19 May 2014 00:39:26 -0400
Subject: [PATCH 0225/1265] add req.baseUrl to access stripped path in routes

fixes #2078
---
 History.md          |  1 +
 lib/router/index.js | 14 ++++++--
 test/req.baseUrl.js | 87 +++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 100 insertions(+), 2 deletions(-)
 create mode 100644 test/req.baseUrl.js

diff --git a/History.md b/History.md
index 00c83c7b157..f572bfb1ae6 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+ * add `req.baseUrl` to access the path stripped from `req.url` in routes
  * fix behavior of multiple `app.VERB` for the same path
  * fix issue routing requests among sub routers
  * invoke `router.param()` only when necessary instead of every match
diff --git a/lib/router/index.js b/lib/router/index.js
index b4df937b58f..ef98117eab8 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -131,9 +131,11 @@ proto.handle = function(req, res, done) {
   // middleware and routes
   var stack = self.stack;
 
-  // request-level next
+  // manage inter-router variables
   var parent = req.next;
+  var parentUrl = req.baseUrl || '';
   done = wrap(done, function(old, err) {
+    req.baseUrl = parentUrl;
     req.next = parent;
     old(err);
   });
@@ -168,6 +170,7 @@ proto.handle = function(req, res, done) {
       slashAdded = false;
     }
 
+    req.baseUrl = parentUrl;
     req.url = protohost + removed + req.url.substr(protohost.length);
     req.originalUrl = req.originalUrl || req.url;
     removed = '';
@@ -228,11 +231,18 @@ proto.handle = function(req, res, done) {
       req.url = protohost + req.url.substr(protohost.length + removed.length);
 
       // Ensure leading slash
-      if (!fqdn && '/' != req.url[0]) {
+      if (!fqdn && req.url[0] !== '/') {
         req.url = '/' + req.url;
         slashAdded = true;
       }
 
+      // Setup base URL (no trailing slash)
+      if (removed.length && removed.substr(-1) === '/') {
+        req.baseUrl = parentUrl + removed.substring(0, removed.length - 1);
+      } else {
+        req.baseUrl = parentUrl + removed;
+      }
+
       debug('%s %s : %s', layer.handle.name || 'anonymous', layerPath, req.originalUrl);
       var arity = layer.handle.length;
       if (err) {
diff --git a/test/req.baseUrl.js b/test/req.baseUrl.js
new file mode 100644
index 00000000000..9ac9d88029b
--- /dev/null
+++ b/test/req.baseUrl.js
@@ -0,0 +1,87 @@
+
+var express = require('..')
+var request = require('supertest')
+
+describe('req', function(){
+  describe('.baseUrl', function(){
+    it('should be empty for top-level route', function(done){
+      var app = express()
+
+      app.get('/:a', function(req, res){
+        res.end(req.baseUrl)
+      })
+
+      request(app)
+      .get('/foo')
+      .expect(200, '', done)
+    })
+
+    it('should contain lower path', function(done){
+      var app = express()
+      var sub = express.Router()
+
+      sub.get('/:b', function(req, res){
+        res.end(req.baseUrl)
+      })
+      app.use('/:a', sub)
+
+      request(app)
+      .get('/foo/bar')
+      .expect(200, '/foo', done);
+    })
+
+    it('should contain full lower path', function(done){
+      var app = express()
+      var sub1 = express.Router()
+      var sub2 = express.Router()
+      var sub3 = express.Router()
+
+      sub3.get('/:d', function(req, res){
+        res.end(req.baseUrl)
+      })
+      sub2.use('/:c', sub3)
+      sub1.use('/:b', sub2)
+      app.use('/:a', sub1)
+
+      request(app)
+      .get('/foo/bar/baz/zed')
+      .expect(200, '/foo/bar/baz', done);
+    })
+
+    it('should travel through routers correctly', function(done){
+      var urls = []
+      var app = express()
+      var sub1 = express.Router()
+      var sub2 = express.Router()
+      var sub3 = express.Router()
+
+      sub3.get('/:d', function(req, res, next){
+        urls.push('0@' + req.baseUrl)
+        next()
+      })
+      sub2.use('/:c', sub3)
+      sub1.use('/', function(req, res, next){
+        urls.push('1@' + req.baseUrl)
+        next()
+      })
+      sub1.use('/bar', sub2)
+      sub1.use('/bar', function(req, res, next){
+        urls.push('2@' + req.baseUrl)
+        next()
+      })
+      app.use(function(req, res, next){
+        urls.push('3@' + req.baseUrl)
+        next()
+      })
+      app.use('/:a', sub1)
+      app.use(function(req, res, next){
+        urls.push('4@' + req.baseUrl)
+        res.end(urls.join(','))
+      })
+
+      request(app)
+      .get('/foo/bar/baz/zed')
+      .expect(200, '3@,1@/foo,0@/foo/bar/baz,2@/foo/bar,4@', done);
+    })
+  })
+})

From e7e25923579b1537d1f1c8f1d7197e0e241f7c6d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 20 May 2014 10:58:39 -0400
Subject: [PATCH 0226/1265] tests: add more app.param tests

---
 test/app.param.js | 56 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/test/app.param.js b/test/app.param.js
index 6f0ee8e76e7..40650f5b0a6 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -95,5 +95,61 @@ describe('app', function(){
       .get('/user/123')
       .expect('123', done);
     })
+
+    it('should only call once per request', function(done) {
+      var app = express();
+      var called = 0;
+      var count = 0;
+
+      app.param('user', function(req, res, next, user) {
+        called++;
+        req.user = user;
+        next();
+      });
+
+      app.get('/foo/:user', function(req, res, next) {
+        count++;
+        next();
+      });
+      app.get('/foo/:user', function(req, res, next) {
+        count++;
+        next();
+      });
+      app.use(function(req, res) {
+        res.end([count, called, req.user].join(' '));
+      });
+
+      request(app)
+      .get('/foo/bob')
+      .expect('2 1 bob', done);
+    })
+
+    it('should call when values differ', function(done) {
+      var app = express();
+      var called = 0;
+      var count = 0;
+
+      app.param('user', function(req, res, next, user) {
+        called++;
+        req.users = (req.users || []).concat(user);
+        next();
+      });
+
+      app.get('/:user/bob', function(req, res, next) {
+        count++;
+        next();
+      });
+      app.get('/foo/:user', function(req, res, next) {
+        count++;
+        next();
+      });
+      app.use(function(req, res) {
+        res.end([count, called, req.users.join(',')].join(' '));
+      });
+
+      request(app)
+      .get('/foo/bob')
+      .expect('2 2 foo,bob', done);
+    })
   })
 })

From 42b982e13c031beb0ba1fdeab9c2160758e55f47 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 20 May 2014 20:22:55 -0400
Subject: [PATCH 0227/1265] build: remove coveralls from devDependencies

---
 .travis.yml  | 1 +
 package.json | 3 +--
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index bb47c1b042a..1ff243c5e64 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,3 +8,4 @@ matrix:
     - node_js: "0.11"
   fast_finish: true
 script: "npm run-script test-travis"
+after_script: "npm install coveralls@2.10.0 && cat ./coverage/lcov.info | coveralls"
diff --git a/package.json b/package.json
index 4a85ea0fcb4..e754dbcc68f 100644
--- a/package.json
+++ b/package.json
@@ -63,7 +63,6 @@
     "debug": ">= 0.8.0 < 1"
   },
   "devDependencies": {
-    "coveralls": "2.10.0",
     "ejs": "~0.8.4",
     "istanbul": "0.2.10",
     "mocha": "~1.18.2",
@@ -85,6 +84,6 @@
     "prepublish": "npm prune",
     "test": "mocha --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/ && (cat ./coverage/lcov.info | coveralls || true)"
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/"
   }
 }

From ed69b688923c8649ef53090a0f94e98d1e133ce3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 20 May 2014 21:20:56 -0400
Subject: [PATCH 0228/1265] update connect to 2.17.0

---
 History.md   | 8 ++++++++
 package.json | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 29a307a0559..0923cf0788a 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,11 @@
+3.x
+===
+
+ * update connect to 2.17.0
+   - deps: express-session@1.2.0
+   - deps: morgan@1.1.1
+   - deps: serve-index@1.0.3
+
 3.7.0 / 2014-05-18
 ==================
 
diff --git a/package.json b/package.json
index e754dbcc68f..365fb798e18 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
   "repository": "git://github.com/visionmedia/express",
   "license": "MIT",
   "dependencies": {
-    "connect": "2.16.2",
+    "connect": "2.17.0",
     "commander": "1.3.2",
     "methods": "1.0.0",
     "mkdirp": "0.5.0",

From dcecdc9be630e86c504efe75996c6759a346e516 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 20 May 2014 21:22:02 -0400
Subject: [PATCH 0229/1265] update mocha to 1.19.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 365fb798e18..f5e3e981989 100644
--- a/package.json
+++ b/package.json
@@ -65,7 +65,7 @@
   "devDependencies": {
     "ejs": "~0.8.4",
     "istanbul": "0.2.10",
-    "mocha": "~1.18.2",
+    "mocha": "~1.19.0",
     "should": "~3.3.1",
     "jade": "~0.30.0",
     "hjs": "~0.0.6",

From 392ef1eb064ecd3ceb158a263ce0f187a9bbb092 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 20 May 2014 22:57:00 -0400
Subject: [PATCH 0230/1265] tests: add more app.render tests

---
 test/app.render.js | 115 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 115 insertions(+)

diff --git a/test/app.render.js b/test/app.render.js
index a9586c77c68..c6d7a5e3137 100644
--- a/test/app.render.js
+++ b/test/app.render.js
@@ -54,6 +54,27 @@ describe('app', function(){
       })
     })
 
+    it('should handle render error throws', function(done){
+      var app = express();
+
+      function View(name, options){
+        this.name = name;
+        this.path = 'fale';
+      }
+
+      View.prototype.render = function(options, fn){
+        throw new Error('err!');
+      };
+
+      app.set('view', View);
+
+      app.render('something', function(err, str){
+        err.should.be.ok;
+        err.message.should.equal('err!');
+        done();
+      })
+    })
+
     describe('when the file does not exist', function(){
       it('should provide a helpful error', function(done){
         var app = express();
@@ -132,6 +153,68 @@ describe('app', function(){
         })
       })
     })
+
+    describe('caching', function(){
+      it('should always lookup view without cache', function(done){
+        var app = express();
+        var count = 0;
+
+        function View(name, options){
+          this.name = name;
+          this.path = 'fake';
+          count++;
+        }
+
+        View.prototype.render = function(options, fn){
+          fn(null, 'abstract engine');
+        };
+
+        app.set('view cache', false);
+        app.set('view', View);
+
+        app.render('something', function(err, str){
+          if (err) return done(err);
+          count.should.equal(1);
+          str.should.equal('abstract engine');
+          app.render('something', function(err, str){
+            if (err) return done(err);
+            count.should.equal(2);
+            str.should.equal('abstract engine');
+            done();
+          })
+        })
+      })
+
+      it('should cache with "view cache" setting', function(done){
+        var app = express();
+        var count = 0;
+
+        function View(name, options){
+          this.name = name;
+          this.path = 'fake';
+          count++;
+        }
+
+        View.prototype.render = function(options, fn){
+          fn(null, 'abstract engine');
+        };
+
+        app.set('view cache', true);
+        app.set('view', View);
+
+        app.render('something', function(err, str){
+          if (err) return done(err);
+          count.should.equal(1);
+          str.should.equal('abstract engine');
+          app.render('something', function(err, str){
+            if (err) return done(err);
+            count.should.equal(1);
+            str.should.equal('abstract engine');
+            done();
+          })
+        })
+      })
+    })
   })
 
   describe('.render(name, options, fn)', function(){
@@ -175,5 +258,37 @@ describe('app', function(){
         done();
       })
     })
+
+    describe('caching', function(){
+      it('should cache with cache option', function(done){
+        var app = express();
+        var count = 0;
+
+        function View(name, options){
+          this.name = name;
+          this.path = 'fake';
+          count++;
+        }
+
+        View.prototype.render = function(options, fn){
+          fn(null, 'abstract engine');
+        };
+
+        app.set('view cache', false);
+        app.set('view', View);
+
+        app.render('something', {cache: true}, function(err, str){
+          if (err) return done(err);
+          count.should.equal(1);
+          str.should.equal('abstract engine');
+          app.render('something', {cache: true}, function(err, str){
+            if (err) return done(err);
+            count.should.equal(1);
+            str.should.equal('abstract engine');
+            done();
+          })
+        })
+      })
+    })
   })
 })

From ff412b927d539234fc1a037c26fc05ca8892084f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 20 May 2014 23:07:53 -0400
Subject: [PATCH 0231/1265] tests: add req.acceptsEncoding tests

---
 test/req.acceptsEncoding.js | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 test/req.acceptsEncoding.js

diff --git a/test/req.acceptsEncoding.js b/test/req.acceptsEncoding.js
new file mode 100644
index 00000000000..54da10ea709
--- /dev/null
+++ b/test/req.acceptsEncoding.js
@@ -0,0 +1,36 @@
+
+var express = require('../')
+  , request = require('supertest');
+
+describe('req', function(){
+  describe('.acceptsEncodings', function(){
+    it('should be true if encoding accpeted', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        req.acceptsEncoding('gzip').should.be.true;
+        req.acceptsEncoding('deflate').should.be.true;
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .set('Accept-Encoding', ' gzip, deflate')
+      .expect(200, done);
+    })
+
+    it('should be false if encoding not accpeted', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        req.acceptsEncoding('bogus').should.be.false;
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .set('Accept-Encoding', ' gzip, deflate')
+      .expect(200, done);
+    })
+  })
+})

From e660f195078b914846692a5140233c7bfb184429 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 20 May 2014 23:13:29 -0400
Subject: [PATCH 0232/1265] tests: add req.acceptsLanguage tests

---
 test/req.acceptsLanguage.js | 53 +++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 test/req.acceptsLanguage.js

diff --git a/test/req.acceptsLanguage.js b/test/req.acceptsLanguage.js
new file mode 100644
index 00000000000..a095e4616ff
--- /dev/null
+++ b/test/req.acceptsLanguage.js
@@ -0,0 +1,53 @@
+
+var express = require('../')
+  , request = require('supertest');
+
+describe('req', function(){
+  describe('.acceptsLanguage', function(){
+    it('should be true if language accpeted', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        req.acceptsLanguage('en-us').should.be.true;
+        req.acceptsLanguage('en').should.be.true;
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .set('Accept-Language', 'en;q=.5, en-us')
+      .expect(200, done);
+    })
+
+    it('should be false if language not accpeted', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        req.acceptsLanguage('es').should.be.false;
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .set('Accept-Language', 'en;q=.5, en-us')
+      .expect(200, done);
+    })
+
+    describe('when Accept-Language is not present', function(){
+      it('should always return true', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          req.acceptsLanguage('en').should.be.true;
+          req.acceptsLanguage('es').should.be.true;
+          req.acceptsLanguage('jp').should.be.true;
+          res.end();
+        });
+
+        request(app)
+        .get('/')
+        .expect(200, done);
+      })
+    })
+  })
+})

From 83b8b7acb7d90730654f6ee4d707fd9da47826ba Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 20 May 2014 23:25:51 -0400
Subject: [PATCH 0233/1265] tests: add more various tests

---
 test/app.js       | 11 ++++++++++-
 test/app.param.js | 43 +++++++++++++++++++++++++++++++++++++++++++
 test/req.range.js |  9 ++++++++-
 3 files changed, 61 insertions(+), 2 deletions(-)

diff --git a/test/app.js b/test/app.js
index f8ea0f01e6e..cae72331954 100644
--- a/test/app.js
+++ b/test/app.js
@@ -71,4 +71,13 @@ describe('in production', function(){
     app.enabled('view cache').should.be.true;
     process.env.NODE_ENV = 'test';
   })
-})
\ No newline at end of file
+})
+
+describe('without NODE_ENV', function(){
+  it('should default to development', function(){
+    process.env.NODE_ENV = '';
+    var app = express();
+    app.get('env').should.equal('development');
+    process.env.NODE_ENV = 'test';
+  })
+})
diff --git a/test/app.param.js b/test/app.param.js
index 6f0ee8e76e7..ab296865132 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -37,6 +37,11 @@ describe('app', function(){
       });
 
     })
+
+    it('should fail if not given fn', function(){
+      var app = express();
+      app.param.bind(app, ':name', 'bob').should.throw();
+    })
   })
 
   describe('.param(names, fn)', function(){
@@ -95,5 +100,43 @@ describe('app', function(){
       .get('/user/123')
       .expect('123', done);
     })
+
+    it('should catch thrown error', function(done){
+      var app = express();
+
+      app.param('id', function(req, res, next, id){
+        throw new Error('err!');
+      });
+
+      app.get('/user/:id', function(req, res){
+        var id = req.params.id;
+        res.send('' + id);
+      });
+
+      request(app)
+      .get('/user/123')
+      .expect(500, done);
+    })
+
+    it('should defer to next route', function(done){
+      var app = express();
+
+      app.param('id', function(req, res, next, id){
+        next('route');
+      });
+
+      app.get('/user/:id', function(req, res){
+        var id = req.params.id;
+        res.send('' + id);
+      });
+
+      app.get('/:name/123', function(req, res){
+        res.send('name');
+      });
+
+      request(app)
+      .get('/user/123')
+      .expect('name', done);
+    })
   })
 })
diff --git a/test/req.range.js b/test/req.range.js
index a71a467050d..08cf8f91e92 100644
--- a/test/req.range.js
+++ b/test/req.range.js
@@ -1,5 +1,6 @@
 
-var express = require('../');
+var assert = require('assert');
+var express = require('..');
 
 function req(ret) {
   return {
@@ -27,5 +28,11 @@ describe('req', function(){
       ret.type = 'users';
       req('users=0-').range(Infinity).should.eql(ret);
     })
+
+    it('should return undefined if no range', function(){
+      var ret = [{ start: 0, end: 50 }, { start: 60, end: 100 }];
+      ret.type = 'bytes';
+      assert(req('').range(120) === undefined);
+    })
   })
 })

From 602e5a82004d243f626002c52d843a0c14ac7ed4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 20 May 2014 23:41:09 -0400
Subject: [PATCH 0234/1265] tests: add more tests of mvc example

---
 examples/mvc/controllers/pet/index.js |  2 +-
 test/acceptance/mvc.js                | 64 +++++++++++++++++++++------
 2 files changed, 52 insertions(+), 14 deletions(-)

diff --git a/examples/mvc/controllers/pet/index.js b/examples/mvc/controllers/pet/index.js
index bce0eacb4b5..9f3c34525ef 100644
--- a/examples/mvc/controllers/pet/index.js
+++ b/examples/mvc/controllers/pet/index.js
@@ -20,7 +20,7 @@ exports.edit = function(req, res, next){
 
 exports.update = function(req, res, next){
   var body = req.body;
-  req.pet.name = body.user.name;
+  req.pet.name = body.pet.name;
   res.message('Information updated!');
   res.redirect('/pet/' + req.pet.id);
 };
diff --git a/test/acceptance/mvc.js b/test/acceptance/mvc.js
index 3386d8338a8..813c55062cc 100644
--- a/test/acceptance/mvc.js
+++ b/test/acceptance/mvc.js
@@ -7,10 +7,38 @@ describe('mvc', function(){
     it('should redirect to /users', function(done){
       request(app)
       .get('/')
+      .expect('Location', '/users')
+      .expect(302, done)
+    })
+  })
+
+  describe('GET /pet/0', function(){
+    it('should get pet', function(done){
+      request(app)
+      .get('/pet/0')
+      .expect(200, /Tobi/, done)
+    })
+  })
+
+  describe('GET /pet/0/edit', function(){
+    it('should get pet edit page', function(done){
+      request(app)
+      .get('/pet/0/edit')
+      .expect(/<form/)
+      .expect(200, /Tobi/, done)
+    })
+  })
+
+  describe('PUT /pet/2', function(){
+    it('should update the pet', function(done){
+      request(app)
+      .put('/pet/3')
+      .send({ pet: { name: 'Boots' } })
       .end(function(err, res){
-        res.should.have.status(302);
-        res.headers.location.should.include('/users');
-        done();
+        if (err) return done(err);
+        request(app)
+        .get('/pet/3/edit')
+        .expect(200, /Boots/, done)
       })
     })
   })
@@ -65,11 +93,8 @@ describe('mvc', function(){
     it('should display the edit form', function(done){
       request(app)
       .get('/user/1/edit')
-      .end(function(err, res){
-        res.text.should.include('<h1>Guillermo</h1>');
-        res.text.should.include('value="put"');
-        done();
-      })
+      .expect(/Guillermo/)
+      .expect(200, /<form/, done)
     })
   })
 
@@ -79,13 +104,26 @@ describe('mvc', function(){
       .put('/user/1')
       .send({ user: { name: 'Tobo' }})
       .end(function(err, res){
+        if (err) return done(err);
         request(app)
         .get('/user/1/edit')
-        .end(function(err, res){
-          res.text.should.include('<h1>Tobo</h1>');
-          done();
-        })
+        .expect(200, /Tobo/, done)
+      })
+    })
+  })
+
+  describe('POST /user/:id/pet', function(){
+    it('should create a pet for user', function(done){
+      request(app)
+      .post('/user/2/pet')
+      .send({ pet: { name: 'Snickers' }})
+      .expect('Location', '/user/2')
+      .expect(302, function(err, res){
+        if (err) return done(err)
+        request(app)
+        .get('/user/2')
+        .expect(200, /Snickers/, done)
       })
     })
   })
-})
\ No newline at end of file
+})

From 1944451082e8cdb2882f8b00fb1ddc04e8eab1a5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 20 May 2014 23:50:58 -0400
Subject: [PATCH 0235/1265] tests: add more tests of negotiation example

---
 test/acceptance/content-negotiation.js | 37 ++++++++++++++++++++++----
 1 file changed, 32 insertions(+), 5 deletions(-)

diff --git a/test/acceptance/content-negotiation.js b/test/acceptance/content-negotiation.js
index 99842585231..ac9dbaf557e 100644
--- a/test/acceptance/content-negotiation.js
+++ b/test/acceptance/content-negotiation.js
@@ -7,16 +7,43 @@ describe('content-negotiation', function(){
     it('should default to text/html', function(done){
       request(app)
       .get('/')
-      .expect('<ul><li>Tobi</li><li>Loki</li><li>Jane</li></ul>')
-      .end(done);
+      .expect(200, '<ul><li>Tobi</li><li>Loki</li><li>Jane</li></ul>', done)
     })
 
     it('should accept to text/plain', function(done){
       request(app)
       .get('/')
       .set('Accept', 'text/plain')
-      .expect(' - Tobi\n - Loki\n - Jane\n')
-      .end(done);
+      .expect(200, ' - Tobi\n - Loki\n - Jane\n', done)
+    })
+
+    it('should accept to application/json', function(done){
+      request(app)
+      .get('/')
+      .set('Accept', 'application/json')
+      .expect(200, '[{"name":"Tobi"},{"name":"Loki"},{"name":"Jane"}]', done)
+    })
+  })
+
+  describe('GET /users', function(){
+    it('should default to text/html', function(done){
+      request(app)
+      .get('/users')
+      .expect(200, '<ul><li>Tobi</li><li>Loki</li><li>Jane</li></ul>', done)
+    })
+
+    it('should accept to text/plain', function(done){
+      request(app)
+      .get('/users')
+      .set('Accept', 'text/plain')
+      .expect(200, ' - Tobi\n - Loki\n - Jane\n', done)
+    })
+
+    it('should accept to application/json', function(done){
+      request(app)
+      .get('/users')
+      .set('Accept', 'application/json')
+      .expect(200, '[{"name":"Tobi"},{"name":"Loki"},{"name":"Jane"}]', done)
     })
   })
-})
\ No newline at end of file
+})

From cf5de082b5f8a41d56d24d3f7eb885b7e8c84519 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 May 2014 00:08:06 -0400
Subject: [PATCH 0236/1265] tests: add more tests of cookies example

---
 test/acceptance/cookies.js | 43 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 41 insertions(+), 2 deletions(-)

diff --git a/test/acceptance/cookies.js b/test/acceptance/cookies.js
index d6d4f007c2e..987c539eeb4 100644
--- a/test/acceptance/cookies.js
+++ b/test/acceptance/cookies.js
@@ -18,6 +18,35 @@ describe('cookies', function(){
         done()
       })
     })
+
+    it('should respond to cookie', function(done){
+      request(app)
+      .post('/')
+      .send({ remember: 1 })
+      .expect(302, function(err, res){
+        if (err) return done(err)
+        request(app)
+        .get('/')
+        .set('Cookie', res.headers['set-cookie'][0])
+        .expect(200, /Remembered/, done)
+      })
+    })
+  })
+
+  describe('GET /forget', function(){
+    it('should clear cookie', function(done){
+      request(app)
+      .post('/')
+      .send({ remember: 1 })
+      .expect(302, function(err, res){
+        if (err) return done(err)
+        request(app)
+        .get('/forget')
+        .set('Cookie', res.headers['set-cookie'][0])
+        .expect('Set-Cookie', /remember=;/)
+        .expect(302, done)
+      })
+    })
   })
 
   describe('POST /', function(){
@@ -25,10 +54,20 @@ describe('cookies', function(){
       request(app)
       .post('/')
       .send({ remember: 1 })
-      .end(function(err, res){
+      .expect(302, function(err, res){
         res.headers.should.have.property('set-cookie')
         done()
       })
     })
+
+    it('should no set cookie w/o reminder', function(done){
+      request(app)
+      .post('/')
+      .send({})
+      .expect(302, function(err, res){
+        res.headers.should.not.have.property('set-cookie')
+        done()
+      })
+    })
   })
-})
\ No newline at end of file
+})

From 8d7d80ef9d307a3b76e9d202e7527350d47c4531 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 May 2014 00:08:17 -0400
Subject: [PATCH 0237/1265] tests: add more tests of web-service example

---
 test/acceptance/web-service.js | 73 +++++++++++++++++++++++++++++++---
 1 file changed, 67 insertions(+), 6 deletions(-)

diff --git a/test/acceptance/web-service.js b/test/acceptance/web-service.js
index 67e9b44ab8e..9fdf7a4ef63 100644
--- a/test/acceptance/web-service.js
+++ b/test/acceptance/web-service.js
@@ -24,11 +24,72 @@ describe('web-service', function(){
       it('should respond users json', function(done){
         request(app)
         .get('/api/users?api-key=foo')
-        .end(function(err, res){
-          res.should.be.json;
-          res.text.should.equal('[{"name":"tobi"},{"name":"loki"},{"name":"jane"}]');
-          done();
-        });
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, '[{"name":"tobi"},{"name":"loki"},{"name":"jane"}]', done)
+      })
+    })
+  })
+
+  describe('GET /api/repos', function(){
+    describe('without an api key', function(){
+      it('should respond with 400 bad request', function(done){
+        request(app)
+        .get('/api/repos')
+        .expect(400, done);
+      })
+    })
+
+    describe('with an invalid api key', function(){
+      it('should respond with 401 unauthorized', function(done){
+        request(app)
+        .get('/api/repos?api-key=rawr')
+        .expect(401, done);
+      })
+    })
+
+    describe('with a valid api key', function(){
+      it('should respond repos json', function(done){
+        request(app)
+        .get('/api/repos?api-key=foo')
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(/"name":"express"/)
+        .expect(/"url":"http:\/\/github.com\/visionmedia\/express"/)
+        .expect(200, done)
+      })
+    })
+  })
+
+  describe('GET /api/user/:name/repos', function(){
+    describe('without an api key', function(){
+      it('should respond with 400 bad request', function(done){
+        request(app)
+        .get('/api/user/loki/repos')
+        .expect(400, done);
+      })
+    })
+
+    describe('with an invalid api key', function(){
+      it('should respond with 401 unauthorized', function(done){
+        request(app)
+        .get('/api/user/loki/repos?api-key=rawr')
+        .expect(401, done);
+      })
+    })
+
+    describe('with a valid api key', function(){
+      it('should respond user repos json', function(done){
+        request(app)
+        .get('/api/user/loki/repos?api-key=foo')
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(/"name":"stylus"/)
+        .expect(/"url":"http:\/\/github.com\/learnboost\/stylus"/)
+        .expect(200, done)
+      })
+
+      it('should 404 with unknown user', function(done){
+        request(app)
+        .get('/api/user/bob/repos?api-key=foo')
+        .expect(404, done)
       })
     })
   })
@@ -45,4 +106,4 @@ describe('web-service', function(){
       });
     })
   })
-})
\ No newline at end of file
+})

From b0f72e13d95b56e78673e9fdf0bc7214f23f4bcf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 May 2014 00:55:10 -0400
Subject: [PATCH 0238/1265] update connect to 2.17.1

---
 History.md   | 3 ++-
 package.json | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 0923cf0788a..a7dcc2ef4cb 100644
--- a/History.md
+++ b/History.md
@@ -1,7 +1,8 @@
 3.x
 ===
 
- * update connect to 2.17.0
+ * update connect to 2.17.1
+   - fix `res.charset` appending charset when `content-type` has one
    - deps: express-session@1.2.0
    - deps: morgan@1.1.1
    - deps: serve-index@1.0.3
diff --git a/package.json b/package.json
index f5e3e981989..ef84bfe2867 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
   "repository": "git://github.com/visionmedia/express",
   "license": "MIT",
   "dependencies": {
-    "connect": "2.17.0",
+    "connect": "2.17.1",
     "commander": "1.3.2",
     "methods": "1.0.0",
     "mkdirp": "0.5.0",

From 084f5d891b4dd413caca21283a3127bb28f9069d Mon Sep 17 00:00:00 2001
From: Alberto Leal <albertoleal>
Date: Fri, 2 May 2014 15:33:09 -0300
Subject: [PATCH 0239/1265] Keep previous Content-Type for res.jsonp

backport of commit be997fd654243a8633aa059343665cf2c88fe609
---
 History.md        |  1 +
 lib/response.js   |  2 +-
 test/res.jsonp.js | 18 ++++++++++++++++++
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a7dcc2ef4cb..9883f46975c 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 3.x
 ===
 
+ * keep previous `Content-Type` for `res.jsonp`
  * update connect to 2.17.1
    - fix `res.charset` appending charset when `content-type` has one
    - deps: express-session@1.2.0
diff --git a/lib/response.js b/lib/response.js
index 8054e5ca7ed..11b1f7a4145 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -248,7 +248,7 @@ res.jsonp = function(obj){
 
   // content-type
   this.charset = this.charset || 'utf-8';
-  this.set('Content-Type', 'application/json');
+  this.get('Content-Type') || this.set('Content-Type', 'application/json');
 
   // fixup callback
   if (Array.isArray(callback)) {
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 03087ec433c..7900b5a4e79 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -334,4 +334,22 @@ describe('res', function(){
       })
     })
   })
+
+  it('should not override previous Content-Types', function(done){
+    var app = express();
+
+    app.get('/', function(req, res){
+      res.type('application/vnd.example+json');
+      res.jsonp({ hello: 'world' });
+    });
+
+    request(app)
+    .get('/')
+    .end(function(err, res){
+      res.statusCode.should.equal(200);
+      res.headers.should.have.property('content-type', 'application/vnd.example+json');
+      res.text.should.equal('{"hello":"world"}');
+      done();
+    })
+  })
 })

From f14e39d4515c81c1e5c980b7ce31566eeeb84734 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 May 2014 23:27:21 -0400
Subject: [PATCH 0240/1265] set proper charset in content-type for res.send

This will write strings to sockets with an explicit "utf8" encoding
(which is the default) and will override the charset in the
Content-Type so it properly relfects the encoding of the response.

closes #1631
closes #2092
---
 History.md             |   1 +
 lib/response.js        |  17 +++++-
 lib/utils.js           |  36 ++++++++++++
 test/res.attachment.js |   2 +-
 test/res.charset.js    |   4 +-
 test/res.format.js     |   6 +-
 test/res.json.js       |  95 ++++++++++++-------------------
 test/res.jsonp.js      | 123 ++++++++++++++++++-----------------------
 test/res.send.js       |  38 ++++++++++---
 9 files changed, 179 insertions(+), 143 deletions(-)

diff --git a/History.md b/History.md
index 9883f46975c..32ee57bc1eb 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@
 ===
 
  * keep previous `Content-Type` for `res.jsonp`
+ * set proper `charset` in `Content-Type` for `res.send`
  * update connect to 2.17.1
    - fix `res.charset` appending charset when `content-type` has one
    - deps: express-session@1.2.0
diff --git a/lib/response.js b/lib/response.js
index 11b1f7a4145..b7ec7ae55c2 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -9,6 +9,7 @@ var http = require('http')
   , sign = require('cookie-signature').sign
   , normalizeType = require('./utils').normalizeType
   , normalizeTypes = require('./utils').normalizeTypes
+  , setCharset = require('./utils').setCharset
   , deprecate = require('./utils').deprecate
   , etag = require('./utils').etag
   , statusCodes = http.STATUS_CODES
@@ -83,6 +84,8 @@ res.links = function(links){
 res.send = function(body){
   var req = this.req;
   var head = 'HEAD' == req.method;
+  var type;
+  var encoding;
   var len;
 
   // settings
@@ -140,6 +143,17 @@ res.send = function(body){
     }
   }
 
+  // write strings in utf-8
+  if ('string' === typeof body) {
+    encoding = 'utf8';
+    type = this.get('Content-Type');
+
+    // reflect this in content-type
+    if ('string' === typeof type) {
+      this.set('Content-Type', setCharset(type, 'utf-8'));
+    }
+  }
+
   // freshness
   if (req.fresh) this.statusCode = 304;
 
@@ -152,7 +166,8 @@ res.send = function(body){
   }
 
   // respond
-  this.end(head ? null : body);
+  this.end((head ? null : body), encoding);
+
   return this;
 };
 
diff --git a/lib/utils.js b/lib/utils.js
index d9dff89dd21..6abce481213 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -14,6 +14,11 @@ var mime = require('connect').mime
 
 var toString = {}.toString;
 
+/**
+ * Simple detection of charset parameter in content-type
+ */
+var charsetRegExp = /;\s*charset\s*=/;
+
 /**
  * Deprecate function, like core `util.deprecate`,
  * but with NODE_ENV and color support.
@@ -367,3 +372,34 @@ exports.compileTrust = function(val) {
 
   return proxyaddr.compile(val || []);
 }
+
+/**
+ * Set the charset in a given Content-Type string.
+ *
+ * @param {String} type
+ * @param {String} charset
+ * @return {String}
+ * @api private
+ */
+
+exports.setCharset = function(type, charset){
+  if (!type || !charset) return type;
+
+  var exists = charsetRegExp.test(type);
+
+  // removing existing charset
+  if (exists) {
+    var parts = type.split(';');
+
+    for (var i = 1; i < parts.length; i++) {
+      if (charsetRegExp.test(';' + parts[i])) {
+        parts.splice(i, 1);
+        break;
+      }
+    }
+
+    type = parts.join(';');
+  }
+
+  return type + '; charset=' + charset;
+};
diff --git a/test/res.attachment.js b/test/res.attachment.js
index 1049b07cf59..4e0421f6cc9 100644
--- a/test/res.attachment.js
+++ b/test/res.attachment.js
@@ -36,7 +36,7 @@ describe('res', function(){
 
       app.use(function(req, res){
         res.attachment('/path/to/image.png');
-        res.send('foo');
+        res.send(new Buffer(4));
       });
 
       request(app)
diff --git a/test/res.charset.js b/test/res.charset.js
index 2403ba4df4a..8fd2d40951b 100644
--- a/test/res.charset.js
+++ b/test/res.charset.js
@@ -18,7 +18,7 @@ describe('res', function(){
       .expect("text/x-foo; charset=utf-8", done);
     })
 
-    it('should take precedence over res.send() defaults', function(done){
+    it('should be replaced by real charset in res.send', function(done){
       var app = express();
 
       app.use(function(req, res){
@@ -28,7 +28,7 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('Content-Type', 'text/html; charset=whoop', done);
+      .expect('Content-Type', 'text/html; charset=utf-8', done);
     })
   })
 })
diff --git a/test/res.format.js b/test/res.format.js
index be1e6cbb31c..105c2b05aaa 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -111,7 +111,7 @@ function test(app) {
     request(app)
     .get('/')
     .set('Accept', 'text/html; q=.5, text/plain')
-    .expect('Content-Type', 'text/plain; charset=UTF-8')
+    .expect('Content-Type', 'text/plain; charset=utf-8')
     .expect('hey', done);
   })
 
@@ -119,12 +119,12 @@ function test(app) {
     request(app)
     .get('/')
     .set('Accept', 'text/html')
-    .expect('Content-Type', 'text/html; charset=UTF-8');
+    .expect('Content-Type', 'text/html; charset=utf-8');
 
     request(app)
     .get('/')
     .set('Accept', 'text/plain')
-    .expect('Content-Type', 'text/plain; charset=UTF-8');
+    .expect('Content-Type', 'text/plain; charset=utf-8');
 
     request(app)
     .get('/')
diff --git a/test/res.json.js b/test/res.json.js
index 9cefe259e21..f9c2213b300 100644
--- a/test/res.json.js
+++ b/test/res.json.js
@@ -17,6 +17,20 @@ describe('res', function(){
       .expect('{"foo":"bar"}', done);
     })
 
+    it('should not override previous Content-Types', function(done){
+      var app = express();
+
+      app.get('/', function(req, res){
+        res.type('application/vnd.example+json');
+        res.json({ hello: 'world' });
+      });
+
+      request(app)
+      .get('/')
+      .expect('Content-Type', 'application/vnd.example+json; charset=utf-8')
+      .expect(200, '{"hello":"world"}', done);
+    })
+
     describe('when given primitives', function(){
       it('should respond with json for null', function(done){
         var app = express();
@@ -27,11 +41,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-          res.text.should.equal('null');
-          done();
-        })
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, 'null', done)
       })
 
       it('should respond with json for Number', function(done){
@@ -43,12 +54,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.statusCode.should.equal(200);
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-          res.text.should.equal('300');
-          done();
-        })
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, '300', done)
       })
 
       it('should respond with json for String', function(done){
@@ -60,12 +67,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.statusCode.should.equal(200);
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-          res.text.should.equal('"str"');
-          done();
-        })
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, '"str"', done)
       })
     })
 
@@ -79,11 +82,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-          res.text.should.equal('["foo","bar","baz"]');
-          done();
-        })
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, '["foo","bar","baz"]', done)
       })
     })
     
@@ -97,11 +97,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-          res.text.should.equal('{"name":"tobi"}');
-          done();
-        })
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, '{"name":"tobi"}', done)
       })
     })
 
@@ -121,10 +118,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.text.should.equal('{"name":"tobi"}');
-          done();
-        });
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, '{"name":"tobi"}', done)
       })
     })
 
@@ -152,10 +147,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.text.should.equal('{\n  "name": "tobi",\n  "age": 2\n}');
-          done();
-        });
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, '{\n  "name": "tobi",\n  "age": 2\n}', done)
       })
     })
   })
@@ -170,12 +163,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.statusCode.should.equal(201);
-        res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-        res.text.should.equal('{"id":1}');
-        done();
-      })
+      .expect('Content-Type', 'application/json; charset=utf-8')
+      .expect(201, '{"id":1}', done)
     })
   })
 
@@ -189,12 +178,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.statusCode.should.equal(201);
-        res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-        res.text.should.equal('{"id":1}');
-        done();
-      })
+      .expect('Content-Type', 'application/json; charset=utf-8')
+      .expect(201, '{"id":1}', done)
     })
 
     it('should use status as second number for backwards compat', function(done){
@@ -206,12 +191,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.statusCode.should.equal(201);
-        res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-        res.text.should.equal('200');
-        done();
-      })
+      .expect('Content-Type', 'application/json; charset=utf-8')
+      .expect(201, '200', done)
     })
   })
 
@@ -225,11 +206,7 @@ describe('res', function(){
 
     request(app)
     .get('/')
-    .end(function(err, res){
-      res.statusCode.should.equal(200);
-      res.headers.should.have.property('content-type', 'application/vnd.example+json');
-      res.text.should.equal('{"hello":"world"}');
-      done();
-    })
+    .expect('content-type', 'application/vnd.example+json; charset=utf-8')
+    .expect(200, '{"hello":"world"}', done)
   })
 })
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 7900b5a4e79..3637a23ed52 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -46,11 +46,8 @@ describe('res', function(){
 
       request(app)
       .get('/?callback[a]=something')
-      .end(function(err, res){
-        res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-        res.text.should.equal('{"count":1}');
-        done();
-      })
+      .expect('Content-Type', 'application/json; charset=utf-8')
+      .expect(200, '{"count":1}', done)
     })
 
     it('should allow renaming callback', function(done){
@@ -119,6 +116,34 @@ describe('res', function(){
       });
     });
 
+    it('should not override previous Content-Types with no callback', function(done){
+      var app = express();
+
+      app.get('/', function(req, res){
+        res.type('application/vnd.example+json');
+        res.jsonp({ hello: 'world' });
+      });
+
+      request(app)
+      .get('/')
+      .expect('Content-Type', 'application/vnd.example+json; charset=utf-8')
+      .expect(200, '{"hello":"world"}', done);
+    })
+
+    it('should override previous Content-Types with callback', function(done){
+      var app = express();
+
+      app.get('/', function(req, res){
+        res.type('application/vnd.example+json');
+        res.jsonp({ hello: 'world' });
+      });
+
+      request(app)
+      .get('/?callback=cb')
+      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect(200, /cb\(\{"hello":"world"\}\);$/, done);
+    })
+
     describe('when given primitives', function(){
       it('should respond with json', function(done){
         var app = express();
@@ -129,11 +154,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-          res.text.should.equal('null');
-          done();
-        })
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, 'null', done)
       })
     })
 
@@ -147,11 +169,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-          res.text.should.equal('["foo","bar","baz"]');
-          done();
-        })
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, '["foo","bar","baz"]', done)
       })
     })
 
@@ -165,11 +184,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-          res.text.should.equal('{"name":"tobi"}');
-          done();
-        })
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, '{"name":"tobi"}', done)
       })
     })
 
@@ -183,11 +199,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-          res.text.should.equal('null');
-          done();
-        })
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, 'null', done)
       })
 
       it('should respond with json for Number', function(done){
@@ -199,12 +212,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.statusCode.should.equal(200);
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-          res.text.should.equal('300');
-          done();
-        })
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, '300', done)
       })
 
       it('should respond with json for String', function(done){
@@ -216,12 +225,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.statusCode.should.equal(200);
-          res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-          res.text.should.equal('"str"');
-          done();
-        })
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, '"str"', done)
       })
     })
 
@@ -241,10 +246,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.text.should.equal('{"name":"tobi"}');
-          done();
-        });
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, '{"name":"tobi"}', done)
       })
     })
 
@@ -272,10 +275,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.text.should.equal('{\n  "name": "tobi",\n  "age": 2\n}');
-          done();
-        });
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, '{\n  "name": "tobi",\n  "age": 2\n}', done)
       })
     })
   })
@@ -290,12 +291,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.statusCode.should.equal(201);
-        res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-        res.text.should.equal('{"id":1}');
-        done();
-      })
+      .expect('Content-Type', 'application/json; charset=utf-8')
+      .expect(201, '{"id":1}', done)
     })
   })
 
@@ -309,12 +306,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.statusCode.should.equal(201);
-        res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-        res.text.should.equal('{"id":1}');
-        done();
-      })
+      .expect('Content-Type', 'application/json; charset=utf-8')
+      .expect(201, '{"id":1}', done)
     })
 
     it('should use status as second number for backwards compat', function(done){
@@ -326,12 +319,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.statusCode.should.equal(201);
-        res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-        res.text.should.equal('200');
-        done();
-      })
+      .expect('Content-Type', 'application/json; charset=utf-8')
+      .expect(201, '200', done)
     })
   })
 
@@ -345,11 +334,7 @@ describe('res', function(){
 
     request(app)
     .get('/')
-    .end(function(err, res){
-      res.statusCode.should.equal(200);
-      res.headers.should.have.property('content-type', 'application/vnd.example+json');
-      res.text.should.equal('{"hello":"world"}');
-      done();
-    })
+    .expect('content-type', 'application/vnd.example+json; charset=utf-8')
+    .expect(200, '{"hello":"world"}', done)
   })
 })
diff --git a/test/res.send.js b/test/res.send.js
index 98d4b8755ce..3eb2776655e 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -135,9 +135,34 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('Content-Type', 'text/plain')
-      .expect('hey')
-      .expect(200, done);
+      .expect('Content-Type', 'text/plain; charset=utf-8')
+      .expect(200, 'hey', done);
+    })
+
+    it('should override charset in Content-Type', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.set('Content-Type', 'text/plain; charset=iso-8859-1').send('hey');
+      });
+
+      request(app)
+      .get('/')
+      .expect('Content-Type', 'text/plain; charset=utf-8')
+      .expect(200, 'hey', done);
+    })
+
+    it('should keep charset in Content-Type for Buffers', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.set('Content-Type', 'text/plain; charset=iso-8859-1').send(new Buffer('hi'));
+      });
+
+      request(app)
+      .get('/')
+      .expect('Content-Type', 'text/plain; charset=iso-8859-1')
+      .expect(200, 'hi', done);
     })
   })
 
@@ -201,11 +226,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.headers.should.have.property('content-type', 'application/json; charset=utf-8');
-        res.text.should.equal('{"name":"tobi"}');
-        done();
-      })
+      .expect('Content-Type', 'application/json; charset=utf-8')
+      .expect(200, '{"name":"tobi"}', done)
     })
   })
 

From f6bbeafd26daf12891d912ef604bad5b206d904f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 May 2014 01:52:14 -0400
Subject: [PATCH 0241/1265] 3.8.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 32ee57bc1eb..c34469bb6e8 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.8.0 / 2014-05-21
+==================
 
  * keep previous `Content-Type` for `res.jsonp`
  * set proper `charset` in `Content-Type` for `res.send`
diff --git a/package.json b/package.json
index ef84bfe2867..9784985eb74 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.7.0",
+  "version": "3.8.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From 91e0c2725260bd40ec2c771a603299aa0f63b28d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 May 2014 02:11:31 -0400
Subject: [PATCH 0242/1265] update example dependencies

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index c468db6f8da..046c15731cb 100644
--- a/package.json
+++ b/package.json
@@ -80,9 +80,9 @@
     "hjs": "~0.0.6",
     "body-parser": "1.2.0",
     "cookie-parser": "1.1.0",
-    "express-session": "1.1.0",
+    "express-session": "1.2.0",
     "method-override": "1.0.1",
-    "morgan": "1.1.0",
+    "morgan": "1.1.1",
     "vhost": "1.0.0"
   },
   "engines": {

From 4e12a728736735400c72035cd800b7f1a57ed2f5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 May 2014 02:13:03 -0400
Subject: [PATCH 0243/1265] 4.3.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index a0be169befe..a0ee7fdf0c4 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.3.0 / 2014-05-21
+==================
 
  * add `req.baseUrl` to access the path stripped from `req.url` in routes
  * fix behavior of multiple `app.VERB` for the same path
diff --git a/package.json b/package.json
index 046c15731cb..85479970d89 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.2.0",
+  "version": "4.3.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From 7f049164b7f253166b43b789475971d6dd8ec2c0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 23 May 2014 18:35:20 -0400
Subject: [PATCH 0244/1265] Revert "fix behavior of multiple app.VERB for the
 same path"

This reverts commit 31b2e2d7b4774eed16a93f9a8a20a9967e91e524.

fixes #2133
---
 History.md         |  6 ++++++
 lib/application.js | 42 +++++++-----------------------------------
 test/app.head.js   | 23 +----------------------
 3 files changed, 14 insertions(+), 57 deletions(-)

diff --git a/History.md b/History.md
index a0ee7fdf0c4..546892c841c 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+ * revert "fix behavior of multiple `app.VERB` for the same path"
+   - this caused a regression in the order of route execution
+
 4.3.0 / 2014-05-21
 ==================
 
diff --git a/lib/application.js b/lib/application.js
index 7bfed38090a..39bdbecbe03 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -31,7 +31,6 @@ var app = exports = module.exports = {};
  */
 
 app.init = function(){
-  this._baseRoutes = {};
   this.cache = {};
   this.settings = {};
   this.engines = {};
@@ -408,11 +407,11 @@ app.disable = function(setting){
 
 methods.forEach(function(method){
   app[method] = function(path){
-    if (method === 'get' && arguments.length === 1) {
-      return this.set(path);
-    }
+    if ('get' == method && 1 == arguments.length) return this.set(path);
+
+    this.lazyrouter();
 
-    var route = this._baseRoute(path);
+    var route = this._router.route(path);
     route[method].apply(route, [].slice.call(arguments, 1));
     return this;
   };
@@ -429,7 +428,9 @@ methods.forEach(function(method){
  */
 
 app.all = function(path){
-  var route = this._baseRoute(path);
+  this.lazyrouter();
+
+  var route = this._router.route(path);
   var args = [].slice.call(arguments, 1);
   methods.forEach(function(method){
     route[method].apply(route, args);
@@ -538,32 +539,3 @@ app.listen = function(){
   var server = http.createServer(this);
   return server.listen.apply(server, arguments);
 };
-
-/**
- * Get or create a new base route for path.
- *
- * @param {String} path
- * @return {Route}
- * @api private
- */
-
-app._baseRoute = function(path){
-  this.lazyrouter();
-
-  var key = typeof path !== 'string'
-    ? 'o:' + String(path)
-    : 's:' + path;
-
-  if (path.ignoreCase || !this._router.caseSensitive) {
-    key = 'i' + key.toLowerCase();
-  }
-
-  var route = this._baseRoutes[key];
-
-  if (!route) {
-    route = this._router.route(path);
-    this._baseRoutes[key] = route;
-  }
-
-  return route;
-};
diff --git a/test/app.head.js b/test/app.head.js
index a59eb898bf2..9ba2ad9a911 100644
--- a/test/app.head.js
+++ b/test/app.head.js
@@ -42,7 +42,7 @@ describe('HEAD', function(){
 })
 
 describe('app.head()', function(){
-  it('should override prior', function(done){
+  it('should override', function(done){
     var app = express()
       , called;
 
@@ -56,27 +56,6 @@ describe('app.head()', function(){
       res.send('tobi');
     });
 
-    request(app)
-    .head('/tobi')
-    .expect(200, function(){
-      assert(called);
-      done();
-    });
-  })
-  it('should override after', function(done){
-    var app = express()
-      , called;
-
-    app.get('/tobi', function(req, res){
-      assert(0, 'should not call GET');
-      res.send('tobi');
-    });
-
-    app.head('/tobi', function(req, res){
-      called = true;
-      res.end('');
-    });
-
     request(app)
     .head('/tobi')
     .expect(200, function(){

From c3470c9c964c0efe408f335a33508776ea17b51c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 23 May 2014 18:46:00 -0400
Subject: [PATCH 0245/1265] tests: add route ordering test

---
 test/app.router.js | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/test/app.router.js b/test/app.router.js
index 3373813d322..fc236cc807a 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -588,6 +588,45 @@ describe('app.router', function(){
     .expect('editing user 12', done);
   })
 
+  it('should run in order added', function(done){
+    var app = express();
+    var path = [];
+
+    app.get('*', function(req, res, next){
+      path.push(0);
+      next();
+    });
+
+    app.get('/user/:id', function(req, res, next){
+      path.push(1);
+      next();
+    });
+
+    app.use(function(req, res, next){
+      path.push(2);
+      next();
+    });
+
+    app.all('/user/:id', function(req, res, next){
+      path.push(3);
+      next();
+    });
+
+    app.get('*', function(req, res, next){
+      path.push(4);
+      next();
+    });
+
+    app.use(function(req, res, next){
+      path.push(5);
+      res.end(path.join(','))
+    });
+
+    request(app)
+    .get('/user/1')
+    .expect(200, '0,1,2,3,4,5', done);
+  })
+
   it('should be chainable', function(){
     var app = express();
     app.get('/', function(){}).should.equal(app);

From 87e02c30e74fccce0c2ca77c0e0de8a1d8c62368 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 23 May 2014 19:11:28 -0400
Subject: [PATCH 0246/1265] 4.3.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 546892c841c..44f3f0ecb1b 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.3.1 / 2014-05-23
+==================
 
  * revert "fix behavior of multiple `app.VERB` for the same path"
    - this caused a regression in the order of route execution
diff --git a/package.json b/package.json
index 85479970d89..a796f1f9b0f 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.3.0",
+  "version": "4.3.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From 867728b5ab54f50112afab7efbb7f6301e5f60ea Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 27 May 2014 23:02:27 -0400
Subject: [PATCH 0247/1265] update connect to 2.17.3

---
 History.md   | 8 ++++++++
 package.json | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c34469bb6e8..d692cf9e9ff 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,11 @@
+unreleased
+==========
+
+ * update connect to 2.17.3
+   - deps: body-parser@1.2.2
+   - deps: express-session@1.2.1
+   - deps: method-override@1.0.2
+
 3.8.0 / 2014-05-21
 ==================
 
diff --git a/package.json b/package.json
index 9784985eb74..7eac0bcedc6 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
   "repository": "git://github.com/visionmedia/express",
   "license": "MIT",
   "dependencies": {
-    "connect": "2.17.1",
+    "connect": "2.17.3",
     "commander": "1.3.2",
     "methods": "1.0.0",
     "mkdirp": "0.5.0",

From f7e73e2da07cb625859824794346c1b74a98c3b5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 27 May 2014 23:43:13 -0400
Subject: [PATCH 0248/1265] 3.8.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index d692cf9e9ff..e7b48d5a4a6 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+3.8.1 / 2014-05-27
+==================
 
  * update connect to 2.17.3
    - deps: body-parser@1.2.2
diff --git a/package.json b/package.json
index 7eac0bcedc6..445ad300d4c 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.8.0",
+  "version": "3.8.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From dfefea5e9db42c90d8f2c5ff591316ed642c17f4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 27 May 2014 23:51:47 -0400
Subject: [PATCH 0249/1265] update example dependencies

---
 package.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index a796f1f9b0f..c08c08972bb 100644
--- a/package.json
+++ b/package.json
@@ -78,10 +78,10 @@
     "marked": "0.3.2",
     "multiparty": "~3.2.4",
     "hjs": "~0.0.6",
-    "body-parser": "1.2.0",
+    "body-parser": "1.2.2",
     "cookie-parser": "1.1.0",
-    "express-session": "1.2.0",
-    "method-override": "1.0.1",
+    "express-session": "1.2.1",
+    "method-override": "1.0.2",
     "morgan": "1.1.1",
     "vhost": "1.0.0"
   },

From 1d54868c12c34bc6e1d84011d55d1befae0612ef Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 27 May 2014 23:54:34 -0400
Subject: [PATCH 0250/1265] update supertest to 0.13.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 445ad300d4c..8b1bb423c92 100644
--- a/package.json
+++ b/package.json
@@ -72,7 +72,7 @@
     "stylus": "~0.40.0",
     "connect-redis": "~1.4.5",
     "marked": "0.2.10",
-    "supertest": "~0.12.1"
+    "supertest": "~0.13.0"
   },
   "engines": {
     "node": ">= 0.8.0"

From c18c2a8e68c6e260ce9346847038c9a259b2eb1b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 28 May 2014 00:07:27 -0400
Subject: [PATCH 0251/1265] tests: exclude untestable lines in examples from
 coverage

---
 examples/auth/app.js                    | 1 +
 examples/big-view/index.js              | 7 +++++--
 examples/content-negotiation/index.js   | 3 ++-
 examples/cookie-sessions/index.js       | 5 +++--
 examples/cookies/app.js                 | 5 +++--
 examples/downloads/app.js               | 3 ++-
 examples/ejs/index.js                   | 3 ++-
 examples/error-pages/index.js           | 5 +++--
 examples/error/index.js                 | 3 ++-
 examples/expose-data-to-client/index.js | 7 +++++--
 examples/hello-world/index.js           | 7 +++++--
 examples/jade/index.js                  | 7 +++++--
 examples/markdown/index.js              | 1 +
 examples/multipart/index.js             | 3 ++-
 examples/mvc/index.js                   | 3 ++-
 examples/online/index.js                | 7 +++++--
 examples/params/app.js                  | 3 ++-
 examples/resource/app.js                | 3 ++-
 examples/route-map/index.js             | 6 +++++-
 examples/route-middleware/index.js      | 7 +++++--
 examples/route-separation/index.js      | 7 +++++--
 examples/search/index.js                | 7 +++++--
 examples/session/index.js               | 7 +++++--
 examples/vhost/index.js                 | 7 +++++--
 examples/view-constructor/index.js      | 1 +
 examples/view-locals/index.js           | 7 +++++--
 examples/web-service/index.js           | 5 +++--
 27 files changed, 91 insertions(+), 39 deletions(-)

diff --git a/examples/auth/app.js b/examples/auth/app.js
index 00175ad62d1..5bca6326827 100644
--- a/examples/auth/app.js
+++ b/examples/auth/app.js
@@ -118,6 +118,7 @@ app.post('/login', function(req, res){
   });
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
diff --git a/examples/big-view/index.js b/examples/big-view/index.js
index 2cb1a042586..35ad5963873 100644
--- a/examples/big-view/index.js
+++ b/examples/big-view/index.js
@@ -20,5 +20,8 @@ app.get('/', function(req, res){
   res.render('pets', { pets: pets });
 });
 
-app.listen(3000);
-console.log('Express listening on port 3000');
\ No newline at end of file
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}
diff --git a/examples/content-negotiation/index.js b/examples/content-negotiation/index.js
index db5ac863121..e8f7509f70a 100644
--- a/examples/content-negotiation/index.js
+++ b/examples/content-negotiation/index.js
@@ -37,7 +37,8 @@ function format(path) {
 
 app.get('/users', format('./users'));
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
-  console.log('listening on port 3000');
+  console.log('Express started on port 3000');
 }
diff --git a/examples/cookie-sessions/index.js b/examples/cookie-sessions/index.js
index f7011003d26..929dd547516 100644
--- a/examples/cookie-sessions/index.js
+++ b/examples/cookie-sessions/index.js
@@ -26,7 +26,8 @@ function count(req, res) {
   res.send('viewed ' + n + ' times\n');
 }
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
-  console.log('Express server listening on port 3000');
-}
\ No newline at end of file
+  console.log('Express started on port 3000');
+}
diff --git a/examples/cookies/app.js b/examples/cookies/app.js
index f381fbed8c4..d2ec02427bb 100644
--- a/examples/cookies/app.js
+++ b/examples/cookies/app.js
@@ -48,7 +48,8 @@ app.post('/', function(req, res){
   res.redirect('back');
 });
 
-if (!module.parent){
+/* istanbul ignore next */
+if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
-}
\ No newline at end of file
+}
diff --git a/examples/downloads/app.js b/examples/downloads/app.js
index 69620fa948d..965f3f6bdf0 100644
--- a/examples/downloads/app.js
+++ b/examples/downloads/app.js
@@ -38,7 +38,8 @@ app.use(function(err, req, res, next){
   }
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
-}
\ No newline at end of file
+}
diff --git a/examples/ejs/index.js b/examples/ejs/index.js
index f9ee51c797c..adf1254f145 100644
--- a/examples/ejs/index.js
+++ b/examples/ejs/index.js
@@ -44,7 +44,8 @@ app.get('/', function(req, res){
   });
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
-  console.log('Express app started on port 3000');
+  console.log('Express started on port 3000');
 }
diff --git a/examples/error-pages/index.js b/examples/error-pages/index.js
index 7c8fd31eb8a..99a9e6f98a9 100644
--- a/examples/error-pages/index.js
+++ b/examples/error-pages/index.js
@@ -106,7 +106,8 @@ app.get('/500', function(req, res, next){
   next(new Error('keyboard cat!'));
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
-  silent || console.log('Express started on port 3000');
-}
\ No newline at end of file
+  console.log('Express started on port 3000');
+}
diff --git a/examples/error/index.js b/examples/error/index.js
index be9cfb51771..1539514ee09 100644
--- a/examples/error/index.js
+++ b/examples/error/index.js
@@ -42,7 +42,8 @@ app.get('/next', function(req, res, next){
   });
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
-}
\ No newline at end of file
+}
diff --git a/examples/expose-data-to-client/index.js b/examples/expose-data-to-client/index.js
index e0f72adbd6e..05789416131 100644
--- a/examples/expose-data-to-client/index.js
+++ b/examples/expose-data-to-client/index.js
@@ -56,5 +56,8 @@ app.get('/user', function(req, res){
   res.render('page');
 });
 
-app.listen(3000);
-console.log('app listening on port 3000');
\ No newline at end of file
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}
diff --git a/examples/hello-world/index.js b/examples/hello-world/index.js
index 2cd9fc456c9..1932ae18c27 100644
--- a/examples/hello-world/index.js
+++ b/examples/hello-world/index.js
@@ -7,5 +7,8 @@ app.get('/', function(req, res){
   res.send('Hello World');
 });
 
-app.listen(3000);
-console.log('Express started on port 3000');
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}
diff --git a/examples/jade/index.js b/examples/jade/index.js
index 9c362015f0f..6d955fdfd44 100644
--- a/examples/jade/index.js
+++ b/examples/jade/index.js
@@ -41,5 +41,8 @@ app.get('/', function(req, res){
   res.render('users', { users: users });
 });
 
-app.listen(3000);
-console.log('Express app started on port 3000');
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}
diff --git a/examples/markdown/index.js b/examples/markdown/index.js
index f872e139786..83733495da2 100644
--- a/examples/markdown/index.js
+++ b/examples/markdown/index.js
@@ -39,6 +39,7 @@ app.get('/fail', function(req, res){
   res.render('missing', { title: 'Markdown Example' });
 })
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
diff --git a/examples/multipart/index.js b/examples/multipart/index.js
index e2323595b94..dc810984b69 100644
--- a/examples/multipart/index.js
+++ b/examples/multipart/index.js
@@ -30,7 +30,8 @@ app.post('/', function(req, res, next){
     , req.body.title));
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
-}
\ No newline at end of file
+}
diff --git a/examples/mvc/index.js b/examples/mvc/index.js
index 3811db4a5d5..ee60525c178 100644
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -86,7 +86,8 @@ app.use(function(req, res, next){
   res.status(404).render('404', { url: req.originalUrl });
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
-  console.log('\n  listening on port 3000\n');
+  console.log('Express started on port 3000');
 }
diff --git a/examples/online/index.js b/examples/online/index.js
index 5ebfe6a760a..44ef213e839 100644
--- a/examples/online/index.js
+++ b/examples/online/index.js
@@ -50,5 +50,8 @@ app.get('/', function(req, res, next){
   });
 });
 
-app.listen(3000);
-console.log('listening on port 3000');
\ No newline at end of file
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}
diff --git a/examples/params/app.js b/examples/params/app.js
index 4c6e2b528a9..3756541ad17 100644
--- a/examples/params/app.js
+++ b/examples/params/app.js
@@ -64,7 +64,8 @@ app.get('/users/:from-:to', function(req, res, next){
   res.send('users ' + names.slice(from, to).join(', '));
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
-}
\ No newline at end of file
+}
diff --git a/examples/resource/app.js b/examples/resource/app.js
index 849a81c905c..7aa5b13d74e 100644
--- a/examples/resource/app.js
+++ b/examples/resource/app.js
@@ -85,7 +85,8 @@ app.get('/', function(req, res){
   ].join('\n')); 
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
-}
\ No newline at end of file
+}
diff --git a/examples/route-map/index.js b/examples/route-map/index.js
index 1400ebe4bdc..7122794fc8c 100644
--- a/examples/route-map/index.js
+++ b/examples/route-map/index.js
@@ -60,4 +60,8 @@ app.map({
   }
 });
 
-app.listen(3000);
\ No newline at end of file
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}
diff --git a/examples/route-middleware/index.js b/examples/route-middleware/index.js
index c4d1d22f69e..2d26a33a0f1 100644
--- a/examples/route-middleware/index.js
+++ b/examples/route-middleware/index.js
@@ -81,5 +81,8 @@ app.delete('/user/:id', loadUser, andRestrictTo('admin'), function(req, res){
   res.send('Deleted user ' + req.user.name);
 });
 
-app.listen(3000);
-console.log('Express app started on port 3000');
\ No newline at end of file
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}
diff --git a/examples/route-separation/index.js b/examples/route-separation/index.js
index cb344e0a901..fcf9c505fe9 100644
--- a/examples/route-separation/index.js
+++ b/examples/route-separation/index.js
@@ -36,5 +36,8 @@ app.put('/user/:id/edit', user.update);
 
 app.get('/posts', post.list);
 
-app.listen(3000);
-console.log('Express app started on port 3000');
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}
diff --git a/examples/search/index.js b/examples/search/index.js
index 731c3c6183a..374e5883c5f 100644
--- a/examples/search/index.js
+++ b/examples/search/index.js
@@ -57,5 +57,8 @@ app.get('/client.js', function(req, res){
   res.sendfile(__dirname + '/client.js');
 });
 
-app.listen(3000);
-console.log('app listening on port 3000');
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}
diff --git a/examples/session/index.js b/examples/session/index.js
index 5ad94b7f155..f4e72054d64 100644
--- a/examples/session/index.js
+++ b/examples/session/index.js
@@ -28,5 +28,8 @@ app.get('/', function(req, res){
   res.send(body + '<p>viewed <strong>' + req.session.views + '</strong> times.</p>');
 });
 
-app.listen(3000);
-console.log('Express app started on port 3000');
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}
diff --git a/examples/vhost/index.js b/examples/vhost/index.js
index bbf5070ef17..732e86dd7af 100644
--- a/examples/vhost/index.js
+++ b/examples/vhost/index.js
@@ -42,5 +42,8 @@ var app = express();
 app.use(express.vhost('*.example.com', redirect)) // Serves all subdomains via Redirect app
 app.use(express.vhost('example.com', main)); // Serves top level domain via Main server app 
 
-app.listen(3000);
-console.log('Express app started on port 3000');
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}
diff --git a/examples/view-constructor/index.js b/examples/view-constructor/index.js
index 3f1aa42240f..000f419c04e 100644
--- a/examples/view-constructor/index.js
+++ b/examples/view-constructor/index.js
@@ -41,6 +41,7 @@ app.get('/Readme.md', function(req, res){
   res.render('Readme.md');
 })
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
diff --git a/examples/view-locals/index.js b/examples/view-locals/index.js
index 7658e83fa3f..dc9421a25b9 100644
--- a/examples/view-locals/index.js
+++ b/examples/view-locals/index.js
@@ -142,5 +142,8 @@ app.all('/api/*', function(req, res, next){
 
 */
 
-app.listen(3000);
-console.log('Application listening on port 3000');
\ No newline at end of file
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}
diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index 045adaa8630..f7c990ab543 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -109,7 +109,8 @@ app.get('/api/user/:name/repos', function(req, res, next){
   else next();
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
-  console.log('Express server listening on port 3000');
-}
\ No newline at end of file
+  console.log('Express started on port 3000');
+}

From ad9a414faed0f15652f27b76fa6b464fcc70570d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 28 May 2014 00:24:24 -0400
Subject: [PATCH 0252/1265] tests: add more acceptance tests

---
 examples/cookies/app.js       |  3 +--
 examples/error-pages/index.js |  4 +---
 examples/params/app.js        |  4 ++--
 test/acceptance/markdown.js   |  4 ++--
 test/acceptance/params.js     | 20 ++++++++++++++++++--
 test/acceptance/resource.js   | 22 +++++++++++++++++++---
 6 files changed, 43 insertions(+), 14 deletions(-)

diff --git a/examples/cookies/app.js b/examples/cookies/app.js
index d2ec02427bb..980becb0da3 100644
--- a/examples/cookies/app.js
+++ b/examples/cookies/app.js
@@ -15,8 +15,7 @@ var express = require('../../')
 app.use(express.favicon());
 
 // custom log format
-if ('test' != process.env.NODE_ENV)
-  app.use(express.logger(':method :url'));
+if ('test' != process.env.NODE_ENV) app.use(express.logger(':method :url'));
 
 // parses request cookies, populating
 // req.cookies and req.signedCookies
diff --git a/examples/error-pages/index.js b/examples/error-pages/index.js
index 99a9e6f98a9..2c17d7f0ee5 100644
--- a/examples/error-pages/index.js
+++ b/examples/error-pages/index.js
@@ -17,9 +17,7 @@ app.enable('verbose errors');
 
 // disable them in production
 // use $ NODE_ENV=production node examples/error-pages
-if ('production' == app.settings.env) {
-  app.disable('verbose errors');
-}
+if ('production' == app.settings.env) app.disable('verbose errors');
 
 app.use(express.favicon());
 
diff --git a/examples/params/app.js b/examples/params/app.js
index 3756541ad17..69973c878cd 100644
--- a/examples/params/app.js
+++ b/examples/params/app.js
@@ -19,8 +19,8 @@ var users = [
 // Convert :to and :from to integers
 
 app.param(['to', 'from'], function(req, res, next, num, name){ 
-  req.params[name] = num = parseInt(num, 10);
-  if( isNaN(num) ){
+  req.params[name] = parseInt(num, 10);
+  if( isNaN(req.params[name]) ){
     next(new Error('failed to parseInt '+num));
   } else {
     next();
diff --git a/test/acceptance/markdown.js b/test/acceptance/markdown.js
index 8c788e35166..1a7d9e3cb75 100644
--- a/test/acceptance/markdown.js
+++ b/test/acceptance/markdown.js
@@ -1,6 +1,6 @@
 
 var app = require('../../examples/markdown')
-  , request = require('supertest');
+var request = require('supertest')
 
 describe('markdown', function(){
   describe('GET /', function(){
@@ -18,4 +18,4 @@ describe('markdown', function(){
         .expect(500,done)
     })
   })
-})
\ No newline at end of file
+})
diff --git a/test/acceptance/params.js b/test/acceptance/params.js
index f96632445a5..cfa65896e63 100644
--- a/test/acceptance/params.js
+++ b/test/acceptance/params.js
@@ -1,5 +1,5 @@
 var app = require('../../examples/params/app')
-  , request = require('supertest');
+var request = require('supertest')
 
 describe('params', function(){
   describe('GET /', function(){
@@ -18,6 +18,14 @@ describe('params', function(){
     })
   })
 
+  describe('GET /user/9', function(){
+    it('should fail to find user', function(done){
+      request(app)
+        .get('/user/9')
+        .expect(/failed to find user/,done)
+    })
+  })
+
   describe('GET /users/0-2', function(){
     it('should respond with three users', function(done){
       request(app)
@@ -25,4 +33,12 @@ describe('params', function(){
         .expect(/users tj, tobi/,done)
     })
   })
-})
\ No newline at end of file
+
+  describe('GET /users/foo-bar', function(){
+    it('should fail integer parsing', function(done){
+      request(app)
+        .get('/users/foo-bar')
+        .expect(/failed to parseInt foo/,done)
+    })
+  })
+})
diff --git a/test/acceptance/resource.js b/test/acceptance/resource.js
index 8ab2331cdde..585d09b43e2 100644
--- a/test/acceptance/resource.js
+++ b/test/acceptance/resource.js
@@ -1,5 +1,5 @@
 var app = require('../../examples/resource/app')
-  , request = require('supertest');
+var request = require('supertest')
 
 describe('resource', function(){
   describe('GET /', function(){
@@ -26,6 +26,14 @@ describe('resource', function(){
     })
   })
 
+  describe('GET /users/9', function(){
+    it('should respond with error', function(done){
+      request(app)
+        .get('/users/9')
+        .expect('{"error":"Cannot find user"}', done)
+    })
+  })
+
   describe('GET /users/1..3', function(){
     it('should respond with users 1 through 3', function(done){
       request(app)
@@ -35,13 +43,21 @@ describe('resource', function(){
   })
 
   describe('DELETE /users/1', function(){
-    it('should respond with users 1 through 3', function(done){
+    it('should delete user 1', function(done){
       request(app)
         .del('/users/1')
         .expect(/^destroyed/,done)
     })
   })
 
+  describe('DELETE /users/9', function(){
+    it('should fail', function(done){
+      request(app)
+        .del('/users/9')
+        .expect('Cannot find user', done)
+    })
+  })
+
   describe('GET /users/1..3.json', function(){
     it('should respond with users 2 and 3 as json', function(done){
       request(app)
@@ -49,4 +65,4 @@ describe('resource', function(){
         .expect(/^\[null,{"name":"aaron"},{"name":"guillermo"}\]/,done)
     })
   })
-})
\ No newline at end of file
+})

From e7ad49bbbe9825368fb97439a770f7192cce748d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 28 May 2014 00:30:29 -0400
Subject: [PATCH 0253/1265] tests: add accepts test with params

---
 test/utils.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/test/utils.js b/test/utils.js
index 649ad12ab9b..181eb4cc2af 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -218,4 +218,10 @@ describe('utils.accepts(type, str)', function(){
         .should.equal('html');
     })
   })
+
+  describe('when params included', function(){
+    it('should match params', function(){
+      assert(null == utils.accepts('text/html; charset=us-ascii', 'text/html; charset=utf-8'));
+    })
+  })
 })

From fb2d9180569ae5bae5ba68aa79c95ed825af3899 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 28 May 2014 22:26:05 -0400
Subject: [PATCH 0254/1265] fix handling of errors from param callbacks

fixes #2149
---
 History.md          |  5 +++++
 lib/router/index.js | 16 ++++++++++++++--
 test/app.param.js   | 25 +++++++++++++++++++++++++
 3 files changed, 44 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 7f82ef3451f..494e27f9d4a 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+ * fix handling of errors from `router.param()` callbacks
+
 4.3.1 / 2014-05-23
 ==================
 
diff --git a/lib/router/index.js b/lib/router/index.js
index ef98117eab8..982e24407a1 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -290,6 +290,7 @@ proto.process_params = function(layer, called, req, res, done) {
   var key;
   var paramVal;
   var paramCallbacks;
+  var paramCalled;
 
   // process params in order
   // param callbacks can be async
@@ -312,12 +313,18 @@ proto.process_params = function(layer, called, req, res, done) {
     name = key.name;
     paramVal = req.params[name];
     paramCallbacks = params[name];
+    paramCalled = called[name];
 
-    if (paramVal === undefined || !paramCallbacks || called[name] === paramVal) {
+    if (paramVal === undefined || !paramCallbacks) {
       return param();
     }
 
-    called[name] = paramVal;
+    // param previously called with same value or error occurred
+    if (paramCalled && (paramCalled.err || paramCalled.val === paramVal)) {
+      return param(paramCalled.err);
+    }
+
+    called[name] = paramCalled = { val: paramVal };
 
     try {
       return paramCallback();
@@ -328,6 +335,11 @@ proto.process_params = function(layer, called, req, res, done) {
 
   // single param callbacks
   function paramCallback(err) {
+    if (err && paramCalled) {
+      // store error
+      paramCalled.err = err;
+    }
+
     var fn = paramCallbacks[paramIndex++];
     if (err || !fn) return param(err);
     fn(req, res, paramCallback, paramVal, key.name);
diff --git a/test/app.param.js b/test/app.param.js
index 923cbc3ae78..abb05370e9f 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -194,5 +194,30 @@ describe('app', function(){
       .get('/user/123')
       .expect('name', done);
     })
+
+    it('should defer all the param routes', function(done){
+      var app = express();
+
+      app.param('id', function(req, res, next, val){
+        if (val === 'new') return next('route');
+        return next();
+      });
+
+      app.all('/user/:id', function(req, res){
+        res.send('all.id');
+      });
+
+      app.get('/user/:id', function(req, res){
+        res.send('get.id');
+      });
+
+      app.get('/user/new', function(req, res){
+        res.send('get.new');
+      });
+
+      request(app)
+      .get('/user/new')
+      .expect('get.new', done);
+    })
   })
 })

From d4a284350046a931d0f91ed2fa1a4fa786e5880b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 28 May 2014 01:08:47 -0400
Subject: [PATCH 0255/1265] tests: add param test with encoded value

closes #2143
---
 test/app.param.js | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/test/app.param.js b/test/app.param.js
index ab296865132..fc34ddb1844 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -101,6 +101,24 @@ describe('app', function(){
       .expect('123', done);
     })
 
+    it('should work with encoded values', function(done){
+      var app = express();
+
+      app.param('name', function(req, res, next, name){
+        req.params.name = name;
+        next();
+      });
+
+      app.get('/user/:name', function(req, res){
+        var name = req.params.name;
+        res.send('' + name);
+      });
+
+      request(app)
+      .get('/user/foo%25bar')
+      .expect('foo%bar', done);
+    })
+
     it('should catch thrown error', function(done){
       var app = express();
 

From 3c0ec59432f738ee70d25c3e4213c17c82a84ec5 Mon Sep 17 00:00:00 2001
From: Tiago Relvao <relvao@gmail.com>
Date: Mon, 28 Apr 2014 10:54:51 +0100
Subject: [PATCH 0256/1265] Include ETag in HEAD requests

backport of commit 3c7310ebcbee1d65f47e6c6115ade2fa4cbd5b59
---
 History.md       |  5 +++++
 lib/response.js  |  2 +-
 test/app.head.js | 23 +++++++++++++++++++++++
 3 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e7b48d5a4a6..bdc023f3ea9 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+3.x
+===
+
+ * Include ETag in HEAD requests
+
 3.8.1 / 2014-05-27
 ==================
 
diff --git a/lib/response.js b/lib/response.js
index b7ec7ae55c2..76eab72e4f2 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -137,7 +137,7 @@ res.send = function(body){
 
   // ETag support
   // TODO: W/ support
-  if (app.settings.etag && len && 'GET' == req.method) {
+  if (app.settings.etag && len && ('GET' == req.method || 'HEAD' == req.method)) {
     if (!this.get('ETag')) {
       this.set('ETag', etag(body));
     }
diff --git a/test/app.head.js b/test/app.head.js
index 41e12916d0d..9ba2ad9a911 100644
--- a/test/app.head.js
+++ b/test/app.head.js
@@ -16,6 +16,29 @@ describe('HEAD', function(){
     .head('/tobi')
     .expect(200, done);
   })
+
+  it('should output the same headers as GET requests', function(done){
+    var app = express();
+
+    app.get('/tobi', function(req, res){
+      // send() detects HEAD
+      res.send('tobi');
+    });
+
+    request(app)
+    .get('/tobi')
+    .expect(200, function(err, res){
+      if (err) return done(err);
+      var headers = res.headers;
+      request(app)
+      .get('/tobi')
+      .expect(200, function(err, res){
+        if (err) return done(err);
+        assert.deepEqual(res.headers, headers);
+        done();
+      });
+    });
+  })
 })
 
 describe('app.head()', function(){

From 311e83e591a149a7549bab543dfd126d3223f7fd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 29 May 2014 00:17:21 -0400
Subject: [PATCH 0257/1265] 4.3.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 494e27f9d4a..02fb9f51f0f 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.3.2 / 2014-05-28
+==================
 
  * fix handling of errors from `router.param()` callbacks
 
diff --git a/package.json b/package.json
index c08c08972bb..87d10d28622 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.3.1",
+  "version": "4.3.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From faffcb889ced5f3cc4c7853f7b4879727dd65c21 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 29 May 2014 22:18:38 -0400
Subject: [PATCH 0258/1265] update connect to 2.18.0

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index bdc023f3ea9..6b0252ddf22 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,10 @@
 ===
 
  * Include ETag in HEAD requests
+ * update connect to 2.18.0
+   - deps: compression@1.0.3
+   - deps: serve-index@1.1.0
+   - deps: serve-static@1.2.0
 
 3.8.1 / 2014-05-27
 ==================
diff --git a/package.json b/package.json
index 8b1bb423c92..1100916b659 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
   "repository": "git://github.com/visionmedia/express",
   "license": "MIT",
   "dependencies": {
-    "connect": "2.17.3",
+    "connect": "2.18.0",
     "commander": "1.3.2",
     "methods": "1.0.0",
     "mkdirp": "0.5.0",

From b49453cf0de1925391f3f6dc8419233ac0f3fe96 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 29 May 2014 22:31:29 -0400
Subject: [PATCH 0259/1265] update send to 0.4.0

closes #2150
---
 History.md           | 4 ++++
 package.json         | 2 +-
 test/res.sendfile.js | 6 +-----
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/History.md b/History.md
index 6b0252ddf22..a7ef1f4d593 100644
--- a/History.md
+++ b/History.md
@@ -6,6 +6,10 @@
    - deps: compression@1.0.3
    - deps: serve-index@1.1.0
    - deps: serve-static@1.2.0
+ * update send to 0.4.0
+   - Calculate ETag with md5 for reduced collisions
+   - Ignore stream errors after request ends
+   - deps: debug@0.8.1
 
 3.8.1 / 2014-05-27
 ==================
diff --git a/package.json b/package.json
index 1100916b659..786a5e9baaa 100644
--- a/package.json
+++ b/package.json
@@ -54,10 +54,10 @@
     "parseurl": "1.0.1",
     "proxy-addr": "1.0.0",
     "range-parser": "1.0.0",
+    "send": "0.4.0",
     "cookie": "0.1.2",
     "buffer-crc32": "0.2.1",
     "fresh": "0.2.2",
-    "send": "0.3.0",
     "cookie-signature": "1.0.3",
     "merge-descriptors": "0.0.2",
     "debug": ">= 0.8.0 < 1"
diff --git a/test/res.sendfile.js b/test/res.sendfile.js
index b6ec9833011..8603f2057ba 100644
--- a/test/res.sendfile.js
+++ b/test/res.sendfile.js
@@ -9,11 +9,7 @@ describe('res', function(){
       var app = express();
 
       app.use(function(req, res){
-        res.sendfile('test/fixtures/user.html', function(err){
-          assert(!err);
-          req.socket.listeners('error').should.have.length(1); // node's original handler
-          done();
-        });
+        res.sendfile('test/fixtures/user.html', done)
       });
 
       request(app)

From 1f2e00ef8d00b6785125a989f118599c418b255a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 29 May 2014 22:53:59 -0400
Subject: [PATCH 0260/1265] deps: should@~4.0.0

---
 examples/resource/app.js       |  8 +++++---
 package.json                   |  4 ++--
 test/acceptance/ejs.js         | 15 ++++++---------
 test/acceptance/mvc.js         | 27 ++++++++++----------------
 test/acceptance/web-service.js |  8 ++------
 test/res.cookie.js             |  7 ++-----
 test/res.download.js           | 35 ++++++++++++++++------------------
 test/res.redirect.js           | 16 ++++++----------
 8 files changed, 49 insertions(+), 71 deletions(-)

diff --git a/examples/resource/app.js b/examples/resource/app.js
index 7aa5b13d74e..ed1810e8c07 100644
--- a/examples/resource/app.js
+++ b/examples/resource/app.js
@@ -18,7 +18,10 @@ app.resource = function(path, obj) {
     obj.range(req, res, a, b, format);
   });
   this.get(path + '/:id', obj.show);
-  this.delete(path + '/:id', obj.destroy);
+  this.delete(path + '/:id', function(req, res){
+    var id = parseInt(req.params.id, 10);
+    obj.destroy(req, res, id);
+  });
 };
 
 // Fake records
@@ -41,8 +44,7 @@ var User = {
   show: function(req, res){
     res.send(users[req.params.id] || { error: 'Cannot find user' });
   },
-  destroy: function(req, res){
-    var id = req.params.id;
+  destroy: function(req, res, id){
     var destroyed = id in users;
     delete users[id];
     res.send(destroyed ? 'destroyed' : 'Cannot find user');
diff --git a/package.json b/package.json
index 786a5e9baaa..88e715912fc 100644
--- a/package.json
+++ b/package.json
@@ -65,8 +65,8 @@
   "devDependencies": {
     "ejs": "~0.8.4",
     "istanbul": "0.2.10",
-    "mocha": "~1.19.0",
-    "should": "~3.3.1",
+    "mocha": "~1.20.0",
+    "should": "~4.0.0",
     "jade": "~0.30.0",
     "hjs": "~0.0.6",
     "stylus": "~0.40.0",
diff --git a/test/acceptance/ejs.js b/test/acceptance/ejs.js
index b51c03be7b1..12defcb564f 100644
--- a/test/acceptance/ejs.js
+++ b/test/acceptance/ejs.js
@@ -7,14 +7,11 @@ describe('ejs', function(){
     it('should respond with html', function(done){
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.should.have.status(200);
-        res.should.have.header('Content-Type', 'text/html; charset=utf-8');
-        res.text.should.include('<li>tobi &lt;tobi@learnboost.com&gt;</li>');
-        res.text.should.include('<li>loki &lt;loki@learnboost.com&gt;</li>');
-        res.text.should.include('<li>jane &lt;jane@learnboost.com&gt;</li>');
-        done();
-      });
+      .expect('Content-Type', 'text/html; charset=utf-8')
+      .expect(/<li>tobi &lt;tobi@learnboost\.com&gt;<\/li>/)
+      .expect(/<li>loki &lt;loki@learnboost\.com&gt;<\/li>/)
+      .expect(/<li>jane &lt;jane@learnboost\.com&gt;<\/li>/)
+      .expect(200, done)
     })
   })
-})
\ No newline at end of file
+})
diff --git a/test/acceptance/mvc.js b/test/acceptance/mvc.js
index 813c55062cc..3de481c679b 100644
--- a/test/acceptance/mvc.js
+++ b/test/acceptance/mvc.js
@@ -47,13 +47,11 @@ describe('mvc', function(){
     it('should display a list of users', function(done){
       request(app)
       .get('/users')
-      .end(function(err, res){
-        res.text.should.include('<h1>Users</h1>');
-        res.text.should.include('>TJ<');
-        res.text.should.include('>Guillermo<');
-        res.text.should.include('>Nathan<');
-        done();
-      })
+      .expect(/<h1>Users<\/h1>/)
+      .expect(/>TJ</)
+      .expect(/>Guillermo</)
+      .expect(/>Nathan</)
+      .expect(200, done)
     })
   })
 
@@ -62,21 +60,16 @@ describe('mvc', function(){
       it('should display the user', function(done){
         request(app)
         .get('/user/0')
-        .end(function(err, res){
-          res.text.should.include('<h1>TJ <a href="/user/0/edit">edit');
-          done();
-        })
+        .expect(200, /<h1>TJ <a href="\/user\/0\/edit">edit/, done)
       })
 
       it('should display the users pets', function(done){
         request(app)
         .get('/user/0')
-        .end(function(err, res){
-          res.text.should.include('/pet/0">Tobi');
-          res.text.should.include('/pet/1">Loki');
-          res.text.should.include('/pet/2">Jane');
-          done();
-        })
+        .expect(/\/pet\/0">Tobi/)
+        .expect(/\/pet\/1">Loki/)
+        .expect(/\/pet\/2">Jane/)
+        .expect(200, done)
       })
     })
 
diff --git a/test/acceptance/web-service.js b/test/acceptance/web-service.js
index 9fdf7a4ef63..e0f744adcee 100644
--- a/test/acceptance/web-service.js
+++ b/test/acceptance/web-service.js
@@ -98,12 +98,8 @@ describe('web-service', function(){
     it('should respond with 404 json', function(done){
       request(app)
       .get('/api/something?api-key=bar')
-      .end(function(err, res){
-        res.should.have.status(404);
-        res.should.be.json;
-        res.text.should.equal('{"error":"Lame, can\'t find that"}');
-        done();
-      });
+      .expect('Content-Type', /json/)
+      .expect(404, '{"error":"Lame, can\'t find that"}', done)
     })
   })
 })
diff --git a/test/res.cookie.js b/test/res.cookie.js
index a322b1d7e72..a00c8d14b40 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -89,7 +89,7 @@ describe('res', function(){
         request(app)
         .get('/')
         .end(function(err, res){
-          res.headers['set-cookie'][0].should.not.include('Thu, 01 Jan 1970 00:00:01 GMT');
+          res.headers['set-cookie'][0].should.not.containEql('Thu, 01 Jan 1970 00:00:01 GMT');
           done();
         })
       })
@@ -104,10 +104,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.headers['set-cookie'][0].should.include('Max-Age=1');
-          done();
-        })
+        .expect('Set-Cookie', /Max-Age=1/, done)
       })
 
       it('should not mutate the options object', function(done){
diff --git a/test/res.download.js b/test/res.download.js
index 614e4320c06..0b9b0ba4edd 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -14,12 +14,9 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.should.have.header('Content-Type', 'text/html; charset=UTF-8');
-        res.should.have.header('Content-Disposition', 'attachment; filename="user.html"');
-        res.text.should.equal('<p>{{user.name}}</p>');
-        done();
-      });
+      .expect('Content-Type', 'text/html; charset=UTF-8')
+      .expect('Content-Disposition', 'attachment; filename="user.html"')
+      .expect(200, '<p>{{user.name}}</p>', done)
     })
   })
 
@@ -33,11 +30,9 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.should.have.header('Content-Type', 'text/html; charset=UTF-8');
-        res.should.have.header('Content-Disposition', 'attachment; filename="document"');
-        done();
-      });
+      .expect('Content-Type', 'text/html; charset=UTF-8')
+      .expect('Content-Disposition', 'attachment; filename="document"')
+      .expect(200, done)
     })
   })
 
@@ -52,10 +47,11 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.should.have.header('Content-Type', 'text/html; charset=UTF-8');
-        res.should.have.header('Content-Disposition', 'attachment; filename="user.html"');
-      });
+      .expect('Content-Type', 'text/html; charset=UTF-8')
+      .expect('Content-Disposition', 'attachment; filename="user.html"')
+      .expect(200, function(err){
+        assert.ifError(err)
+      })
     })
   })
 
@@ -70,10 +66,11 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.should.have.header('Content-Type', 'text/html; charset=UTF-8');
-        res.should.have.header('Content-Disposition', 'attachment; filename="document"');
-      });
+      .expect('Content-Type', 'text/html; charset=UTF-8')
+      .expect('Content-Disposition', 'attachment; filename="document"')
+      .expect(200, function(err){
+        assert.ifError(err)
+      })
     })
   })
 
diff --git a/test/res.redirect.js b/test/res.redirect.js
index f13a070c176..c5aab7f1c53 100644
--- a/test/res.redirect.js
+++ b/test/res.redirect.js
@@ -13,11 +13,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.statusCode.should.equal(302);
-        res.headers.should.have.property('location', 'http://google.com');
-        done();
-      })
+      .expect('location', 'http://google.com')
+      .expect(302, done)
     })
   })
 
@@ -159,12 +156,11 @@ describe('res', function(){
       request(app)
       .get('/')
       .set('Accept', 'application/octet-stream')
-      .end(function(err, res){
-        res.should.have.status(302);
-        res.headers.should.have.property('location', 'http://google.com');
+      .expect('location', 'http://google.com')
+      .expect('content-length', '0')
+      .expect(302, '', function(err, res){
+        if (err) return done(err)
         res.headers.should.not.have.property('content-type');
-        res.headers.should.have.property('content-length', '0');
-        res.text.should.equal('');
         done();
       })
     })

From 8ab96ab80dfcf9282d27b45b902554bcc5ea328c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 29 May 2014 23:10:25 -0400
Subject: [PATCH 0261/1265] mark res.send ETag as weak and reduce collisions

---
 History.md       |  1 +
 lib/utils.js     |  9 +++++++--
 test/res.send.js | 13 +++++--------
 test/utils.js    |  8 ++++----
 4 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/History.md b/History.md
index a7ef1f4d593..265d68b1fc5 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@
 ===
 
  * Include ETag in HEAD requests
+ * mark `res.send` ETag as weak and reduce collisions
  * update connect to 2.18.0
    - deps: compression@1.0.3
    - deps: serve-index@1.1.0
diff --git a/lib/utils.js b/lib/utils.js
index 6abce481213..d62322c218d 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -47,12 +47,17 @@ exports.deprecate = function(fn, msg){
  * Return ETag for `body`.
  *
  * @param {String|Buffer} body
+ * @param {String} [encoding]
  * @return {String}
  * @api private
  */
 
-exports.etag = function(body){
-  return '"' + crc32.signed(body) + '"';
+exports.etag = function(body, encoding){
+  var buf = Buffer.isBuffer(body)
+    ? body
+    : new Buffer(body, encoding)
+  var len = buf.length
+  return 'W/"' + len.toString(16) + '-' + crc32.unsigned(buf) + '"'
 };
 
 /**
diff --git a/test/res.send.js b/test/res.send.js
index 3eb2776655e..7eafb84c924 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -105,7 +105,7 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('ETag', '"-1498647312"')
+      .expect('ETag', 'W/"7ff-2796319984"')
       .end(done);
     })
 
@@ -194,7 +194,7 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('ETag', '"-1498647312"')
+      .expect('ETag', 'W/"7ff-2796319984"')
       .end(done);
     })
 
@@ -309,7 +309,7 @@ describe('res', function(){
 
     request(app)
     .get('/')
-    .set('If-None-Match', '"-1498647312"')
+    .set('If-None-Match', 'W/"7ff-2796319984"')
     .expect(304, done);
   })
 
@@ -358,7 +358,7 @@ describe('res', function(){
         });
       })
 
-      it('should send ETag ', function(done){
+      it('should send ETag', function(done){
         var app = express();
 
         app.use(function(req, res){
@@ -368,10 +368,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.headers.should.have.property('etag', '"-1498647312"');
-          done();
-        });
+        .expect('etag', 'W/"7ff-2796319984"', done)
       });
     });
 
diff --git a/test/utils.js b/test/utils.js
index 181eb4cc2af..0f6319e42b4 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -8,16 +8,16 @@ describe('utils.etag(body)', function(){
   var strUTF8 = '<!DOCTYPE html>\n<html>\n<head>\n</head>\n<body><p>自動販売</p></body></html>';
 
   it('should support strings', function(){
-    utils.etag(str).should.eql('"-2034458343"');
+    utils.etag(str).should.eql('W/"9-2260508953"');
   })
 
   it('should support utf8 strings', function(){
-    utils.etag(strUTF8).should.eql('"1395090196"');
+    utils.etag(strUTF8, 'utf8').should.eql('W/"4d-1395090196"');
   })
 
   it('should support buffer', function(){
-    utils.etag(new Buffer(strUTF8)).should.eql('"1395090196"');
-    utils.etag(new Buffer(str)).should.eql('"-2034458343"');
+    utils.etag(new Buffer(strUTF8, 'utf8')).should.eql('W/"4d-1395090196"');
+    utils.etag(new Buffer(str)).should.eql('W/"9-2260508953"');
   })
 
 })

From 766b3aecf7aadc14d95e382c4e85c985d0288890 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 29 May 2014 23:39:52 -0400
Subject: [PATCH 0262/1265] deps: update example dependencies

---
 package.json       | 7 +++----
 test/app.render.js | 2 +-
 test/res.render.js | 4 ++--
 3 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/package.json b/package.json
index 88e715912fc..a03b6f4f4e7 100644
--- a/package.json
+++ b/package.json
@@ -63,15 +63,14 @@
     "debug": ">= 0.8.0 < 1"
   },
   "devDependencies": {
-    "ejs": "~0.8.4",
     "istanbul": "0.2.10",
     "mocha": "~1.20.0",
     "should": "~4.0.0",
-    "jade": "~0.30.0",
+    "ejs": "~1.0.0",
+    "jade": "~1.3.1",
     "hjs": "~0.0.6",
-    "stylus": "~0.40.0",
+    "marked": "0.3.2",
     "connect-redis": "~1.4.5",
-    "marked": "0.2.10",
     "supertest": "~0.13.0"
   },
   "engines": {
diff --git a/test/app.render.js b/test/app.render.js
index c6d7a5e3137..a2c1ce69bcf 100644
--- a/test/app.render.js
+++ b/test/app.render.js
@@ -95,7 +95,7 @@ describe('app', function(){
         app.render('user.jade', function(err, str){
           // nextTick to prevent cyclic
           process.nextTick(function(){
-            err.message.should.match(/user is not defined/);
+            err.message.should.match(/Cannot read property 'name' of undefined/);
             done();
           });
         })
diff --git a/test/res.render.js b/test/res.render.js
index db38752c83a..b55417ff0ca 100644
--- a/test/res.render.js
+++ b/test/res.render.js
@@ -79,7 +79,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect(/user is not defined/, done);
+        .expect(/Cannot read property 'name' of undefined/, done);
       })
     })
 
@@ -250,7 +250,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect(/is not defined/, done);
+        .expect(/Cannot read property 'name' of undefined/, done);
       })
     })
   })

From 3e358458f436f2aaf04c406e34cfa99dd0e007e0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 30 May 2014 19:51:32 -0400
Subject: [PATCH 0263/1265] tests: add more etag tests

---
 test/req.fresh.js | 11 ++++++-----
 test/req.stale.js | 11 ++++++-----
 test/res.send.js  | 45 ++++++++++++++++++++++++++++++---------------
 test/res.set.js   | 13 +++++++------
 test/utils.js     | 22 +++++++++++++---------
 5 files changed, 62 insertions(+), 40 deletions(-)

diff --git a/test/req.fresh.js b/test/req.fresh.js
index 68912b88604..be23c43a6de 100644
--- a/test/req.fresh.js
+++ b/test/req.fresh.js
@@ -6,15 +6,16 @@ describe('req', function(){
   describe('.fresh', function(){
     it('should return true when the resource is not modified', function(done){
       var app = express();
+      var etag = '"12345"';
 
       app.use(function(req, res){
-        res.set('ETag', '12345');
+        res.set('ETag', etag);
         res.send(req.fresh);
       });
 
       request(app)
       .get('/')
-      .set('If-None-Match', '12345')
+      .set('If-None-Match', etag)
       .expect(304, done);
     })
 
@@ -22,14 +23,14 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        res.set('ETag', '123');
+        res.set('ETag', '"123"');
         res.send(req.fresh);
       });
 
       request(app)
       .get('/')
-      .set('If-None-Match', '12345')
-      .expect('false', done);
+      .set('If-None-Match', '"12345"')
+      .expect(200, 'false', done);
     })
   })
 })
diff --git a/test/req.stale.js b/test/req.stale.js
index 2c55e8b9a1a..a52237f3c06 100644
--- a/test/req.stale.js
+++ b/test/req.stale.js
@@ -6,15 +6,16 @@ describe('req', function(){
   describe('.stale', function(){
     it('should return false when the resource is not modified', function(done){
       var app = express();
+      var etag = '"12345"';
 
       app.use(function(req, res){
-        res.set('ETag', '12345');
+        res.set('ETag', etag);
         res.send(req.stale);
       });
 
       request(app)
       .get('/')
-      .set('If-None-Match', '12345')
+      .set('If-None-Match', etag)
       .expect(304, done);
     })
 
@@ -22,14 +23,14 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        res.set('ETag', '123');
+        res.set('ETag', '"123"');
         res.send(req.stale);
       });
 
       request(app)
       .get('/')
-      .set('If-None-Match', '12345')
-      .expect('true', done);
+      .set('If-None-Match', '"12345"')
+      .expect(200, 'true', done);
     })
   })
 })
diff --git a/test/res.send.js b/test/res.send.js
index 7eafb84c924..cf24c198911 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -287,15 +287,16 @@ describe('res', function(){
 
   it('should always check regardless of length', function(done){
     var app = express();
+    var etag = '"asdf"';
 
     app.use(function(req, res, next){
-      res.set('ETag', 'asdf');
+      res.set('ETag', etag);
       res.send('hey');
     });
 
     request(app)
     .get('/')
-    .set('If-None-Match', 'asdf')
+    .set('If-None-Match', etag)
     .expect(304, done);
   })
 
@@ -315,16 +316,17 @@ describe('res', function(){
 
   it('should not perform freshness check unless 2xx or 304', function(done){
     var app = express();
+    var etag = '"asdf"';
 
     app.use(function(req, res, next){
       res.status(500);
-      res.set('ETag', 'asdf');
+      res.set('ETag', etag);
       res.send('hey');
     });
 
     request(app)
     .get('/')
-    .set('If-None-Match', 'asdf')
+    .set('If-None-Match', etag)
     .expect('hey')
     .expect(500, done);
   })
@@ -343,22 +345,21 @@ describe('res', function(){
 
   describe('"etag" setting', function(){
     describe('when enabled', function(){
-      it('should send ETag even when content-length < 1024', function(done){
+      it('should send ETag', function(done){
         var app = express();
 
         app.use(function(req, res){
           res.send('kajdslfkasdf');
         });
 
+        app.enable('etag');
+
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.headers.should.have.property('etag');
-          done();
-        });
+        .expect('etag', 'W/"c-1525560792"', done)
       })
 
-      it('should send ETag', function(done){
+      it('should send ETag for long response', function(done){
         var app = express();
 
         app.use(function(req, res){
@@ -366,10 +367,27 @@ describe('res', function(){
           res.send(str);
         });
 
+        app.enable('etag');
+
         request(app)
         .get('/')
         .expect('etag', 'W/"7ff-2796319984"', done)
       });
+
+      it('should not override ETag when manually set', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          res.set('etag', '"asdf"');
+          res.send(200);
+        });
+
+        app.enable('etag');
+
+        request(app)
+        .get('/')
+        .expect('etag', '"asdf"', done)
+      });
     });
 
     describe('when disabled', function(){
@@ -397,16 +415,13 @@ describe('res', function(){
         app.disable('etag');
 
         app.use(function(req, res){
-          res.set('etag', 1);
+          res.set('etag', '"asdf"');
           res.send(200);
         });
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.headers.should.have.property('etag');
-          done();
-        });
+        .expect('etag', '"asdf"', done)
       });
     });
   })
diff --git a/test/res.set.js b/test/res.set.js
index 76dcf7fe6f6..1017e3aeaa1 100644
--- a/test/res.set.js
+++ b/test/res.set.js
@@ -20,8 +20,8 @@ describe('res', function(){
 
     it('should coerce to a string', function(){
       res.headers = {};
-      res.set('ETag', 123);
-      res.get('ETag').should.equal('123');
+      res.set('X-Number', 123);
+      res.get('X-Number').should.equal('123');
     })
   })
 
@@ -41,8 +41,9 @@ describe('res', function(){
 
     it('should coerce to an array of strings', function(){
       res.headers = {};
-      res.set('ETag', [123, 456]);
-      JSON.stringify(res.get('ETag')).should.equal('["123","456"]');
+      res.set('X-Numbers', [123, 456]);
+      JSON.stringify(res.get('X-Numbers'))
+      .should.equal('["123","456"]');
     })
   })
 
@@ -66,8 +67,8 @@ describe('res', function(){
 
     it('should coerce to a string', function(){
       res.headers = {};
-      res.set({ ETag: 123 });
-      res.get('ETag').should.equal('123');
+      res.set({ 'X-Number': 123 });
+      res.get('X-Number').should.equal('123');
     })
   })
 })
diff --git a/test/utils.js b/test/utils.js
index 0f6319e42b4..bcb3f860067 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -2,24 +2,28 @@
 var utils = require('../lib/utils')
   , assert = require('assert');
 
-describe('utils.etag(body)', function(){
-
-  var str = 'Hello CRC';
-  var strUTF8 = '<!DOCTYPE html>\n<html>\n<head>\n</head>\n<body><p>自動販売</p></body></html>';
-
+describe('utils.etag(body, encoding)', function(){
   it('should support strings', function(){
-    utils.etag(str).should.eql('W/"9-2260508953"');
+    utils.etag('express!')
+    .should.eql('W/"8-3098196679"')
   })
 
   it('should support utf8 strings', function(){
-    utils.etag(strUTF8, 'utf8').should.eql('W/"4d-1395090196"');
+    utils.etag('express❤', 'utf8')
+    .should.eql('W/"a-1751845617"')
   })
 
   it('should support buffer', function(){
-    utils.etag(new Buffer(strUTF8, 'utf8')).should.eql('W/"4d-1395090196"');
-    utils.etag(new Buffer(str)).should.eql('W/"9-2260508953"');
+    var buf = new Buffer('express!')
+    utils.etag(buf)
+    .should.eql('W/"8-3098196679"');
   })
 
+  it('should support empty string', function(){
+    var buf = new Buffer('express!')
+    utils.etag('')
+    .should.eql('W/"0-0"');
+  })
 })
 
 describe('utils.isAbsolute()', function(){

From c21226aa7c6ad61311c2b190fe63f2a7cd027b42 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 30 May 2014 21:02:21 -0400
Subject: [PATCH 0264/1265] improve etag control for res.send

closes #1435
closes #2129
---
 History.md         |   6 +++
 lib/application.js |  28 +++++++++----
 lib/response.js    |  33 ++++++++-------
 lib/utils.js       |  68 ++++++++++++++++++++++++++++--
 package.json       |   2 +-
 test/config.js     |  16 ++++++-
 test/res.send.js   | 102 +++++++++++++++++++++++++++++++++++++++++++++
 test/utils.js      |  30 +++++++++++--
 8 files changed, 251 insertions(+), 34 deletions(-)

diff --git a/History.md b/History.md
index 265d68b1fc5..9f6046109f0 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,12 @@
 3.x
 ===
 
+ * custom etag control with `app.set('etag', val)`
+   - `app.set('etag', function(body, encoding){ return '"etag"' })` custom etag generation
+   - `app.set('etag', 'weak')` weak tag
+   - `app.set('etag', 'strong')` strong etag
+   - `app.set('etag', false)` turn off
+   - `app.set('etag', true)` standard etag
  * Include ETag in HEAD requests
  * mark `res.send` ETag as weak and reduce collisions
  * update connect to 2.18.0
diff --git a/lib/application.js b/lib/application.js
index 3408f68e75d..8efed1e6c94 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -8,6 +8,7 @@ var connect = require('connect')
   , middleware = require('./middleware')
   , debug = require('debug')('express:application')
   , locals = require('./utils').locals
+  , compileETag = require('./utils').compileETag
   , compileTrust = require('./utils').compileTrust
   , View = require('./view')
   , utils = connect.utils
@@ -46,7 +47,7 @@ app.init = function(){
 app.defaultConfiguration = function(){
   // default settings
   this.enable('x-powered-by');
-  this.enable('etag');
+  this.set('etag', 'weak');
   this.set('env', process.env.NODE_ENV || 'development');
   this.set('subdomain offset', 2);
   this.set('trust proxy', false);
@@ -251,18 +252,27 @@ app.param = function(name, fn){
  */
 
 app.set = function(setting, val){
-  if (1 == arguments.length) {
+  if (arguments.length === 1) {
+    // app.get(setting)
     return this.settings[setting];
-  } else {
-    this.settings[setting] = val;
+  }
 
-    if (setting === 'trust proxy') {
-      debug('compile trust proxy %j', val);
+  // set value
+  this.settings[setting] = val;
+
+  // trigger matched settings
+  switch (setting) {
+    case 'etag':
+      debug('compile etag %s', val);
+      this.set('etag fn', compileETag(val));
+      break;
+    case 'trust proxy':
+      debug('compile trust proxy %s', val);
       this.set('trust proxy fn', compileTrust(val));
-    }
-
-    return this;
+      break;
   }
+
+  return this;
 };
 
 /**
diff --git a/lib/response.js b/lib/response.js
index 76eab72e4f2..3b633d8d9ed 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -11,7 +11,6 @@ var http = require('http')
   , normalizeTypes = require('./utils').normalizeTypes
   , setCharset = require('./utils').setCharset
   , deprecate = require('./utils').deprecate
-  , etag = require('./utils').etag
   , statusCodes = http.STATUS_CODES
   , cookie = require('cookie')
   , send = require('send')
@@ -128,21 +127,6 @@ res.send = function(body){
       break;
   }
 
-  // populate Content-Length
-  if (undefined !== body && !this.get('Content-Length')) {
-    this.set('Content-Length', len = Buffer.isBuffer(body)
-      ? body.length
-      : Buffer.byteLength(body));
-  }
-
-  // ETag support
-  // TODO: W/ support
-  if (app.settings.etag && len && ('GET' == req.method || 'HEAD' == req.method)) {
-    if (!this.get('ETag')) {
-      this.set('ETag', etag(body));
-    }
-  }
-
   // write strings in utf-8
   if ('string' === typeof body) {
     encoding = 'utf8';
@@ -154,6 +138,23 @@ res.send = function(body){
     }
   }
 
+  // populate Content-Length
+  if (undefined !== body && !this.get('Content-Length')) {
+    len = Buffer.isBuffer(body)
+      ? body.length
+      : Buffer.byteLength(body, encoding);
+    this.set('Content-Length', len);
+  }
+
+  // ETag support
+  var etag = len !== undefined && app.get('etag fn');
+  if (etag && ('GET' === req.method || 'HEAD' === req.method)) {
+    if (!this.get('ETag')) {
+      etag = etag(body, encoding);
+      etag && this.set('ETag', etag);
+    }
+  }
+
   // freshness
   if (req.fresh) this.statusCode = 304;
 
diff --git a/lib/utils.js b/lib/utils.js
index d62322c218d..0d8c72e2073 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -6,7 +6,8 @@
 var mime = require('connect').mime
   , deprecate = require('util').deprecate
   , proxyaddr = require('proxy-addr')
-  , crc32 = require('buffer-crc32');
+  , crc32 = require('buffer-crc32')
+  , crypto = require('crypto');
 
 /**
  * toString ref.
@@ -44,7 +45,7 @@ exports.deprecate = function(fn, msg){
 };
 
 /**
- * Return ETag for `body`.
+ * Return strong ETag for `body`.
  *
  * @param {String|Buffer} body
  * @param {String} [encoding]
@@ -52,7 +53,34 @@ exports.deprecate = function(fn, msg){
  * @api private
  */
 
-exports.etag = function(body, encoding){
+exports.etag = function etag(body, encoding){
+  if (body.length === 0) {
+    // fast-path empty body
+    return '"1B2M2Y8AsgTpgAmY7PhCfg=="'
+  }
+
+  var hash = crypto
+    .createHash('md5')
+    .update(body, encoding)
+    .digest('base64')
+  return '"' + hash + '"'
+};
+
+/**
+ * Return weak ETag for `body`.
+ *
+ * @param {String|Buffer} body
+ * @param {String} [encoding]
+ * @return {String}
+ * @api private
+ */
+
+exports.wetag = function wetag(body, encoding){
+  if (body.length === 0) {
+    // fast-path empty body
+    return 'W/"0-0"'
+  }
+
   var buf = Buffer.isBuffer(body)
     ? body
     : new Buffer(body, encoding)
@@ -349,6 +377,40 @@ exports.pathRegexp = function(path, keys, sensitive, strict) {
   return new RegExp('^' + path + '$', sensitive ? '' : 'i');
 }
 
+/**
+ * Compile "etag" value to function.
+ *
+ * @param  {Boolean|String|Function} val
+ * @return {Function}
+ * @api private
+ */
+
+exports.compileETag = function(val) {
+  var fn;
+
+  if (typeof val === 'function') {
+    return val;
+  }
+
+  switch (val) {
+    case true:
+      fn = exports.wetag;
+      break;
+    case false:
+      break;
+    case 'strong':
+      fn = exports.etag;
+      break;
+    case 'weak':
+      fn = exports.wetag;
+      break;
+    default:
+      throw new TypeError('unknown value for etag function: ' + val);
+  }
+
+  return fn;
+}
+
 /**
  * Compile "proxy trust" value to function.
  *
diff --git a/package.json b/package.json
index a03b6f4f4e7..d33910b6925 100644
--- a/package.json
+++ b/package.json
@@ -47,6 +47,7 @@
   "repository": "git://github.com/visionmedia/express",
   "license": "MIT",
   "dependencies": {
+    "buffer-crc32": "0.2.1",
     "connect": "2.18.0",
     "commander": "1.3.2",
     "methods": "1.0.0",
@@ -56,7 +57,6 @@
     "range-parser": "1.0.0",
     "send": "0.4.0",
     "cookie": "0.1.2",
-    "buffer-crc32": "0.2.1",
     "fresh": "0.2.2",
     "cookie-signature": "1.0.3",
     "merge-descriptors": "0.0.2",
diff --git a/test/config.js b/test/config.js
index 9e9239b0d7c..3574bf1bc47 100644
--- a/test/config.js
+++ b/test/config.js
@@ -13,6 +13,20 @@ describe('config', function(){
       var app = express();
       app.set('foo', undefined).should.equal(app);
     })
+
+    describe('"etag"', function(){
+      it('should throw on bad value', function(){
+        var app = express()
+        app.set.bind(app, 'etag', 42).should.throw(/unknown value/)
+      })
+
+      it('should set "etag fn"', function(){
+        var app = express()
+        var fn = function(){}
+        app.set('etag', fn)
+        app.get('etag fn').should.equal(fn)
+      })
+    })
   })
 
   describe('.get()', function(){
@@ -91,4 +105,4 @@ describe('config', function(){
       app.disabled('foo').should.be.false;
     })
   })
-})
\ No newline at end of file
+})
diff --git a/test/res.send.js b/test/res.send.js
index cf24c198911..ec9919f2c28 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -359,6 +359,20 @@ describe('res', function(){
         .expect('etag', 'W/"c-1525560792"', done)
       })
 
+      it('should send ETag for empty string response', function(done){
+        var app = express()
+
+        app.use(function(req, res){
+          res.send('')
+        });
+
+        app.enable('etag')
+
+        request(app)
+        .get('/')
+        .expect('etag', 'W/"0-0"', done)
+      })
+
       it('should send ETag for long response', function(done){
         var app = express();
 
@@ -388,6 +402,23 @@ describe('res', function(){
         .get('/')
         .expect('etag', '"asdf"', done)
       });
+
+      it('should not send ETag for res.send()', function(done){
+        var app = express()
+
+        app.use(function(req, res){
+          res.send()
+        });
+
+        app.enable('etag')
+
+        request(app)
+        .get('/')
+        .end(function(err, res){
+          res.headers.should.not.have.property('etag');
+          done();
+        })
+      })
     });
 
     describe('when disabled', function(){
@@ -424,5 +455,76 @@ describe('res', function(){
         .expect('etag', '"asdf"', done)
       });
     });
+
+    describe('when "strong"', function(){
+      it('should send strong ETag', function(done){
+        var app = express()
+
+        app.set('etag', 'strong');
+
+        app.use(function(req, res){
+          res.send('hello, world!');
+        });
+
+        request(app)
+        .get('/')
+        .expect('etag', '"Otu60XkfuuPskIiUxJY4cA=="', done)
+      })
+    })
+
+    describe('when "weak"', function(){
+      it('should send weak ETag', function(done){
+        var app = express()
+
+        app.set('etag', 'weak');
+
+        app.use(function(req, res){
+          res.send('hello, world!');
+        });
+
+        request(app)
+        .get('/')
+        .expect('etag', 'W/"d-1486392595"', done)
+      })
+    })
+
+    describe('when a function', function(){
+      it('should send custom ETag', function(done){
+        var app = express()
+
+        app.set('etag', function(body, encoding){
+          body.should.equal('hello, world!')
+          encoding.should.equal('utf8')
+          return '"custom"'
+        });
+
+        app.use(function(req, res){
+          res.send('hello, world!');
+        });
+
+        request(app)
+        .get('/')
+        .expect('etag', '"custom"', done)
+      })
+
+      it('should not send falsy ETag', function(done){
+        var app = express()
+
+        app.set('etag', function(body, encoding){
+          return undefined
+        });
+
+        app.use(function(req, res){
+          res.send('hello, world!');
+        });
+
+        request(app)
+        .get('/')
+        .end(function(err, res){
+          res.headers.should.not.have.property('etag')
+          done();
+        })
+      })
+    })
   })
 })
diff --git a/test/utils.js b/test/utils.js
index bcb3f860067..590fa730ef3 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -5,23 +5,45 @@ var utils = require('../lib/utils')
 describe('utils.etag(body, encoding)', function(){
   it('should support strings', function(){
     utils.etag('express!')
-    .should.eql('W/"8-3098196679"')
+    .should.eql('"zZdv4imtWD49AHEviejT6A=="')
   })
 
   it('should support utf8 strings', function(){
     utils.etag('express❤', 'utf8')
-    .should.eql('W/"a-1751845617"')
+    .should.eql('"fsFba4IxwQS6h6Umb+FNxw=="')
   })
 
   it('should support buffer', function(){
     var buf = new Buffer('express!')
     utils.etag(buf)
-    .should.eql('W/"8-3098196679"');
+    .should.eql('"zZdv4imtWD49AHEviejT6A=="');
   })
 
   it('should support empty string', function(){
-    var buf = new Buffer('express!')
     utils.etag('')
+    .should.eql('"1B2M2Y8AsgTpgAmY7PhCfg=="');
+  })
+})
+
+describe('utils.wetag(body, encoding)', function(){
+  it('should support strings', function(){
+    utils.wetag('express!')
+    .should.eql('W/"8-3098196679"')
+  })
+
+  it('should support utf8 strings', function(){
+    utils.wetag('express❤', 'utf8')
+    .should.eql('W/"a-1751845617"')
+  })
+
+  it('should support buffer', function(){
+    var buf = new Buffer('express!')
+    utils.wetag(buf)
+    .should.eql('W/"8-3098196679"');
+  })
+
+  it('should support empty string', function(){
+    utils.wetag('')
     .should.eql('W/"0-0"');
   })
 })

From 8751d7ecf860f780c8471f62ffc9e90d1924dfd6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 30 May 2014 21:28:48 -0400
Subject: [PATCH 0265/1265] tests: add more tests

---
 test/app.router.js | 24 ++++++++++++++++++++++++
 test/config.js     |  9 +++++++++
 test/utils.js      | 28 +++++++++++++++++++++++++++-
 3 files changed, 60 insertions(+), 1 deletion(-)

diff --git a/test/app.router.js b/test/app.router.js
index 980249574cf..9ba82a17596 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -564,6 +564,30 @@ describe('app.router', function(){
     })
   })
 
+  describe('when next("route") is called', function(){
+    it('should jump to next route', function(done){
+      var app = express()
+
+      function fn(req, res, next){
+        res.set('X-Hit', '1')
+        next('route')
+      }
+
+      app.get('/foo', fn, function(req, res, next){
+        res.end('failure')
+      });
+
+      app.get('/foo', function(req, res){
+        res.end('success')
+      })
+
+      request(app)
+      .get('/foo')
+      .expect('X-Hit', '1')
+      .expect(200, 'success', done)
+    })
+  })
+
   describe('when next(err) is called', function(){
     it('should break out of app.router', function(done){
       var app = express()
diff --git a/test/config.js b/test/config.js
index 3574bf1bc47..59d38f07a32 100644
--- a/test/config.js
+++ b/test/config.js
@@ -27,6 +27,15 @@ describe('config', function(){
         app.get('etag fn').should.equal(fn)
       })
     })
+
+    describe('"trust proxy"', function(){
+      it('should set "trust proxy fn"', function(){
+        var app = express()
+        var fn = function(){}
+        app.set('trust proxy', fn)
+        app.get('trust proxy fn').should.equal(fn)
+      })
+    })
   })
 
   describe('.get()', function(){
diff --git a/test/utils.js b/test/utils.js
index 590fa730ef3..90566a3f8f8 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -2,6 +2,28 @@
 var utils = require('../lib/utils')
   , assert = require('assert');
 
+describe('utils.deprecate(fn, msg)', function(){
+  var env
+  before(function(){
+    env = process.env.NODE_ENV
+  })
+  after(function(){
+    process.env.NODE_ENV = env
+  })
+
+  it('should pass-through fn in test environment', function(){
+    var fn = function(){}
+    process.env.NODE_ENV = 'test'
+    utils.deprecate(fn).should.equal(fn)
+  })
+
+  it('should return new fn in other environment', function(){
+    var fn = function(){}
+    process.env.NODE_ENV = ''
+    utils.deprecate(fn).should.not.equal(fn)
+  })
+})
+
 describe('utils.etag(body, encoding)', function(){
   it('should support strings', function(){
     utils.etag('express!')
@@ -54,7 +76,11 @@ describe('utils.isAbsolute()', function(){
     assert(!utils.isAbsolute(':\\'));
   })
 
-  it('should unices', function(){
+  it('should support windows unc', function(){
+    assert(utils.isAbsolute('\\\\foo\\bar'))
+  })
+
+  it('should support unices', function(){
     assert(utils.isAbsolute('/foo/bar'));
     assert(!utils.isAbsolute('foo/bar'));
   })

From 0dc5836d5e6f41760d736d98d0cfa5b57bac84a7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 30 May 2014 21:35:12 -0400
Subject: [PATCH 0266/1265] 3.9.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 9f6046109f0..7a77df4a792 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.9.0 / 2014-05-30
+==================
 
  * custom etag control with `app.set('etag', val)`
    - `app.set('etag', function(body, encoding){ return '"etag"' })` custom etag generation
diff --git a/package.json b/package.json
index d33910b6925..99d6a9c85c7 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.8.1",
+  "version": "3.9.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From f92a7ad0a3ce460cb434bae065850ddf6b1373e8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 30 May 2014 22:48:32 -0400
Subject: [PATCH 0267/1265] update accepts to 1.0.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 2497283f957..342d1be2d10 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,8 @@ unreleased
    - `app.set('etag', false)` turn off
    - `app.set('etag', true)` standard etag
  * mark `res.send` ETag as weak and reduce collisions
+ * update accepts to 1.0.2
+   - Fix interpretation when header not in request
  * update send to 0.4.0
    - Calculate ETag with md5 for reduced collisions
    - Ignore stream errors after request ends
diff --git a/package.json b/package.json
index 1d088b1ced2..602de147b81 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
   "repository": "git://github.com/visionmedia/express",
   "license": "MIT",
   "dependencies": {
-    "accepts": "1.0.1",
+    "accepts": "1.0.2",
     "buffer-crc32": "0.2.1",
     "parseurl": "1.0.1",
     "proxy-addr": "1.0.0",

From 9024d24e818bc61f7732d7f821a3286c0902a207 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 30 May 2014 22:50:22 -0400
Subject: [PATCH 0268/1265] deps: supertest@~0.13.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 602de147b81..265fdc86bcc 100644
--- a/package.json
+++ b/package.json
@@ -71,7 +71,7 @@
     "istanbul": "0.2.10",
     "mocha": "~1.20.0",
     "should": "~4.0.0",
-    "supertest": "~0.12.0",
+    "supertest": "~0.13.0",
     "connect-redis": "~2.0.0",
     "ejs": "~1.0.0",
     "jade": "~1.3.1",

From f665c57c5cd71b9d4f816f57d956aca9bbaaeccc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 30 May 2014 22:53:02 -0400
Subject: [PATCH 0269/1265] update serve-static to 1.2.0

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 342d1be2d10..00e35c4b2c9 100644
--- a/History.md
+++ b/History.md
@@ -14,6 +14,10 @@ unreleased
    - Calculate ETag with md5 for reduced collisions
    - Ignore stream errors after request ends
    - deps: debug@0.8.1
+ * update serve-static to 1.2.0
+   - Calculate ETag with md5 for reduced collisions
+   - Ignore stream errors after request ends
+   - deps: send@0.4.0
 
 4.3.2 / 2014-05-28
 ==================
diff --git a/package.json b/package.json
index 265fdc86bcc..9c7863e5dbe 100644
--- a/package.json
+++ b/package.json
@@ -62,7 +62,7 @@
     "utils-merge": "1.0.0",
     "escape-html": "1.0.1",
     "qs": "0.6.6",
-    "serve-static": "1.1.0",
+    "serve-static": "1.2.0",
     "path-to-regexp": "0.1.2",
     "debug": "0.8.1"
   },

From 95fa49147b08fd102685520eaaa32e1dd28a06b6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 31 May 2014 00:00:39 -0400
Subject: [PATCH 0270/1265] 4.4.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 00e35c4b2c9..4c7f1677fd9 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.4.0 / 2014-05-30
+==================
 
  * custom etag control with `app.set('etag', val)`
    - `app.set('etag', function(body, encoding){ return '"etag"' })` custom etag generation
diff --git a/package.json b/package.json
index 9c7863e5dbe..0082fc0cf2f 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.3.2",
+  "version": "4.4.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From 9e6b881f8566f26f2d2ea017657455ec7c674ad6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 31 May 2014 11:45:18 -0400
Subject: [PATCH 0271/1265] remove jsdoc params for polymorphic functions

until jsdoc has a way to actually document them

closes #2156
---
 lib/application.js |  3 ---
 lib/response.js    | 18 ------------------
 2 files changed, 21 deletions(-)

diff --git a/lib/application.js b/lib/application.js
index 5aaa1e3fa04..e8c2d46e64e 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -166,9 +166,6 @@ app.handle = function(req, res, done) {
  * If the _fn_ parameter is an express app, then it will be
  * mounted at the _route_ specified.
  *
- * @param {String|Function|Server} route
- * @param {Function|Server} fn
- * @return {app} for chaining
  * @api public
  */
 
diff --git a/lib/response.js b/lib/response.js
index e890d5c66be..246f90eeec7 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -74,9 +74,6 @@ res.links = function(links){
  *     res.send(404, 'Sorry, cant find that');
  *     res.send(404);
  *
- * @param {Mixed} body or status
- * @param {Mixed} body
- * @return {ServerResponse}
  * @api public
  */
 
@@ -179,9 +176,6 @@ res.send = function(body){
  *     res.json(500, 'oh noes!');
  *     res.json(404, 'I dont have that');
  *
- * @param {Mixed} obj or status
- * @param {Mixed} obj
- * @return {ServerResponse}
  * @api public
  */
 
@@ -228,9 +222,6 @@ var jsonNumDeprecated = deprecate(res.json,
  *     res.jsonp(500, 'oh noes!');
  *     res.jsonp(404, 'I dont have that');
  *
- * @param {Mixed} obj or status
- * @param {Mixed} obj
- * @return {ServerResponse}
  * @api public
  */
 
@@ -319,9 +310,6 @@ var jsonpNumDeprecated = deprecate(res.json,
  *       });
  *     });
  *
- * @param {String} path
- * @param {Object|Function} options or fn
- * @param {Function} fn
  * @api public
  */
 
@@ -395,9 +383,6 @@ res.sendfile = function(path, options, fn){
  *
  * This method uses `res.sendfile()`.
  *
- * @param {String} path
- * @param {String|Function} filename or fn
- * @param {Function} fn
  * @api public
  */
 
@@ -788,9 +773,6 @@ res.vary = function(field){
  *  - `cache`     boolean hinting to the engine it should cache
  *  - `filename`  filename of the view being rendered
  *
- * @param  {String} view
- * @param  {Object|Function} options or callback function
- * @param  {Function} fn
  * @api public
  */
 

From a7cd5a25537b7a1522698e83220757a3a78d2773 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 2 Jun 2014 19:19:56 -0400
Subject: [PATCH 0272/1265] deps: methods@1.0.1

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 7a77df4a792..3494b02a377 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+3.x
+===
+
+ * deps: methods@1.0.1
+
 3.9.0 / 2014-05-30
 ==================
 
diff --git a/package.json b/package.json
index 99d6a9c85c7..69778adbbde 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "buffer-crc32": "0.2.1",
     "connect": "2.18.0",
     "commander": "1.3.2",
-    "methods": "1.0.0",
+    "methods": "1.0.1",
     "mkdirp": "0.5.0",
     "parseurl": "1.0.1",
     "proxy-addr": "1.0.0",

From 16fdc11ccb09b1b94db2f49bda842957c7ce783a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 2 Jun 2014 20:48:18 -0400
Subject: [PATCH 0273/1265] deps: methods@1.0.1

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 4c7f1677fd9..a69f5e3042d 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+ * deps: methods@1.0.1
+
 4.4.0 / 2014-05-30
 ==================
 
diff --git a/package.json b/package.json
index 0082fc0cf2f..13e5a5a47b0 100644
--- a/package.json
+++ b/package.json
@@ -49,6 +49,7 @@
   "dependencies": {
     "accepts": "1.0.2",
     "buffer-crc32": "0.2.1",
+    "methods": "1.0.1",
     "parseurl": "1.0.1",
     "proxy-addr": "1.0.0",
     "range-parser": "1.0.0",
@@ -56,7 +57,6 @@
     "type-is": "1.2.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",
-    "methods": "1.0.0",
     "cookie-signature": "1.0.3",
     "merge-descriptors": "0.0.2",
     "utils-merge": "1.0.0",

From 8ccd9d0eb5097adcfa8adff345175f2d2b2e7db8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 2 Jun 2014 20:49:11 -0400
Subject: [PATCH 0274/1265] deps: send@0.4.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a69f5e3042d..a4f4b6e69b0 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,8 @@ unreleased
 ==========
 
  * deps: methods@1.0.1
+ * deps: send@0.4.1
+   - Send `max-age` in `Cache-Control` in correct format
 
 4.4.0 / 2014-05-30
 ==================
diff --git a/package.json b/package.json
index 13e5a5a47b0..a3f5e5ebbbc 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "parseurl": "1.0.1",
     "proxy-addr": "1.0.0",
     "range-parser": "1.0.0",
-    "send": "0.4.0",
+    "send": "0.4.1",
     "type-is": "1.2.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",

From 492e9337963eb87b8a833b7f21438043d14c4412 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 2 Jun 2014 20:50:54 -0400
Subject: [PATCH 0275/1265] deps: serve-static@1.2.1

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a4f4b6e69b0..15e90df899a 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,9 @@ unreleased
  * deps: methods@1.0.1
  * deps: send@0.4.1
    - Send `max-age` in `Cache-Control` in correct format
+ * deps: serve-static@1.2.1
+   - use `escape-html` for escaping
+   - deps: send@0.4.1
 
 4.4.0 / 2014-05-30
 ==================
diff --git a/package.json b/package.json
index a3f5e5ebbbc..350bbeea8dc 100644
--- a/package.json
+++ b/package.json
@@ -54,6 +54,7 @@
     "proxy-addr": "1.0.0",
     "range-parser": "1.0.0",
     "send": "0.4.1",
+    "serve-static": "1.2.1",
     "type-is": "1.2.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",
@@ -62,7 +63,6 @@
     "utils-merge": "1.0.0",
     "escape-html": "1.0.1",
     "qs": "0.6.6",
-    "serve-static": "1.2.0",
     "path-to-regexp": "0.1.2",
     "debug": "0.8.1"
   },

From 9e5a758e7ce77821b2cb302bbd0f1a9443c9db76 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 2 Jun 2014 20:59:45 -0400
Subject: [PATCH 0276/1265] deps: update example dependencies

---
 examples/mvc/controllers/pet/views/edit.jade    | 3 +--
 examples/mvc/controllers/user/views/edit.jade   | 3 +--
 examples/mvc/index.js                           | 4 ++--
 examples/route-separation/index.js              | 1 +
 examples/route-separation/views/users/edit.jade | 3 +--
 package.json                                    | 4 ++--
 6 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/examples/mvc/controllers/pet/views/edit.jade b/examples/mvc/controllers/pet/views/edit.jade
index 1ccc29dc2f3..690bd956b17 100644
--- a/examples/mvc/controllers/pet/views/edit.jade
+++ b/examples/mvc/controllers/pet/views/edit.jade
@@ -1,7 +1,6 @@
 link(rel='stylesheet', href='/style.css')
 h1= pet.name
-form(action='/pet/#{pet.id}', method='post')
-  input(type='hidden', name='_method', value='put')
+form(action='/pet/#{pet.id}?_method=put', method='post')
   label= 'Name: '
     input(type='text', name='pet[name]', value=pet.name)
   input(type='submit', value='Update')
diff --git a/examples/mvc/controllers/user/views/edit.jade b/examples/mvc/controllers/user/views/edit.jade
index ab9cdbeeccf..a2fde5d477e 100644
--- a/examples/mvc/controllers/user/views/edit.jade
+++ b/examples/mvc/controllers/user/views/edit.jade
@@ -1,7 +1,6 @@
 link(rel='stylesheet', href='/style.css')
 h1= user.name
-form(action='/user/#{user.id}', method='post')
-  input(type='hidden', name='_method', value='put')
+form(action='/user/#{user.id}?_method=put', method='post')
   label= 'Name: '
     input(type='text', name='user[name]', value='#{user.name}')
   input(type='submit', value='Update')
diff --git a/examples/mvc/index.js b/examples/mvc/index.js
index 9e7cf335e04..cd5b74cbd04 100644
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -44,8 +44,8 @@ app.use(session());
 // parse request bodies (req.body)
 app.use(bodyParser());
 
-// override methods (put, delete)
-app.use(methodOverride());
+// allow overriding methods in query (?_method=put)
+app.use(methodOverride('_method'));
 
 // expose the "messages" local variable when views are rendered
 app.use(function(req, res, next){
diff --git a/examples/route-separation/index.js b/examples/route-separation/index.js
index 50299e853f6..c6f8aab7d38 100644
--- a/examples/route-separation/index.js
+++ b/examples/route-separation/index.js
@@ -16,6 +16,7 @@ var user = require('./user');
 app.set('view engine', 'jade');
 app.set('views', __dirname + '/views');
 app.use(logger('dev'));
+app.use(methodOverride('_method'));
 app.use(cookieParser());
 app.use(bodyParser());
 app.use(express.static(__dirname + '/public'));
diff --git a/examples/route-separation/views/users/edit.jade b/examples/route-separation/views/users/edit.jade
index 10dbab8d5bb..f9ef180d6db 100644
--- a/examples/route-separation/views/users/edit.jade
+++ b/examples/route-separation/views/users/edit.jade
@@ -3,8 +3,7 @@ extends ../layout
 block content
   h1 Editing #{user.name}
   #user
-    form(method="post")
-      input(type="hidden", value="put", name="_method")
+    form(action="?_method=put", method="post")
       p Name: 
         input(type="text", value= user.name, name="user[name]")
       p Email: 
diff --git a/package.json b/package.json
index 350bbeea8dc..0b7cfb7b0d7 100644
--- a/package.json
+++ b/package.json
@@ -78,10 +78,10 @@
     "marked": "0.3.2",
     "multiparty": "~3.2.4",
     "hjs": "~0.0.6",
-    "body-parser": "1.2.2",
+    "body-parser": "1.3.0",
     "cookie-parser": "1.1.0",
     "express-session": "1.2.1",
-    "method-override": "1.0.2",
+    "method-override": "2.0.1",
     "morgan": "1.1.1",
     "vhost": "1.0.0"
   },

From f9ec70edd0f2804e53b1c4bf72c79294845f370f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 2 Jun 2014 21:13:50 -0400
Subject: [PATCH 0277/1265] 4.4.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 15e90df899a..62ce5fb1f4d 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.4.1 / 2014-06-02
+==================
 
  * deps: methods@1.0.1
  * deps: send@0.4.1
diff --git a/package.json b/package.json
index 0b7cfb7b0d7..4eaa01d5982 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.4.0",
+  "version": "4.4.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From a94278abd1bab96607fae4bc08ba2b344070673e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 2 Jun 2014 20:49:11 -0400
Subject: [PATCH 0278/1265] deps: send@0.4.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 3494b02a377..18204ccb1f8 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,8 @@
 ===
 
  * deps: methods@1.0.1
+ * deps: send@0.4.1
+   - Send `max-age` in `Cache-Control` in correct format
 
 3.9.0 / 2014-05-30
 ==================
diff --git a/package.json b/package.json
index 69778adbbde..0186a12963e 100644
--- a/package.json
+++ b/package.json
@@ -55,7 +55,7 @@
     "parseurl": "1.0.1",
     "proxy-addr": "1.0.0",
     "range-parser": "1.0.0",
-    "send": "0.4.0",
+    "send": "0.4.1",
     "cookie": "0.1.2",
     "fresh": "0.2.2",
     "cookie-signature": "1.0.3",

From f433b7c7cfd39aaa64a336f3fe1cce41c52b32ee Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 3 Jun 2014 00:37:32 -0400
Subject: [PATCH 0279/1265] replace utils.escape with html-escape

---
 lib/response.js |  3 ++-
 lib/utils.js    | 16 ----------------
 package.json    |  1 +
 test/utils.js   |  7 -------
 4 files changed, 3 insertions(+), 24 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index 3b633d8d9ed..156aae220b7 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -2,6 +2,7 @@
  * Module dependencies.
  */
 
+var escapeHtml = require('escape-html');
 var http = require('http')
   , path = require('path')
   , connect = require('connect')
@@ -744,7 +745,7 @@ res.redirect = function(url){
     },
 
     html: function(){
-      var u = utils.escape(url);
+      var u = escapeHtml(url);
       body = '<p>' + statusCodes[status] + '. Redirecting to <a href="' + u + '">' + u + '</a></p>';
     },
 
diff --git a/lib/utils.js b/lib/utils.js
index 0d8c72e2073..7cae6278c1e 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -322,22 +322,6 @@ function acceptParams(str, index) {
   return ret;
 }
 
-/**
- * Escape special characters in the given string of html.
- *
- * @param  {String} html
- * @return {String}
- * @api private
- */
-
-exports.escape = function(html) {
-  return String(html)
-    .replace(/&/g, '&amp;')
-    .replace(/"/g, '&quot;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;');
-};
-
 /**
  * Normalize the given path string,
  * returning a regular expression.
diff --git a/package.json b/package.json
index 0186a12963e..68ccac13562 100644
--- a/package.json
+++ b/package.json
@@ -50,6 +50,7 @@
     "buffer-crc32": "0.2.1",
     "connect": "2.18.0",
     "commander": "1.3.2",
+    "escape-html": "1.0.1",
     "methods": "1.0.1",
     "mkdirp": "0.5.0",
     "parseurl": "1.0.1",
diff --git a/test/utils.js b/test/utils.js
index 90566a3f8f8..155a1292a70 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -94,13 +94,6 @@ describe('utils.flatten(arr)', function(){
   })
 })
 
-describe('utils.escape(html)', function(){
-  it('should escape html entities', function(){
-    utils.escape('<script>foo & "bar"')
-      .should.equal('&lt;script&gt;foo &amp; &quot;bar&quot;')
-  })
-})
-
 describe('utils.parseParams(str)', function(){
   it('should default quality to 1', function(){
     utils.parseParams('text/html')

From bb6e207336965c0f96923eac5088a2df2407324c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 3 Jun 2014 00:37:57 -0400
Subject: [PATCH 0280/1265] deps: connect@2.19.1

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 18204ccb1f8..b99b887fa58 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,13 @@
 3.x
 ===
 
+ * deps: connect@2.19.1
+   - deprecate `methodOverride()` -- use `method-override` module directly
+   - deps: body-parser@1.3.0
+   - deps: method-override@2.0.1
+   - deps: multiparty@3.2.8
+   - deps: response-time@2.0.0
+   - deps: serve-static@1.2.1
  * deps: methods@1.0.1
  * deps: send@0.4.1
    - Send `max-age` in `Cache-Control` in correct format
diff --git a/package.json b/package.json
index 68ccac13562..5ed241f1142 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
   "license": "MIT",
   "dependencies": {
     "buffer-crc32": "0.2.1",
-    "connect": "2.18.0",
+    "connect": "2.19.1",
     "commander": "1.3.2",
     "escape-html": "1.0.1",
     "methods": "1.0.1",

From 298ac11018535739789696940f392eca07661d5d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 3 Jun 2014 00:40:27 -0400
Subject: [PATCH 0281/1265] 3.10.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index b99b887fa58..197a1df30e5 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.10.0 / 2014-06-02
+===================
 
  * deps: connect@2.19.1
    - deprecate `methodOverride()` -- use `method-override` module directly
diff --git a/package.json b/package.json
index 5ed241f1142..8d4660910c3 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.9.0",
+  "version": "3.10.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From 721f6388c35775ad8d93a3b63580aac17f762855 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 3 Jun 2014 16:42:49 -0400
Subject: [PATCH 0282/1265] deps: proxy-addr@1.0.1

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 197a1df30e5..7941ea8c0ef 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+3.x
+===
+
+ * deps: proxy-addr@1.0.1
+
 3.10.0 / 2014-06-02
 ===================
 
diff --git a/package.json b/package.json
index 8d4660910c3..c286fc20af2 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,7 @@
     "methods": "1.0.1",
     "mkdirp": "0.5.0",
     "parseurl": "1.0.1",
-    "proxy-addr": "1.0.0",
+    "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.4.1",
     "cookie": "0.1.2",

From ad79ce9c4b7f14662bec1749bff2012ff4cdbfef Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 3 Jun 2014 16:44:29 -0400
Subject: [PATCH 0283/1265] deps: connect@2.19.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 7941ea8c0ef..811e9cc7168 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,8 @@
 3.x
 ===
 
+ * deps: connect@2.19.2
+   - deps: compression@1.0.4
  * deps: proxy-addr@1.0.1
 
 3.10.0 / 2014-06-02
diff --git a/package.json b/package.json
index c286fc20af2..c141c2bf1c4 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
   "license": "MIT",
   "dependencies": {
     "buffer-crc32": "0.2.1",
-    "connect": "2.19.1",
+    "connect": "2.19.2",
     "commander": "1.3.2",
     "escape-html": "1.0.1",
     "methods": "1.0.1",

From 3b34a537eee8569b7dc5f27bb701da6c54282b4f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 3 Jun 2014 16:45:09 -0400
Subject: [PATCH 0284/1265] 3.10.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 811e9cc7168..cb1fecd3cf5 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.10.1 / 2014-06-03
+===================
 
  * deps: connect@2.19.2
    - deps: compression@1.0.4
diff --git a/package.json b/package.json
index c141c2bf1c4..d4021c4adf5 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.10.0",
+  "version": "3.10.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From bffb71d4c88d9b1b16810e4ee41e7cd07ed96fab Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 3 Jun 2014 17:25:20 -0400
Subject: [PATCH 0285/1265] deps: proxy-addr@1.0.1

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 175415e5b12..092e805df61 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+ * deps: proxy-addr@1.0.1
+
 4.4.1 / 2014-06-02
 ==================
 
diff --git a/package.json b/package.json
index f305fcb67c1..cd645aa3f7f 100644
--- a/package.json
+++ b/package.json
@@ -52,7 +52,7 @@
     "escape-html": "1.0.1",
     "methods": "1.0.1",
     "parseurl": "1.0.1",
-    "proxy-addr": "1.0.0",
+    "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.4.1",
     "serve-static": "1.2.1",

From fe6f392c2dc00861dd64e999cb5635a074c03b4c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 3 Jun 2014 21:33:55 -0400
Subject: [PATCH 0286/1265] deps: connect@2.19.3

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index cb1fecd3cf5..32ede1b21cc 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+3.x
+===
+
+ * deps: connect@2.19.3
+   - deps: compression@1.0.6
+
 3.10.1 / 2014-06-03
 ===================
 
diff --git a/package.json b/package.json
index d4021c4adf5..85f71e5b9d3 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
   "license": "MIT",
   "dependencies": {
     "buffer-crc32": "0.2.1",
-    "connect": "2.19.2",
+    "connect": "2.19.3",
     "commander": "1.3.2",
     "escape-html": "1.0.1",
     "methods": "1.0.1",

From c919b4a5730e9d08fde1c19e1f0082ef27807d2f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 3 Jun 2014 21:35:34 -0400
Subject: [PATCH 0287/1265] 3.10.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 32ede1b21cc..59cf7451d91 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.10.2 / 2014-06-03
+===================
 
  * deps: connect@2.19.3
    - deps: compression@1.0.6
diff --git a/package.json b/package.json
index 85f71e5b9d3..638aa8c7c18 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.10.1",
+  "version": "3.10.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     {

From 6d65ae5ba6b07057b117c4e8fcdf4310d31904c9 Mon Sep 17 00:00:00 2001
From: Jonathan Ong <jonathanrichardong@gmail.com>
Date: Thu, 5 Jun 2014 16:10:58 -0700
Subject: [PATCH 0288/1265] use vary@0.1.0

with backwards compatibility

closes #2161
---
 History.md      |  5 +++++
 lib/response.js | 26 ++++----------------------
 package.json    |  1 +
 3 files changed, 10 insertions(+), 22 deletions(-)

diff --git a/History.md b/History.md
index 59cf7451d91..beb71342820 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+3.x
+===
+
+ * use `vary` module for `res.vary`
+
 3.10.2 / 2014-06-03
 ===================
 
diff --git a/lib/response.js b/lib/response.js
index 156aae220b7..094e35c98c2 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -3,6 +3,7 @@
  */
 
 var escapeHtml = require('escape-html');
+var vary = require('vary');
 var http = require('http')
   , path = require('path')
   , connect = require('connect')
@@ -770,31 +771,12 @@ res.redirect = function(url){
  */
 
 res.vary = function(field){
-  var self = this;
-
-  // nothing
+  // checks for back-compat
   if (!field) return this;
+  if (Array.isArray(field) && !field.length) return this;
 
-  // array
-  if (Array.isArray(field)) {
-    field.forEach(function(field){
-      self.vary(field);
-    });
-    return;
-  }
-
-  var vary = this.get('Vary');
-
-  // append
-  if (vary) {
-    vary = vary.split(/ *, */);
-    if (!~vary.indexOf(field)) vary.push(field);
-    this.set('Vary', vary.join(', '));
-    return this;
-  }
+  vary(this, field);
 
-  // set
-  this.set('Vary', field);
   return this;
 };
 
diff --git a/package.json b/package.json
index 638aa8c7c18..c73e1c162a0 100644
--- a/package.json
+++ b/package.json
@@ -57,6 +57,7 @@
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.4.1",
+    "vary": "0.1.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",
     "cookie-signature": "1.0.3",

From 56831d7799bb1d26a65c39df56307644d21bb90f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 5 Jun 2014 19:34:05 -0400
Subject: [PATCH 0289/1265] deps: debug@1.0.0

---
 History.md   | 1 +
 package.json | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index beb71342820..5c87b72efef 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@
 ===
 
  * use `vary` module for `res.vary`
+ * deps: debug@1.0.0
 
 3.10.2 / 2014-06-03
 ===================
diff --git a/package.json b/package.json
index c73e1c162a0..4fa9df6cee6 100644
--- a/package.json
+++ b/package.json
@@ -50,6 +50,7 @@
     "buffer-crc32": "0.2.1",
     "connect": "2.19.3",
     "commander": "1.3.2",
+    "debug": "1.0.0",
     "escape-html": "1.0.1",
     "methods": "1.0.1",
     "mkdirp": "0.5.0",
@@ -61,8 +62,7 @@
     "cookie": "0.1.2",
     "fresh": "0.2.2",
     "cookie-signature": "1.0.3",
-    "merge-descriptors": "0.0.2",
-    "debug": ">= 0.8.0 < 1"
+    "merge-descriptors": "0.0.2"
   },
   "devDependencies": {
     "istanbul": "0.2.10",

From 980a15d847e32ff06159815a77edf53f995acae3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 5 Jun 2014 19:40:27 -0400
Subject: [PATCH 0290/1265] deps: type-is@1.2.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 092e805df61..2cc46a8bc5c 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
  * deps: proxy-addr@1.0.1
+ * deps: type-is@1.2.1
 
 4.4.1 / 2014-06-02
 ==================
diff --git a/package.json b/package.json
index cd645aa3f7f..ad4f12c150b 100644
--- a/package.json
+++ b/package.json
@@ -56,7 +56,7 @@
     "range-parser": "1.0.0",
     "send": "0.4.1",
     "serve-static": "1.2.1",
-    "type-is": "1.2.0",
+    "type-is": "1.2.1",
     "cookie": "0.1.2",
     "fresh": "0.2.2",
     "cookie-signature": "1.0.3",

From 2e257d1cf744400d0ed4c80cd0e2fb7b01ec3896 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 5 Jun 2014 19:45:00 -0400
Subject: [PATCH 0291/1265] build: use compressed formats in package

---
 package.json | 36 +++++++-----------------------------
 1 file changed, 7 insertions(+), 29 deletions(-)

diff --git a/package.json b/package.json
index 4fa9df6cee6..89bbe95d561 100644
--- a/package.json
+++ b/package.json
@@ -4,34 +4,12 @@
   "version": "3.10.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
-    {
-      "name": "TJ Holowaychuk",
-      "email": "tj@vision-media.ca"
-    },
-    {
-      "name": "Aaron Heckmann",
-      "email": "aaron.heckmann+github@gmail.com"
-    },
-    {
-      "name": "Ciaran Jessup",
-      "email": "ciaranj@gmail.com"
-    },
-    {
-      "name": "Douglas Christopher Wilson",
-      "email": "doug@somethingdoug.com"
-    },
-    {
-      "name": "Guillermo Rauch",
-      "email": "rauchg@gmail.com"
-    },
-    {
-      "name": "Jonathan Ong",
-      "email": "me@jongleberry.com"
-    },
-    {
-      "name": "Roman Shtylman",
-      "email": "shtylman+expressjs@gmail.com"
-    }
+    "Aaron Heckmann <aaron.heckmann+github@gmail.com>",
+    "Ciaran Jessup <ciaranj@gmail.com>",
+    "Douglas Christopher Wilson <doug@somethingdoug.com>",
+    "Guillermo Rauch <rauchg@gmail.com>",
+    "Jonathan Ong <me@jongleberry.com>",
+    "Roman Shtylman <shtylman+expressjs@gmail.com"
   ],
   "keywords": [
     "express",
@@ -44,7 +22,7 @@
     "app",
     "api"
   ],
-  "repository": "git://github.com/visionmedia/express",
+  "repository": "visionmedia/express",
   "license": "MIT",
   "dependencies": {
     "buffer-crc32": "0.2.1",

From 9cf7bba8f06a0b1a73bb2111444d5f4a893fb5fb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 5 Jun 2014 23:37:22 -0400
Subject: [PATCH 0292/1265] deps: connect@2.19.4

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5c87b72efef..f415131e107 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,10 @@
 ===
 
  * use `vary` module for `res.vary`
+ * deps: connect@2.19.4
+   - deps: errorhandler@1.0.2
+   - deps: method-override@2.0.2
+   - deps: serve-favicon@2.0.1
  * deps: debug@1.0.0
 
 3.10.2 / 2014-06-03
diff --git a/package.json b/package.json
index 89bbe95d561..cfa42236dc2 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
   "license": "MIT",
   "dependencies": {
     "buffer-crc32": "0.2.1",
-    "connect": "2.19.3",
+    "connect": "2.19.4",
     "commander": "1.3.2",
     "debug": "1.0.0",
     "escape-html": "1.0.1",

From 2fd31f6ea64c394251a9e2313804e84bc7ba5779 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 5 Jun 2014 23:38:58 -0400
Subject: [PATCH 0293/1265] 3.10.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index f415131e107..63e1d0ae442 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.10.3 / 2014-06-05
+===================
 
  * use `vary` module for `res.vary`
  * deps: connect@2.19.4
diff --git a/package.json b/package.json
index cfa42236dc2..e3844971dc4 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.10.2",
+  "version": "3.10.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 5019f38e29b4e13968d24f1f511e4c9d3bec1dd1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 6 Jun 2014 00:38:14 -0400
Subject: [PATCH 0294/1265] tests: add more tests

---
 test/app.router.js |  5 +++++
 test/app.use.js    |  5 +++++
 test/exports.js    | 10 +++++++++-
 test/res.format.js | 18 ++++++++++++++++++
 4 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/test/app.router.js b/test/app.router.js
index 50af69beb7d..a1f9a8d3783 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -25,6 +25,11 @@ describe('app.router', function(){
         [method]('/foo')
         .expect('head' == method ? '' : method, done);
       })
+
+      it('should reject numbers for app.' + method, function(){
+        var app = express();
+        app[method].bind(app, '/', 3).should.throw(/Number/);
+      })
     });
   })
 
diff --git a/test/app.use.js b/test/app.use.js
index 6ebd4eda13c..9e115e95fee 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -15,6 +15,11 @@ describe('app', function(){
     app.use(blog);
   })
 
+  it('should reject numbers', function(){
+    var app = express();
+    app.use.bind(app, 3).should.throw(/Number/);
+  })
+
   describe('.use(app)', function(){
     it('should mount the app', function(done){
       var blog = express()
diff --git a/test/exports.js b/test/exports.js
index 9a593291017..d34a7b1cf3e 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -1,7 +1,7 @@
 
 var express = require('../');
 var request = require('supertest');
-var assert = require('assert');
+var should = require('should');
 
 describe('exports', function(){
   it('should expose Router', function(){
@@ -50,4 +50,12 @@ describe('exports', function(){
     .get('/')
     .expect('bar', done);
   })
+
+  it('should throw on old middlewares', function(){
+    var error;
+    try { express.bodyParser; } catch (e) { error = e; }
+    should(error).have.property('message');
+    error.message.should.containEql('middleware');
+    error.message.should.containEql('bodyParser');
+  })
 })
diff --git a/test/res.format.js b/test/res.format.js
index 7b846222f5c..260dc329a26 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -77,6 +77,24 @@ describe('res', function(){
       test(app2);
     })
 
+    describe('with parameters', function(){
+      var app = express();
+
+      app.use(function(req, res, next){
+        res.format({
+          'text/plain; charset=utf-8': function(){ res.send('hey') },
+          'text/html; foo=bar; bar=baz': function(){ res.send('<p>hey</p>') },
+          'application/json; q=0.5': function(){ res.send({ message: 'hey' }) }
+        });
+      });
+
+      app.use(function(err, req, res, next){
+        res.send(err.status, 'Supports: ' + err.types.join(', '));
+      });
+
+      test(app);
+    })
+
     describe('given .default', function(){
       it('should be invoked instead of auto-responding', function(done){
         request(app3)

From fcbe68eeb55d21070fffa646bd3bc805e406292e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 6 Jun 2014 00:41:08 -0400
Subject: [PATCH 0295/1265] docs: move badges

---
 Readme.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 2541cff1a1d..33caf7ff842 100644
--- a/Readme.md
+++ b/Readme.md
@@ -2,7 +2,10 @@
 
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
-  [![NPM version](https://badge.fury.io/js/express.svg)](http://badge.fury.io/js/express) [![Build Status](https://travis-ci.org/visionmedia/express.svg?branch=master)](https://travis-ci.org/visionmedia/express) [![Coverage Status](https://img.shields.io/coveralls/visionmedia/express.svg)](https://coveralls.io/r/visionmedia/express) [![Gittip](http://img.shields.io/gittip/visionmedia.svg)](https://www.gittip.com/visionmedia/)
+  [![NPM version](https://badge.fury.io/js/express.svg)](http://badge.fury.io/js/express)
+  [![Build Status](https://travis-ci.org/visionmedia/express.svg?branch=master)](https://travis-ci.org/visionmedia/express)
+  [![Coverage Status](https://img.shields.io/coveralls/visionmedia/express.svg)](https://coveralls.io/r/visionmedia/express)
+  [![Gittip](http://img.shields.io/gittip/visionmedia.svg)](https://www.gittip.com/visionmedia/)
 
 ```js
 var express = require('express');

From 3db6dd752f51748c5338c8ac1741abd3dfe07472 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 6 Jun 2014 10:23:47 -0400
Subject: [PATCH 0296/1265] change confusing 404 handling in download example

---
 examples/downloads/app.js    | 20 +++++---------------
 test/acceptance/downloads.js |  2 +-
 2 files changed, 6 insertions(+), 16 deletions(-)

diff --git a/examples/downloads/app.js b/examples/downloads/app.js
index 211e0bbd994..2e61857de44 100644
--- a/examples/downloads/app.js
+++ b/examples/downloads/app.js
@@ -19,23 +19,13 @@ app.get('/files/:file(*)', function(req, res, next){
   var file = req.params.file;
   var path = __dirname + '/files/' + file;
 
-  res.download(path);
-});
-
-// error handling middleware. Because it's
-// below our routes, you will be able to
-// "intercept" errors, otherwise Connect
-// will respond with 500 "Internal Server Error".
-app.use(function(err, req, res, next){
-  // special-case 404s,
-  // remember you could
-  // render a 404 template here
-  if (404 == err.status) {
+  res.download(path, function(err){
+    if (!err) return; // file sent
+    if (err && err.status !== 404) return next(err); // non-404 error
+    // file for download not found
     res.statusCode = 404;
     res.send('Cant find that file, sorry!');
-  } else {
-    next(err);
-  }
+  });
 });
 
 /* istanbul ignore next */
diff --git a/test/acceptance/downloads.js b/test/acceptance/downloads.js
index ab7082a0ce2..674acb15262 100644
--- a/test/acceptance/downloads.js
+++ b/test/acceptance/downloads.js
@@ -30,4 +30,4 @@ describe('downloads', function(){
       .expect(404, done)
     })
   })
-})
\ No newline at end of file
+})

From 4279e6ef4540be760f83a759a5b4d5e36e6fbe99 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 6 Jun 2014 10:42:29 -0400
Subject: [PATCH 0297/1265] improve before hook in mvc example

---
 examples/mvc/controllers/pet/index.js      |  2 +-
 examples/mvc/controllers/user-pet/index.js |  2 +-
 examples/mvc/controllers/user/index.js     |  2 +-
 examples/mvc/index.js                      |  9 +-------
 examples/mvc/lib/boot.js                   | 27 +++++++++++-----------
 test/acceptance/mvc.js                     |  7 ++++++
 6 files changed, 25 insertions(+), 24 deletions(-)

diff --git a/examples/mvc/controllers/pet/index.js b/examples/mvc/controllers/pet/index.js
index c183e51c9eb..f1b9c262128 100644
--- a/examples/mvc/controllers/pet/index.js
+++ b/examples/mvc/controllers/pet/index.js
@@ -6,7 +6,7 @@ var db = require('../../db');
 
 exports.before = function(req, res, next){
   var pet = db.pets[req.params.pet_id];
-  if (!pet) return next(new Error('Pet not found'));
+  if (!pet) return next('route');
   req.pet = pet;
   next();
 };
diff --git a/examples/mvc/controllers/user-pet/index.js b/examples/mvc/controllers/user-pet/index.js
index b05d80a4fe4..416b00741a2 100644
--- a/examples/mvc/controllers/user-pet/index.js
+++ b/examples/mvc/controllers/user-pet/index.js
@@ -11,7 +11,7 @@ exports.create = function(req, res, next){
   var id = req.params.user_id;
   var user = db.users[id];
   var body = req.body;
-  if (!user) return next(new Error('User not found'));
+  if (!user) return next('route');
   var pet = { name: body.pet.name };
   pet.id = db.pets.push(pet) - 1;
   user.pets.push(pet);
diff --git a/examples/mvc/controllers/user/index.js b/examples/mvc/controllers/user/index.js
index 0eb40f3f5cf..9ccbcccb9ca 100644
--- a/examples/mvc/controllers/user/index.js
+++ b/examples/mvc/controllers/user/index.js
@@ -11,7 +11,7 @@ exports.before = function(req, res, next){
   process.nextTick(function(){
     req.user = db.users[id];
     // cant find that user
-    if (!req.user) return next(new Error('User not found'));
+    if (!req.user) return next('route');
     // found it, move on to the routes
     next();
   });
diff --git a/examples/mvc/index.js b/examples/mvc/index.js
index cd5b74cbd04..e994824560b 100644
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -73,16 +73,9 @@ app.use(function(req, res, next){
 // load controllers
 require('./lib/boot')(app, { verbose: !module.parent });
 
-// assume "not found" in the error msgs
-// is a 404. this is somewhat silly, but
-// valid, you can do whatever you like, set
-// properties, use instanceof etc.
 app.use(function(err, req, res, next){
-  // treat as 404
-  if (~err.message.indexOf('not found')) return next();
-
   // log it
-  console.error(err.stack);
+  if (!module.parent) console.error(err.stack);
 
   // error page
   res.status(500).render('5xx');
diff --git a/examples/mvc/lib/boot.js b/examples/mvc/lib/boot.js
index 9cad303feab..82ac8a5186e 100644
--- a/examples/mvc/lib/boot.js
+++ b/examples/mvc/lib/boot.js
@@ -13,6 +13,7 @@ module.exports = function(parent, options){
     var name = obj.name || name;
     var prefix = obj.prefix || '';
     var app = express();
+    var handler;
     var method;
     var path;
 
@@ -20,16 +21,6 @@ module.exports = function(parent, options){
     if (obj.engine) app.set('view engine', obj.engine);
     app.set('views', __dirname + '/../controllers/' + name + '/views');
 
-    // before middleware support
-    if (obj.before) {
-      path = '/' + name + '/:' + name + '_id';
-      app.all(path, obj.before);
-      verbose && console.log('     ALL %s -> before', path);
-      path = '/' + name + '/:' + name + '_id/*';
-      app.all(path, obj.before);
-      verbose && console.log('     ALL %s -> before', path);
-    }
-
     // generate routes based
     // on the exported methods
     for (var key in obj) {
@@ -62,15 +53,25 @@ module.exports = function(parent, options){
           path = '/';
           break;
         default:
+          /* istanbul ignore next */
           throw new Error('unrecognized route: ' + name + '.' + key);
       }
 
+      // setup
+      handler = obj[key];
       path = prefix + path;
-      app[method](path, obj[key]);
-      verbose && console.log('     %s %s -> %s', method.toUpperCase(), path, key);
+
+      // before middleware support
+      if (obj.before) {
+        app[method](path, obj.before, handler);
+        verbose && console.log('     %s %s -> before -> %s', method.toUpperCase(), path, key);
+      } else {
+        app[method](path, obj[key]);
+        verbose && console.log('     %s %s -> %s', method.toUpperCase(), path, key);
+      }
     }
 
     // mount the app
     parent.use(app);
   });
-};
\ No newline at end of file
+};
diff --git a/test/acceptance/mvc.js b/test/acceptance/mvc.js
index 3de481c679b..dcaf63e6b8f 100644
--- a/test/acceptance/mvc.js
+++ b/test/acceptance/mvc.js
@@ -92,6 +92,13 @@ describe('mvc', function(){
   })
 
   describe('PUT /user/:id', function(){
+    it('should 500 on error', function(done){
+      request(app)
+      .put('/user/1')
+      .send({})
+      .expect(500, done)
+    })
+
     it('should update the user', function(done){
       request(app)
       .put('/user/1')

From 21393c244cbcbbfe6d64a5252d1248875994efe0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 6 Jun 2014 11:12:52 -0400
Subject: [PATCH 0298/1265] tests: add more route tests

---
 test/Route.js     | 19 +++++++++++++++++++
 test/Router.js    | 19 +++++++++++++++++++
 test/app.route.js | 10 ++++++++++
 3 files changed, 48 insertions(+)

diff --git a/test/Route.js b/test/Route.js
index ccb102232fd..614947e9661 100644
--- a/test/Route.js
+++ b/test/Route.js
@@ -167,5 +167,24 @@ describe('Route', function(){
 
       route.dispatch({ method: 'get' }, {});
     });
+
+    it('should handle throwing inside error handlers', function(done) {
+      var route = new Route('');
+
+      route.get(function(req, res, next){
+        throw new Error('boom!');
+      });
+
+      route.get(function(err, req, res, next){
+        throw new Error('oops');
+      });
+
+      route.get(function(err, req, res, next){
+        assert.equal(err.message, 'oops');
+        done();
+      });
+
+      route.dispatch({ url: '/', method: 'GET' }, {}, done);
+    });
   })
 })
diff --git a/test/Router.js b/test/Router.js
index 0a84a88c117..a1fc89ecee9 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -131,6 +131,25 @@ describe('Router', function(){
 
       router.handle({ url: '/foo/2', method: 'GET' }, {}, done);
     });
+
+    it('should handle throwing inside error handlers', function(done) {
+      var router = new Router();
+
+      router.use(function(req, res, next){
+        throw new Error('boom!');
+      });
+
+      router.use(function(err, req, res, next){
+        throw new Error('oops');
+      });
+
+      router.use(function(err, req, res, next){
+        assert.equal(err.message, 'oops');
+        done();
+      });
+
+      router.handle({ url: '/', method: 'GET' }, {}, done);
+    });
   })
 
   describe('.all', function() {
diff --git a/test/app.route.js b/test/app.route.js
index 8675b4e184b..75e5e0b8421 100644
--- a/test/app.route.js
+++ b/test/app.route.js
@@ -49,4 +49,14 @@ describe('app.route', function(){
     .get('/test')
     .expect('test', done);
   });
+
+  it('should not error on empty routes', function(done){
+    var app = express();
+
+    app.route('/:foo');
+
+    request(app)
+    .get('/test')
+    .expect(404, done);
+  });
 });

From ad05eb822208fbc7fbfd241d82f535756b338f3c Mon Sep 17 00:00:00 2001
From: Joshua Goldberg <jsgoldberg90@gmail.com>
Date: Sat, 7 Jun 2014 17:09:07 -0700
Subject: [PATCH 0299/1265] Fix typo in console.log in multipart example

closes #2164
---
 examples/multipart/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/multipart/index.js b/examples/multipart/index.js
index f4405dda941..42c2af23f74 100644
--- a/examples/multipart/index.js
+++ b/examples/multipart/index.js
@@ -56,5 +56,5 @@ app.post('/', function(req, res, next){
 /* istanbul ignore next */
 if (!module.parent) {
   app.listen(4000);
-  console.log('Express started on port 3000');
+  console.log('Express started on port 4000');
 }

From 253ce4837a2423ee2e987d49f4a9f21c45150c56 Mon Sep 17 00:00:00 2001
From: Nick Heiner <nick.heiner@opower.com>
Date: Sun, 8 Jun 2014 13:59:52 -0400
Subject: [PATCH 0300/1265] Use path.resolve for views dir instead of concat

closes #2165
---
 lib/application.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/application.js b/lib/application.js
index e8c2d46e64e..a126020dea1 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -14,6 +14,7 @@ var http = require('http');
 var compileETag = require('./utils').compileETag;
 var compileTrust = require('./utils').compileTrust;
 var deprecate = require('./utils').deprecate;
+var resolve = require('path').resolve;
 
 /**
  * Application prototype.
@@ -74,7 +75,7 @@ app.defaultConfiguration = function(){
 
   // default configuration
   this.set('view', View);
-  this.set('views', process.cwd() + '/views');
+  this.set('views', resolve('views'));
   this.set('jsonp callback name', 'callback');
 
   if (env === 'production') {

From 4d3e0d88a2aa507808406a227bc783d6287bdf20 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 9 Jun 2014 09:43:51 -0400
Subject: [PATCH 0301/1265] Fix catching errors from top-level handlers

---
 History.md          |  1 +
 lib/router/index.js | 10 +++++-----
 test/Router.js      | 24 +++++++++++++++++++++++-
 3 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/History.md b/History.md
index a58ce15faab..ac3701d13e1 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+ * fix catching errors from top-level handlers
  * use `vary` module for `res.vary`
  * deps: proxy-addr@1.0.1
  * deps: type-is@1.2.1
diff --git a/lib/router/index.js b/lib/router/index.js
index 982e24407a1..6b826602403 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -245,15 +245,15 @@ proto.handle = function(req, res, done) {
 
       debug('%s %s : %s', layer.handle.name || 'anonymous', layerPath, req.originalUrl);
       var arity = layer.handle.length;
-      if (err) {
-        if (arity === 4) {
+      try {
+        if (err && arity === 4) {
           layer.handle(err, req, res, next);
+        } else if (!err && arity < 4) {
+          layer.handle(req, res, next);
         } else {
           next(err);
         }
-      } else if (arity < 4) {
-        layer.handle(req, res, next);
-      } else {
+      } catch (err) {
         next(err);
       }
     }
diff --git a/test/Router.js b/test/Router.js
index a1fc89ecee9..cbc8acbc525 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -129,7 +129,29 @@ describe('Router', function(){
         done();
       });
 
-      router.handle({ url: '/foo/2', method: 'GET' }, {}, done);
+      router.handle({ url: '/foo/2', method: 'GET' }, {}, function() {});
+    });
+
+    it('should handle throwing in handler after async param', function(done) {
+      var router = new Router();
+
+      router.param('user', function(req, res, next, val){
+        process.nextTick(function(){
+          req.user = val;
+          next();
+        });
+      });
+
+      router.use('/:user', function(req, res, next){
+        throw new Error('oh no!');
+      });
+
+      router.use(function(err, req, res, next){
+        assert.equal(err.message, 'oh no!');
+        done();
+      });
+
+      router.handle({ url: '/bob', method: 'GET' }, {}, function() {});
     });
 
     it('should handle throwing inside error handlers', function(done) {

From 8060a49c6c683bcb5f0d7ff3ba7682f133ed98e3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 9 Jun 2014 18:50:00 -0400
Subject: [PATCH 0302/1265] deps: connect@2.19.5

---
 History.md   | 10 ++++++++++
 package.json |  2 +-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 63e1d0ae442..bcc7d62fe5c 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,13 @@
+3.x
+===
+
+ * deps: connect@2.19.5
+   - fix "event emitter leak" warnings
+   - deps: csurf@1.2.1
+   - deps: debug@1.0.1
+   - deps: serve-static@1.2.2
+   - deps: type-is@1.2.1
+
 3.10.3 / 2014-06-05
 ===================
 
diff --git a/package.json b/package.json
index e3844971dc4..89583af1912 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
   "license": "MIT",
   "dependencies": {
     "buffer-crc32": "0.2.1",
-    "connect": "2.19.4",
+    "connect": "2.19.5",
     "commander": "1.3.2",
     "debug": "1.0.0",
     "escape-html": "1.0.1",

From dc94f305cc18b32135f1cbfb43735a2b074ede83 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 9 Jun 2014 18:50:36 -0400
Subject: [PATCH 0303/1265] deps: debug@1.0.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index bcc7d62fe5c..f51e992b42c 100644
--- a/History.md
+++ b/History.md
@@ -7,6 +7,7 @@
    - deps: debug@1.0.1
    - deps: serve-static@1.2.2
    - deps: type-is@1.2.1
+ * deps: debug@1.0.1
 
 3.10.3 / 2014-06-05
 ===================
diff --git a/package.json b/package.json
index 89583af1912..96940aee5b5 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
     "buffer-crc32": "0.2.1",
     "connect": "2.19.5",
     "commander": "1.3.2",
-    "debug": "1.0.0",
+    "debug": "1.0.1",
     "escape-html": "1.0.1",
     "methods": "1.0.1",
     "mkdirp": "0.5.0",

From 5af625903f6e2e5dbfefc1add40e380101a0ef27 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 9 Jun 2014 18:51:55 -0400
Subject: [PATCH 0304/1265] deps: send@0.4.2

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f51e992b42c..969f04a4395 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,10 @@
    - deps: serve-static@1.2.2
    - deps: type-is@1.2.1
  * deps: debug@1.0.1
+ * deps: send@0.4.2
+   - fix "event emitter leak" warnings
+   - deps: finished@1.2.1
+   - deps: debug@1.0.1
 
 3.10.3 / 2014-06-05
 ===================
diff --git a/package.json b/package.json
index 96940aee5b5..6e357d041f3 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,7 @@
     "parseurl": "1.0.1",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.4.1",
+    "send": "0.4.2",
     "vary": "0.1.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",

From f881784e9b762996be802c249ad8dc72889e9650 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 9 Jun 2014 18:53:52 -0400
Subject: [PATCH 0305/1265] 3.10.4

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 969f04a4395..a12d5ef0894 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.10.4 / 2014-06-09
+===================
 
  * deps: connect@2.19.5
    - fix "event emitter leak" warnings
diff --git a/package.json b/package.json
index 6e357d041f3..3c4492cc1e4 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.10.3",
+  "version": "3.10.4",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 142462d539dfad36f148f118f5245205fe014399 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 9 Jun 2014 20:19:09 -0400
Subject: [PATCH 0306/1265] deps: debug@1.0.1

---
 History.md   | 2 +-
 package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index ac3701d13e1..1bed47ce0f2 100644
--- a/History.md
+++ b/History.md
@@ -3,9 +3,9 @@ unreleased
 
  * fix catching errors from top-level handlers
  * use `vary` module for `res.vary`
+ * deps: debug@1.0.1
  * deps: proxy-addr@1.0.1
  * deps: type-is@1.2.1
- * deps: debug@1.0.0
 
 4.4.1 / 2014-06-02
 ==================
diff --git a/package.json b/package.json
index e072f4610fc..e4299793346 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "accepts": "1.0.2",
     "buffer-crc32": "0.2.1",
-    "debug": "1.0.0",
+    "debug": "1.0.1",
     "escape-html": "1.0.1",
     "methods": "1.0.1",
     "parseurl": "1.0.1",

From 7f6c7a19c67bc89f976f9707f92e742f830d8a4a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 9 Jun 2014 20:21:31 -0400
Subject: [PATCH 0307/1265] deps: serve-static@1.2.2

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 1bed47ce0f2..56bd4956104 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,9 @@ unreleased
  * use `vary` module for `res.vary`
  * deps: debug@1.0.1
  * deps: proxy-addr@1.0.1
+ * deps: serve-static@1.2.2
+   - fix "event emitter leak" warnings
+   - deps: send@0.4.2
  * deps: type-is@1.2.1
 
 4.4.1 / 2014-06-02
diff --git a/package.json b/package.json
index e4299793346..fc8b9947551 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.4.1",
-    "serve-static": "1.2.1",
+    "serve-static": "1.2.2",
     "type-is": "1.2.1",
     "vary": "0.1.0",
     "cookie": "0.1.2",

From b45fd70f99a259653ab068c233df1c628c0713b5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 9 Jun 2014 20:22:42 -0400
Subject: [PATCH 0308/1265] deps: send@0.4.2

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 56bd4956104..d1e84ce1796 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,10 @@ unreleased
  * use `vary` module for `res.vary`
  * deps: debug@1.0.1
  * deps: proxy-addr@1.0.1
+ * deps: send@0.4.2
+   - fix "event emitter leak" warnings
+   - deps: debug@1.0.1
+   - deps: finished@1.2.1
  * deps: serve-static@1.2.2
    - fix "event emitter leak" warnings
    - deps: send@0.4.2
diff --git a/package.json b/package.json
index fc8b9947551..a4c7679af9d 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "parseurl": "1.0.1",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.4.1",
+    "send": "0.4.2",
     "serve-static": "1.2.2",
     "type-is": "1.2.1",
     "vary": "0.1.0",

From b1efa19f9713a4d72a0fcb26f6100efb2f0ea8b0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 9 Jun 2014 20:24:36 -0400
Subject: [PATCH 0309/1265] deps: update testing dependencies

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index a4c7679af9d..3341e24e524 100644
--- a/package.json
+++ b/package.json
@@ -48,8 +48,8 @@
   "devDependencies": {
     "after": "0.8.1",
     "istanbul": "0.2.10",
-    "mocha": "~1.20.0",
-    "should": "~4.0.0",
+    "mocha": "~1.20.1",
+    "should": "~4.0.4",
     "supertest": "~0.13.0",
     "connect-redis": "~2.0.0",
     "ejs": "~1.0.0",

From 3205f6851059f79b6ed0b27931b7096d36eb7153 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 9 Jun 2014 20:36:58 -0400
Subject: [PATCH 0310/1265] deps: update example dependencies

---
 examples/vhost/index.js  | 10 ++++-----
 package.json             |  4 ++--
 test/acceptance/vhost.js | 46 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 53 insertions(+), 7 deletions(-)
 create mode 100644 test/acceptance/vhost.js

diff --git a/examples/vhost/index.js b/examples/vhost/index.js
index 1a01507d2e2..4a0c17b8502 100644
--- a/examples/vhost/index.js
+++ b/examples/vhost/index.js
@@ -18,7 +18,7 @@ edit /etc/hosts:
 
 var main = express();
 
-main.use(logger('dev'));
+if (!module.parent) main.use(logger('dev'));
 
 main.get('/', function(req, res){
   res.send('Hello from main app!');
@@ -32,14 +32,14 @@ main.get('/:sub', function(req, res){
 
 var redirect = express();
 
-redirect.all('*', function(req, res){
-  console.log(req.subdomains);
-  res.redirect('http://example.com:3000/' + req.subdomains[0]);
+redirect.use(function(req, res){
+  if (!module.parent) console.log(req.vhost);
+  res.redirect('http://example.com:3000/' + req.vhost[0]);
 });
 
 // Vhost app
 
-var app = express();
+var app = module.exports = express();
 
 app.use(vhost('*.example.com', redirect)); // Serves all subdomains via Redirect app
 app.use(vhost('example.com', main)); // Serves top level domain via Main server app
diff --git a/package.json b/package.json
index 3341e24e524..1e3b40133c1 100644
--- a/package.json
+++ b/package.json
@@ -60,9 +60,9 @@
     "body-parser": "1.3.0",
     "cookie-parser": "1.1.0",
     "express-session": "1.2.1",
-    "method-override": "2.0.1",
+    "method-override": "2.0.2",
     "morgan": "1.1.1",
-    "vhost": "1.0.0"
+    "vhost": "2.0.0"
   },
   "engines": {
     "node": ">= 0.10.0"
diff --git a/test/acceptance/vhost.js b/test/acceptance/vhost.js
new file mode 100644
index 00000000000..1b633d4b2bc
--- /dev/null
+++ b/test/acceptance/vhost.js
@@ -0,0 +1,46 @@
+var app = require('../../examples/vhost')
+var request = require('supertest')
+
+describe('vhost', function(){
+  describe('example.com', function(){
+    describe('GET /', function(){
+      it('should say hello', function(done){
+        request(app)
+        .get('/')
+        .set('Host', 'example.com')
+        .expect(200, /hello/i, done)
+      })
+    })
+
+    describe('GET /foo', function(){
+      it('should say foo', function(done){
+        request(app)
+        .get('/foo')
+        .set('Host', 'example.com')
+        .expect(200, 'requested foo', done)
+      })
+    })
+  })
+
+  describe('foo.example.com', function(){
+    describe('GET /', function(){
+      it('should redirect to /foo', function(done){
+        request(app)
+        .get('/')
+        .set('Host', 'foo.example.com')
+        .expect(302, /Redirecting to http:\/\/example.com:3000\/foo/, done)
+      })
+    })
+  })
+
+  describe('bar.example.com', function(){
+    describe('GET /', function(){
+      it('should redirect to /bar', function(done){
+        request(app)
+        .get('/')
+        .set('Host', 'bar.example.com')
+        .expect(302, /Redirecting to http:\/\/example.com:3000\/bar/, done)
+      })
+    })
+  })
+})

From 7daae1912b3f86320559a8afcea26d8184f036ce Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 9 Jun 2014 20:40:39 -0400
Subject: [PATCH 0311/1265] 4.4.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 86759eafd3b..f8c2b9438a2 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.4.2 / 2014-06-09
+==================
 
  * fix catching errors from top-level handlers
  * use `vary` module for `res.vary`
diff --git a/package.json b/package.json
index 1e3b40133c1..b2b2064e0f0 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.4.1",
+  "version": "4.4.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 7df7f7a575df4cf26c1d43535a6a1a6b8778933c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 11 Jun 2014 17:53:56 -0400
Subject: [PATCH 0312/1265] deps: debug@1.0.2

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f8c2b9438a2..0dd85545d98 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+ * deps: debug@1.0.2
+
 4.4.2 / 2014-06-09
 ==================
 
diff --git a/package.json b/package.json
index b2b2064e0f0..1f48ebbc34a 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "accepts": "1.0.2",
     "buffer-crc32": "0.2.1",
-    "debug": "1.0.1",
+    "debug": "1.0.2",
     "escape-html": "1.0.1",
     "methods": "1.0.1",
     "parseurl": "1.0.1",

From 6775658ed5cbac13f2d24c89e23ed967ad6a66ba Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 11 Jun 2014 18:15:09 -0400
Subject: [PATCH 0313/1265] Fix persistence of req.params from app.params

fixes #2170
---
 History.md          |  1 +
 lib/router/index.js | 29 ++++++++++++++++++++++-------
 test/app.param.js   | 20 ++++++++++++++++++++
 3 files changed, 43 insertions(+), 7 deletions(-)

diff --git a/History.md b/History.md
index 0dd85545d98..17fc3c4709b 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+ * fix persistence of modified `req.params[name]` from `app.param()`
  * deps: debug@1.0.2
 
 4.4.2 / 2014-06-09
diff --git a/lib/router/index.js b/lib/router/index.js
index 6b826602403..a3a4c1bf0bd 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -320,11 +320,19 @@ proto.process_params = function(layer, called, req, res, done) {
     }
 
     // param previously called with same value or error occurred
-    if (paramCalled && (paramCalled.err || paramCalled.val === paramVal)) {
-      return param(paramCalled.err);
+    if (paramCalled && (paramCalled.error || paramCalled.match === paramVal)) {
+      // restore value
+      req.params[name] = paramCalled.value;
+
+      // next param
+      return param(paramCalled.error);
     }
 
-    called[name] = paramCalled = { val: paramVal };
+    called[name] = paramCalled = {
+      error: null,
+      match: paramVal,
+      value: paramVal
+    };
 
     try {
       return paramCallback();
@@ -335,13 +343,20 @@ proto.process_params = function(layer, called, req, res, done) {
 
   // single param callbacks
   function paramCallback(err) {
-    if (err && paramCalled) {
+    var fn = paramCallbacks[paramIndex++];
+
+    // store updated value
+    paramCalled.value = req.params[key.name];
+
+    if (err) {
       // store error
-      paramCalled.err = err;
+      paramCalled.error = err;
+      param(err);
+      return;
     }
 
-    var fn = paramCallbacks[paramIndex++];
-    if (err || !fn) return param(err);
+    if (!fn) return param();
+
     fn(req, res, paramCallback, paramVal, key.name);
   }
 
diff --git a/test/app.param.js b/test/app.param.js
index 18dc2f03019..9c6264c274c 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -157,6 +157,26 @@ describe('app', function(){
       .expect('2 2 foo,bob', done);
     })
 
+    it('should support altering req.params across routes', function(done) {
+      var app = express();
+
+      app.param('user', function(req, res, next, user) {
+        req.params.user = 'loki';
+        next();
+      });
+
+      app.get('/:user', function(req, res, next) {
+        next('route');
+      });
+      app.get('/:user', function(req, res, next) {
+        res.send(req.params.user);
+      });
+
+      request(app)
+      .get('/bob')
+      .expect('loki', done);
+    })
+
     it('should work with encoded values', function(done){
       var app = express();
 

From 9cdbc8052248ec99d2d56d2893aa25789233f0b3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 12 Jun 2014 00:14:36 -0400
Subject: [PATCH 0314/1265] deps: send@0.4.3

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 17fc3c4709b..055556cd0e8 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,12 @@ unreleased
 
  * fix persistence of modified `req.params[name]` from `app.param()`
  * deps: debug@1.0.2
+ * deps: send@0.4.3
+   - Do not throw un-catchable error on file open race condition
+   - Use `escape-html` for HTML escaping
+   - deps: debug@1.0.2
+   - deps: finished@1.2.2
+   - deps: fresh@0.2.2
 
 4.4.2 / 2014-06-09
 ==================
diff --git a/package.json b/package.json
index 1f48ebbc34a..9cc0139029a 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "parseurl": "1.0.1",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.4.2",
+    "send": "0.4.3",
     "serve-static": "1.2.2",
     "type-is": "1.2.1",
     "vary": "0.1.0",

From 3428543bb876baeb9b2c68fd620bb52e8f9e9d16 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 12 Jun 2014 00:16:05 -0400
Subject: [PATCH 0315/1265] deps: accepts@1.0.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 055556cd0e8..2f69db8fa42 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,8 @@ unreleased
 ==========
 
  * fix persistence of modified `req.params[name]` from `app.param()`
+ * deps: accepts@1.0.3
+   - deps: negotiator@0.4.6
  * deps: debug@1.0.2
  * deps: send@0.4.3
    - Do not throw un-catchable error on file open race condition
diff --git a/package.json b/package.json
index 9cc0139029a..7f4875761b3 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
   "repository": "visionmedia/express",
   "license": "MIT",
   "dependencies": {
-    "accepts": "1.0.2",
+    "accepts": "1.0.3",
     "buffer-crc32": "0.2.1",
     "debug": "1.0.2",
     "escape-html": "1.0.1",

From c361a06bd4de787e7058d64c29646f04784380ba Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 12 Jun 2014 00:17:28 -0400
Subject: [PATCH 0316/1265] deps: serve-static@1.2.3

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 2f69db8fa42..f4b6283f874 100644
--- a/History.md
+++ b/History.md
@@ -11,6 +11,9 @@ unreleased
    - deps: debug@1.0.2
    - deps: finished@1.2.2
    - deps: fresh@0.2.2
+ * deps: serve-static@1.2.3
+   - Do not throw un-catchable error on file open race condition
+   - deps: send@0.4.3
 
 4.4.2 / 2014-06-09
 ==================
diff --git a/package.json b/package.json
index 7f4875761b3..40028cc5ca7 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.4.3",
-    "serve-static": "1.2.2",
+    "serve-static": "1.2.3",
     "type-is": "1.2.1",
     "vary": "0.1.0",
     "cookie": "0.1.2",

From a76d5084246a0ea74ce823c7ef316dabb7d74520 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 12 Jun 2014 00:20:30 -0400
Subject: [PATCH 0317/1265] deps: connect@2.19.6

---
 History.md   | 10 ++++++++++
 package.json |  2 +-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a12d5ef0894..75f1d2e7c7c 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,13 @@
+3.x
+===
+
+ * deps: connect@2.19.6
+   - deps: body-parser@1.3.1
+   - deps: compression@1.0.7
+   - deps: debug@1.0.2
+   - deps: serve-index@1.1.1
+   - deps: serve-static@1.2.3
+
 3.10.4 / 2014-06-09
 ===================
 
diff --git a/package.json b/package.json
index 3c4492cc1e4..57be9fc68ca 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
   "license": "MIT",
   "dependencies": {
     "buffer-crc32": "0.2.1",
-    "connect": "2.19.5",
+    "connect": "2.19.6",
     "commander": "1.3.2",
     "debug": "1.0.1",
     "escape-html": "1.0.1",

From 9e9827d2365ee9ce5250736c3c5645a5fd89e374 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 12 Jun 2014 00:23:15 -0400
Subject: [PATCH 0318/1265] deps: debug@1.0.2

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 75f1d2e7c7c..eee4e676f4c 100644
--- a/History.md
+++ b/History.md
@@ -7,6 +7,7 @@
    - deps: debug@1.0.2
    - deps: serve-index@1.1.1
    - deps: serve-static@1.2.3
+ * deps: debug@1.0.2
 
 3.10.4 / 2014-06-09
 ===================
diff --git a/package.json b/package.json
index 57be9fc68ca..8b2c51b533a 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
     "buffer-crc32": "0.2.1",
     "connect": "2.19.6",
     "commander": "1.3.2",
-    "debug": "1.0.1",
+    "debug": "1.0.2",
     "escape-html": "1.0.1",
     "methods": "1.0.1",
     "mkdirp": "0.5.0",

From 3b1f747f9606d498e0c659a2e400831927959136 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 12 Jun 2014 00:24:21 -0400
Subject: [PATCH 0319/1265] deps: send@0.4.3

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index eee4e676f4c..1067e5f477c 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,12 @@
    - deps: serve-index@1.1.1
    - deps: serve-static@1.2.3
  * deps: debug@1.0.2
+ * deps: send@0.4.3
+   - Do not throw un-catchable error on file open race condition
+   - Use `escape-html` for HTML escaping
+   - deps: debug@1.0.2
+   - deps: finished@1.2.2
+   - deps: fresh@0.2.2
 
 3.10.4 / 2014-06-09
 ===================
diff --git a/package.json b/package.json
index 8b2c51b533a..12d59055394 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,7 @@
     "parseurl": "1.0.1",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.4.2",
+    "send": "0.4.3",
     "vary": "0.1.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",

From 73c5533e665743d305e266eee134c48d88d2dcfd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 12 Jun 2014 00:28:08 -0400
Subject: [PATCH 0320/1265] 3.10.5

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 1067e5f477c..8ce41d2227e 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.10.5 / 2014-06-11
+===================
 
  * deps: connect@2.19.6
    - deps: body-parser@1.3.1
diff --git a/package.json b/package.json
index 12d59055394..81b6f801f18 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.10.4",
+  "version": "3.10.5",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From ac573cf830fc73284293055df7034c4b11aa5459 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 12 Jun 2014 00:41:24 -0400
Subject: [PATCH 0321/1265] 4.4.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 8ee054ea80e..06fa3474f4d 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.4.3 / 2014-06-11
+==================
 
  * fix persistence of modified `req.params[name]` from `app.param()`
  * deps: accepts@1.0.3
diff --git a/package.json b/package.json
index 40028cc5ca7..d834173dda9 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.4.2",
+  "version": "4.4.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 8258ce14f42db2cbb2bc2990497352c6a6a2114e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 14 Jun 2014 12:57:32 -0400
Subject: [PATCH 0322/1265] fix "trim prefix" debug message in express:router

closes #2177
---
 History.md          | 5 +++++
 lib/router/index.js | 6 ++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 06fa3474f4d..4e41c61aa44 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+ * fix "trim prefix" debug message in `express:router`
+
 4.4.3 / 2014-06-11
 ==================
 
diff --git a/lib/router/index.js b/lib/router/index.js
index a3a4c1bf0bd..08462c1b170 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -226,9 +226,11 @@ proto.handle = function(req, res, done) {
 
       // Trim off the part of the url that matches the route
       // middleware (.use stuff) needs to have the path stripped
-      debug('trim prefix (%s) from url %s', removed, req.url);
       removed = layerPath;
-      req.url = protohost + req.url.substr(protohost.length + removed.length);
+      if (removed.length) {
+        debug('trim prefix (%s) from url %s', layerPath, req.url);
+        req.url = protohost + req.url.substr(protohost.length + removed.length);
+      }
 
       // Ensure leading slash
       if (!fqdn && req.url[0] !== '/') {

From 9db1367c2da82a7103151df2bd1f11ad0301e10f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 19 Jun 2014 22:55:21 -0400
Subject: [PATCH 0323/1265] deps: buffer-crc32@0.2.3

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 8ce41d2227e..54af7d7abee 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+ * deps: buffer-crc32@0.2.3
+
 3.10.5 / 2014-06-11
 ===================
 
diff --git a/package.json b/package.json
index 81b6f801f18..1306d91804c 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
   "repository": "visionmedia/express",
   "license": "MIT",
   "dependencies": {
-    "buffer-crc32": "0.2.1",
+    "buffer-crc32": "0.2.3",
     "connect": "2.19.6",
     "commander": "1.3.2",
     "debug": "1.0.2",

From 5a4e9125decbc6391fc0fa931b9a87b4930b1bab Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 19 Jun 2014 23:24:07 -0400
Subject: [PATCH 0324/1265] deps: connect@2.20.2

---
 History.md             | 16 ++++++++++++++++
 examples/mvc/index.js  |  2 +-
 package.json           |  2 +-
 test/acceptance/mvc.js |  3 +++
 test/support/env.js    |  1 +
 5 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 54af7d7abee..ff5569b1c9f 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,22 @@ unreleased
 ==========
 
  * deps: buffer-crc32@0.2.3
+ * deps: connect@2.20.2
+   - deprecate `verify` option to `json` -- use `body-parser` module directly
+   - deprecate `verify` option to `urlencoded` -- use `body-parser` module directly
+   - deprecate things with `depd` module
+   - use `finalhandler` for final response handling
+   - use `media-typer` to parse `content-type` for charset
+   - deps: body-parser@1.4.3
+   - deps: connect-timeout@1.1.1
+   - deps: cookie-parser@1.3.1
+   - deps: csurf@1.2.2
+   - deps: errorhandler@1.1.0
+   - deps: express-session@1.4.0
+   - deps: multiparty@3.2.9
+   - deps: serve-index@1.1.2
+   - deps: type-is@1.3.1
+   - deps: vhost@2.0.0
 
 3.10.5 / 2014-06-11
 ===================
diff --git a/examples/mvc/index.js b/examples/mvc/index.js
index ee60525c178..ca9f3cc402a 100644
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -35,7 +35,7 @@ app.use(express.cookieParser('some secret here'));
 app.use(express.session());
 
 // parse request bodies (req.body)
-app.use(express.bodyParser());
+app.use(express.urlencoded({ extended: true }));
 
 // support _method (PUT in forms etc)
 app.use(express.methodOverride());
diff --git a/package.json b/package.json
index 1306d91804c..bba7c1ab2c5 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
   "license": "MIT",
   "dependencies": {
     "buffer-crc32": "0.2.3",
-    "connect": "2.19.6",
+    "connect": "2.20.2",
     "commander": "1.3.2",
     "debug": "1.0.2",
     "escape-html": "1.0.1",
diff --git a/test/acceptance/mvc.js b/test/acceptance/mvc.js
index 3de481c679b..df0ce7d9bf9 100644
--- a/test/acceptance/mvc.js
+++ b/test/acceptance/mvc.js
@@ -33,6 +33,7 @@ describe('mvc', function(){
     it('should update the pet', function(done){
       request(app)
       .put('/pet/3')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
       .send({ pet: { name: 'Boots' } })
       .end(function(err, res){
         if (err) return done(err);
@@ -95,6 +96,7 @@ describe('mvc', function(){
     it('should update the user', function(done){
       request(app)
       .put('/user/1')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
       .send({ user: { name: 'Tobo' }})
       .end(function(err, res){
         if (err) return done(err);
@@ -109,6 +111,7 @@ describe('mvc', function(){
     it('should create a pet for user', function(done){
       request(app)
       .post('/user/2/pet')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
       .send({ pet: { name: 'Snickers' }})
       .expect('Location', '/user/2')
       .expect(302, function(err, res){
diff --git a/test/support/env.js b/test/support/env.js
index eb938f3b7a1..7dbdffef1f2 100644
--- a/test/support/env.js
+++ b/test/support/env.js
@@ -1,2 +1,3 @@
 
 process.env.NODE_ENV = 'test';
+process.env.NO_DEPRECATION = 'connect';

From 9c731f1883a837ca2f46ddcf476bfdce60e82fb3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 19 Jun 2014 23:33:56 -0400
Subject: [PATCH 0325/1265] deprecate things with depd module

---
 History.md          |  1 +
 lib/application.js  |  4 ++--
 lib/express.js      |  4 ++--
 lib/response.js     | 30 +++++++++++-------------------
 lib/utils.js        | 25 -------------------------
 package.json        |  1 +
 test/support/env.js |  2 +-
 test/utils.js       | 22 ----------------------
 8 files changed, 18 insertions(+), 71 deletions(-)

diff --git a/History.md b/History.md
index ff5569b1c9f..7f8b1689fef 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+ * deprecate things with `depd` module
  * deps: buffer-crc32@0.2.3
  * deps: connect@2.20.2
    - deprecate `verify` option to `json` -- use `body-parser` module directly
diff --git a/lib/application.js b/lib/application.js
index 8efed1e6c94..e4618fbd967 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -12,8 +12,8 @@ var connect = require('connect')
   , compileTrust = require('./utils').compileTrust
   , View = require('./view')
   , utils = connect.utils
-  , deprecate = require('./utils').deprecate
   , http = require('http');
+var deprecate = require('depd')('express');
 
 /**
  * Application prototype.
@@ -448,7 +448,7 @@ app.all = function(path){
 
 // del -> delete alias
 
-app.del = deprecate(app.delete, 'app.del: Use app.delete instead');
+app.del = deprecate.function(app.delete, 'app.del: Use app.delete instead');
 
 /**
  * Render the given view `name` name with `options`
diff --git a/lib/express.js b/lib/express.js
index fdad68210ed..8a976daa4b8 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -2,6 +2,7 @@
  * Module dependencies.
  */
 
+var deprecate = require('depd')('express');
 var merge = require('merge-descriptors');
 var connect = require('connect')
   , proto = require('./application')
@@ -9,7 +10,6 @@ var connect = require('connect')
   , Router = require('./router')
   , req = require('./request')
   , res = require('./response')
-  , deprecate = require('./utils').deprecate
   , utils = connect.utils;
 
 /**
@@ -51,7 +51,7 @@ merge(exports, connect.middleware);
  * Deprecated createServer().
  */
 
-exports.createServer = deprecate(createApplication,
+exports.createServer = deprecate.function(createApplication,
   'createServer() is deprecated\n' +
   'express applications no longer inherit from http.Server\n' +
   'please use:\n' +
diff --git a/lib/response.js b/lib/response.js
index 094e35c98c2..339bf0c483a 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -2,6 +2,7 @@
  * Module dependencies.
  */
 
+var deprecate = require('depd')('express');
 var escapeHtml = require('escape-html');
 var vary = require('vary');
 var http = require('http')
@@ -12,7 +13,6 @@ var http = require('http')
   , normalizeType = require('./utils').normalizeType
   , normalizeTypes = require('./utils').normalizeTypes
   , setCharset = require('./utils').setCharset
-  , deprecate = require('./utils').deprecate
   , statusCodes = http.STATUS_CODES
   , cookie = require('cookie')
   , send = require('send')
@@ -196,9 +196,11 @@ res.json = function(obj){
     // res.json(body, status) backwards compat
     if ('number' == typeof arguments[1]) {
       this.statusCode = arguments[1];
-      return 'number' === typeof obj
-        ? jsonNumDeprecated.call(this, obj)
-        : jsonDeprecated.call(this, obj);
+      if (typeof obj === 'number') {
+        deprecate('res.json(obj, status): Use res.json(status, obj) instead');
+      } else {
+        deprecate('res.json(num, status): Use res.status(status).json(num) instead');
+      }
     } else {
       this.statusCode = obj;
       obj = arguments[1];
@@ -218,12 +220,6 @@ res.json = function(obj){
   return this.send(body);
 };
 
-var jsonDeprecated = deprecate(res.json,
-  'res.json(obj, status): Use res.json(status, obj) instead');
-
-var jsonNumDeprecated = deprecate(res.json,
-  'res.json(num, status): Use res.status(status).json(num) instead');
-
 /**
  * Send JSON response with JSONP callback support.
  *
@@ -246,9 +242,11 @@ res.jsonp = function(obj){
     // res.json(body, status) backwards compat
     if ('number' == typeof arguments[1]) {
       this.statusCode = arguments[1];
-      return 'number' === typeof obj
-        ? jsonpNumDeprecated.call(this, obj)
-        : jsonpDeprecated.call(this, obj);
+      if (typeof obj === 'number') {
+        deprecate('res.jsonp(obj, status): Use res.jsonp(status, obj) instead');
+      } else {
+        deprecate('res.jsonp(num, status): Use res.status(status).jsonp(num) instead');
+      }
     } else {
       this.statusCode = obj;
       obj = arguments[1];
@@ -283,12 +281,6 @@ res.jsonp = function(obj){
   return this.send(body);
 };
 
-var jsonpDeprecated = deprecate(res.json,
-  'res.jsonp(obj, status): Use res.jsonp(status, obj) instead');
-
-var jsonpNumDeprecated = deprecate(res.json,
-  'res.jsonp(num, status): Use res.status(status).jsonp(num) instead');
-
 /**
  * Transfer the file at the given `path`.
  *
diff --git a/lib/utils.js b/lib/utils.js
index 7cae6278c1e..5f3a98b09d2 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -4,7 +4,6 @@
  */
 
 var mime = require('connect').mime
-  , deprecate = require('util').deprecate
   , proxyaddr = require('proxy-addr')
   , crc32 = require('buffer-crc32')
   , crypto = require('crypto');
@@ -20,30 +19,6 @@ var toString = {}.toString;
  */
 var charsetRegExp = /;\s*charset\s*=/;
 
-/**
- * Deprecate function, like core `util.deprecate`,
- * but with NODE_ENV and color support.
- *
- * @param {Function} fn
- * @param {String} msg
- * @return {Function}
- * @api private
- */
-
-exports.deprecate = function(fn, msg){
-  if (process.env.NODE_ENV === 'test') return fn;
-
-  // prepend module name
-  msg = 'express: ' + msg;
-
-  if (process.stderr.isTTY) {
-    // colorize
-    msg = '\x1b[31;1m' + msg + '\x1b[0m';
-  }
-
-  return deprecate(fn, msg);
-};
-
 /**
  * Return strong ETag for `body`.
  *
diff --git a/package.json b/package.json
index bba7c1ab2c5..f0660e43fa2 100644
--- a/package.json
+++ b/package.json
@@ -29,6 +29,7 @@
     "connect": "2.20.2",
     "commander": "1.3.2",
     "debug": "1.0.2",
+    "depd": "0.3.0",
     "escape-html": "1.0.1",
     "methods": "1.0.1",
     "mkdirp": "0.5.0",
diff --git a/test/support/env.js b/test/support/env.js
index 7dbdffef1f2..ee4396dc855 100644
--- a/test/support/env.js
+++ b/test/support/env.js
@@ -1,3 +1,3 @@
 
 process.env.NODE_ENV = 'test';
-process.env.NO_DEPRECATION = 'connect';
+process.env.NO_DEPRECATION = 'connect,express';
diff --git a/test/utils.js b/test/utils.js
index 155a1292a70..21594c409e8 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -2,28 +2,6 @@
 var utils = require('../lib/utils')
   , assert = require('assert');
 
-describe('utils.deprecate(fn, msg)', function(){
-  var env
-  before(function(){
-    env = process.env.NODE_ENV
-  })
-  after(function(){
-    process.env.NODE_ENV = env
-  })
-
-  it('should pass-through fn in test environment', function(){
-    var fn = function(){}
-    process.env.NODE_ENV = 'test'
-    utils.deprecate(fn).should.equal(fn)
-  })
-
-  it('should return new fn in other environment', function(){
-    var fn = function(){}
-    process.env.NODE_ENV = ''
-    utils.deprecate(fn).should.not.equal(fn)
-  })
-})
-
 describe('utils.etag(body, encoding)', function(){
   it('should support strings', function(){
     utils.etag('express!')

From 2a105df9f2bae5d2b0e5af64fc0367a159fe42f2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 19 Jun 2014 23:36:00 -0400
Subject: [PATCH 0326/1265] 3.11.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 7f8b1689fef..cf6a8f4f0ff 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+3.11.0 / 2014-06-19
+===================
 
  * deprecate things with `depd` module
  * deps: buffer-crc32@0.2.3
diff --git a/package.json b/package.json
index f0660e43fa2..826287bc156 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.10.5",
+  "version": "3.11.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From ffe663aedfa89a399aea73a4729e02008f423df1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 20 Jun 2014 00:35:38 -0400
Subject: [PATCH 0327/1265] deps: buffer-crc32@0.2.3

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 4e41c61aa44..ca6902cd65a 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
  * fix "trim prefix" debug message in `express:router`
+ * deps: buffer-crc32@0.2.3
 
 4.4.3 / 2014-06-11
 ==================
diff --git a/package.json b/package.json
index d834173dda9..11f9f4567f5 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
   "license": "MIT",
   "dependencies": {
     "accepts": "1.0.3",
-    "buffer-crc32": "0.2.1",
+    "buffer-crc32": "0.2.3",
     "debug": "1.0.2",
     "escape-html": "1.0.1",
     "methods": "1.0.1",

From 6ee9433f29b0a9eae53f01978f4cbda92dac5b03 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 20 Jun 2014 16:43:04 -0400
Subject: [PATCH 0328/1265] deps: update example dependencies

---
 examples/auth/app.js               | 6 ++----
 examples/cookie-sessions/index.js  | 6 +-----
 examples/cookies/app.js            | 4 ++--
 examples/cors/index.js             | 2 +-
 examples/mvc/index.js              | 6 ++----
 examples/route-separation/index.js | 2 +-
 examples/session/index.js          | 8 +-------
 examples/session/redis.js          | 8 +-------
 package.json                       | 6 +++---
 test/acceptance/cookies.js         | 3 +++
 test/acceptance/mvc.js             | 3 +++
 test/req.param.js                  | 2 +-
 12 files changed, 21 insertions(+), 35 deletions(-)

diff --git a/examples/auth/app.js b/examples/auth/app.js
index 7538c87939a..79c74dbb345 100644
--- a/examples/auth/app.js
+++ b/examples/auth/app.js
@@ -5,7 +5,6 @@
 var express = require('../..');
 var hash = require('./pass').hash;
 var bodyParser = require('body-parser');
-var cookieParser = require('cookie-parser');
 var session = require('express-session');
 
 var app = module.exports = express();
@@ -17,9 +16,8 @@ app.set('views', __dirname + '/views');
 
 // middleware
 
-app.use(bodyParser());
-app.use(cookieParser('shhhh, very secret'));
-app.use(session());
+app.use(bodyParser.urlencoded({ extended: false }));
+app.use(session({ secret: 'shhhh, very secret' }));
 
 // Session-persisted message middleware
 
diff --git a/examples/cookie-sessions/index.js b/examples/cookie-sessions/index.js
index f2a8693ecda..b7b9ce51e10 100644
--- a/examples/cookie-sessions/index.js
+++ b/examples/cookie-sessions/index.js
@@ -3,15 +3,11 @@
  */
 
 var express = require('../../');
-var cookie-parser = require('cookie-parser');
 
 var app = module.exports = express();
 
-// pass a secret to cookieParser() for signed cookies
-app.use(cookieParser('manny is cool'));
-
 // add req.session cookie support
-app.use(cookieSession());
+app.use(cookieSession({ secret: 'manny is cool' }));
 
 // do something with the session
 app.use(count);
diff --git a/examples/cookies/app.js b/examples/cookies/app.js
index 775f9895944..5d1ba3461c7 100644
--- a/examples/cookies/app.js
+++ b/examples/cookies/app.js
@@ -17,8 +17,8 @@ if ('test' != process.env.NODE_ENV) app.use(logger(':method :url'));
 // for signing the cookies.
 app.use(cookieParser('my secret here'));
 
-// parses json, x-www-form-urlencoded, and multipart/form-data
-app.use(bodyParser());
+// parses x-www-form-urlencoded
+app.use(bodyParser.urlencoded({ extended: false }));
 
 app.get('/', function(req, res){
   if (req.cookies.remember) {
diff --git a/examples/cors/index.js b/examples/cors/index.js
index 6de9cbf5c99..ac1475d0af3 100644
--- a/examples/cors/index.js
+++ b/examples/cors/index.js
@@ -15,7 +15,7 @@ app.use(express.static(__dirname + '/public'));
 // api middleware
 
 api.use(logger('dev'));
-api.use(bodyParser());
+api.use(bodyParser.json());
 
 /**
  * CORS support.
diff --git a/examples/mvc/index.js b/examples/mvc/index.js
index e994824560b..91e2bf7a763 100644
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -5,7 +5,6 @@
 var express = require('../..');
 var logger = require('morgan');
 var session = require('express-session');
-var cookieParser = require('cookie-parser');
 var bodyParser = require('body-parser');
 var methodOverride = require('method-override');
 
@@ -38,11 +37,10 @@ if (!module.parent) app.use(logger('dev'));
 app.use(express.static(__dirname + '/public'));
 
 // session support
-app.use(cookieParser('some secret here'));
-app.use(session());
+app.use(session({ secret: 'some secret here' }));
 
 // parse request bodies (req.body)
-app.use(bodyParser());
+app.use(bodyParser.urlencoded({ extended: true }));
 
 // allow overriding methods in query (?_method=put)
 app.use(methodOverride('_method'));
diff --git a/examples/route-separation/index.js b/examples/route-separation/index.js
index c6f8aab7d38..2559f788b89 100644
--- a/examples/route-separation/index.js
+++ b/examples/route-separation/index.js
@@ -18,7 +18,7 @@ app.set('views', __dirname + '/views');
 app.use(logger('dev'));
 app.use(methodOverride('_method'));
 app.use(cookieParser());
-app.use(bodyParser());
+app.use(bodyParser.urlencoded({ extended: true }));
 app.use(express.static(__dirname + '/public'));
 
 // General
diff --git a/examples/session/index.js b/examples/session/index.js
index b148478cace..de60eac0b8f 100644
--- a/examples/session/index.js
+++ b/examples/session/index.js
@@ -3,18 +3,12 @@
 // $ redis-server
 
 var express = require('../..');
-var cookieParser = require('cookie-parser');
 var session = require('express-session');
 
 var app = express();
 
-// Required by session() middleware
-// pass the secret for signed cookies
-// (required by session())
-app.use(cookieParser('keyboard cat'));
-
 // Populates req.session
-app.use(session());
+app.use(session({ secret: 'keyboard cat' }));
 
 app.get('/', function(req, res){
   var body = '';
diff --git a/examples/session/redis.js b/examples/session/redis.js
index b3211c76da7..77fe60f7aeb 100644
--- a/examples/session/redis.js
+++ b/examples/session/redis.js
@@ -4,7 +4,6 @@
 
 var express = require('../..');
 var logger = require('morgan');
-var cookieParser = require('cookie-parser');
 var session = require('express-session');
 
 // pass the express to the connect redis module
@@ -15,13 +14,8 @@ var app = express();
 
 app.use(logger('dev'));
 
-// Required by session() middleware
-// pass the secret for signed cookies
-// (required by session())
-app.use(cookieParser('keyboard cat'));
-
 // Populates req.session
-app.use(session({ store: new RedisStore }));
+app.use(session({ store: new RedisStore, secret: 'keyboard cat' }));
 
 app.get('/', function(req, res){
   var body = '';
diff --git a/package.json b/package.json
index 11f9f4567f5..ca1044d37f3 100644
--- a/package.json
+++ b/package.json
@@ -57,9 +57,9 @@
     "marked": "0.3.2",
     "multiparty": "~3.2.4",
     "hjs": "~0.0.6",
-    "body-parser": "1.3.0",
-    "cookie-parser": "1.1.0",
-    "express-session": "1.2.1",
+    "body-parser": "~1.4.3",
+    "cookie-parser": "~1.3.1",
+    "express-session": "~1.5.0",
     "method-override": "2.0.2",
     "morgan": "1.1.1",
     "vhost": "2.0.0"
diff --git a/test/acceptance/cookies.js b/test/acceptance/cookies.js
index 987c539eeb4..f28daa8a64b 100644
--- a/test/acceptance/cookies.js
+++ b/test/acceptance/cookies.js
@@ -22,6 +22,7 @@ describe('cookies', function(){
     it('should respond to cookie', function(done){
       request(app)
       .post('/')
+      .type('urlencoded')
       .send({ remember: 1 })
       .expect(302, function(err, res){
         if (err) return done(err)
@@ -37,6 +38,7 @@ describe('cookies', function(){
     it('should clear cookie', function(done){
       request(app)
       .post('/')
+      .type('urlencoded')
       .send({ remember: 1 })
       .expect(302, function(err, res){
         if (err) return done(err)
@@ -53,6 +55,7 @@ describe('cookies', function(){
     it('should set a cookie', function(done){
       request(app)
       .post('/')
+      .type('urlencoded')
       .send({ remember: 1 })
       .expect(302, function(err, res){
         res.headers.should.have.property('set-cookie')
diff --git a/test/acceptance/mvc.js b/test/acceptance/mvc.js
index dcaf63e6b8f..7ef1fdb0a5e 100644
--- a/test/acceptance/mvc.js
+++ b/test/acceptance/mvc.js
@@ -33,6 +33,7 @@ describe('mvc', function(){
     it('should update the pet', function(done){
       request(app)
       .put('/pet/3')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
       .send({ pet: { name: 'Boots' } })
       .end(function(err, res){
         if (err) return done(err);
@@ -102,6 +103,7 @@ describe('mvc', function(){
     it('should update the user', function(done){
       request(app)
       .put('/user/1')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
       .send({ user: { name: 'Tobo' }})
       .end(function(err, res){
         if (err) return done(err);
@@ -116,6 +118,7 @@ describe('mvc', function(){
     it('should create a pet for user', function(done){
       request(app)
       .post('/user/2/pet')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
       .send({ pet: { name: 'Snickers' }})
       .expect('Location', '/user/2')
       .expect(302, function(err, res){
diff --git a/test/req.param.js b/test/req.param.js
index 6c6483e0852..1e827f03058 100644
--- a/test/req.param.js
+++ b/test/req.param.js
@@ -34,7 +34,7 @@ describe('req', function(){
     it('should check req.body', function(done){
       var app = express();
 
-      app.use(bodyParser());
+      app.use(bodyParser.json());
 
       app.use(function(req, res){
         res.end(req.param('name'));

From 6aba1b4c49feff98494aa49145d5d4d35cf52d92 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 20 Jun 2014 16:44:50 -0400
Subject: [PATCH 0329/1265] deps: accepts@~1.0.5

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ca6902cd65a..4ca744642c5 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
  * fix "trim prefix" debug message in `express:router`
+ * deps: accepts@~1.0.5
  * deps: buffer-crc32@0.2.3
 
 4.4.3 / 2014-06-11
diff --git a/package.json b/package.json
index ca1044d37f3..d71e54c1493 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
   "repository": "visionmedia/express",
   "license": "MIT",
   "dependencies": {
-    "accepts": "1.0.3",
+    "accepts": "~1.0.5",
     "buffer-crc32": "0.2.3",
     "debug": "1.0.2",
     "escape-html": "1.0.1",

From e606d99dc892159312e9204ea809a76b26b93dbe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=88=98=E6=98=9F?= <liuxingmatt@gmail.com>
Date: Fri, 20 Jun 2014 12:37:22 +0800
Subject: [PATCH 0330/1265] Fix res.attachment Unicode filenames in Safari

closes #2188
---
 History.md                                                      | 1 +
 examples/downloads/app.js                                       | 1 +
 ...270\212\346\265\267\345\210\206\350\265\233\345\214\272.txt" | 2 ++
 lib/utils.js                                                    | 2 +-
 test/res.attachment.js                                          | 2 +-
 5 files changed, 6 insertions(+), 2 deletions(-)
 create mode 100644 "examples/downloads/files/CCTV\345\244\247\350\265\233\344\270\212\346\265\267\345\210\206\350\265\233\345\214\272.txt"

diff --git a/History.md b/History.md
index 4ca744642c5..02113ea1f0f 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+ * fix `res.attachment` Unicode filenames in Safari
  * fix "trim prefix" debug message in `express:router`
  * deps: accepts@~1.0.5
  * deps: buffer-crc32@0.2.3
diff --git a/examples/downloads/app.js b/examples/downloads/app.js
index 2e61857de44..d7bdc0c0430 100644
--- a/examples/downloads/app.js
+++ b/examples/downloads/app.js
@@ -10,6 +10,7 @@ app.get('/', function(req, res){
     + '<li>Download <a href="/files/amazing.txt">amazing.txt</a>.</li>'
     + '<li>Download <a href="/files/utf-8 한中日.txt">utf-8 한中日.txt</a>.</li>'
     + '<li>Download <a href="/files/missing.txt">missing.txt</a>.</li>'
+    + '<li>Download <a href="/files/CCTV大赛上海分赛区.txt">CCTV大赛上海分赛区.txt</a>.</li>'
     + '</ul>');
 });
 
diff --git "a/examples/downloads/files/CCTV\345\244\247\350\265\233\344\270\212\346\265\267\345\210\206\350\265\233\345\214\272.txt" "b/examples/downloads/files/CCTV\345\244\247\350\265\233\344\270\212\346\265\267\345\210\206\350\265\233\345\214\272.txt"
new file mode 100644
index 00000000000..3b049c3168d
--- /dev/null
+++ "b/examples/downloads/files/CCTV\345\244\247\350\265\233\344\270\212\346\265\267\345\210\206\350\265\233\345\214\272.txt"
@@ -0,0 +1,2 @@
+Only for test.
+The file name is faked.
\ No newline at end of file
diff --git a/lib/utils.js b/lib/utils.js
index 909e99e4819..d629fb9beea 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -164,7 +164,7 @@ exports.contentDisposition = function(filename){
     filename = basename(filename);
     // if filename contains non-ascii characters, add a utf-8 version ala RFC 5987
     ret = /[^\040-\176]/.test(filename)
-      ? 'attachment; filename=' + encodeURI(filename) + '; filename*=UTF-8\'\'' + encodeURI(filename)
+      ? 'attachment; filename="' + encodeURI(filename) + '"; filename*=UTF-8\'\'' + encodeURI(filename)
       : 'attachment; filename="' + filename + '"';
   }
 
diff --git a/test/res.attachment.js b/test/res.attachment.js
index b81d8f289eb..be189344749 100644
--- a/test/res.attachment.js
+++ b/test/res.attachment.js
@@ -57,7 +57,7 @@ describe('res', function(){
       request(app)
       .get('/')
       .expect('Content-Disposition', 'attachment;' +
-          ' filename=%E6%97%A5%E6%9C%AC%E8%AA%9E.txt;' +
+          ' filename="%E6%97%A5%E6%9C%AC%E8%AA%9E.txt";' +
           ' filename*=UTF-8\'\'%E6%97%A5%E6%9C%AC%E8%AA%9E.txt',
         done);
     })

From f498b660da4cc954a5921d50407cf7a790e8a378 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 20 Jun 2014 16:56:51 -0400
Subject: [PATCH 0331/1265] 4.4.4

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 02113ea1f0f..ec406e5cf05 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.4.4 / 2014-06-20
+==================
 
  * fix `res.attachment` Unicode filenames in Safari
  * fix "trim prefix" debug message in `express:router`
diff --git a/package.json b/package.json
index d71e54c1493..923ec45168a 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.4.3",
+  "version": "4.4.4",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 7d6208e0afd638c9003e8037ce9438de9d0a9cfb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 21 Jun 2014 17:25:50 -0400
Subject: [PATCH 0332/1265] deps: connect@2.21.0

---
 History.md                | 12 ++++++++++++
 bin/express               |  2 +-
 examples/auth/app.js      |  5 ++---
 examples/mvc/index.js     |  3 +--
 examples/session/index.js |  7 +------
 examples/session/redis.js |  7 +------
 package.json              |  2 +-
 7 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/History.md b/History.md
index cf6a8f4f0ff..9fb5d00dfe1 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,15 @@
+unreleased
+==========
+
+ * deps: connect@2.21.0
+   - deprecate `connect(middleware)` -- use `app.use(middleware)` instead
+   - deprecate `connect.createServer()` -- use `connect()` instead
+   - fix `res.setHeader()` patch to work with with get -> append -> set pattern
+   - deps: compression@~1.0.8
+   - deps: errorhandler@~1.1.1
+   - deps: express-session@~1.5.0
+   - deps: serve-index@~1.1.3
+
 3.11.0 / 2014-06-19
 ===================
 
diff --git a/bin/express b/bin/express
index ad0d64a810d..a95df72841b 100755
--- a/bin/express
+++ b/bin/express
@@ -335,7 +335,7 @@ function createApplicationAt(path) {
 
     // Session support
     app = app.replace('{sess}', program.sessions
-      ? eol + 'app.use(express.cookieParser(\'your secret here\'));' + eol + 'app.use(express.session());'
+      ? eol + 'app.use(express.session({ secret: \'your secret here\' }));'
       : '');
 
     // Template support
diff --git a/examples/auth/app.js b/examples/auth/app.js
index 5bca6326827..4fcab9f1412 100644
--- a/examples/auth/app.js
+++ b/examples/auth/app.js
@@ -14,9 +14,8 @@ app.set('views', __dirname + '/views');
 
 // middleware
 
-app.use(express.bodyParser());
-app.use(express.cookieParser('shhhh, very secret'));
-app.use(express.session());
+app.use(express.urlencoded({ extended: false }));
+app.use(express.session({ secret: 'shhhh, very secret' }));
 
 // Session-persisted message middleware
 
diff --git a/examples/mvc/index.js b/examples/mvc/index.js
index ca9f3cc402a..b24d4663871 100644
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -31,8 +31,7 @@ if (!module.parent) app.use(express.logger('dev'));
 app.use(express.static(__dirname + '/public'));
 
 // session support
-app.use(express.cookieParser('some secret here'));
-app.use(express.session());
+app.use(express.session({ secret: 'some secret here' }));
 
 // parse request bodies (req.body)
 app.use(express.urlencoded({ extended: true }));
diff --git a/examples/session/index.js b/examples/session/index.js
index f4e72054d64..06a76fc6396 100644
--- a/examples/session/index.js
+++ b/examples/session/index.js
@@ -9,13 +9,8 @@ var app = express();
 
 app.use(express.logger('dev'));
 
-// Required by session() middleware
-// pass the secret for signed cookies
-// (required by session())
-app.use(express.cookieParser('keyboard cat'));
-
 // Populates req.session
-app.use(express.session());
+app.use(express.session({ secret: 'keyboard cat' }));
 
 app.get('/', function(req, res){
   var body = '';
diff --git a/examples/session/redis.js b/examples/session/redis.js
index 5ba3671bff4..b85365c124b 100644
--- a/examples/session/redis.js
+++ b/examples/session/redis.js
@@ -10,13 +10,8 @@ var app = express();
 
 app.use(express.logger('dev'));
 
-// Required by session() middleware
-// pass the secret for signed cookies
-// (required by session())
-app.use(express.cookieParser('keyboard cat'));
-
 // Populates req.session
-app.use(express.session({ store: new RedisStore }));
+app.use(express.session({ store: new RedisStore, secret: 'keyboard cat' }));
 
 app.get('/', function(req, res){
   var body = '';
diff --git a/package.json b/package.json
index 826287bc156..a31f8af2d09 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
   "license": "MIT",
   "dependencies": {
     "buffer-crc32": "0.2.3",
-    "connect": "2.20.2",
+    "connect": "2.21.0",
     "commander": "1.3.2",
     "debug": "1.0.2",
     "depd": "0.3.0",

From e66667e465aff68273890349158b382404b6932f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 21 Jun 2014 19:32:18 -0400
Subject: [PATCH 0333/1265] Use media-typer to alter content-type charset

---
 History.md   |  1 +
 lib/utils.js | 27 +++++++--------------------
 package.json |  1 +
 3 files changed, 9 insertions(+), 20 deletions(-)

diff --git a/History.md b/History.md
index 9fb5d00dfe1..c45dd08f417 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+ * use `media-typer` to alter content-type charset
  * deps: connect@2.21.0
    - deprecate `connect(middleware)` -- use `app.use(middleware)` instead
    - deprecate `connect.createServer()` -- use `connect()` instead
diff --git a/lib/utils.js b/lib/utils.js
index 5f3a98b09d2..2d5bfbb33fa 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -7,6 +7,7 @@ var mime = require('connect').mime
   , proxyaddr = require('proxy-addr')
   , crc32 = require('buffer-crc32')
   , crypto = require('crypto');
+var typer = require('media-typer');
 
 /**
  * toString ref.
@@ -14,11 +15,6 @@ var mime = require('connect').mime
 
 var toString = {}.toString;
 
-/**
- * Simple detection of charset parameter in content-type
- */
-var charsetRegExp = /;\s*charset\s*=/;
-
 /**
  * Return strong ETag for `body`.
  *
@@ -411,21 +407,12 @@ exports.compileTrust = function(val) {
 exports.setCharset = function(type, charset){
   if (!type || !charset) return type;
 
-  var exists = charsetRegExp.test(type);
-
-  // removing existing charset
-  if (exists) {
-    var parts = type.split(';');
+  // parse type
+  var parsed = typer.parse(type);
 
-    for (var i = 1; i < parts.length; i++) {
-      if (charsetRegExp.test(';' + parts[i])) {
-        parts.splice(i, 1);
-        break;
-      }
-    }
-
-    type = parts.join(';');
-  }
+  // set charset
+  parsed.parameters.charset = charset;
 
-  return type + '; charset=' + charset;
+  // format type
+  return typer.format(parsed);
 };
diff --git a/package.json b/package.json
index a31f8af2d09..d6b9a240abb 100644
--- a/package.json
+++ b/package.json
@@ -31,6 +31,7 @@
     "debug": "1.0.2",
     "depd": "0.3.0",
     "escape-html": "1.0.1",
+    "media-typer": "0.2.0",
     "methods": "1.0.1",
     "mkdirp": "0.5.0",
     "parseurl": "1.0.1",

From 75422c16bfcd0d9e1ea23f92b77099430cdea65e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 21 Jun 2014 21:57:02 -0400
Subject: [PATCH 0334/1265] 3.12.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index c45dd08f417..7a72df67b0c 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+3.12.0 / 2014-06-21
+===================
 
  * use `media-typer` to alter content-type charset
  * deps: connect@2.21.0
diff --git a/package.json b/package.json
index d6b9a240abb..5c2e0cbbf78 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.11.0",
+  "version": "3.12.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 7e01531e505c5bd081056aab4f4329d76f1b3fc5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 5 Jun 2014 23:59:27 -0400
Subject: [PATCH 0335/1265] use finalhandler for final response handling

---
 History.md         |  1 +
 lib/application.js | 57 +++++++++++++++-------------------------------
 package.json       |  1 +
 3 files changed, 20 insertions(+), 39 deletions(-)

diff --git a/History.md b/History.md
index 839aa9c0a18..dd9cdb236ec 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
  * deprecate things with `depd` module
+ * use `finalhandler` for final response handling
  * use `media-typer` to alter content-type charset
 
 4.4.4 / 2014-06-20
diff --git a/lib/application.js b/lib/application.js
index 47d29907850..ca5c042df08 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -2,8 +2,8 @@
  * Module dependencies.
  */
 
+var finalhandler = require('finalhandler');
 var mixin = require('utils-merge');
-var escapeHtml = require('escape-html');
 var Router = require('./router');
 var methods = require('methods');
 var middleware = require('./middleware/init');
@@ -119,45 +119,13 @@ app.lazyrouter = function() {
  */
 
 app.handle = function(req, res, done) {
-  var env = this.get('env');
-
-  this._router.handle(req, res, function(err) {
-    if (done) {
-      return done(err);
-    }
-
-    // unhandled error
-    if (err) {
-      // default to 500
-      if (res.statusCode < 400) res.statusCode = 500;
-      debug('default %s', res.statusCode);
-
-      // respect err.status
-      if (err.status) res.statusCode = err.status;
-
-      // production gets a basic error message
-      var msg = 'production' == env
-        ? http.STATUS_CODES[res.statusCode]
-        : err.stack || err.toString();
-      msg = escapeHtml(msg);
-
-      // log to stderr in a non-test env
-      if ('test' != env) console.error(err.stack || err.toString());
-      if (res.headersSent) return req.socket.destroy();
-      res.setHeader('Content-Type', 'text/html');
-      res.setHeader('Content-Length', Buffer.byteLength(msg));
-      if ('HEAD' == req.method) return res.end();
-      res.end(msg);
-      return;
-    }
-
-    // 404
-    debug('default 404');
-    res.statusCode = 404;
-    res.setHeader('Content-Type', 'text/html');
-    if ('HEAD' == req.method) return res.end();
-    res.end('Cannot ' + escapeHtml(req.method) + ' ' + escapeHtml(req.originalUrl) + '\n');
+  // final handler
+  done = done || finalhandler(req, res, {
+    env: this.get('env'),
+    onerror: logerror.bind(this)
   });
+
+  this._router.handle(req, res, done);
 };
 
 /**
@@ -547,3 +515,14 @@ app.listen = function(){
   var server = http.createServer(this);
   return server.listen.apply(server, arguments);
 };
+
+/**
+* Log error using console.error.
+*
+* @param {Error} err
+* @api public
+*/
+
+function logerror(err){
+  if (this.get('env') !== 'test') console.error(err.stack || err.toString());
+}
diff --git a/package.json b/package.json
index 28bc79519b0..a90d730895f 100644
--- a/package.json
+++ b/package.json
@@ -30,6 +30,7 @@
     "debug": "1.0.2",
     "depd": "0.3.0",
     "escape-html": "1.0.1",
+    "finalhandler": "0.0.0",
     "media-typer": "0.2.0",
     "methods": "1.0.1",
     "parseurl": "1.0.1",

From bdfd288eec38464bf08e7f13ebec9652f4dfe582 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 2 Jun 2014 15:43:19 -0400
Subject: [PATCH 0336/1265] fix behavior when handling request without routes

fixes #2159
---
 History.md         |  1 +
 lib/application.js | 11 ++++++++++-
 test/app.js        | 16 ++++++++++++++--
 3 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index dd9cdb236ec..9d443aee7ad 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
  * deprecate things with `depd` module
+ * fix behavior when handling request without routes
  * use `finalhandler` for final response handling
  * use `media-typer` to alter content-type charset
 
diff --git a/lib/application.js b/lib/application.js
index ca5c042df08..c755b1da8a9 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -119,13 +119,22 @@ app.lazyrouter = function() {
  */
 
 app.handle = function(req, res, done) {
+  var router = this._router;
+
   // final handler
   done = done || finalhandler(req, res, {
     env: this.get('env'),
     onerror: logerror.bind(this)
   });
 
-  this._router.handle(req, res, done);
+  // no routes
+  if (!router) {
+    debug('no routes defined on app');
+    done();
+    return;
+  }
+
+  router.handle(req, res, done);
 };
 
 /**
diff --git a/test/app.js b/test/app.js
index 310c49a1dad..ec2a341d03a 100644
--- a/test/app.js
+++ b/test/app.js
@@ -1,6 +1,7 @@
 
-var express = require('../')
-  , assert = require('assert');
+var assert = require('assert')
+var express = require('..')
+var request = require('supertest')
 
 describe('app', function(){
   it('should inherit from event emitter', function(done){
@@ -8,6 +9,17 @@ describe('app', function(){
     app.on('foo', done);
     app.emit('foo');
   })
+
+  it('should be callable', function(){
+    var app = express();
+    assert(typeof app, 'function');
+  })
+
+  it('should 404 without routes', function(done){
+    request(express())
+    .get('/')
+    .expect(404, done);
+  })
 })
 
 describe('app.parent', function(){

From 746044b6c2886c6bc6d60c38ef423b5a7e9e8f54 Mon Sep 17 00:00:00 2001
From: Guy Ellis Monster <wildfiction@gmail.com>
Date: Thu, 5 Jun 2014 23:21:45 -0700
Subject: [PATCH 0337/1265] Replace __defineGetter__ with Object.defineProperty

closes #2162
---
 lib/request.js | 36 ++++++++++++++++++++++++++----------
 1 file changed, 26 insertions(+), 10 deletions(-)

diff --git a/lib/request.js b/lib/request.js
index ce35431a467..500890fdf2f 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -249,7 +249,7 @@ req.is = function(types){
  * @api public
  */
 
-req.__defineGetter__('protocol', function(){
+defineGetter(req, 'protocol', function protocol(){
   var trust = this.app.get('trust proxy fn');
 
   if (!trust(this.connection.remoteAddress)) {
@@ -273,7 +273,7 @@ req.__defineGetter__('protocol', function(){
  * @api public
  */
 
-req.__defineGetter__('secure', function(){
+defineGetter(req, 'secure', function secure(){
   return 'https' == this.protocol;
 });
 
@@ -287,7 +287,7 @@ req.__defineGetter__('secure', function(){
  * @api public
  */
 
-req.__defineGetter__('ip', function(){
+defineGetter(req, 'ip', function ip(){
   var trust = this.app.get('trust proxy fn');
   return proxyaddr(this, trust);
 });
@@ -304,7 +304,7 @@ req.__defineGetter__('ip', function(){
  * @api public
  */
 
-req.__defineGetter__('ips', function(){
+defineGetter(req, 'ips', function ips() {
   var trust = this.app.get('trust proxy fn');
   var addrs = proxyaddr.all(this, trust);
   return addrs.slice(1).reverse();
@@ -325,7 +325,7 @@ req.__defineGetter__('ips', function(){
  * @api public
  */
 
-req.__defineGetter__('subdomains', function(){
+defineGetter(req, 'subdomains', function subdomains() {
   var offset = this.app.get('subdomain offset');
   return (this.host || '')
     .split('.')
@@ -340,7 +340,7 @@ req.__defineGetter__('subdomains', function(){
  * @api public
  */
 
-req.__defineGetter__('path', function(){
+defineGetter(req, 'path', function path() {
   return parse(this).pathname;
 });
 
@@ -355,7 +355,7 @@ req.__defineGetter__('path', function(){
  * @api public
  */
 
-req.__defineGetter__('host', function(){
+defineGetter(req, 'host', function host(){
   var trust = this.app.get('trust proxy fn');
   var host = this.get('X-Forwarded-Host');
 
@@ -385,7 +385,7 @@ req.__defineGetter__('host', function(){
  * @api public
  */
 
-req.__defineGetter__('fresh', function(){
+defineGetter(req, 'fresh', function(){
   var method = this.method;
   var s = this.res.statusCode;
 
@@ -409,7 +409,7 @@ req.__defineGetter__('fresh', function(){
  * @api public
  */
 
-req.__defineGetter__('stale', function(){
+defineGetter(req, 'stale', function stale(){
   return !this.fresh;
 });
 
@@ -420,7 +420,23 @@ req.__defineGetter__('stale', function(){
  * @api public
  */
 
-req.__defineGetter__('xhr', function(){
+defineGetter(req, 'xhr', function xhr(){
   var val = this.get('X-Requested-With') || '';
   return 'xmlhttprequest' == val.toLowerCase();
 });
+
+/**
+ * Helper function for creating a getter on an object.
+ *
+ * @param {Object} obj
+ * @param {String} name
+ * @param {Function} getter
+ * @api private
+ */
+function defineGetter(obj, name, getter) {
+  Object.defineProperty(obj, name, {
+    configurable: true,
+    enumerable: true,
+    get: getter
+  });
+};

From b89a597029c8e0c7fe5e97d326853f7acacf0f77 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 6 Jun 2014 11:54:27 -0400
Subject: [PATCH 0338/1265] Restore req.params after invoking Router

fixes #2163
---
 History.md          |  1 +
 lib/router/index.js | 44 +++++++++++++++++++++++++++++++-------------
 test/app.router.js  | 27 +++++++++++++++++++++++++++
 3 files changed, 59 insertions(+), 13 deletions(-)

diff --git a/History.md b/History.md
index 9d443aee7ad..33db6e14ec5 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,7 @@ unreleased
 
  * deprecate things with `depd` module
  * fix behavior when handling request without routes
+ * restore `req.params` after invoking router
  * use `finalhandler` for final response handling
  * use `media-typer` to alter content-type charset
 
diff --git a/lib/router/index.js b/lib/router/index.js
index 08462c1b170..189f3cc7fa2 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -132,13 +132,10 @@ proto.handle = function(req, res, done) {
   var stack = self.stack;
 
   // manage inter-router variables
-  var parent = req.next;
   var parentUrl = req.baseUrl || '';
-  done = wrap(done, function(old, err) {
-    req.baseUrl = parentUrl;
-    req.next = parent;
-    old(err);
-  });
+  done = restore(done, req, 'baseUrl', 'next', 'params');
+
+  // setup next layer
   req.next = next;
 
   // for options requests, respond with a default if nothing else responds
@@ -260,13 +257,6 @@ proto.handle = function(req, res, done) {
       }
     }
   }
-
-  function wrap(old, fn) {
-    return function () {
-      var args = [old].concat(slice.call(arguments));
-      fn.apply(this, args);
-    };
-  }
 };
 
 /**
@@ -450,3 +440,31 @@ methods.concat('all').forEach(function(method){
     return this;
   };
 });
+
+// restore obj props after function
+function restore(fn, obj) {
+  var props = new Array(arguments.length - 2);
+  var vals = new Array(arguments.length - 2);
+
+  for (var i = 0; i < props.length; i++) {
+    props[i] = arguments[i + 2];
+    vals[i] = obj[props[i]];
+  }
+
+  return function(err){
+    // restore vals
+    for (var i = 0; i < props.length; i++) {
+      obj[props[i]] = vals[i];
+    }
+
+    return fn.apply(this, arguments);
+  };
+}
+
+// wrap a function
+function wrap(old, fn) {
+  return function () {
+    var args = [old].concat(slice.call(arguments));
+    fn.apply(this, args);
+  };
+}
diff --git a/test/app.router.js b/test/app.router.js
index a1f9a8d3783..71cea448da2 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -656,6 +656,33 @@ describe('app.router', function(){
     .expect(200, '0,1,2,3,4,5', done);
   })
 
+  it('should provide req.params to all handlers', function(done){
+    var app = express();
+    var router = new express.Router();
+
+    function handler1(req, res, next){
+      res.setHeader('x-user-id', req.params.id);
+      next()
+    }
+
+    function handler2(req, res){
+      res.send(req.params.id);
+    }
+
+    router.use(function(req, res, next){
+      res.setHeader('x-router', req.params.id);
+      next();
+    });
+
+    app.get('/user/:id', handler1, router, handler2);
+
+    request(app)
+    .get('/user/1')
+    .expect('x-router', 'undefined')
+    .expect('x-user-id', '1')
+    .expect(200, '1', done);
+  })
+
   it('should be chainable', function(){
     var app = express();
     app.get('/', function(){}).should.equal(app);

From 7f26cfca91f29a6a870be4c00d9507970efa6d51 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 6 Jun 2014 22:16:39 -0400
Subject: [PATCH 0339/1265] Fix handling when route.all is only route

---
 History.md          |  1 +
 lib/router/route.js | 39 ++++++++-------------------------------
 test/Route.js       | 26 ++++++++++++++++++++++++++
 3 files changed, 35 insertions(+), 31 deletions(-)

diff --git a/History.md b/History.md
index 33db6e14ec5..41fbdc3b672 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,7 @@ unreleased
 
  * deprecate things with `depd` module
  * fix behavior when handling request without routes
+ * fix handling when `route.all` is only route
  * restore `req.params` after invoking router
  * use `finalhandler` for final response handling
  * use `media-typer` to alter content-type charset
diff --git a/lib/router/route.js b/lib/router/route.js
index dca4b1b2241..f67d0dd727f 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -22,7 +22,7 @@ module.exports = Route;
 function Route(path) {
   debug('new %s', path);
   this.path = path;
-  this.stack = undefined;
+  this.stack = [];
 
   // route handlers for various http methods
   this.methods = {};
@@ -46,25 +46,17 @@ Route.prototype._options = function(){
  */
 
 Route.prototype.dispatch = function(req, res, done){
-  var self = this;
-  var method = req.method.toLowerCase();
+  var stack = this.stack;
+  if (stack.length === 0) {
+    return done();
+  }
 
+  var method = req.method.toLowerCase();
   if (method === 'head' && !this.methods['head']) {
     method = 'get';
   }
 
-  req.route = self;
-
-  // single middleware route case
-  if (typeof this.stack === 'function') {
-    this.stack(req, res, done);
-    return;
-  }
-
-  var stack = self.stack;
-  if (!stack) {
-    return done();
-  }
+  req.route = this;
 
   var idx = 0;
   (function next_layer(err) {
@@ -145,15 +137,7 @@ Route.prototype.all = function(){
       throw new Error(msg);
     }
 
-    if (!self.stack) {
-      self.stack = fn;
-    }
-    else if (typeof self.stack === 'function') {
-      self.stack = [{ handle: self.stack }, { handle: fn }];
-    }
-    else {
-      self.stack.push({ handle: fn });
-    }
+    self.stack.push({ handle: fn });
   });
 
   return self;
@@ -177,13 +161,6 @@ methods.forEach(function(method){
         self.methods[method] = true;
       }
 
-      if (!self.stack) {
-        self.stack = [];
-      }
-      else if (typeof self.stack === 'function') {
-        self.stack = [{ handle: self.stack }];
-      }
-
       self.stack.push({ method: method, handle: fn });
     });
     return self;
diff --git a/test/Route.js b/test/Route.js
index 614947e9661..8d37a0bb9c1 100644
--- a/test/Route.js
+++ b/test/Route.js
@@ -1,4 +1,5 @@
 
+var should = require('should');
 var express = require('../')
   , Route = express.Route
   , methods = require('methods')
@@ -184,6 +185,31 @@ describe('Route', function(){
         done();
       });
 
+      route.dispatch({ url: '/', method: 'GET' }, {});
+    });
+
+    it('should handle throw in .all', function(done) {
+      var route = new Route('');
+
+      route.all(function(req, res, next){
+        throw new Error('boom!');
+      });
+
+      route.dispatch({ url: '/', method: 'GET' }, {}, function(err){
+        should(err).be.ok;
+        err.message.should.equal('boom!');
+        done();
+      });
+    });
+
+    it('should handle single error handler', function(done) {
+      var route = new Route('');
+
+      route.all(function(err, req, res, next){
+        // this should not execute
+        true.should.be.false;
+      });
+
       route.dispatch({ url: '/', method: 'GET' }, {}, done);
     });
   })

From 10618ced22dadde1f7be262252483962ed8bd1b9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 7 Jun 2014 02:41:31 -0400
Subject: [PATCH 0340/1265] Reduce try-catch de-op area in param matching

---
 lib/router/layer.js | 33 +++++++++++++++++++++++----------
 1 file changed, 23 insertions(+), 10 deletions(-)

diff --git a/lib/router/layer.js b/lib/router/layer.js
index 2dcb288b2f9..80625fb4e16 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -45,16 +45,7 @@ Layer.prototype.match = function(path){
 
   for (var i = 1, len = m.length; i < len; ++i) {
     key = keys[i - 1];
-
-    try {
-      val = 'string' == typeof m[i]
-        ? decodeURIComponent(m[i])
-        : m[i];
-    } catch(e) {
-      var err = new Error("Failed to decode param '" + m[i] + "'");
-      err.status = 400;
-      throw err;
-    }
+    val = decode_param(m[i]);
 
     if (key) {
       params[key.name] = val;
@@ -65,3 +56,25 @@ Layer.prototype.match = function(path){
 
   return true;
 };
+
+/**
+ * Decode param value.
+ *
+ * @param {string} val
+ * @return {string}
+ * @api private
+ */
+
+function decode_param(val){
+  if (typeof val !== 'string') {
+    return val;
+  }
+
+  try {
+    return decodeURIComponent(val);
+  } catch (e) {
+    var err = new TypeError("Failed to decode param '" + val + "'");
+    err.status = 400;
+    throw err;
+  }
+}

From 83bbf0902d230fc8b31588b427667830526cb735 Mon Sep 17 00:00:00 2001
From: Carlos Souza <carloshrsouza@gmail.com>
Date: Mon, 23 Jun 2014 13:19:27 -0400
Subject: [PATCH 0341/1265] examples: tweak cors example

The PUT method needs clearance from the server, unlike GET, HEAD
and POST, so this demonstrates a case where the method in the
response is important.

closes #2195
---
 examples/cors/index.js          | 8 ++++----
 examples/cors/public/index.html | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/examples/cors/index.js b/examples/cors/index.js
index ac1475d0af3..ac30ac9444e 100644
--- a/examples/cors/index.js
+++ b/examples/cors/index.js
@@ -25,7 +25,7 @@ api.all('*', function(req, res, next){
   if (!req.get('Origin')) return next();
   // use "*" here to accept any origin
   res.set('Access-Control-Allow-Origin', 'http://localhost:3000');
-  res.set('Access-Control-Allow-Methods', 'GET, POST');
+  res.set('Access-Control-Allow-Methods', 'PUT');
   res.set('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type');
   // res.set('Access-Control-Allow-Max-Age', 3600);
   if ('OPTIONS' == req.method) return res.send(200);
@@ -33,12 +33,12 @@ api.all('*', function(req, res, next){
 });
 
 /**
- * POST a user.
+ * PUT an existing user.
  */
 
-api.post('/user', function(req, res){
+api.put('/user/:id', function(req, res){
   console.log(req.body);
-  res.send(201);
+  res.send(204);
 });
 
 app.listen(3000);
diff --git a/examples/cors/public/index.html b/examples/cors/public/index.html
index fec717325d7..d87edc2255c 100644
--- a/examples/cors/public/index.html
+++ b/examples/cors/public/index.html
@@ -3,10 +3,10 @@
   <body>
     <script>
       var req = new XMLHttpRequest;
-      req.open('POST', 'http://localhost:3001/user', false);
+      req.open('PUT', 'http://localhost:3001/user/1', false);
       req.setRequestHeader('Content-Type', 'application/json');
       req.send('{"name":"tobi","species":"ferret"}');
       console.log(req.responseText);
     </script>
   </body>
-</html>
\ No newline at end of file
+</html>

From 2cccbc186efdcaf089bc501a5148391b6e92f473 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 23 Jun 2014 16:17:44 -0400
Subject: [PATCH 0342/1265] add deprecation message to non-plural req.accepts*

---
 History.md                   |  1 +
 lib/request.js               | 29 +++++++++++---------
 test/req.acceptsCharset.js   |  6 ++--
 test/req.acceptsCharsets.js  | 49 +++++++++++++++++++++++++++++++++
 test/req.acceptsEncoding.js  |  2 +-
 test/req.acceptsEncodings.js | 36 ++++++++++++++++++++++++
 test/req.acceptsLanguages.js | 53 ++++++++++++++++++++++++++++++++++++
 7 files changed, 159 insertions(+), 17 deletions(-)
 create mode 100644 test/req.acceptsCharsets.js
 create mode 100644 test/req.acceptsEncodings.js
 create mode 100644 test/req.acceptsLanguages.js

diff --git a/History.md b/History.md
index 41fbdc3b672..ac659fa1e0b 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+ * add deprecation message to non-plural `req.accepts*`
  * deprecate things with `depd` module
  * fix behavior when handling request without routes
  * fix handling when `route.all` is only route
diff --git a/lib/request.js b/lib/request.js
index 500890fdf2f..e7e7f8e9563 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -3,6 +3,7 @@
  */
 
 var accepts = require('accepts');
+var deprecate = require('depd')('express');
 var typeis = require('type-is');
 var http = require('http');
 var fresh = require('fresh');
@@ -106,53 +107,55 @@ req.accepts = function(){
 };
 
 /**
- * Check if the given `encoding` is accepted.
+ * Check if the given `encoding`s are accepted.
  *
- * @param {String} encoding
+ * @param {String} ...encoding
  * @return {Boolean}
  * @api public
  */
 
-req.acceptsEncoding = // backwards compatibility
 req.acceptsEncodings = function(){
   var accept = accepts(this);
   return accept.encodings.apply(accept, arguments);
 };
 
+req.acceptsEncoding = deprecate.function(req.acceptsEncodings,
+  'req.acceptsEncoding: Use acceptsEncodings instead');
+
 /**
- * To do: update docs.
- *
- * Check if the given `charset` is acceptable,
+ * Check if the given `charset`s are acceptable,
  * otherwise you should respond with 406 "Not Acceptable".
  *
- * @param {String} charset
+ * @param {String} ...charset
  * @return {Boolean}
  * @api public
  */
 
-req.acceptsCharset = // backwards compatibility
 req.acceptsCharsets = function(){
   var accept = accepts(this);
   return accept.charsets.apply(accept, arguments);
 };
 
+req.acceptsCharset = deprecate.function(req.acceptsCharsets,
+  'req.acceptsCharset: Use acceptsCharsets instead');
+
 /**
- * To do: update docs.
- *
- * Check if the given `lang` is acceptable,
+ * Check if the given `lang`s are acceptable,
  * otherwise you should respond with 406 "Not Acceptable".
  *
- * @param {String} lang
+ * @param {String} ...lang
  * @return {Boolean}
  * @api public
  */
 
-req.acceptsLanguage = // backwards compatibility
 req.acceptsLanguages = function(){
   var accept = accepts(this);
   return accept.languages.apply(accept, arguments);
 };
 
+req.acceptsLanguage = deprecate.function(req.acceptsLanguages,
+  'req.acceptsLanguage: Use acceptsLanguages instead');
+
 /**
  * Parse Range header field,
  * capping to the given `size`.
diff --git a/test/req.acceptsCharset.js b/test/req.acceptsCharset.js
index a5461d01ae8..0d0ed8b5e41 100644
--- a/test/req.acceptsCharset.js
+++ b/test/req.acceptsCharset.js
@@ -9,7 +9,7 @@ describe('req', function(){
         var app = express();
 
         app.use(function(req, res, next){
-          res.end(req.acceptsCharsets('utf-8') ? 'yes' : 'no');
+          res.end(req.acceptsCharset('utf-8') ? 'yes' : 'no');
         });
 
         request(app)
@@ -23,7 +23,7 @@ describe('req', function(){
         var app = express();
 
         app.use(function(req, res, next){
-          res.end(req.acceptsCharsets('utf-8') ? 'yes' : 'no');
+          res.end(req.acceptsCharset('utf-8') ? 'yes' : 'no');
         });
 
         request(app)
@@ -36,7 +36,7 @@ describe('req', function(){
         var app = express();
 
         app.use(function(req, res, next){
-          res.end(req.acceptsCharsets('utf-8') ? 'yes' : 'no');
+          res.end(req.acceptsCharset('utf-8') ? 'yes' : 'no');
         });
 
         request(app)
diff --git a/test/req.acceptsCharsets.js b/test/req.acceptsCharsets.js
new file mode 100644
index 00000000000..2f4574c5244
--- /dev/null
+++ b/test/req.acceptsCharsets.js
@@ -0,0 +1,49 @@
+
+var express = require('../')
+  , request = require('supertest');
+
+describe('req', function(){
+  describe('.acceptsCharsets(type)', function(){
+    describe('when Accept-Charset is not present', function(){
+      it('should return true', function(done){
+        var app = express();
+
+        app.use(function(req, res, next){
+          res.end(req.acceptsCharsets('utf-8') ? 'yes' : 'no');
+        });
+
+        request(app)
+        .get('/')
+        .expect('yes', done);
+      })
+    })
+
+    describe('when Accept-Charset is not present', function(){
+      it('should return true when present', function(done){
+        var app = express();
+
+        app.use(function(req, res, next){
+          res.end(req.acceptsCharsets('utf-8') ? 'yes' : 'no');
+        });
+
+        request(app)
+        .get('/')
+        .set('Accept-Charset', 'foo, bar, utf-8')
+        .expect('yes', done);
+      })
+
+      it('should return false otherwise', function(done){
+        var app = express();
+
+        app.use(function(req, res, next){
+          res.end(req.acceptsCharsets('utf-8') ? 'yes' : 'no');
+        });
+
+        request(app)
+        .get('/')
+        .set('Accept-Charset', 'foo, bar')
+        .expect('no', done);
+      })
+    })
+  })
+})
diff --git a/test/req.acceptsEncoding.js b/test/req.acceptsEncoding.js
index 8714904b118..930b4ea76c1 100644
--- a/test/req.acceptsEncoding.js
+++ b/test/req.acceptsEncoding.js
@@ -3,7 +3,7 @@ var express = require('../')
   , request = require('supertest');
 
 describe('req', function(){
-  describe('.acceptsEncodings', function(){
+  describe('.acceptsEncoding', function(){
     it('should be true if encoding accpeted', function(done){
       var app = express();
 
diff --git a/test/req.acceptsEncodings.js b/test/req.acceptsEncodings.js
new file mode 100644
index 00000000000..c4c68e1e8ed
--- /dev/null
+++ b/test/req.acceptsEncodings.js
@@ -0,0 +1,36 @@
+
+var express = require('../')
+  , request = require('supertest');
+
+describe('req', function(){
+  describe('.acceptsEncodingss', function(){
+    it('should be true if encoding accpeted', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        req.acceptsEncodings('gzip').should.be.ok;
+        req.acceptsEncodings('deflate').should.be.ok;
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .set('Accept-Encoding', ' gzip, deflate')
+      .expect(200, done);
+    })
+
+    it('should be false if encoding not accpeted', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        req.acceptsEncodings('bogus').should.not.be.ok;
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .set('Accept-Encoding', ' gzip, deflate')
+      .expect(200, done);
+    })
+  })
+})
diff --git a/test/req.acceptsLanguages.js b/test/req.acceptsLanguages.js
new file mode 100644
index 00000000000..8d11eb81e83
--- /dev/null
+++ b/test/req.acceptsLanguages.js
@@ -0,0 +1,53 @@
+
+var express = require('../')
+  , request = require('supertest');
+
+describe('req', function(){
+  describe('.acceptsLanguages', function(){
+    it('should be true if language accpeted', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        req.acceptsLanguages('en-us').should.be.ok;
+        req.acceptsLanguages('en').should.be.ok;
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .set('Accept-Language', 'en;q=.5, en-us')
+      .expect(200, done);
+    })
+
+    it('should be false if language not accpeted', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        req.acceptsLanguages('es').should.not.be.ok;
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .set('Accept-Language', 'en;q=.5, en-us')
+      .expect(200, done);
+    })
+
+    describe('when Accept-Language is not present', function(){
+      it('should always return true', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          req.acceptsLanguages('en').should.be.ok;
+          req.acceptsLanguages('es').should.be.ok;
+          req.acceptsLanguages('jp').should.be.ok;
+          res.end();
+        });
+
+        request(app)
+        .get('/')
+        .expect(200, done);
+      })
+    })
+  })
+})

From ba8a4c5a8d491012a017f1c9b97d09115b877687 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 23 Jun 2014 16:26:00 -0400
Subject: [PATCH 0343/1265] add deprecation message to res.send(body, status)

---
 History.md      | 1 +
 lib/response.js | 1 +
 2 files changed, 2 insertions(+)

diff --git a/History.md b/History.md
index ac659fa1e0b..914c14e5559 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
  * add deprecation message to non-plural `req.accepts*`
+ * add deprecation message to `res.send(body, status)`
  * deprecate things with `depd` module
  * fix behavior when handling request without routes
  * fix handling when `route.all` is only route
diff --git a/lib/response.js b/lib/response.js
index db31d79e607..d70595c5134 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -92,6 +92,7 @@ res.send = function(body){
   if (2 == arguments.length) {
     // res.send(body, status) backwards compat
     if ('number' != typeof body && 'number' == typeof arguments[1]) {
+      deprecate('res.send(body, status): Use res.send(status, body) instead');
       this.statusCode = arguments[1];
     } else {
       this.statusCode = body;

From 381b3b0f77a5050cea95a36ea7f657bae8d4a905 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 23 Jun 2014 16:26:28 -0400
Subject: [PATCH 0344/1265] add deprecation message to res.vary()

---
 History.md      | 1 +
 lib/response.js | 6 ++++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 914c14e5559..4507794304c 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,7 @@ unreleased
 
  * add deprecation message to non-plural `req.accepts*`
  * add deprecation message to `res.send(body, status)`
+ * add deprecation message to `res.vary()`
  * deprecate things with `depd` module
  * fix behavior when handling request without routes
  * fix handling when `route.all` is only route
diff --git a/lib/response.js b/lib/response.js
index d70595c5134..9a0a8864585 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -730,8 +730,10 @@ res.redirect = function(url){
 
 res.vary = function(field){
   // checks for back-compat
-  if (!field) return this;
-  if (Array.isArray(field) && !field.length) return this;
+  if (!field || (Array.isArray(field) && !field.length)) {
+    deprecate('res.vary(): Provide a field name');
+    return this;
+  }
 
   vary(this, field);
 

From 0ebfc6b7bf921d9ee0b8f46cbdc1819c49ab9d55 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 23 Jun 2014 20:35:44 -0400
Subject: [PATCH 0345/1265] tests: add test for OPTIONS in app.all

---
 test/app.options.js | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/test/app.options.js b/test/app.options.js
index b7689d493f1..98fefe9a0bd 100644
--- a/test/app.options.js
+++ b/test/app.options.js
@@ -16,6 +16,24 @@ describe('OPTIONS', function(){
     .expect('Allow', 'GET,PUT', done);
   })
 
+  it('should not be affected by app.all', function(done){
+    var app = express();
+
+    app.get('/', function(){});
+    app.get('/users', function(req, res){});
+    app.put('/users', function(req, res){});
+    app.all('/users', function(req, res, next){
+      res.setHeader('x-hit', '1');
+      next();
+    });
+
+    request(app)
+    .options('/users')
+    .expect('x-hit', '1')
+    .expect('allow', 'GET,PUT')
+    .expect(200, 'GET,PUT', done);
+  })
+
   it('should not respond if the path is not defined', function(done){
     var app = express();
 

From a5252526908104823584652424f98cff41212393 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 24 Jun 2014 21:15:43 -0400
Subject: [PATCH 0346/1265] deps: istanbul@0.2.11

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index a90d730895f..77b43d172a3 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
   },
   "devDependencies": {
     "after": "0.8.1",
-    "istanbul": "0.2.10",
+    "istanbul": "0.2.11",
     "mocha": "~1.20.1",
     "should": "~4.0.4",
     "supertest": "~0.13.0",

From e7caaf6757d2a070fc1a20cac8faa5872c93f426 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 24 Jun 2014 21:18:12 -0400
Subject: [PATCH 0347/1265] deps: type-is@~1.3.2

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 4507794304c..6c6f48b3320 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,7 @@ unreleased
  * restore `req.params` after invoking router
  * use `finalhandler` for final response handling
  * use `media-typer` to alter content-type charset
+ * deps: type-is@~1.3.2
 
 4.4.4 / 2014-06-20
 ==================
diff --git a/package.json b/package.json
index 77b43d172a3..da322e82081 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "range-parser": "1.0.0",
     "send": "0.4.3",
     "serve-static": "1.2.3",
-    "type-is": "1.2.1",
+    "type-is": "~1.3.2",
     "vary": "0.1.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",

From 81036aa6399ff3ed2285ca9017850a65037e2e8c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 24 Jun 2014 21:19:03 -0400
Subject: [PATCH 0348/1265] deps: finalhandler@0.0.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index da322e82081..a2b4c1213ab 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "debug": "1.0.2",
     "depd": "0.3.0",
     "escape-html": "1.0.1",
-    "finalhandler": "0.0.0",
+    "finalhandler": "0.0.2",
     "media-typer": "0.2.0",
     "methods": "1.0.1",
     "parseurl": "1.0.1",

From 9cb147370ec8d062891229cad38134850449a5e3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 26 Jun 2014 18:21:26 -0400
Subject: [PATCH 0349/1265] deps: istanbul@0.2.12

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 5c2e0cbbf78..2a5d5a8a5c3 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "merge-descriptors": "0.0.2"
   },
   "devDependencies": {
-    "istanbul": "0.2.10",
+    "istanbul": "0.2.12",
     "mocha": "~1.20.0",
     "should": "~4.0.0",
     "ejs": "~1.0.0",

From 8ffb9f94774d36ecaa8b5904d27552ff63c4c594 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 26 Jun 2014 18:25:48 -0400
Subject: [PATCH 0350/1265] deps: connect@2.21.1

---
 History.md   | 9 +++++++++
 package.json | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 7a72df67b0c..a0365d36847 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,12 @@
+3.x
+===
+
+ * deps: connect@2.21.1
+   - deps: cookie-parser@1.3.2
+   - deps: cookie-signature@1.0.4
+   - deps: express-session@~1.5.2
+   - deps: type-is@~1.3.2
+
 3.12.0 / 2014-06-21
 ===================
 
diff --git a/package.json b/package.json
index 2a5d5a8a5c3..8e4a16a7bf5 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
   "license": "MIT",
   "dependencies": {
     "buffer-crc32": "0.2.3",
-    "connect": "2.21.0",
+    "connect": "2.21.1",
     "commander": "1.3.2",
     "debug": "1.0.2",
     "depd": "0.3.0",

From 78d489d73050e87d8fd0f99d16a8283143aaf4d6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 26 Jun 2014 18:26:34 -0400
Subject: [PATCH 0351/1265] deps: cookie-signature@1.0.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a0365d36847..3f309143d8e 100644
--- a/History.md
+++ b/History.md
@@ -6,6 +6,8 @@
    - deps: cookie-signature@1.0.4
    - deps: express-session@~1.5.2
    - deps: type-is@~1.3.2
+ * deps: cookie-signature@1.0.4
+   - fix for timing attacks
 
 3.12.0 / 2014-06-21
 ===================
diff --git a/package.json b/package.json
index 8e4a16a7bf5..36366e9dce4 100644
--- a/package.json
+++ b/package.json
@@ -41,7 +41,7 @@
     "vary": "0.1.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",
-    "cookie-signature": "1.0.3",
+    "cookie-signature": "1.0.4",
     "merge-descriptors": "0.0.2"
   },
   "devDependencies": {

From 9bb47fba300a4c096e049e51b636b3c282eb11f7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 26 Jun 2014 18:35:54 -0400
Subject: [PATCH 0352/1265] 3.12.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 3f309143d8e..7c67c733e5f 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.12.1 / 2014-06-26
+===================
 
  * deps: connect@2.21.1
    - deps: cookie-parser@1.3.2
diff --git a/package.json b/package.json
index 36366e9dce4..e29e9eeab9c 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.12.0",
+  "version": "3.12.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From f0ad55798705a780c508ba78e7b0a7c4f6374373 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 26 Jun 2014 20:25:20 -0400
Subject: [PATCH 0353/1265] deps: cookie-signature@1.0.4

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ec406e5cf05..1b51ea56fe9 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+ * deps: cookie-signature@1.0.4
+   - fix for timing attacks
+
 4.4.4 / 2014-06-20
 ==================
 
diff --git a/package.json b/package.json
index 923ec45168a..25902b3ea3e 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "vary": "0.1.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",
-    "cookie-signature": "1.0.3",
+    "cookie-signature": "1.0.4",
     "merge-descriptors": "0.0.2",
     "utils-merge": "1.0.0",
     "qs": "0.6.6",

From fd27f1f4e19710d683f78b0683d45c5d8c590eae Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 26 Jun 2014 20:26:43 -0400
Subject: [PATCH 0354/1265] 4.4.5

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 1b51ea56fe9..9beb88943a0 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.4.5 / 2014-06-26
+==================
 
  * deps: cookie-signature@1.0.4
    - fix for timing attacks
diff --git a/package.json b/package.json
index 25902b3ea3e..3dee3263143 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "4.4.4",
+  "version": "4.4.5",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From fd35351594b71cb61c9c5803efdf0e7d23d0afc7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 3 Jul 2014 01:06:21 -0400
Subject: [PATCH 0355/1265] Add mergeParams option to Router

fixes #2153
fixes #2203
---
 History.md          |   2 +
 lib/router/index.js |  43 ++++++++++++-
 test/app.router.js  | 154 ++++++++++++++++++++++++++++++++++++--------
 3 files changed, 171 insertions(+), 28 deletions(-)

diff --git a/History.md b/History.md
index 4d4319c7938..81029b58fd9 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,8 @@ unreleased
  * add deprecation message to non-plural `req.accepts*`
  * add deprecation message to `res.send(body, status)`
  * add deprecation message to `res.vary()`
+ * add `mergeParams` option to `Router`
+   - merges `req.params` from parent routes
  * deprecate things with `depd` module
  * fix behavior when handling request without routes
  * fix handling when `route.all` is only route
diff --git a/lib/router/index.js b/lib/router/index.js
index 189f3cc7fa2..388ac9d6d07 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -5,6 +5,7 @@
 var Route = require('./route');
 var Layer = require('./layer');
 var methods = require('methods');
+var mixin = require('utils-merge');
 var debug = require('debug')('express:router');
 var parseUrl = require('parseurl');
 var slice = Array.prototype.slice;
@@ -30,6 +31,7 @@ var proto = module.exports = function(options) {
   router.params = {};
   router._params = [];
   router.caseSensitive = options.caseSensitive;
+  router.mergeParams = options.mergeParams;
   router.strict = options.strict;
   router.stack = [];
 
@@ -132,6 +134,7 @@ proto.handle = function(req, res, done) {
   var stack = self.stack;
 
   // manage inter-router variables
+  var parentParams = req.params;
   var parentUrl = req.baseUrl || '';
   done = restore(done, req, 'baseUrl', 'next', 'params');
 
@@ -197,7 +200,9 @@ proto.handle = function(req, res, done) {
       }
 
       // Capture one-time layer values
-      req.params = layer.params;
+      req.params = self.mergeParams
+        ? mergeParams(layer.params, parentParams)
+        : layer.params;
       layerPath = layer.path;
 
       // this should be done for the layer
@@ -441,6 +446,42 @@ methods.concat('all').forEach(function(method){
   };
 });
 
+// merge params with parent params
+function mergeParams(params, parent) {
+  if (typeof parent !== 'object' || !parent) {
+    return params;
+  }
+
+  // make copy of parent for base
+  var obj = mixin({}, parent);
+
+  // simple non-numeric merging
+  if (!(0 in params) || !(0 in parent)) {
+    return mixin(obj, params);
+  }
+
+  var i = 0;
+  var o = 0;
+
+  // determine numeric gaps
+  while (i === o || o in parent) {
+    if (i in params) i++;
+    if (o in parent) o++;
+  }
+
+  // offset numeric indices in params before merge
+  for (i--; i >= 0; i--) {
+    params[i + o] = params[i];
+
+    // create holes for the merge when necessary
+    if (i < o) {
+      delete params[i];
+    }
+  }
+
+  return mixin(parent, params);
+}
+
 // restore obj props after function
 function restore(fn, obj) {
   var props = new Array(arguments.length - 2);
diff --git a/test/app.router.js b/test/app.router.js
index 71cea448da2..ade4240c962 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -5,6 +5,33 @@ var express = require('../')
   , methods = require('methods');
 
 describe('app.router', function(){
+  it('should restore req.params after leaving router', function(done){
+    var app = express();
+    var router = new express.Router();
+
+    function handler1(req, res, next){
+      res.setHeader('x-user-id', req.params.id);
+      next()
+    }
+
+    function handler2(req, res){
+      res.send(req.params.id);
+    }
+
+    router.use(function(req, res, next){
+      res.setHeader('x-router', req.params.id);
+      next();
+    });
+
+    app.get('/user/:id', handler1, router, handler2);
+
+    request(app)
+    .get('/user/1')
+    .expect('x-router', 'undefined')
+    .expect('x-user-id', '1')
+    .expect(200, '1', done);
+  })
+
   describe('methods supported', function(){
     methods.concat('del').forEach(function(method){
       if (method === 'connect') return;
@@ -183,6 +210,106 @@ describe('app.router', function(){
     })
   })
 
+  describe('params', function(){
+    it('should overwrite existing req.params by default', function(done){
+      var app = express();
+      var router = new express.Router();
+
+      router.get('/:action', function(req, res){
+        res.send(req.params);
+      });
+
+      app.use('/user/:user', router);
+
+      request(app)
+      .get('/user/1/get')
+      .expect(200, '{"action":"get"}', done);
+    })
+
+    it('should allow merging existing req.params', function(done){
+      var app = express();
+      var router = new express.Router({ mergeParams: true });
+
+      router.get('/:action', function(req, res){
+        var keys = Object.keys(req.params).sort();
+        res.send(keys.map(function(k){ return [k, req.params[k]] }));
+      });
+
+      app.use('/user/:user', router);
+
+      request(app)
+      .get('/user/tj/get')
+      .expect(200, '[["action","get"],["user","tj"]]', done);
+    })
+
+    it('should use params from router', function(done){
+      var app = express();
+      var router = new express.Router({ mergeParams: true });
+
+      router.get('/:thing', function(req, res){
+        var keys = Object.keys(req.params).sort();
+        res.send(keys.map(function(k){ return [k, req.params[k]] }));
+      });
+
+      app.use('/user/:thing', router);
+
+      request(app)
+      .get('/user/tj/get')
+      .expect(200, '[["thing","get"]]', done);
+    })
+
+    it('should merge numeric indices req.params', function(done){
+      var app = express();
+      var router = new express.Router({ mergeParams: true });
+
+      router.get('/*.*', function(req, res){
+        var keys = Object.keys(req.params).sort();
+        res.send(keys.map(function(k){ return [k, req.params[k]] }));
+      });
+
+      app.use('/user/id:(\\d+)', router);
+
+      request(app)
+      .get('/user/id:10/profile.json')
+      .expect(200, '[["0","10"],["1","profile"],["2","json"]]', done);
+    })
+
+    it('should merge numeric indices req.params when more in parent', function(done){
+      var app = express();
+      var router = new express.Router({ mergeParams: true });
+
+      router.get('/*', function(req, res){
+        var keys = Object.keys(req.params).sort();
+        res.send(keys.map(function(k){ return [k, req.params[k]] }));
+      });
+
+      app.use('/user/id:(\\d+)/name:(\\w+)', router);
+
+      request(app)
+      .get('/user/id:10/name:tj/profile')
+      .expect(200, '[["0","10"],["1","tj"],["2","profile"]]', done);
+    })
+
+    it('should ignore invalid incoming req.params', function(done){
+      var app = express();
+      var router = new express.Router({ mergeParams: true });
+
+      router.get('/:name', function(req, res){
+        var keys = Object.keys(req.params).sort();
+        res.send(keys.map(function(k){ return [k, req.params[k]] }));
+      });
+
+      app.use('/user/', function (req, res, next) {
+        req.params = 3; // wat?
+        router(req, res, next);
+      });
+
+      request(app)
+      .get('/user/tj')
+      .expect(200, '[["name","tj"]]', done);
+    })
+  })
+
   describe('trailing slashes', function(){
     it('should be optional by default', function(done){
       var app = express();
@@ -656,33 +783,6 @@ describe('app.router', function(){
     .expect(200, '0,1,2,3,4,5', done);
   })
 
-  it('should provide req.params to all handlers', function(done){
-    var app = express();
-    var router = new express.Router();
-
-    function handler1(req, res, next){
-      res.setHeader('x-user-id', req.params.id);
-      next()
-    }
-
-    function handler2(req, res){
-      res.send(req.params.id);
-    }
-
-    router.use(function(req, res, next){
-      res.setHeader('x-router', req.params.id);
-      next();
-    });
-
-    app.get('/user/:id', handler1, router, handler2);
-
-    request(app)
-    .get('/user/1')
-    .expect('x-router', 'undefined')
-    .expect('x-user-id', '1')
-    .expect(200, '1', done);
-  })
-
   it('should be chainable', function(){
     var app = express();
     app.get('/', function(){}).should.equal(app);

From ca306eace1befc9d290cd5f79be8e6ba7c01b917 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 3 Jul 2014 10:49:53 -0400
Subject: [PATCH 0356/1265] deps: update example dependencies

---
 examples/auth/app.js      | 6 +++++-
 examples/mvc/index.js     | 6 +++++-
 examples/session/index.js | 6 +++++-
 examples/session/redis.js | 7 ++++++-
 package.json              | 2 +-
 5 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/examples/auth/app.js b/examples/auth/app.js
index 79c74dbb345..d110fe28d42 100644
--- a/examples/auth/app.js
+++ b/examples/auth/app.js
@@ -17,7 +17,11 @@ app.set('views', __dirname + '/views');
 // middleware
 
 app.use(bodyParser.urlencoded({ extended: false }));
-app.use(session({ secret: 'shhhh, very secret' }));
+app.use(session({
+  resave: false, // don't save session if unmodified
+  saveUninitialized: false, // don't create session until something stored
+  secret: 'shhhh, very secret'
+}));
 
 // Session-persisted message middleware
 
diff --git a/examples/mvc/index.js b/examples/mvc/index.js
index 91e2bf7a763..bf7f726e30f 100644
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -37,7 +37,11 @@ if (!module.parent) app.use(logger('dev'));
 app.use(express.static(__dirname + '/public'));
 
 // session support
-app.use(session({ secret: 'some secret here' }));
+app.use(session({
+  resave: false, // don't save session if unmodified
+  saveUninitialized: false, // don't create session until something stored
+  secret: 'some secret here'
+}));
 
 // parse request bodies (req.body)
 app.use(bodyParser.urlencoded({ extended: true }));
diff --git a/examples/session/index.js b/examples/session/index.js
index de60eac0b8f..de41a77d2c0 100644
--- a/examples/session/index.js
+++ b/examples/session/index.js
@@ -8,7 +8,11 @@ var session = require('express-session');
 var app = express();
 
 // Populates req.session
-app.use(session({ secret: 'keyboard cat' }));
+app.use(session({
+  resave: false, // don't save session if unmodified
+  saveUninitialized: false, // don't create session until something stored
+  secret: 'keyboard cat'
+}));
 
 app.get('/', function(req, res){
   var body = '';
diff --git a/examples/session/redis.js b/examples/session/redis.js
index 77fe60f7aeb..1338d6e95e6 100644
--- a/examples/session/redis.js
+++ b/examples/session/redis.js
@@ -15,7 +15,12 @@ var app = express();
 app.use(logger('dev'));
 
 // Populates req.session
-app.use(session({ store: new RedisStore, secret: 'keyboard cat' }));
+app.use(session({
+  resave: false, // don't save session if unmodified
+  saveUninitialized: false, // don't create session until something stored
+  secret: 'keyboard cat',
+  store: new RedisStore
+}));
 
 app.get('/', function(req, res){
   var body = '';
diff --git a/package.json b/package.json
index 31a8b35539f..ac3693df728 100644
--- a/package.json
+++ b/package.json
@@ -62,7 +62,7 @@
     "hjs": "~0.0.6",
     "body-parser": "~1.4.3",
     "cookie-parser": "~1.3.1",
-    "express-session": "~1.5.0",
+    "express-session": "~1.6.1",
     "method-override": "2.0.2",
     "morgan": "1.1.1",
     "vhost": "2.0.0"

From d1b1dfd472a790f165ee2ef98565e353eb4f632e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 3 Jul 2014 11:11:18 -0400
Subject: [PATCH 0357/1265] deps: serve-static@~1.3.0

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 81029b58fd9..6df81e17f2c 100644
--- a/History.md
+++ b/History.md
@@ -12,6 +12,11 @@ unreleased
  * restore `req.params` after invoking router
  * use `finalhandler` for final response handling
  * use `media-typer` to alter content-type charset
+ * deps: serve-static@~1.3.0
+   - Accept string for `maxAge` (converted by `ms`)
+   - Add `setHeaders` option
+   - Include HTML link in redirect response
+   - deps: send@0.5.0
  * deps: type-is@~1.3.2
 
 4.4.5 / 2014-06-26
diff --git a/package.json b/package.json
index ac3693df728..5aceff68ed0 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.4.3",
-    "serve-static": "1.2.3",
+    "serve-static": "~1.3.0",
     "type-is": "~1.3.2",
     "vary": "0.1.0",
     "cookie": "0.1.2",

From 3136e98dced1739d4c724135c5515f8c8a9543f2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 3 Jul 2014 11:18:35 -0400
Subject: [PATCH 0358/1265] deps: send@0.5.0

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 6df81e17f2c..2bf296d9df1 100644
--- a/History.md
+++ b/History.md
@@ -12,6 +12,9 @@ unreleased
  * restore `req.params` after invoking router
  * use `finalhandler` for final response handling
  * use `media-typer` to alter content-type charset
+ * deps: send@0.5.0
+   - Accept string for `maxage` (converted by `ms`)
+   - Include link in default redirect response
  * deps: serve-static@~1.3.0
    - Accept string for `maxAge` (converted by `ms`)
    - Add `setHeaders` option
diff --git a/package.json b/package.json
index 5aceff68ed0..f63622f7f19 100644
--- a/package.json
+++ b/package.json
@@ -36,7 +36,7 @@
     "parseurl": "1.0.1",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.4.3",
+    "send": "0.5.0",
     "serve-static": "~1.3.0",
     "type-is": "~1.3.2",
     "vary": "0.1.0",

From ce3d1fe07ed312f3b8420bd4e200fbb58bcae434 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 3 Jul 2014 12:53:49 -0400
Subject: [PATCH 0359/1265] Add headers option to res.sendfile

---
 History.md           |  2 ++
 lib/response.js      | 35 ++++++++++++++++++++++++++---------
 test/res.sendfile.js | 35 +++++++++++++++++++++++++++++++++++
 3 files changed, 63 insertions(+), 9 deletions(-)

diff --git a/History.md b/History.md
index 2bf296d9df1..d28542bf52c 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,8 @@ unreleased
  * add deprecation message to non-plural `req.accepts*`
  * add deprecation message to `res.send(body, status)`
  * add deprecation message to `res.vary()`
+ * add `headers` option to `res.sendfile`
+   - use to set headers on successful file transfer
  * add `mergeParams` option to `Router`
    - merges `req.params` from parent routes
  * deprecate things with `depd` module
diff --git a/lib/response.js b/lib/response.js
index 9a0a8864585..13f215d33be 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -278,9 +278,10 @@ res.jsonp = function(obj){
  *
  * Options:
  *
- *   - `maxAge` defaulting to 0
- *   - `root`   root directory for relative filenames
- *   - `hidden` serve hidden files, defaulting to false
+ *   - `maxAge`  defaulting to 0 (can be string converted by `ms`)
+ *   - `root`    root directory for relative filenames
+ *   - `headers` object of headers to serve with file
+ *   - `hidden`  serve hidden files, defaulting to false
  *
  * Other options are passed along to `send`.
  *
@@ -331,14 +332,10 @@ res.sendfile = function(path, options, fn){
 
     // clean up
     cleanup();
-    if (!self.headersSent) self.removeHeader('Content-Disposition');
 
     // callback available
     if (fn) return fn(err);
 
-    // list in limbo if there's no callback
-    if (self.headersSent) return;
-
     // delegate
     next(err);
   }
@@ -363,6 +360,21 @@ res.sendfile = function(path, options, fn){
   file.on('error', error);
   file.on('directory', next);
   file.on('stream', stream);
+
+  if (options.headers) {
+    // set headers on successful transfer
+    file.on('headers', function headers(res) {
+      var obj = options.headers;
+      var keys = Object.keys(obj);
+
+      for (var i = 0; i < keys.length; i++) {
+        var k = keys[i];
+        res.setHeader(k, obj[k]);
+      }
+    });
+  }
+
+  // pipe
   file.pipe(this);
   this.on('finish', cleanup);
 };
@@ -388,8 +400,13 @@ res.download = function(path, filename, fn){
   }
 
   filename = filename || path;
-  this.set('Content-Disposition', contentDisposition(filename));
-  return this.sendfile(path, fn);
+
+  // set Content-Disposition when file is sent
+  var headers = {
+    'Content-Disposition': contentDisposition(filename)
+  };
+
+  return this.sendfile(path, { headers: headers }, fn);
 };
 
 /**
diff --git a/test/res.sendfile.js b/test/res.sendfile.js
index 6fcbf11758a..45e55845bb8 100644
--- a/test/res.sendfile.js
+++ b/test/res.sendfile.js
@@ -130,6 +130,41 @@ describe('res', function(){
       .expect(200, 'tobi', done);
     })
 
+    it('should accept headers option', function(done){
+      var app = express();
+      var headers = {
+         'x-success': 'sent',
+         'x-other': 'done'
+      };
+
+      app.use(function(req, res){
+        res.sendfile('test/fixtures/user.html', { headers: headers });
+      });
+
+      request(app)
+      .get('/')
+      .expect('x-success', 'sent')
+      .expect('x-other', 'done')
+      .expect(200, done);
+    })
+
+    it('should ignore headers option on 404', function(done){
+      var app = express();
+      var headers = { 'x-success': 'sent' };
+
+      app.use(function(req, res){
+        res.sendfile('test/fixtures/user.nothing', { headers: headers });
+      });
+
+      request(app)
+      .get('/')
+      .expect(404, function (err, res) {
+        if (err) return done(err);
+        res.headers.should.not.have.property('x-success');
+        done();
+      });
+    })
+
     describe('with an absolute path', function(){
       it('should transfer the file', function(done){
         var app = express();

From c468f5ff2031150bc95d16e1716569716be46788 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 3 Jul 2014 11:18:35 -0400
Subject: [PATCH 0360/1265] deps: send@0.5.0

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 7c67c733e5f..245cc0181ef 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+unreleased
+==========
+
+ * deps: send@0.5.0
+   - Accept string for `maxage` (converted by `ms`)
+   - Include link in default redirect response
+
 3.12.1 / 2014-06-26
 ===================
 
diff --git a/package.json b/package.json
index e29e9eeab9c..818d28dd21d 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "parseurl": "1.0.1",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.4.3",
+    "send": "0.5.0",
     "vary": "0.1.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",

From 185e327e29e8afbb23d7d0ad3c74aba31883370f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 3 Jul 2014 14:13:39 -0400
Subject: [PATCH 0361/1265] add deprecation message to app.configure

---
 History.md         |  1 +
 lib/application.js | 17 +++++++++++------
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/History.md b/History.md
index 245cc0181ef..dcb4d666bd9 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+ * add deprecation message to `app.configure`
  * deps: send@0.5.0
    - Accept string for `maxage` (converted by `ms`)
    - Include link in default redirect response
diff --git a/lib/application.js b/lib/application.js
index e4618fbd967..5be5ad45e98 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -48,10 +48,12 @@ app.defaultConfiguration = function(){
   // default settings
   this.enable('x-powered-by');
   this.set('etag', 'weak');
-  this.set('env', process.env.NODE_ENV || 'development');
+  var env = process.env.NODE_ENV || 'development';
+  this.set('env', env);
   this.set('subdomain offset', 2);
   this.set('trust proxy', false);
-  debug('booting in %s mode', this.get('env'));
+
+  debug('booting in %s mode', env);
 
   // implicit middleware
   this.use(connect.query());
@@ -86,13 +88,13 @@ app.defaultConfiguration = function(){
   this.set('views', process.cwd() + '/views');
   this.set('jsonp callback name', 'callback');
 
-  this.configure('development', function(){
+  if (env === 'development') {
     this.set('json spaces', 2);
-  });
+  }
 
-  this.configure('production', function(){
+  if (env === 'production') {
     this.enable('view cache');
-  });
+  }
 };
 
 /**
@@ -411,6 +413,9 @@ app.configure = function(env, fn){
   return this;
 };
 
+app.configure = deprecate.function(app.configure,
+  'app.configure: Check app.get(\'env\') in an if statement');
+
 /**
  * Delegate `.VERB(...)` calls to `router.VERB(...)`.
  */

From 12507cfcd0958b2e49a2f4ff6b96d5e772656eb1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 3 Jul 2014 23:09:44 -0400
Subject: [PATCH 0362/1265] deps: connect@2.22.0

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index dcb4d666bd9..40972bf7a2d 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,11 @@ unreleased
 ==========
 
  * add deprecation message to `app.configure`
+ * deps: connect@2.22.0
+   - deps: csurf@~1.3.0
+   - deps: express-session@~1.6.1
+   - deps: multiparty@3.3.0
+   - deps: serve-static@~1.3.0
  * deps: send@0.5.0
    - Accept string for `maxage` (converted by `ms`)
    - Include link in default redirect response
diff --git a/package.json b/package.json
index 818d28dd21d..33ff74b50cf 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
   "license": "MIT",
   "dependencies": {
     "buffer-crc32": "0.2.3",
-    "connect": "2.21.1",
+    "connect": "2.22.0",
     "commander": "1.3.2",
     "debug": "1.0.2",
     "depd": "0.3.0",

From f381f2d9b6e9ed962f5efff367cfff8d52d02ede Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Jul 2014 00:24:01 -0400
Subject: [PATCH 0363/1265] add deprecation message to req.auth

---
 History.md     |  2 ++
 lib/request.js | 19 +++++++------------
 package.json   |  1 +
 3 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/History.md b/History.md
index 40972bf7a2d..60b6ee68d09 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,8 @@ unreleased
 ==========
 
  * add deprecation message to `app.configure`
+ * add deprecation message to `req.auth`
+ * use `basic-auth` to parse `Authorization` header
  * deps: connect@2.22.0
    - deps: csurf@~1.3.0
    - deps: express-session@~1.6.1
diff --git a/lib/request.js b/lib/request.js
index dac29ee44f8..065e4c6fe3c 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -3,6 +3,8 @@
  * Module dependencies.
  */
 
+var auth = require('basic-auth');
+var deprecate = require('depd')('express');
 var http = require('http')
   , utils = require('./utils')
   , connect = require('connect')
@@ -422,20 +424,13 @@ req.__defineGetter__('ips', function(){
  */
 
 req.__defineGetter__('auth', function(){
-  // missing
-  var auth = this.get('Authorization');
-  if (!auth) return;
-
-  // malformed
-  var parts = auth.split(' ');
-  if ('basic' != parts[0].toLowerCase()) return;
-  if (!parts[1]) return;
-  auth = parts[1];
+  deprecate('req.auth: Use basic-auth module directly');
 
   // credentials
-  auth = new Buffer(auth, 'base64').toString().match(/^([^:]*):(.*)$/);
-  if (!auth) return;
-  return { username: auth[1], password: auth[2] };
+  var creds = auth(this);
+  if (!creds) return;
+
+  return { username: creds.name, password: creds.pass };
 });
 
 /**
diff --git a/package.json b/package.json
index 33ff74b50cf..ca1fe625efd 100644
--- a/package.json
+++ b/package.json
@@ -25,6 +25,7 @@
   "repository": "visionmedia/express",
   "license": "MIT",
   "dependencies": {
+    "basic-auth": "0.0.1",
     "buffer-crc32": "0.2.3",
     "connect": "2.22.0",
     "commander": "1.3.2",

From b601d64203d50950bee4dee967187b06becfb6f4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Jul 2014 00:38:59 -0400
Subject: [PATCH 0364/1265] tests: fix inconsistent test

---
 test/app.head.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/test/app.head.js b/test/app.head.js
index 9ba2ad9a911..ed8499ce293 100644
--- a/test/app.head.js
+++ b/test/app.head.js
@@ -34,6 +34,8 @@ describe('HEAD', function(){
       .get('/tobi')
       .expect(200, function(err, res){
         if (err) return done(err);
+        delete headers.date;
+        delete res.headers.date;
         assert.deepEqual(res.headers, headers);
         done();
       });

From abe0ffa311bf39ca2bbfc8791856753b7cabe843 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Jul 2014 00:40:01 -0400
Subject: [PATCH 0365/1265] 3.13.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 60b6ee68d09..322cdaf971f 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+3.13.0 / 2014-07-03
+===================
 
  * add deprecation message to `app.configure`
  * add deprecation message to `req.auth`
diff --git a/package.json b/package.json
index ca1fe625efd..1c0a31d02c8 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.12.1",
+  "version": "3.13.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 32dbda1460bd042bc68d2a9e6ef4f86fd0d8ea87 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Jul 2014 01:23:14 -0400
Subject: [PATCH 0366/1265] deps: istanbul@0.2.14

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f63622f7f19..931f751bb79 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
   },
   "devDependencies": {
     "after": "0.8.1",
-    "istanbul": "0.2.12",
+    "istanbul": "0.2.14",
     "mocha": "~1.20.1",
     "should": "~4.0.4",
     "supertest": "~0.13.0",

From 99e839a27460cc3b014c8b4d7cb4be8ec5857c67 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Jul 2014 01:24:42 -0400
Subject: [PATCH 0367/1265] deps: update example dependencies

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 931f751bb79..9bff085bb2e 100644
--- a/package.json
+++ b/package.json
@@ -58,12 +58,12 @@
     "ejs": "~1.0.0",
     "jade": "~1.3.1",
     "marked": "0.3.2",
-    "multiparty": "~3.2.4",
     "hjs": "~0.0.6",
     "body-parser": "~1.4.3",
     "cookie-parser": "~1.3.1",
     "express-session": "~1.6.1",
     "method-override": "2.0.2",
+    "multiparty": "~3.3.0",
     "morgan": "1.1.1",
     "vhost": "2.0.0"
   },

From efbc3f95eebbe56683948e5d80add740afe37a85 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Jul 2014 12:51:44 -0400
Subject: [PATCH 0368/1265] deps: accepts@~1.0.7

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ca8ca42c014..fb9507b3b80 100644
--- a/History.md
+++ b/History.md
@@ -14,6 +14,7 @@ unreleased
  * restore `req.params` after invoking router
  * use `finalhandler` for final response handling
  * use `media-typer` to alter content-type charset
+ * deps: accepts@~1.0.7
  * deps: send@0.5.0
    - Accept string for `maxage` (converted by `ms`)
    - Include link in default redirect response
diff --git a/package.json b/package.json
index 9bff085bb2e..4b5681883ad 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
   "repository": "visionmedia/express",
   "license": "MIT",
   "dependencies": {
-    "accepts": "~1.0.5",
+    "accepts": "~1.0.7",
     "buffer-crc32": "0.2.3",
     "debug": "1.0.2",
     "depd": "0.3.0",

From 269dc5323f41ce9d56229784f9441857fbf5f27f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 3 Jul 2014 16:41:23 -0400
Subject: [PATCH 0369/1265] Invoke router.param() only when route matches

fixes #2206
---
 History.md          |  1 +
 lib/router/index.js | 14 +++++++++++---
 lib/router/route.js | 19 +++++++++++++++++++
 test/app.param.js   | 25 +++++++++++++++++++++++++
 4 files changed, 56 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index fb9507b3b80..d8d1d5b21c6 100644
--- a/History.md
+++ b/History.md
@@ -11,6 +11,7 @@ unreleased
  * deprecate things with `depd` module
  * fix behavior when handling request without routes
  * fix handling when `route.all` is only route
+ * invoke `router.param()` only when route matches
  * restore `req.params` after invoking router
  * use `finalhandler` for final response handling
  * use `media-typer` to alter content-type charset
diff --git a/lib/router/index.js b/lib/router/index.js
index 388ac9d6d07..23c1f8b0a42 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -191,12 +191,20 @@ proto.handle = function(req, res, done) {
           return next(err);
         }
 
-        req.route = route;
+        var has_method = route._handles_method(method);
 
-        // we can now dispatch to the route
-        if (method === 'options' && !route.methods['options']) {
+        // build up automatic options response
+        if (!has_method && method === 'options') {
           options.push.apply(options, route._options());
         }
+
+        // don't even bother
+        if (!has_method && method !== 'head') {
+          return next();
+        }
+
+        // we can now dispatch to the route
+        req.route = route;
       }
 
       // Capture one-time layer values
diff --git a/lib/router/route.js b/lib/router/route.js
index f67d0dd727f..e9cf1a95abd 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -28,6 +28,24 @@ function Route(path) {
   this.methods = {};
 }
 
+/**
+ * @api private
+ */
+
+Route.prototype._handles_method = function _handles_method(method) {
+  if (this.methods._all) {
+    return true;
+  }
+
+  method = method.toLowerCase();
+
+  if (method === 'head' && !this.methods['head']) {
+    method = 'get';
+  }
+
+  return Boolean(this.methods[method]);
+};
+
 /**
  * @return {Array} supported HTTP methods
  * @api private
@@ -137,6 +155,7 @@ Route.prototype.all = function(){
       throw new Error(msg);
     }
 
+    self.methods._all = true;
     self.stack.push({ handle: fn });
   });
 
diff --git a/test/app.param.js b/test/app.param.js
index 9c6264c274c..cd5bc9b298b 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -177,6 +177,31 @@ describe('app', function(){
       .expect('loki', done);
     })
 
+    it('should not invoke without route handler', function(done) {
+      var app = express();
+
+      app.param('thing', function(req, res, next, thing) {
+        req.thing = thing;
+        next();
+      });
+
+      app.param('user', function(req, res, next, user) {
+        next(new Error('invalid invokation'));
+      });
+
+      app.post('/:user', function(req, res, next) {
+        res.send(req.params.user);
+      });
+
+      app.get('/:thing', function(req, res, next) {
+        res.send(req.thing);
+      });
+
+      request(app)
+      .get('/bob')
+      .expect(200, 'bob', done);
+    })
+
     it('should work with encoded values', function(done){
       var app = express();
 

From e6eeec3f0392f32271309e92aec965b00bbb777d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Jul 2014 13:59:01 -0400
Subject: [PATCH 0370/1265] Add req.hostname

closes #2179
---
 History.md           |   2 +
 lib/request.js       |  12 +++-
 test/req.hostname.js | 138 +++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 149 insertions(+), 3 deletions(-)
 create mode 100644 test/req.hostname.js

diff --git a/History.md b/History.md
index d8d1d5b21c6..5df9e78aaf9 100644
--- a/History.md
+++ b/History.md
@@ -8,7 +8,9 @@ unreleased
    - use to set headers on successful file transfer
  * add `mergeParams` option to `Router`
    - merges `req.params` from parent routes
+ * add `req.hostname` -- correct name for what `req.host` returns
  * deprecate things with `depd` module
+ * deprecate `req.host` -- use `req.hostname` instead
  * fix behavior when handling request without routes
  * fix handling when `route.all` is only route
  * invoke `router.param()` only when route matches
diff --git a/lib/request.js b/lib/request.js
index e7e7f8e9563..514175b0037 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -330,7 +330,7 @@ defineGetter(req, 'ips', function ips() {
 
 defineGetter(req, 'subdomains', function subdomains() {
   var offset = this.app.get('subdomain offset');
-  return (this.host || '')
+  return (this.hostname || '')
     .split('.')
     .reverse()
     .slice(offset);
@@ -348,7 +348,7 @@ defineGetter(req, 'path', function path() {
 });
 
 /**
- * Parse the "Host" header field hostname.
+ * Parse the "Host" header field to a hostname.
  *
  * When the "trust proxy" setting trusts the socket
  * address, the "X-Forwarded-Host" header field will
@@ -358,7 +358,7 @@ defineGetter(req, 'path', function path() {
  * @api public
  */
 
-defineGetter(req, 'host', function host(){
+defineGetter(req, 'hostname', function hostname(){
   var trust = this.app.get('trust proxy fn');
   var host = this.get('X-Forwarded-Host');
 
@@ -379,6 +379,12 @@ defineGetter(req, 'host', function host(){
     : host;
 });
 
+// TODO: change req.host to return host in next major
+
+defineGetter(req, 'host', deprecate.function(function host(){
+  return this.hostname;
+}, 'req.host: Use req.hostname instead'));
+
 /**
  * Check if the request is fresh, aka
  * Last-Modified and/or the ETag
diff --git a/test/req.hostname.js b/test/req.hostname.js
new file mode 100644
index 00000000000..65c2be81a1f
--- /dev/null
+++ b/test/req.hostname.js
@@ -0,0 +1,138 @@
+
+var express = require('../')
+  , request = require('supertest')
+  , assert = require('assert');
+
+describe('req', function(){
+  describe('.hostname', function(){
+    it('should return the Host when present', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.end(req.hostname);
+      });
+
+      request(app)
+      .post('/')
+      .set('Host', 'example.com')
+      .expect('example.com', done);
+    })
+
+    it('should strip port number', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.end(req.hostname);
+      });
+
+      request(app)
+      .post('/')
+      .set('Host', 'example.com:3000')
+      .expect('example.com', done);
+    })
+
+    it('should return undefined otherwise', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        req.headers.host = null;
+        res.end(String(req.hostname));
+      });
+
+      request(app)
+      .post('/')
+      .expect('undefined', done);
+    })
+
+    it('should work with IPv6 Host', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.end(req.hostname);
+      });
+
+      request(app)
+      .post('/')
+      .set('Host', '[::1]')
+      .expect('[::1]', done);
+    })
+
+    it('should work with IPv6 Host and port', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.end(req.hostname);
+      });
+
+      request(app)
+      .post('/')
+      .set('Host', '[::1]:3000')
+      .expect('[::1]', done);
+    })
+
+    describe('when "trust proxy" is enabled', function(){
+      it('should respect X-Forwarded-Host', function(done){
+        var app = express();
+
+        app.enable('trust proxy');
+
+        app.use(function(req, res){
+          res.end(req.hostname);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', 'localhost')
+        .set('X-Forwarded-Host', 'example.com:3000')
+        .expect('example.com', done);
+      })
+
+      it('should ignore X-Forwarded-Host if socket addr not trusted', function(done){
+        var app = express();
+
+        app.set('trust proxy', '10.0.0.1');
+
+        app.use(function(req, res){
+          res.end(req.hostname);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', 'localhost')
+        .set('X-Forwarded-Host', 'example.com')
+        .expect('localhost', done);
+      })
+
+      it('should default to Host', function(done){
+        var app = express();
+
+        app.enable('trust proxy');
+
+        app.use(function(req, res){
+          res.end(req.hostname);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', 'example.com')
+        .expect('example.com', done);
+      })
+    })
+
+    describe('when "trust proxy" is disabled', function(){
+      it('should ignore X-Forwarded-Host', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          res.end(req.hostname);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', 'localhost')
+        .set('X-Forwarded-Host', 'evil')
+        .expect('localhost', done);
+      })
+    })
+  })
+})

From bd6908516dd88320522d3a9d6089dde4d6005bba Mon Sep 17 00:00:00 2001
From: Fishrock123 <fishrock123@rocketmail.com>
Date: Fri, 4 Jul 2014 15:10:19 -0400
Subject: [PATCH 0371/1265] docs: cleanup readme, update package description

closes #2210
---
 Readme.md    | 110 +++++++++++++++++++++++++++++----------------------
 package.json |   2 +-
 2 files changed, 63 insertions(+), 49 deletions(-)

diff --git a/Readme.md b/Readme.md
index 33caf7ff842..18fbcc51c69 100644
--- a/Readme.md
+++ b/Readme.md
@@ -1,48 +1,58 @@
-[![express logo](https://i.cloudup.com/zfY6lL7eFa-3000x3000.png)](http://expressjs.com/)
+[![Express Logo](https://i.cloudup.com/zfY6lL7eFa-3000x3000.png)](https://expressjs.com/)
 
-  Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
+  Fast, unopinionated, minimalist web framework for [node](https://nodejs.org).
 
-  [![NPM version](https://badge.fury.io/js/express.svg)](http://badge.fury.io/js/express)
+  [![NPM Version](https://badge.fury.io/js/express.svg)](https://badge.fury.io/js/express)
   [![Build Status](https://travis-ci.org/visionmedia/express.svg?branch=master)](https://travis-ci.org/visionmedia/express)
   [![Coverage Status](https://img.shields.io/coveralls/visionmedia/express.svg)](https://coveralls.io/r/visionmedia/express)
-  [![Gittip](http://img.shields.io/gittip/visionmedia.svg)](https://www.gittip.com/visionmedia/)
+  [![Gittip](https://img.shields.io/gittip/visionmedia.svg)](https://www.gittip.com/visionmedia/)
 
 ```js
-var express = require('express');
-var app = express();
+var express = require('express')
+var app = express()
 
-app.get('/', function(req, res){
-  res.send('Hello World');
-});
+app.get('/', function (req, res) {
+  res.send('Hello World')
+})
 
-app.listen(3000);
+app.listen(3000)
 ```
 
-**PROTIP** Be sure to read [Migrating from 3.x to 4.x](https://github.com/visionmedia/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/visionmedia/express/wiki/New-features-in-4.x).
+  **PROTIP** Be sure to read [Migrating from 3.x to 4.x](https://github.com/visionmedia/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/visionmedia/express/wiki/New-features-in-4.x).
 
-## Installation
+### Installation
 
-    $ npm install express
+```bash
+$ npm install express
+```
 
 ## Quick Start
 
- The quickest way to get started with express is to utilize the executable [`express(1)`](http://github.com/expressjs/generator) to generate an application as shown below:
- 
- Install the executable. The executable's major version will match Express's:
- 
-    $ npm install -g express-generator@3
+  The quickest way to get started with express is to utilize the executable [`express(1)`](https://github.com/expressjs/generator) to generate an application as shown below:
+
+  Install the executable. The executable's major version will match Express's:
 
- Create the app:
+```bash
+$ npm install -g express-generator@4
+```
 
-    $ express /tmp/foo && cd /tmp/foo
+  Create the app:
+
+```bash
+$ express /tmp/foo && cd /tmp/foo
+```
 
- Install dependencies:
+  Install dependencies:
 
-    $ npm install
+```bash
+$ npm install
+```
 
- Start the server:
+  Start the server:
 
-    $ npm start
+```bash
+$ npm start
+```
 
 ## Features
 
@@ -61,53 +71,57 @@ app.listen(3000);
   HTTP APIs.
 
   Express does not force you to use any specific ORM or template engine. With support for over
-  14 template engines via [Consolidate.js](http://github.com/visionmedia/consolidate.js),
+  14 template engines via [Consolidate.js](https://github.com/visionmedia/consolidate.js),
   you can quickly craft your perfect framework.
 
 ## More Information
 
-  * [Website and Documentation](http://expressjs.com/) stored at [visionmedia/expressjs.com](https://github.com/visionmedia/expressjs.com)
-  * Join #express on freenode
-  * [Google Group](http://groups.google.com/group/express-js) for discussion
-  * Follow [tjholowaychuk](http://twitter.com/tjholowaychuk) and [defunctzombie](https://twitter.com/defunctzombie) on twitter for updates
-  * Visit the [Wiki](http://github.com/visionmedia/express/wiki)
+  * [Website and Documentation](http://expressjs.com/) - [[website repo](https://github.com/visionmedia/expressjs.com)]
+  * [Github Organization](https://github.com/expressjs) for Official Middleware & Modules
+  * [#express](https://webchat.freenode.net/?channels=express) on freenode IRC
+  * Visit the [Wiki](https://github.com/visionmedia/express/wiki)
+  * [Google Group](https://groups.google.com/group/express-js) for discussion
   * [Русскоязычная документация](http://jsman.ru/express/)
   * Run express examples [online](https://runnable.com/express)
 
 ## Viewing Examples
 
-Clone the Express repo, then install the dev dependencies to install all the example / test suite dependencies:
+  Clone the Express repo, then install the dev dependencies to install all the example / test suite dependencies:
 
-    $ git clone git://github.com/visionmedia/express.git --depth 1
-    $ cd express
-    $ npm install
+```bash
+$ git clone git://github.com/visionmedia/express.git --depth 1
+$ cd express
+$ npm install
+```
 
-Then run whichever tests you want:
+  Then run whichever example you want:
 
     $ node examples/content-negotiation
 
-You can also view live examples here:
+  You can also view live examples here:
 
-<a href="https://runnable.com/express" target="_blank"><img src="https://runnable.com/external/styles/assets/runnablebtn.png" style="width:67px;height:25px;"></a>
+  <a href="https://runnable.com/express" target="_blank"><img src="https://runnable.com/external/styles/assets/runnablebtn.png" style="width:67px;height:25px;"></a>
 
 ## Running Tests
 
-To run the test suite, first invoke the following command within the repo, installing the development dependencies:
+  To run the test suite, first invoke the following command within the repo, installing the development dependencies:
 
-    $ npm install
+```bash
+$ npm install
+```
 
-Then run the tests:
+  Then run the tests:
 
-```sh
+```bash
 $ npm test
 ```
 
-## Contributors
-  
-  Author: [TJ Holowaychuk](http://github.com/visionmedia)  
-  Lead Maintainer: [Roman Shtylman](https://github.com/defunctzombie)  
-  Contributors: https://github.com/visionmedia/express/graphs/contributors  
+### Contributors
+
+ * Author: [TJ Holowaychuk](https://github.com/visionmedia)
+ * Lead Maintainer: [Douglas Christopher Wilson](https://github.com/dougwilson)
+ * [All Contributors](https://github.com/visionmedia/express/graphs/contributors)
 
-## License
+### License
 
-MIT
+  [MIT](LICENSE)
diff --git a/package.json b/package.json
index 4b5681883ad..7a20c574670 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express",
-  "description": "Sinatra inspired web development framework",
+  "description": "Fast, unopinionated, minimalist web framework",
   "version": "4.4.5",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [

From 92c45199bdcbb1ffa753026f3862d7ad3dc7c514 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Jul 2014 21:03:07 -0400
Subject: [PATCH 0372/1265] 4.5.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 5df9e78aaf9..ed6059ce33f 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.5.0 / 2014-07-04
+==================
 
  * add deprecation message to non-plural `req.accepts*`
  * add deprecation message to `res.send(body, status)`
diff --git a/package.json b/package.json
index 7a20c574670..e0048d225e7 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.4.5",
+  "version": "4.5.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From b4b2efee0f0c07c944ead4444e63ac534fbf3238 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 5 Jul 2014 11:32:44 -0400
Subject: [PATCH 0373/1265] tests: add more app.use tests

---
 test/app.use.js | 84 +++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 82 insertions(+), 2 deletions(-)

diff --git a/test/app.use.js b/test/app.use.js
index 9e115e95fee..dda16f4dd22 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -1,6 +1,7 @@
 
-var express = require('../')
-  , request = require('supertest');
+var after = require('after');
+var express = require('..');
+var request = require('supertest');
 
 describe('app', function(){
   it('should emit "mount" when mounted', function(done){
@@ -84,4 +85,83 @@ describe('app', function(){
       .expect('success', done);
     })
   })
+
+  describe('.use(middleware)', function(){
+    it('should invoke middleware for all requests', function (done) {
+      var app = express();
+      var cb = after(3, done);
+
+      app.use(function (req, res) {
+        res.send('saw ' + req.method + ' ' + req.url);
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, 'saw GET /', cb);
+
+      request(app)
+      .options('/')
+      .expect(200, 'saw OPTIONS /', cb);
+
+      request(app)
+      .post('/foo')
+      .expect(200, 'saw POST /foo', cb);
+    })
+  })
+
+  describe('.use(path, middleware)', function(){
+    it('should strip path from req.url', function (done) {
+      var app = express();
+
+      app.use('/foo', function (req, res) {
+        res.send('saw ' + req.method + ' ' + req.url);
+      });
+
+      request(app)
+      .get('/foo/bar')
+      .expect(200, 'saw GET /bar', done);
+    })
+
+    it('should invoke middleware for all requests starting with path', function (done) {
+      var app = express();
+      var cb = after(3, done);
+
+      app.use('/foo', function (req, res) {
+        res.send('saw ' + req.method + ' ' + req.url);
+      });
+
+      request(app)
+      .get('/')
+      .expect(404, cb);
+
+      request(app)
+      .post('/foo')
+      .expect(200, 'saw POST /', cb);
+
+      request(app)
+      .post('/foo/bar')
+      .expect(200, 'saw POST /bar', cb);
+    })
+
+    it('should work if path has trailing slash', function (done) {
+      var app = express();
+      var cb = after(3, done);
+
+      app.use('/foo/', function (req, res) {
+        res.send('saw ' + req.method + ' ' + req.url);
+      });
+
+      request(app)
+      .get('/')
+      .expect(404, cb);
+
+      request(app)
+      .post('/foo')
+      .expect(200, 'saw POST /', cb);
+
+      request(app)
+      .post('/foo/bar')
+      .expect(200, 'saw POST /bar', cb);
+    })
+  })
 })

From 23a49ff61eb30181917240bf722d89752738a1fe Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 6 Jul 2014 19:42:08 -0400
Subject: [PATCH 0374/1265] Fix routing regression when altering req.method

---
 History.md          |  5 +++++
 lib/router/index.js |  9 ++++-----
 test/app.router.js  | 32 +++++++++++++++++++++++++++++++-
 3 files changed, 40 insertions(+), 6 deletions(-)

diff --git a/History.md b/History.md
index ed6059ce33f..765bbc1e659 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+ * fix routing regression when altering `req.method`
+
 4.5.0 / 2014-07-04
 ==================
 
diff --git a/lib/router/index.js b/lib/router/index.js
index 23c1f8b0a42..c08b39cd935 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -115,8 +115,6 @@ proto.handle = function(req, res, done) {
 
   debug('dispatching %s %s', req.method, req.url);
 
-  var method = req.method.toLowerCase();
-
   var search = 1 + req.url.indexOf('?');
   var pathlength = search ? search - 1 : req.url.length;
   var fqdn = 1 + req.url.substr(0, pathlength).indexOf('://');
@@ -142,7 +140,7 @@ proto.handle = function(req, res, done) {
   req.next = next;
 
   // for options requests, respond with a default if nothing else responds
-  if (method === 'options') {
+  if (req.method === 'OPTIONS') {
     done = wrap(done, function(old, err) {
       if (err || options.length === 0) return old(err);
 
@@ -191,15 +189,16 @@ proto.handle = function(req, res, done) {
           return next(err);
         }
 
+        var method = req.method;
         var has_method = route._handles_method(method);
 
         // build up automatic options response
-        if (!has_method && method === 'options') {
+        if (!has_method && method === 'OPTIONS') {
           options.push.apply(options, route._options());
         }
 
         // don't even bother
-        if (!has_method && method !== 'head') {
+        if (!has_method && method !== 'HEAD') {
           return next();
         }
 
diff --git a/test/app.router.js b/test/app.router.js
index ade4240c962..f785069050f 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -1,4 +1,5 @@
 
+var after = require('after');
 var express = require('../')
   , request = require('supertest')
   , assert = require('assert')
@@ -32,7 +33,7 @@ describe('app.router', function(){
     .expect(200, '1', done);
   })
 
-  describe('methods supported', function(){
+  describe('methods', function(){
     methods.concat('del').forEach(function(method){
       if (method === 'connect') return;
 
@@ -58,6 +59,35 @@ describe('app.router', function(){
         app[method].bind(app, '/', 3).should.throw(/Number/);
       })
     });
+
+    it('should re-route when method is altered', function (done) {
+      var app = express();
+      var cb = after(3, done);
+
+      app.use(function (req, res, next) {
+        if (req.method !== 'POST') return next();
+        req.method = 'DELETE';
+        res.setHeader('X-Method-Altered', '1');
+        next();
+      });
+
+      app.delete('/', function (req, res) {
+        res.end('deleted everything');
+      });
+
+      request(app)
+      .get('/')
+      .expect(404, 'Cannot GET /\n', cb);
+
+      request(app)
+      .delete('/')
+      .expect(200, 'deleted everything', cb);
+
+      request(app)
+      .post('/')
+      .expect('X-Method-Altered', '1')
+      .expect(200, 'deleted everything', cb);
+    });
   })
 
   describe('decode querystring', function(){

From bcdeee2df510cea17ad4524cf53b9900a46d5042 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 6 Jul 2014 19:48:18 -0400
Subject: [PATCH 0375/1265] 4.5.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 765bbc1e659..5c999c70375 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.5.1 / 2014-07-06
+==================
 
  * fix routing regression when altering `req.method`
 
diff --git a/package.json b/package.json
index e0048d225e7..9dc608fb23b 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.5.0",
+  "version": "4.5.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From ef497fdae413f85362d319436cf113edf6320677 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 7 Jul 2014 23:06:48 -0400
Subject: [PATCH 0376/1265] tests: add mounting to strict routing test

---
 test/app.router.js | 82 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)

diff --git a/test/app.router.js b/test/app.router.js
index f785069050f..b7422b5664f 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -368,6 +368,46 @@ describe('app.router', function(){
         .expect('tj', done);
       })
 
+      it('should pass-though middleware', function(done){
+        var app = express();
+
+        app.enable('strict routing');
+
+        app.use(function (req, res, next) {
+          res.setHeader('x-middleware', 'true');
+          next();
+        });
+
+        app.get('/user/', function(req, res){
+          res.end('tj');
+        });
+
+        request(app)
+        .get('/user/')
+        .expect('x-middleware', 'true')
+        .expect(200, 'tj', done);
+      })
+
+      it('should pass-though mounted middleware', function(done){
+        var app = express();
+
+        app.enable('strict routing');
+
+        app.use('/user/', function (req, res, next) {
+          res.setHeader('x-middleware', 'true');
+          next();
+        });
+
+        app.get('/user/test/', function(req, res){
+          res.end('tj');
+        });
+
+        request(app)
+        .get('/user/test/')
+        .expect('x-middleware', 'true')
+        .expect(200, 'tj', done);
+      })
+
       it('should match no slashes', function(done){
         var app = express();
 
@@ -382,6 +422,48 @@ describe('app.router', function(){
         .expect('tj', done);
       })
 
+      it('should match middleware when omitting the trailing slash', function(done){
+        var app = express();
+
+        app.enable('strict routing');
+
+        app.use('/user/', function(req, res){
+          res.end('tj');
+        });
+
+        request(app)
+        .get('/user')
+        .expect(200, 'tj', done);
+      })
+
+      it('should match middleware', function(done){
+        var app = express();
+
+        app.enable('strict routing');
+
+        app.use('/user', function(req, res){
+          res.end('tj');
+        });
+
+        request(app)
+        .get('/user')
+        .expect(200, 'tj', done);
+      })
+
+      it('should match middleware when adding the trailing slash', function(done){
+        var app = express();
+
+        app.enable('strict routing');
+
+        app.use('/user', function(req, res){
+          res.end('tj');
+        });
+
+        request(app)
+        .get('/user/')
+        .expect(200, 'tj', done);
+      })
+
       it('should fail when omitting the trailing slash', function(done){
         var app = express();
 

From 968b00c3d76995f09a274530e0a83321db45aae1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 8 Jul 2014 19:40:22 -0400
Subject: [PATCH 0377/1265] tests: add missing FQDN router URL tests

---
 test/Router.js | 105 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 105 insertions(+)

diff --git a/test/Router.js b/test/Router.js
index cbc8acbc525..e42d9520108 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -174,6 +174,111 @@ describe('Router', function(){
     });
   })
 
+  describe('FQDN', function () {
+    it('should not obscure FQDNs', function (done) {
+      var request = { hit: 0, url: 'http://example.com/foo', method: 'GET' };
+      var router = new Router();
+
+      router.use(function (req, res, next) {
+        assert.equal(req.hit++, 0);
+        assert.equal(req.url, 'http://example.com/foo');
+        next();
+      });
+
+      router.handle(request, {}, function (err) {
+        if (err) return done(err);
+        assert.equal(request.hit, 1);
+        done();
+      });
+    });
+
+    it('should ignore FQDN in search', function (done) {
+      var request = { hit: 0, url: '/proxy?url=http://example.com/blog/post/1', method: 'GET' };
+      var router = new Router();
+
+      router.use('/proxy', function (req, res, next) {
+        assert.equal(req.hit++, 0);
+        assert.equal(req.url, '/?url=http://example.com/blog/post/1');
+        next();
+      });
+
+      router.handle(request, {}, function (err) {
+        if (err) return done(err);
+        assert.equal(request.hit, 1);
+        done();
+      });
+    });
+
+    it('should adjust FQDN req.url', function (done) {
+      var request = { hit: 0, url: 'http://example.com/blog/post/1', method: 'GET' };
+      var router = new Router();
+
+      router.use('/blog', function (req, res, next) {
+        assert.equal(req.hit++, 0);
+        assert.equal(req.url, 'http://example.com/post/1');
+        next();
+      });
+
+      router.handle(request, {}, function (err) {
+        if (err) return done(err);
+        assert.equal(request.hit, 1);
+        done();
+      });
+    });
+
+    it('should adjust FQDN req.url with multiple handlers', function (done) {
+      var request = { hit: 0, url: 'http://example.com/blog/post/1', method: 'GET' };
+      var router = new Router();
+
+      router.use(function (req, res, next) {
+        assert.equal(req.hit++, 0);
+        assert.equal(req.url, 'http://example.com/blog/post/1');
+        next();
+      });
+
+      router.use('/blog', function (req, res, next) {
+        assert.equal(req.hit++, 1);
+        assert.equal(req.url, 'http://example.com/post/1');
+        next();
+      });
+
+      router.handle(request, {}, function (err) {
+        if (err) return done(err);
+        assert.equal(request.hit, 2);
+        done();
+      });
+    });
+
+    it('should adjust FQDN req.url with multiple routed handlers', function (done) {
+      var request = { hit: 0, url: 'http://example.com/blog/post/1', method: 'GET' };
+      var router = new Router();
+
+      router.use('/blog', function (req, res, next) {
+        assert.equal(req.hit++, 0);
+        assert.equal(req.url, 'http://example.com/post/1');
+        next();
+      });
+
+      router.use('/blog', function (req, res, next) {
+        assert.equal(req.hit++, 1);
+        assert.equal(req.url, 'http://example.com/post/1');
+        next();
+      });
+
+      router.use(function (req, res, next) {
+        assert.equal(req.hit++, 2);
+        assert.equal(req.url, 'http://example.com/blog/post/1');
+        next();
+      });
+
+      router.handle(request, {}, function (err) {
+        if (err) return done(err);
+        assert.equal(request.hit, 3);
+        done();
+      });
+    });
+  })
+
   describe('.all', function() {
     it('should support using .all to capture all http verbs', function(done){
       var router = new Router();

From 4fe1073f105dbc3b8aa00adf33aa5a19f248117c Mon Sep 17 00:00:00 2001
From: Ryan Seys <ryan@ryanseys.com>
Date: Tue, 8 Jul 2014 21:47:11 -0700
Subject: [PATCH 0378/1265] docs: fix nodejs.org link

closes #2222
---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 18fbcc51c69..6940c71efdd 100644
--- a/Readme.md
+++ b/Readme.md
@@ -1,6 +1,6 @@
 [![Express Logo](https://i.cloudup.com/zfY6lL7eFa-3000x3000.png)](https://expressjs.com/)
 
-  Fast, unopinionated, minimalist web framework for [node](https://nodejs.org).
+  Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
   [![NPM Version](https://badge.fury.io/js/express.svg)](https://badge.fury.io/js/express)
   [![Build Status](https://travis-ci.org/visionmedia/express.svg?branch=master)](https://travis-ci.org/visionmedia/express)

From 7bcf5f508535a974090c370ec742733d79bcd1c9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Jul 2014 22:56:31 -0400
Subject: [PATCH 0379/1265] deps: connect@2.23.0

---
 History.md   | 10 ++++++++++
 package.json |  2 +-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 322cdaf971f..2e901781a48 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,13 @@
+3.x
+===
+
+ * deps: connect@2.23.0
+   - deps: debug@1.0.3
+   - deps: express-session@~1.6.4
+   - deps: method-override@~2.1.0
+   - deps: parseurl@~1.1.3
+   - deps: serve-static@~1.3.1
+
 3.13.0 / 2014-07-03
 ===================
 
diff --git a/package.json b/package.json
index 1c0a31d02c8..20f836753cf 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "basic-auth": "0.0.1",
     "buffer-crc32": "0.2.3",
-    "connect": "2.22.0",
+    "connect": "2.23.0",
     "commander": "1.3.2",
     "debug": "1.0.2",
     "depd": "0.3.0",

From 7c1f90bf1657e68deddad0864216396981d4fb15 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Jul 2014 22:57:08 -0400
Subject: [PATCH 0380/1265] deps: istanbul@0.3.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 20f836753cf..61704a41e5e 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "merge-descriptors": "0.0.2"
   },
   "devDependencies": {
-    "istanbul": "0.2.12",
+    "istanbul": "0.3.0",
     "mocha": "~1.20.0",
     "should": "~4.0.0",
     "ejs": "~1.0.0",

From 3c87a6aedefda6ac6101c929b37155c716461773 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Jul 2014 23:02:24 -0400
Subject: [PATCH 0381/1265] deps: debug@1.0.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 2e901781a48..3ec904ad087 100644
--- a/History.md
+++ b/History.md
@@ -7,6 +7,8 @@
    - deps: method-override@~2.1.0
    - deps: parseurl@~1.1.3
    - deps: serve-static@~1.3.1
+  * deps: debug@1.0.3
+    - Add support for multiple wildcards in namespaces
 
 3.13.0 / 2014-07-03
 ===================
diff --git a/package.json b/package.json
index 61704a41e5e..128537a73a3 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
     "buffer-crc32": "0.2.3",
     "connect": "2.23.0",
     "commander": "1.3.2",
-    "debug": "1.0.2",
+    "debug": "1.0.3",
     "depd": "0.3.0",
     "escape-html": "1.0.1",
     "media-typer": "0.2.0",

From 577cc1d1a065e3a36816de067e328d4486135fbc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Jul 2014 23:03:26 -0400
Subject: [PATCH 0382/1265] deps: parseurl@~1.1.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 3ec904ad087..702875f527e 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,8 @@
    - deps: serve-static@~1.3.1
   * deps: debug@1.0.3
     - Add support for multiple wildcards in namespaces
+  * deps: parseurl@~1.1.3
+    - faster parsing of href-only URLs
 
 3.13.0 / 2014-07-03
 ===================
diff --git a/package.json b/package.json
index 128537a73a3..434b374c815 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,7 @@
     "media-typer": "0.2.0",
     "methods": "1.0.1",
     "mkdirp": "0.5.0",
-    "parseurl": "1.0.1",
+    "parseurl": "~1.1.3",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.5.0",

From 25ef8425d22347448fb5c85ad47775be6bea0d80 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Jul 2014 23:06:15 -0400
Subject: [PATCH 0383/1265] deps: methods@1.1.0

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 702875f527e..1153237e23a 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,8 @@
    - deps: serve-static@~1.3.1
   * deps: debug@1.0.3
     - Add support for multiple wildcards in namespaces
+  * deps: methods@1.1.0
+    - add `CONNECT`
   * deps: parseurl@~1.1.3
     - faster parsing of href-only URLs
 
diff --git a/package.json b/package.json
index 434b374c815..2b8093cff0b 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "depd": "0.3.0",
     "escape-html": "1.0.1",
     "media-typer": "0.2.0",
-    "methods": "1.0.1",
+    "methods": "1.1.0",
     "mkdirp": "0.5.0",
     "parseurl": "~1.1.3",
     "proxy-addr": "1.0.1",

From cf8005e63fb2d1d3ade4bc503034126dcdf6e227 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Jul 2014 23:07:45 -0400
Subject: [PATCH 0384/1265] deps: basic-auth@1.0.0

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 1153237e23a..a00fcd67a6c 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,9 @@
 3.x
 ===
 
+ * deps: basic-auth@1.0.0
+   - support empty password
+   - support empty username
  * deps: connect@2.23.0
    - deps: debug@1.0.3
    - deps: express-session@~1.6.4
diff --git a/package.json b/package.json
index 2b8093cff0b..3d66e6ec909 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
   "repository": "visionmedia/express",
   "license": "MIT",
   "dependencies": {
-    "basic-auth": "0.0.1",
+    "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
     "connect": "2.23.0",
     "commander": "1.3.2",

From 544c6665f54b1ebdbc54769ba78721c4e13acdf7 Mon Sep 17 00:00:00 2001
From: Yad Smood <y.s.inside@gmail.com>
Date: Thu, 10 Jul 2014 11:44:47 +0800
Subject: [PATCH 0385/1265] Fix res.send(status, num) to send num as json

fixes #2226
---
 History.md       |  1 +
 lib/response.js  | 15 +++++++++------
 test/res.send.js | 15 +++++++++++++++
 3 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/History.md b/History.md
index a00fcd67a6c..a94295825ca 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 3.x
 ===
 
+ * fix `res.send(status, num)` to send `num` as json (not error)
  * deps: basic-auth@1.0.0
    - support empty password
    - support empty username
diff --git a/lib/response.js b/lib/response.js
index 339bf0c483a..ebdb1a8f924 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -103,13 +103,15 @@ res.send = function(body){
     }
   }
 
+  // disambiguate res.send(status) and res.send(status, num)
+  if (typeof body === 'number' && arguments.length === 1) {
+    // res.send(status) will set status message as text string
+    this.get('Content-Type') || this.type('txt');
+    this.statusCode = body;
+    body = http.STATUS_CODES[body];
+  }
+
   switch (typeof body) {
-    // response status
-    case 'number':
-      this.get('Content-Type') || this.type('txt');
-      this.statusCode = body;
-      body = http.STATUS_CODES[body];
-      break;
     // string defaulting to html
     case 'string':
       if (!this.get('Content-Type')) {
@@ -118,6 +120,7 @@ res.send = function(body){
       }
       break;
     case 'boolean':
+    case 'number':
     case 'object':
       if (null == body) {
         body = '';
diff --git a/test/res.send.js b/test/res.send.js
index ec9919f2c28..a73353c84b2 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -77,6 +77,21 @@ describe('res', function(){
     })
   })
 
+  describe('.send(code, number)', function(){
+    it('should send number as json', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.send(200, 0.123);
+      });
+
+      request(app)
+      .get('/')
+      .expect('Content-Type', 'application/json; charset=utf-8')
+      .expect(200, '0.123', done);
+    })
+  })
+
   describe('.send(String)', function(){
     it('should send as html', function(done){
       var app = express();

From 5d03d0eac8cb64a24caba2b60b157263e21f6fdf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Jul 2014 01:15:40 -0400
Subject: [PATCH 0386/1265] Deprecate res.redirect(url, status)

---
 History.md      | 1 +
 lib/response.js | 4 +---
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index a94295825ca..fdd95b55188 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 3.x
 ===
 
+ * deprecate `res.redirect(url, status)` -- use `res.redirect(status, url)` instead
  * fix `res.send(status, num)` to send `num` as json (not error)
  * deps: basic-auth@1.0.0
    - support empty password
diff --git a/lib/response.js b/lib/response.js
index ebdb1a8f924..db8c85db204 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -707,11 +707,8 @@ res.location = function(url){
  *    res.redirect('/foo/bar');
  *    res.redirect('http://example.com');
  *    res.redirect(301, 'http://example.com');
- *    res.redirect('http://example.com', 301);
  *    res.redirect('../login'); // /blog/post/1 -> /blog/login
  *
- * @param {String} url
- * @param {Number} code
  * @api public
  */
 
@@ -726,6 +723,7 @@ res.redirect = function(url){
       status = url;
       url = arguments[1];
     } else {
+      deprecate('res.redirect(ur, status): Use res.redirect(status, url) instead');
       status = arguments[1];
     }
   }

From f684a64df71a08c0caf2371aa305411df690a10f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 11 Jul 2014 00:05:33 -0400
Subject: [PATCH 0387/1265] Add explicit "Rosetta Flash JSONP abuse" protection

---
 History.md        |  2 ++
 lib/response.js   | 15 ++++++++---
 test/res.jsonp.js | 65 ++++++++++++++++++++++++-----------------------
 3 files changed, 46 insertions(+), 36 deletions(-)

diff --git a/History.md b/History.md
index fdd95b55188..9a99efda53b 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,8 @@
 3.x
 ===
 
+ * add explicit "Rosetta Flash JSONP abuse" protection
+   - previous versions are not vulnerable; this is just explicit protection
  * deprecate `res.redirect(url, status)` -- use `res.redirect(status, url)` instead
  * fix `res.send(status, num)` to send `num` as json (not error)
  * deps: basic-auth@1.0.0
diff --git a/lib/response.js b/lib/response.js
index db8c85db204..345597b80f2 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -266,8 +266,11 @@ res.jsonp = function(obj){
   var callback = this.req.query[app.get('jsonp callback name')];
 
   // content-type
-  this.charset = this.charset || 'utf-8';
-  this.get('Content-Type') || this.set('Content-Type', 'application/json');
+  if (!this.get('Content-Type')) {
+    this.charset = 'utf-8';
+    this.set('X-Content-Type-Options', 'nosniff');
+    this.set('Content-Type', 'application/json');
+  }
 
   // fixup callback
   if (Array.isArray(callback)) {
@@ -275,10 +278,14 @@ res.jsonp = function(obj){
   }
 
   // jsonp
-  if (callback && 'string' === typeof callback) {
+  if (typeof callback === 'string' && callback.length !== 0) {
+    this.charset = 'utf-8';
+    this.set('X-Content-Type-Options', 'nosniff');
     this.set('Content-Type', 'text/javascript');
     var cb = callback.replace(/[^\[\]\w$.]/g, '');
-    body = 'typeof ' + cb + ' === \'function\' && ' + cb + '(' + body + ');';
+
+    // the /**/ is a specific security mitigation for "Rosetta Flash JSONP abuse"
+    body = '/**/ typeof ' + cb + ' === \'function\' && ' + cb + '(' + body + ');';
   }
 
   return this.send(body);
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 3637a23ed52..45acb906422 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -14,11 +14,8 @@ describe('res', function(){
 
       request(app)
       .get('/?callback=something')
-      .end(function(err, res){
-        res.headers.should.have.property('content-type', 'text/javascript; charset=utf-8');
-        res.text.should.equal('typeof something === \'function\' && something({"count":1});');
-        done();
-      })
+      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect(200, /something\(\{"count":1\}\);/, done);
     })
 
     it('should use first callback parameter with jsonp', function(done){
@@ -29,12 +26,9 @@ describe('res', function(){
       });
 
       request(app)
-          .get('/?callback=something&callback=somethingelse')
-          .end(function(err, res){
-            res.headers.should.have.property('content-type', 'text/javascript; charset=utf-8');
-            res.text.should.equal('typeof something === \'function\' && something({"count":1});');
-            done();
-          })
+      .get('/?callback=something&callback=somethingelse')
+      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect(200, /something\(\{"count":1\}\);/, done);
     })
 
     it('should ignore object callback parameter with jsonp', function(done){
@@ -61,11 +55,8 @@ describe('res', function(){
 
       request(app)
       .get('/?clb=something')
-      .end(function(err, res){
-        res.headers.should.have.property('content-type', 'text/javascript; charset=utf-8');
-        res.text.should.equal('typeof something === \'function\' && something({"count":1});');
-        done();
-      })
+      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect(200, /something\(\{"count":1\}\);/, done);
     })
 
     it('should allow []', function(done){
@@ -77,11 +68,8 @@ describe('res', function(){
 
       request(app)
       .get('/?callback=callbacks[123]')
-      .end(function(err, res){
-        res.headers.should.have.property('content-type', 'text/javascript; charset=utf-8');
-        res.text.should.equal('typeof callbacks[123] === \'function\' && callbacks[123]({"count":1});');
-        done();
-      })
+      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect(200, /callbacks\[123\]\(\{"count":1\}\);/, done);
     })
 
     it('should disallow arbitrary js', function(done){
@@ -93,11 +81,8 @@ describe('res', function(){
 
       request(app)
       .get('/?callback=foo;bar()')
-      .end(function(err, res){
-        res.headers.should.have.property('content-type', 'text/javascript; charset=utf-8');
-        res.text.should.equal('typeof foobar === \'function\' && foobar({});');
-        done();
-      })
+      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect(200, /foobar\(\{\}\);/, done);
     })
 
     it('should escape utf whitespace', function(done){
@@ -109,13 +94,24 @@ describe('res', function(){
 
       request(app)
       .get('/?callback=foo')
-      .end(function(err, res){
-        res.headers.should.have.property('content-type', 'text/javascript; charset=utf-8');
-        res.text.should.equal('typeof foo === \'function\' && foo({"str":"\\u2028 \\u2029 woot"});');
-        done();
-      });
+      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect(200, /foo\(\{"str":"\\u2028 \\u2029 woot"\}\);/, done);
     });
 
+    it('should include security header and prologue', function (done) {
+      var app = express();
+
+      app.use(function(req, res){
+        res.jsonp({ count: 1 });
+      });
+
+      request(app)
+      .get('/?callback=something')
+      .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect('X-Content-Type-Options', 'nosniff')
+      .expect(200, /^\/\*\*\//, done);
+    })
+
     it('should not override previous Content-Types with no callback', function(done){
       var app = express();
 
@@ -127,7 +123,11 @@ describe('res', function(){
       request(app)
       .get('/')
       .expect('Content-Type', 'application/vnd.example+json; charset=utf-8')
-      .expect(200, '{"hello":"world"}', done);
+      .expect(200, '{"hello":"world"}', function (err, res) {
+        if (err) return done(err);
+        res.headers.should.not.have.property('x-content-type-options');
+        done();
+      });
     })
 
     it('should override previous Content-Types with callback', function(done){
@@ -141,6 +141,7 @@ describe('res', function(){
       request(app)
       .get('/?callback=cb')
       .expect('Content-Type', 'text/javascript; charset=utf-8')
+      .expect('X-Content-Type-Options', 'nosniff')
       .expect(200, /cb\(\{"hello":"world"\}\);$/, done);
     })
 

From b2382a73365ecf1d411b7bf57e589bc6ccc073c7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 11 Jul 2014 00:20:11 -0400
Subject: [PATCH 0388/1265] Remove unnecessary escaping in res.jsonp

---
 History.md        |  1 +
 lib/response.js   | 16 +++++++++++-----
 test/res.jsonp.js | 13 +++++++++++++
 3 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index 9a99efda53b..bc318420cd1 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@
    - previous versions are not vulnerable; this is just explicit protection
  * deprecate `res.redirect(url, status)` -- use `res.redirect(status, url)` instead
  * fix `res.send(status, num)` to send `num` as json (not error)
+ * remove unnecessary escaping when `res.jsonp` returns JSON response
  * deps: basic-auth@1.0.0
    - support empty password
    - support empty username
diff --git a/lib/response.js b/lib/response.js
index 345597b80f2..2e4b35cb747 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -260,9 +260,7 @@ res.jsonp = function(obj){
   var app = this.app;
   var replacer = app.get('json replacer');
   var spaces = app.get('json spaces');
-  var body = JSON.stringify(obj, replacer, spaces)
-    .replace(/\u2028/g, '\\u2028')
-    .replace(/\u2029/g, '\\u2029');
+  var body = JSON.stringify(obj, replacer, spaces);
   var callback = this.req.query[app.get('jsonp callback name')];
 
   // content-type
@@ -282,10 +280,18 @@ res.jsonp = function(obj){
     this.charset = 'utf-8';
     this.set('X-Content-Type-Options', 'nosniff');
     this.set('Content-Type', 'text/javascript');
-    var cb = callback.replace(/[^\[\]\w$.]/g, '');
+
+    // restrict callback charset
+    callback = callback.replace(/[^\[\]\w$.]/g, '');
+
+    // replace chars not allowed in JavaScript that are in JSON
+    body = body
+      .replace(/\u2028/g, '\\u2028')
+      .replace(/\u2029/g, '\\u2029');
 
     // the /**/ is a specific security mitigation for "Rosetta Flash JSONP abuse"
-    body = '/**/ typeof ' + cb + ' === \'function\' && ' + cb + '(' + body + ');';
+    // the typeof check is just to reduce client error noise
+    body = '/**/ typeof ' + callback + ' === \'function\' && ' + callback + '(' + body + ');';
   }
 
   return this.send(body);
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 45acb906422..2c5e245fbc0 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -98,6 +98,19 @@ describe('res', function(){
       .expect(200, /foo\(\{"str":"\\u2028 \\u2029 woot"\}\);/, done);
     });
 
+    it('should not escape utf whitespace for json fallback', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.jsonp({ str: '\u2028 \u2029 woot' });
+      });
+
+      request(app)
+      .get('/')
+      .expect('Content-Type', 'application/json; charset=utf-8')
+      .expect(200, '{"str":"\u2028 \u2029 woot"}', done);
+    });
+
     it('should include security header and prologue', function (done) {
       var app = express();
 

From ec5b9f5c618d4f73fb3c211ed1936c89911acca3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 11 Jul 2014 09:35:20 -0400
Subject: [PATCH 0389/1265] tests: add test for error handler in route

closes #2228
---
 test/app.router.js | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/test/app.router.js b/test/app.router.js
index b7422b5664f..c0e13fdb75c 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -836,6 +836,32 @@ describe('app.router', function(){
         done();
       })
     })
+
+    it('should call handler in same route, if exists', function(done){
+      var app = express();
+
+      function fn1(req, res, next) {
+        next(new Error('boom!'));
+      }
+
+      function fn2(req, res, next) {
+        res.send('foo here');
+      }
+
+      function fn3(err, req, res, next) {
+        res.send('route go ' + err.message);
+      }
+
+      app.get('/foo', fn1, fn2, fn3);
+
+      app.use(function (err, req, res, next) {
+        res.end('error!');
+      })
+
+      request(app)
+      .get('/foo')
+      .expect('route go boom!', done)
+    })
   })
 
   it('should allow rewriting of the url', function(done){

From 916c53737d97b605385f9b5235a3a890f864c6bb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 11 Jul 2014 13:11:31 -0400
Subject: [PATCH 0390/1265] 3.14.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index bc318420cd1..7bd01d44c65 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.14.0 / 2014-07-11
+===================
 
  * add explicit "Rosetta Flash JSONP abuse" protection
    - previous versions are not vulnerable; this is just explicit protection
diff --git a/package.json b/package.json
index 3d66e6ec909..12780bd7552 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.13.0",
+  "version": "3.14.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 1c3bd36be62c16dc1792a6f38bcf12e7f582f74f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 5 Jul 2014 13:23:07 -0400
Subject: [PATCH 0391/1265] Support non-string path in app.use(path, fn)

fixes #2207
---
 History.md          |  4 ++++
 lib/application.js  | 15 +++++++++------
 lib/router/index.js | 21 ++++++++-------------
 package.json        |  4 ++--
 test/app.use.js     | 46 +++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 69 insertions(+), 21 deletions(-)

diff --git a/History.md b/History.md
index 2ce2b03eefb..fcbbc65dddc 100644
--- a/History.md
+++ b/History.md
@@ -6,12 +6,16 @@ unreleased
   * deprecate `res.redirect(url, status)` -- use `res.redirect(status, url)` instead
   * fix `res.send(status, num)` to send `num` as json (not error)
   * remove unnecessary escaping when `res.jsonp` returns JSON response
+  * support non-string `path` in `app.use(path, fn)`
+    - supports array of paths
+    - supports `RegExp`
   * deps: debug@1.0.3
     - Add support for multiple wildcards in namespaces
   * deps: methods@1.1.0
     - add `CONNECT`
   * deps: parseurl@~1.1.3
     - faster parsing of href-only URLs
+  * deps: path-to-regexp@0.1.3
 
 4.5.1 / 2014-07-06
 ==================
diff --git a/lib/application.js b/lib/application.js
index c755b1da8a9..5c11196ee25 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -147,19 +147,22 @@ app.handle = function(req, res, done) {
  * @api public
  */
 
-app.use = function(route, fn){
+app.use = function use(path, fn){
   var mount_app;
 
-  // default route to '/'
-  if ('string' != typeof route) fn = route, route = '/';
+  // default path to '/'
+  if (arguments.length < 2) {
+    fn = path;
+    path = '/';
+  }
 
   // express app
   if (fn.handle && fn.set) mount_app = fn;
 
   // restore .app property on req and res
   if (mount_app) {
-    debug('.use app under %s', route);
-    mount_app.mountpath = route;
+    debug('.use app under %s', path);
+    mount_app.mountpath = path;
     fn = function(req, res, next) {
       var orig = req.app;
       mount_app.handle(req, res, function(err) {
@@ -171,7 +174,7 @@ app.use = function(route, fn){
   }
 
   this.lazyrouter();
-  this._router.use(route, fn);
+  this._router.use(path, fn);
 
   // mounted an app
   if (mount_app) {
diff --git a/lib/router/index.js b/lib/router/index.js
index c08b39cd935..b0fe5428e1c 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -385,11 +385,11 @@ proto.process_params = function(layer, called, req, res, done) {
  * @api public
  */
 
-proto.use = function(route, fn){
-  // default route to '/'
-  if ('string' != typeof route) {
-    fn = route;
-    route = '/';
+proto.use = function(path, fn){
+  // default path to '/'
+  if (arguments.length < 2) {
+    fn = path;
+    path = '/';
   }
 
   if (typeof fn !== 'function') {
@@ -398,19 +398,14 @@ proto.use = function(route, fn){
     throw new Error(msg);
   }
 
-  // strip trailing slash
-  if ('/' == route[route.length - 1]) {
-    route = route.slice(0, -1);
-  }
-
-  var layer = new Layer(route, {
+  var layer = new Layer(path, {
     sensitive: this.caseSensitive,
-    strict: this.strict,
+    strict: false,
     end: false
   }, fn);
 
   // add the middleware
-  debug('use %s %s', route || '/', fn.name || 'anonymous');
+  debug('use %s %s', path || '/', fn.name || 'anonymous');
 
   this.stack.push(layer);
   return this;
diff --git a/package.json b/package.json
index e5d1ac2afb2..3067eec54f5 100644
--- a/package.json
+++ b/package.json
@@ -34,6 +34,7 @@
     "media-typer": "0.2.0",
     "methods": "1.1.0",
     "parseurl": "~1.1.3",
+    "path-to-regexp": "0.1.3",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.5.0",
@@ -44,9 +45,8 @@
     "fresh": "0.2.2",
     "cookie-signature": "1.0.4",
     "merge-descriptors": "0.0.2",
-    "utils-merge": "1.0.0",
     "qs": "0.6.6",
-    "path-to-regexp": "0.1.2"
+    "utils-merge": "1.0.0"
   },
   "devDependencies": {
     "after": "0.8.1",
diff --git a/test/app.use.js b/test/app.use.js
index dda16f4dd22..7ef6896c799 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -163,5 +163,51 @@ describe('app', function(){
       .post('/foo/bar')
       .expect(200, 'saw POST /bar', cb);
     })
+
+    it('should support array of paths', function (done) {
+      var app = express();
+      var cb = after(3, done);
+
+      app.use(['/foo/', '/bar'], function (req, res) {
+        res.send('saw ' + req.method + ' ' + req.url + ' through ' + req.originalUrl);
+      });
+
+      request(app)
+      .get('/')
+      .expect(404, cb);
+
+      request(app)
+      .get('/foo')
+      .expect(200, 'saw GET / through /foo', cb);
+
+      request(app)
+      .get('/bar')
+      .expect(200, 'saw GET / through /bar', cb);
+    })
+
+    it('should support regexp path', function (done) {
+      var app = express();
+      var cb = after(4, done);
+
+      app.use(/^\/[a-z]oo/, function (req, res) {
+        res.send('saw ' + req.method + ' ' + req.url + ' through ' + req.originalUrl);
+      });
+
+      request(app)
+      .get('/')
+      .expect(404, cb);
+
+      request(app)
+      .get('/foo')
+      .expect(200, 'saw GET / through /foo', cb);
+
+      request(app)
+      .get('/zoo/bear')
+      .expect(200, 'saw GET /bear through /zoo/bear', cb);
+
+      request(app)
+      .get('/get/zoo')
+      .expect(404, cb);
+    })
   })
 })

From 996d31926354d8c73d2ce314c0595367f8305451 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 7 Jul 2014 22:50:05 -0400
Subject: [PATCH 0392/1265] router: fix optimization on router exit

---
 History.md          |  1 +
 lib/router/index.js | 12 +++++++++---
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index fcbbc65dddc..fc04680449a 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,7 @@ unreleased
   * support non-string `path` in `app.use(path, fn)`
     - supports array of paths
     - supports `RegExp`
+  * router: fix optimization on router exit
   * deps: debug@1.0.3
     - Add support for multiple wildcards in namespaces
   * deps: methods@1.1.0
diff --git a/lib/router/index.js b/lib/router/index.js
index b0fe5428e1c..c88ce9310c9 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -443,7 +443,7 @@ proto.route = function(path){
 methods.concat('all').forEach(function(method){
   proto[method] = function(path){
     var route = this.route(path)
-    route[method].apply(route, [].slice.call(arguments, 1));
+    route[method].apply(route, slice.call(arguments, 1));
     return this;
   };
 });
@@ -506,8 +506,14 @@ function restore(fn, obj) {
 
 // wrap a function
 function wrap(old, fn) {
-  return function () {
-    var args = [old].concat(slice.call(arguments));
+  return function proxy() {
+    var args = new Array(arguments.length + 1);
+
+    args[0] = old;
+    for (var i = 0, len = arguments.length; i < len; i++) {
+      args[i + 1] = arguments[i];
+    }
+
     fn.apply(this, args);
   };
 }

From 8dc67af6060a145f861f5300c4a3b52fc2bf76a6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 8 Jul 2014 00:16:39 -0400
Subject: [PATCH 0393/1265] router: speed up standard app.use(fn)

---
 History.md          |  1 +
 lib/router/index.js | 46 ++++++++++++++++++----------------
 lib/router/layer.js | 37 +++++++++++++++++++++------
 lib/router/match.js | 61 +++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 115 insertions(+), 30 deletions(-)
 create mode 100644 lib/router/match.js

diff --git a/History.md b/History.md
index fc04680449a..beeab59be04 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,7 @@ unreleased
     - supports array of paths
     - supports `RegExp`
   * router: fix optimization on router exit
+  * router: speed up standard `app.use(fn)`
   * deps: debug@1.0.3
     - Add support for multiple wildcards in namespaces
   * deps: methods@1.1.0
diff --git a/lib/router/index.js b/lib/router/index.js
index c88ce9310c9..81f712ea36c 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -149,6 +149,10 @@ proto.handle = function(req, res, done) {
     });
   }
 
+  // setup basic req values
+  req.baseUrl = parentUrl;
+  req.originalUrl = req.originalUrl || req.url;
+
   next();
 
   function next(err) {
@@ -159,23 +163,23 @@ proto.handle = function(req, res, done) {
     var layer = stack[idx++];
     var layerPath;
 
-    if (!layer) {
-      return done(err);
-    }
-
     if (slashAdded) {
       req.url = req.url.substr(1);
       slashAdded = false;
     }
 
-    req.baseUrl = parentUrl;
-    req.url = protohost + removed + req.url.substr(protohost.length);
-    req.originalUrl = req.originalUrl || req.url;
-    removed = '';
+    if (removed.length !== 0) {
+      req.baseUrl = parentUrl;
+      req.url = protohost + removed + req.url.substr(protohost.length);
+      removed = '';
+    }
+
+    if (!layer) {
+      return done(err);
+    }
 
     try {
       var path = parseUrl(req).pathname;
-      if (undefined == path) path = '/';
 
       if (!layer.match(path)) return next(err);
 
@@ -235,23 +239,21 @@ proto.handle = function(req, res, done) {
 
       // Trim off the part of the url that matches the route
       // middleware (.use stuff) needs to have the path stripped
-      removed = layerPath;
-      if (removed.length) {
+      if (layerPath.length !== 0) {
         debug('trim prefix (%s) from url %s', layerPath, req.url);
+        removed = layerPath;
         req.url = protohost + req.url.substr(protohost.length + removed.length);
-      }
 
-      // Ensure leading slash
-      if (!fqdn && req.url[0] !== '/') {
-        req.url = '/' + req.url;
-        slashAdded = true;
-      }
+        // Ensure leading slash
+        if (!fqdn && req.url[0] !== '/') {
+          req.url = '/' + req.url;
+          slashAdded = true;
+        }
 
-      // Setup base URL (no trailing slash)
-      if (removed.length && removed.substr(-1) === '/') {
-        req.baseUrl = parentUrl + removed.substring(0, removed.length - 1);
-      } else {
-        req.baseUrl = parentUrl + removed;
+        // Setup base URL (no trailing slash)
+        req.baseUrl = parentUrl + (removed[removed.length - 1] === '/'
+          ? removed.substring(0, removed.length - 1)
+          : removed);
       }
 
       debug('%s %s : %s', layer.handle.name || 'anonymous', layerPath, req.originalUrl);
diff --git a/lib/router/layer.js b/lib/router/layer.js
index 80625fb4e16..4d02ee076ac 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -18,8 +18,15 @@ function Layer(path, options, fn) {
 
   debug('new %s', path);
   options = options || {};
-  this.regexp = pathRegexp(path, this.keys = [], options);
+
   this.handle = fn;
+  this.params = undefined;
+  this.path = undefined;
+  this.regexp = pathRegexp(path, this.keys = [], options);
+
+  if (path === '/' && options.end === false) {
+    this.regexp.fast_slash = true;
+  }
 }
 
 /**
@@ -31,18 +38,32 @@ function Layer(path, options, fn) {
  * @api private
  */
 
-Layer.prototype.match = function(path){
-  var keys = this.keys;
-  var params = this.params = {};
+Layer.prototype.match = function match(path) {
+  if (this.regexp.fast_slash) {
+    // fast path non-ending match for / (everything matches)
+    this.params = {};
+    this.path = '';
+    return true;
+  }
+
   var m = this.regexp.exec(path);
-  var n = 0;
-  var key;
-  var val;
 
-  if (!m) return false;
+  if (!m) {
+    this.params = undefined;
+    this.path = undefined;
+    return false;
+  }
 
+  // store values
+  this.params = {};
   this.path = m[0];
 
+  var keys = this.keys;
+  var params = this.params;
+  var n = 0;
+  var key;
+  var val;
+
   for (var i = 1, len = m.length; i < len; ++i) {
     key = keys[i - 1];
     val = decode_param(m[i]);
diff --git a/lib/router/match.js b/lib/router/match.js
new file mode 100644
index 00000000000..ce308c41486
--- /dev/null
+++ b/lib/router/match.js
@@ -0,0 +1,61 @@
+/**
+ * Module dependencies.
+ */
+
+var pathRegexp = require('path-to-regexp');
+
+/**
+ * Expose `Layer`.
+ */
+
+module.exports = Match;
+
+function Match(layer, path, params) {
+  this.layer = layer;
+  this.params = {};
+  this.path = path || '';
+
+  if (!params) {
+    return this;
+  }
+
+  var keys = layer.keys;
+  var n = 0;
+  var prop;
+  var key;
+  var val;
+
+  for (var i = 0; i < params.length; i++) {
+    key = keys[i];
+    val = decode_param(params[i]);
+    prop = key
+      ? key.name
+      : n++;
+
+    this.params[prop] = val;
+  }
+
+  return this;
+};
+
+/**
+ * Decode param value.
+ *
+ * @param {string} val
+ * @return {string}
+ * @api private
+ */
+
+function decode_param(val){
+  if (typeof val !== 'string') {
+    return val;
+  }
+
+  try {
+    return decodeURIComponent(val);
+  } catch (e) {
+    var err = new TypeError("Failed to decode param '" + val + "'");
+    err.status = 400;
+    throw err;
+  }
+}

From 76e8bfa1dcb7b29389c55d55d2072491edbccd91 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 8 Jul 2014 01:50:57 -0400
Subject: [PATCH 0394/1265] router: refactor location of try blocks

---
 History.md          |   1 +
 lib/router/index.js | 119 +++++++++++++++++++++++++-------------------
 lib/router/layer.js |  50 +++++++++++++++++++
 lib/router/route.js |  48 +++++++-----------
 4 files changed, 136 insertions(+), 82 deletions(-)

diff --git a/History.md b/History.md
index beeab59be04..294ca2d823e 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,7 @@ unreleased
     - supports array of paths
     - supports `RegExp`
   * router: fix optimization on router exit
+  * router: refactor location of `try` blocks
   * router: speed up standard `app.use(fn)`
   * deps: debug@1.0.3
     - Add support for multiple wildcards in namespaces
diff --git a/lib/router/index.js b/lib/router/index.js
index 81f712ea36c..b1496c7f28e 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -156,12 +156,11 @@ proto.handle = function(req, res, done) {
   next();
 
   function next(err) {
-    if (err === 'route') {
-      err = undefined;
-    }
+    var layerError = err === 'route'
+      ? null
+      : err;
 
     var layer = stack[idx++];
-    var layerPath;
 
     if (slashAdded) {
       req.url = req.url.substr(1);
@@ -175,13 +174,13 @@ proto.handle = function(req, res, done) {
     }
 
     if (!layer) {
-      return done(err);
+      return done(layerError);
     }
 
-    try {
-      var path = parseUrl(req).pathname;
-
-      if (!layer.match(path)) return next(err);
+    self.match_layer(layer, req, res, function (err, path) {
+      if (err || path === undefined) {
+        return next(layerError || err);
+      }
 
       // route object and not middleware
       var route = layer.route;
@@ -189,8 +188,8 @@ proto.handle = function(req, res, done) {
       // if final route, then we support options
       if (route) {
         // we don't run any routes with error first
-        if (err) {
-          return next(err);
+        if (layerError) {
+          return next(layerError);
         }
 
         var method = req.method;
@@ -214,63 +213,77 @@ proto.handle = function(req, res, done) {
       req.params = self.mergeParams
         ? mergeParams(layer.params, parentParams)
         : layer.params;
-      layerPath = layer.path;
+      var layerPath = layer.path;
 
       // this should be done for the layer
-      return self.process_params(layer, paramcalled, req, res, function(err) {
+      self.process_params(layer, paramcalled, req, res, function (err) {
         if (err) {
-          return next(err);
+          return next(layerError || err);
         }
 
         if (route) {
-          return layer.handle(req, res, next);
+          return layer.handle_request(req, res, next);
         }
 
-        trim_prefix();
+        trim_prefix(layer, layerError, layerPath, path);
       });
+    });
+  }
 
-    } catch (err) {
-      next(err);
+  function trim_prefix(layer, layerError, layerPath, path) {
+    var c = path[layerPath.length];
+    if (c && '/' !== c && '.' !== c) return next(layerError);
+
+     // Trim off the part of the url that matches the route
+     // middleware (.use stuff) needs to have the path stripped
+    if (layerPath.length !== 0) {
+      debug('trim prefix (%s) from url %s', layerPath, req.url);
+      removed = layerPath;
+      req.url = protohost + req.url.substr(protohost.length + removed.length);
+
+      // Ensure leading slash
+      if (!fqdn && req.url[0] !== '/') {
+        req.url = '/' + req.url;
+        slashAdded = true;
+      }
+
+      // Setup base URL (no trailing slash)
+      req.baseUrl = parentUrl + (removed[removed.length - 1] === '/'
+        ? removed.substring(0, removed.length - 1)
+        : removed);
     }
 
-    function trim_prefix() {
-      var c = path[layerPath.length];
-      if (c && '/' != c && '.' != c) return next(err);
-
-      // Trim off the part of the url that matches the route
-      // middleware (.use stuff) needs to have the path stripped
-      if (layerPath.length !== 0) {
-        debug('trim prefix (%s) from url %s', layerPath, req.url);
-        removed = layerPath;
-        req.url = protohost + req.url.substr(protohost.length + removed.length);
-
-        // Ensure leading slash
-        if (!fqdn && req.url[0] !== '/') {
-          req.url = '/' + req.url;
-          slashAdded = true;
-        }
+    debug('%s %s : %s', layer.name, layerPath, req.originalUrl);
 
-        // Setup base URL (no trailing slash)
-        req.baseUrl = parentUrl + (removed[removed.length - 1] === '/'
-          ? removed.substring(0, removed.length - 1)
-          : removed);
-      }
+    if (layerError) {
+      layer.handle_error(layerError, req, res, next);
+    } else {
+      layer.handle_request(req, res, next);
+    }
+  }
+};
 
-      debug('%s %s : %s', layer.handle.name || 'anonymous', layerPath, req.originalUrl);
-      var arity = layer.handle.length;
-      try {
-        if (err && arity === 4) {
-          layer.handle(err, req, res, next);
-        } else if (!err && arity < 4) {
-          layer.handle(req, res, next);
-        } else {
-          next(err);
-        }
-      } catch (err) {
-        next(err);
-      }
+/**
+ * Match request to a layer.
+ *
+ * @api private
+ */
+
+proto.match_layer = function match_layer(layer, req, res, done) {
+  var error = null;
+  var path;
+
+  try {
+    path = parseUrl(req).pathname;
+
+    if (!layer.match(path)) {
+      path = undefined;
     }
+  } catch (err) {
+    error = err;
   }
+
+  done(error, path);
 };
 
 /**
@@ -406,6 +419,8 @@ proto.use = function(path, fn){
     end: false
   }, fn);
 
+  layer.route = undefined;
+
   // add the middleware
   debug('use %s %s', path || '/', fn.name || 'anonymous');
 
diff --git a/lib/router/layer.js b/lib/router/layer.js
index 4d02ee076ac..e292a13a895 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -20,6 +20,7 @@ function Layer(path, options, fn) {
   options = options || {};
 
   this.handle = fn;
+  this.name = fn.name || '<anonymous>';
   this.params = undefined;
   this.path = undefined;
   this.regexp = pathRegexp(path, this.keys = [], options);
@@ -29,6 +30,55 @@ function Layer(path, options, fn) {
   }
 }
 
+/**
+ * Handle the error for the layer.
+ *
+ * @param {Error} error
+ * @param {Request} req
+ * @param {Response} res
+ * @param {function} next
+ * @api private
+ */
+
+Layer.prototype.handle_error = function handle_error(error, req, res, next) {
+  var fn = this.handle;
+
+  if (fn.length !== 4) {
+    // not a standard error handler
+    return next(error);
+  }
+
+  try {
+    fn(error, req, res, next);
+  } catch (err) {
+    next(err);
+  }
+};
+
+/**
+ * Handle the request for the layer.
+ *
+ * @param {Request} req
+ * @param {Response} res
+ * @param {function} next
+ * @api private
+ */
+
+Layer.prototype.handle_request = function handle(req, res, next) {
+  var fn = this.handle;
+
+  if (fn.length > 3) {
+    // not a standard request handler
+    return next();
+  }
+
+  try {
+    fn(req, res, next);
+  } catch (err) {
+    next(err);
+  }
+};
+
 /**
  * Check if this route matches `path`, if so
  * populate `.params`.
diff --git a/lib/router/route.js b/lib/router/route.js
index e9cf1a95abd..6b39211921a 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -3,6 +3,7 @@
  */
 
 var debug = require('debug')('express:router:route');
+var Layer = require('./layer');
 var methods = require('methods');
 var utils = require('../utils');
 
@@ -64,6 +65,7 @@ Route.prototype._options = function(){
  */
 
 Route.prototype.dispatch = function(req, res, done){
+  var idx = 0;
   var stack = this.stack;
   if (stack.length === 0) {
     return done();
@@ -76,8 +78,9 @@ Route.prototype.dispatch = function(req, res, done){
 
   req.route = this;
 
-  var idx = 0;
-  (function next_layer(err) {
+  next();
+
+  function next(err) {
     if (err && err === 'route') {
       return done();
     }
@@ -88,33 +91,15 @@ Route.prototype.dispatch = function(req, res, done){
     }
 
     if (layer.method && layer.method !== method) {
-      return next_layer(err);
+      return next(err);
     }
 
-    var arity = layer.handle.length;
     if (err) {
-      if (arity < 4) {
-        return next_layer(err);
-      }
-
-      try {
-        layer.handle(err, req, res, next_layer);
-      } catch (err) {
-        next_layer(err);
-      }
-      return;
+      layer.handle_error(err, req, res, next);
+    } else {
+      layer.handle_request(req, res, next);
     }
-
-    if (arity > 3) {
-      return next_layer();
-    }
-
-    try {
-      layer.handle(req, res, next_layer);
-    } catch (err) {
-      next_layer(err);
-    }
-  })();
+  }
 };
 
 /**
@@ -155,8 +140,11 @@ Route.prototype.all = function(){
       throw new Error(msg);
     }
 
+    var layer = Layer('/', {}, fn);
+    layer.method = undefined;
+
     self.methods._all = true;
-    self.stack.push({ handle: fn });
+    self.stack.push(layer);
   });
 
   return self;
@@ -176,11 +164,11 @@ methods.forEach(function(method){
 
       debug('%s %s', method, self.path);
 
-      if (!self.methods[method]) {
-        self.methods[method] = true;
-      }
+      var layer = Layer('/', {}, fn);
+      layer.method = method;
 
-      self.stack.push({ method: method, handle: fn });
+      self.methods[method] = true;
+      self.stack.push(layer);
     });
     return self;
   };

From a01326adac588006a823746238ca90ade63e4580 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 8 Jul 2014 01:15:31 -0400
Subject: [PATCH 0395/1265] Catch errors in multiple req.param(name, fn)
 handlers

---
 History.md          |  1 +
 lib/router/index.js | 12 ++++++------
 test/app.param.js   | 21 +++++++++++++++++++++
 3 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/History.md b/History.md
index 294ca2d823e..ebd34a5beb1 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,7 @@ unreleased
 
   * add explicit "Rosetta Flash JSONP abuse" protection
     - previous versions are not vulnerable; this is just explicit protection
+  * catch errors in multiple `req.param(name, fn)` handlers
   * deprecate `res.redirect(url, status)` -- use `res.redirect(status, url)` instead
   * fix `res.send(status, num)` to send `num` as json (not error)
   * remove unnecessary escaping when `res.jsonp` returns JSON response
diff --git a/lib/router/index.js b/lib/router/index.js
index b1496c7f28e..4b6f39af220 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -353,11 +353,7 @@ proto.process_params = function(layer, called, req, res, done) {
       value: paramVal
     };
 
-    try {
-      return paramCallback();
-    } catch (err) {
-      return done(err);
-    }
+    paramCallback();
   }
 
   // single param callbacks
@@ -376,7 +372,11 @@ proto.process_params = function(layer, called, req, res, done) {
 
     if (!fn) return param();
 
-    fn(req, res, paramCallback, paramVal, key.name);
+    try {
+      fn(req, res, paramCallback, paramVal, key.name);
+    } catch (e) {
+      paramCallback(e);
+    }
   }
 
   param();
diff --git a/test/app.param.js b/test/app.param.js
index cd5bc9b298b..858ea2d5f6a 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -237,6 +237,27 @@ describe('app', function(){
       .expect(500, done);
     })
 
+    it('should catch thrown secondary error', function(done){
+      var app = express();
+
+      app.param('id', function(req, res, next, val){
+        process.nextTick(next);
+      });
+
+      app.param('id', function(req, res, next, id){
+        throw new Error('err!');
+      });
+
+      app.get('/user/:id', function(req, res){
+        var id = req.params.id;
+        res.send('' + id);
+      });
+
+      request(app)
+      .get('/user/123')
+      .expect(500, done);
+    })
+
     it('should defer to next route', function(done){
       var app = express();
 

From 997a558a73eb49d7f3b99ceec82c4c88bd3424a0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 9 Jul 2014 20:04:24 -0400
Subject: [PATCH 0396/1265] Accept multiple callbacks to app.use()

fixes #2224
---
 History.md          |  1 +
 lib/application.js  | 48 ++++++++++++++++++++++----------------
 lib/router/index.js | 52 +++++++++++++++++++++++++----------------
 test/app.use.js     | 56 +++++++++++++++++++++++++++++++++++++++++++--
 4 files changed, 115 insertions(+), 42 deletions(-)

diff --git a/History.md b/History.md
index ebd34a5beb1..3e6ca2136b9 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * accept multiple callbacks to `app.use()`
   * add explicit "Rosetta Flash JSONP abuse" protection
     - previous versions are not vulnerable; this is just explicit protection
   * catch errors in multiple `req.param(name, fn)` handlers
diff --git a/lib/application.js b/lib/application.js
index 5c11196ee25..352d57e3041 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -147,41 +147,49 @@ app.handle = function(req, res, done) {
  * @api public
  */
 
-app.use = function use(path, fn){
+app.use = function use(path, fn) {
   var mount_app;
-
-  // default path to '/'
-  if (arguments.length < 2) {
-    fn = path;
-    path = '/';
+  var mount_path;
+
+  // check for .use(path, app) or .use(app) signature
+  if (arguments.length <= 2) {
+    mount_path = typeof path === 'string'
+      ? path
+      : '/';
+    mount_app = typeof path === 'function'
+      ? path
+      : fn;
   }
 
-  // express app
-  if (fn.handle && fn.set) mount_app = fn;
+  // setup router
+  this.lazyrouter();
+  var router = this._router;
 
-  // restore .app property on req and res
-  if (mount_app) {
-    debug('.use app under %s', path);
+  // express app
+  if (mount_app && mount_app.handle && mount_app.set) {
+    debug('.use app under %s', mount_path);
     mount_app.mountpath = path;
-    fn = function(req, res, next) {
+    mount_app.parent = this;
+
+    // restore .app property on req and res
+    router.use(mount_path, function mounted_app(req, res, next) {
       var orig = req.app;
       mount_app.handle(req, res, function(err) {
         req.__proto__ = orig.request;
         res.__proto__ = orig.response;
         next(err);
       });
-    };
-  }
-
-  this.lazyrouter();
-  this._router.use(path, fn);
+    });
 
-  // mounted an app
-  if (mount_app) {
-    mount_app.parent = this;
+    // mounted an app
     mount_app.emit('mount', this);
+
+    return this;
   }
 
+  // pass-through use
+  router.use.apply(router, arguments);
+
   return this;
 };
 
diff --git a/lib/router/index.js b/lib/router/index.js
index 4b6f39af220..4e63eb1060f 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -9,6 +9,8 @@ var mixin = require('utils-merge');
 var debug = require('debug')('express:router');
 var parseUrl = require('parseurl');
 var slice = Array.prototype.slice;
+var toString = Object.prototype.toString;
+var utils = require('../utils');
 
 /**
  * Initialize a new `Router` with the given `options`.
@@ -394,37 +396,47 @@ proto.process_params = function(layer, called, req, res, done) {
  * handlers can operate without any code changes regardless of the "prefix"
  * pathname.
  *
- * @param {String|Function} route
- * @param {Function} fn
- * @return {app} for chaining
  * @api public
  */
 
-proto.use = function(path, fn){
+proto.use = function use(fn) {
+  var offset = 0;
+  var path = '/';
+  var self = this;
+
   // default path to '/'
-  if (arguments.length < 2) {
-    fn = path;
-    path = '/';
+  if (typeof fn !== 'function') {
+    offset = 1;
+    path = fn;
   }
 
-  if (typeof fn !== 'function') {
-    var type = {}.toString.call(fn);
-    var msg = 'Router.use() requires callback functions but got a ' + type;
-    throw new Error(msg);
+  var callbacks = utils.flatten(slice.call(arguments, offset));
+
+  if (callbacks.length === 0) {
+    throw new TypeError('Router.use() requires callback function');
   }
 
-  var layer = new Layer(path, {
-    sensitive: this.caseSensitive,
-    strict: false,
-    end: false
-  }, fn);
+  callbacks.forEach(function (fn) {
+    if (typeof fn !== 'function') {
+      var type = toString.call(fn);
+      var msg = 'Router.use() requires callback function but got a ' + type;
+      throw new TypeError(msg);
+    }
 
-  layer.route = undefined;
+    // add the middleware
+    debug('use %s %s', path, fn.name || '<anonymous>');
 
-  // add the middleware
-  debug('use %s %s', path || '/', fn.name || 'anonymous');
+    var layer = new Layer(path, {
+      sensitive: self.caseSensitive,
+      strict: false,
+      end: false
+    }, fn);
+
+    layer.route = undefined;
+
+    self.stack.push(layer);
+  });
 
-  this.stack.push(layer);
   return this;
 };
 
diff --git a/test/app.use.js b/test/app.use.js
index 7ef6896c799..681a6a911de 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -16,9 +16,9 @@ describe('app', function(){
     app.use(blog);
   })
 
-  it('should reject numbers', function(){
+  it('should reject missing functions', function(){
     var app = express();
-    app.use.bind(app, 3).should.throw(/Number/);
+    app.use.bind(app, 3).should.throw(/requires callback function/);
   })
 
   describe('.use(app)', function(){
@@ -87,6 +87,32 @@ describe('app', function(){
   })
 
   describe('.use(middleware)', function(){
+    it('should accept multiple arguments', function (done) {
+      var app = express();
+
+      function fn1(req, res, next) {
+        res.setHeader('x-fn-1', 'hit');
+        next();
+      }
+
+      function fn2(req, res, next) {
+        res.setHeader('x-fn-2', 'hit');
+        next();
+      }
+
+      app.use(fn1, fn2, function fn3(req, res) {
+        res.setHeader('x-fn-3', 'hit');
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .expect('x-fn-1', 'hit')
+      .expect('x-fn-2', 'hit')
+      .expect('x-fn-3', 'hit')
+      .expect(200, done);
+    })
+
     it('should invoke middleware for all requests', function (done) {
       var app = express();
       var cb = after(3, done);
@@ -122,6 +148,32 @@ describe('app', function(){
       .expect(200, 'saw GET /bar', done);
     })
 
+    it('should accept multiple arguments', function (done) {
+      var app = express();
+
+      function fn1(req, res, next) {
+        res.setHeader('x-fn-1', 'hit');
+        next();
+      }
+
+      function fn2(req, res, next) {
+        res.setHeader('x-fn-2', 'hit');
+        next();
+      }
+
+      app.use('/foo', fn1, fn2, function fn3(req, res) {
+        res.setHeader('x-fn-3', 'hit');
+        res.end();
+      });
+
+      request(app)
+      .get('/foo')
+      .expect('x-fn-1', 'hit')
+      .expect('x-fn-2', 'hit')
+      .expect('x-fn-3', 'hit')
+      .expect(200, done);
+    })
+
     it('should invoke middleware for all requests starting with path', function (done) {
       var app = express();
       var cb = after(3, done);

From c6e620302097838e37663e3cb23168b29f641ad0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Jul 2014 01:02:57 -0400
Subject: [PATCH 0397/1265] perf: fix arguments reassign deopt in some res
 methods

---
 History.md      |   1 +
 lib/response.js | 133 ++++++++++++++++++++++++++++--------------------
 2 files changed, 79 insertions(+), 55 deletions(-)

diff --git a/History.md b/History.md
index 3e6ca2136b9..0c3cd8a7c2d 100644
--- a/History.md
+++ b/History.md
@@ -21,6 +21,7 @@ unreleased
   * deps: parseurl@~1.1.3
     - faster parsing of href-only URLs
   * deps: path-to-regexp@0.1.3
+  * perf: fix arguments reassign deopt in some `res` methods
 
 4.5.1 / 2014-07-06
 ==================
diff --git a/lib/response.js b/lib/response.js
index 7ba47b26aee..4ea938e32df 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -78,70 +78,77 @@ res.links = function(links){
  * @api public
  */
 
-res.send = function(body){
-  var req = this.req;
-  var head = 'HEAD' == req.method;
-  var type;
+res.send = function send(body) {
+  var chunk = body;
   var encoding;
   var len;
+  var req = this.req;
+  var type;
 
   // settings
   var app = this.app;
 
   // allow status / body
-  if (2 == arguments.length) {
+  if (arguments.length === 2) {
     // res.send(body, status) backwards compat
-    if ('number' != typeof body && 'number' == typeof arguments[1]) {
+    if (typeof arguments[0] !== 'number' && typeof arguments[1] === 'number') {
       deprecate('res.send(body, status): Use res.send(status, body) instead');
       this.statusCode = arguments[1];
     } else {
-      this.statusCode = body;
-      body = arguments[1];
+      this.statusCode = arguments[0];
+      chunk = arguments[1];
     }
   }
 
   // disambiguate res.send(status) and res.send(status, num)
-  if (typeof body === 'number' && arguments.length === 1) {
+  if (typeof chunk === 'number' && arguments.length === 1) {
     // res.send(status) will set status message as text string
-    this.get('Content-Type') || this.type('txt');
-    this.statusCode = body;
-    body = http.STATUS_CODES[body];
+    if (!this.get('Content-Type')) {
+      this.type('txt');
+    }
+
+    this.statusCode = chunk;
+    chunk = http.STATUS_CODES[chunk];
   }
 
-  switch (typeof body) {
+  switch (typeof chunk) {
     // string defaulting to html
     case 'string':
-      if (!this.get('Content-Type')) this.type('html');
+      if (!this.get('Content-Type')) {
+        this.type('html');
+      }
       break;
     case 'boolean':
     case 'number':
     case 'object':
-      if (null == body) {
-        body = '';
-      } else if (Buffer.isBuffer(body)) {
-        this.get('Content-Type') || this.type('bin');
+      if (chunk === null) {
+        chunk = '';
+      } else if (Buffer.isBuffer(chunk)) {
+        if (!this.get('Content-Type')) {
+          this.type('bin');
+        }
       } else {
-        return this.json(body);
+        return this.json(chunk);
       }
       break;
   }
 
   // write strings in utf-8
-  if ('string' === typeof body) {
+  if (typeof chunk === 'string') {
     encoding = 'utf8';
     type = this.get('Content-Type');
 
     // reflect this in content-type
-    if ('string' === typeof type) {
+    if (typeof type === 'string') {
       this.set('Content-Type', setCharset(type, 'utf-8'));
     }
   }
 
   // populate Content-Length
-  if (undefined !== body && !this.get('Content-Length')) {
-    len = Buffer.isBuffer(body)
-      ? body.length
-      : Buffer.byteLength(body, encoding);
+  if (chunk !== undefined && !this.get('Content-Length')) {
+    len = Buffer.isBuffer(chunk)
+      ? chunk.length
+      : Buffer.byteLength(chunk, encoding);
     this.set('Content-Length', len);
   }
 
@@ -149,7 +156,7 @@ res.send = function(body){
   var etag = len !== undefined && app.get('etag fn');
   if (etag && ('GET' === req.method || 'HEAD' === req.method)) {
     if (!this.get('ETag')) {
-      etag = etag(body, encoding);
+      etag = etag(chunk, encoding);
       etag && this.set('ETag', etag);
     }
   }
@@ -162,11 +169,16 @@ res.send = function(body){
     this.removeHeader('Content-Type');
     this.removeHeader('Content-Length');
     this.removeHeader('Transfer-Encoding');
-    body = '';
+    chunk = '';
+  }
+
+  // skip body for HEAD
+  if (req.method === 'HEAD') {
+    this.end();
   }
 
   // respond
-  this.end((head ? null : body), encoding);
+  this.end(chunk, encoding);
 
   return this;
 };
@@ -184,20 +196,22 @@ res.send = function(body){
  * @api public
  */
 
-res.json = function(obj){
+res.json = function json(obj) {
+  var val = obj;
+
   // allow status / body
-  if (2 == arguments.length) {
+  if (arguments.length === 2) {
     // res.json(body, status) backwards compat
-    if ('number' == typeof arguments[1]) {
+    if (typeof arguments[1] === 'number') {
       this.statusCode = arguments[1];
-      if (typeof obj === 'number') {
+      if (typeof arguments[0] === 'number') {
         deprecate('res.json(obj, status): Use res.json(status, obj) instead');
       } else {
         deprecate('res.json(num, status): Use res.status(status).json(num) instead');
       }
     } else {
-      this.statusCode = obj;
-      obj = arguments[1];
+      this.statusCode = arguments[0];
+      val = arguments[1];
     }
   }
 
@@ -205,10 +219,12 @@ res.json = function(obj){
   var app = this.app;
   var replacer = app.get('json replacer');
   var spaces = app.get('json spaces');
-  var body = JSON.stringify(obj, replacer, spaces);
+  var body = JSON.stringify(val, replacer, spaces);
 
   // content-type
-  this.get('Content-Type') || this.set('Content-Type', 'application/json');
+  if (!this.get('Content-Type')) {
+    this.set('Content-Type', 'application/json');
+  }
 
   return this.send(body);
 };
@@ -226,20 +242,22 @@ res.json = function(obj){
  * @api public
  */
 
-res.jsonp = function(obj){
+res.jsonp = function jsonp(obj) {
+  var val = obj;
+
   // allow status / body
-  if (2 == arguments.length) {
+  if (arguments.length === 2) {
     // res.json(body, status) backwards compat
-    if ('number' == typeof arguments[1]) {
+    if (typeof arguments[1] === 'number') {
       this.statusCode = arguments[1];
-      if (typeof obj === 'number') {
+      if (typeof arguments[0] === 'number') {
         deprecate('res.jsonp(obj, status): Use res.jsonp(status, obj) instead');
       } else {
         deprecate('res.jsonp(num, status): Use res.status(status).jsonp(num) instead');
       }
     } else {
-      this.statusCode = obj;
-      obj = arguments[1];
+      this.statusCode = arguments[0];
+      val = arguments[1];
     }
   }
 
@@ -247,7 +265,7 @@ res.jsonp = function(obj){
   var app = this.app;
   var replacer = app.get('json replacer');
   var spaces = app.get('json spaces');
-  var body = JSON.stringify(obj, replacer, spaces);
+  var body = JSON.stringify(val, replacer, spaces);
   var callback = this.req.query[app.get('jsonp callback name')];
 
   // content-type
@@ -566,8 +584,8 @@ res.attachment = function(filename){
  */
 
 res.set =
-res.header = function(field, val){
-  if (2 == arguments.length) {
+res.header = function header(field, val) {
+  if (arguments.length === 2) {
     if (Array.isArray(val)) val = val.map(String);
     else val = String(val);
     if ('content-type' == field.toLowerCase() && !/;\s*charset\s*=/.test(val)) {
@@ -708,16 +726,16 @@ res.location = function(url){
  * @api public
  */
 
-res.redirect = function(url){
-  var head = 'HEAD' == this.req.method;
-  var status = 302;
+res.redirect = function redirect(url) {
+  var address = url;
   var body;
+  var status = 302;
 
   // allow status / url
-  if (2 == arguments.length) {
-    if ('number' == typeof url) {
-      status = url;
-      url = arguments[1];
+  if (arguments.length === 2) {
+    if (typeof arguments[0] === 'number') {
+      status = arguments[0];
+      address = arguments[1];
     } else {
       deprecate('res.redirect(ur, status): Use res.redirect(status, url) instead');
       status = arguments[1];
@@ -725,8 +743,8 @@ res.redirect = function(url){
   }
 
   // Set location header
-  this.location(url);
-  url = this.get('Location');
+  this.location(address);
+  address = this.get('Location');
 
   // Support text/{plain,html} by default
   this.format({
@@ -747,7 +765,12 @@ res.redirect = function(url){
   // Respond
   this.statusCode = status;
   this.set('Content-Length', Buffer.byteLength(body));
-  this.end(head ? null : body);
+
+  if (this.req.method === 'HEAD') {
+    this.end();
+  }
+
+  this.end(body);
 };
 
 /**

From fa6a40526a364a22976bd39cfbe94cc2674e6a7e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 11 Jul 2014 22:46:25 -0400
Subject: [PATCH 0398/1265] deps: update example dependencies

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 3067eec54f5..2862413bf42 100644
--- a/package.json
+++ b/package.json
@@ -61,8 +61,8 @@
     "hjs": "~0.0.6",
     "body-parser": "~1.4.3",
     "cookie-parser": "~1.3.1",
-    "express-session": "~1.6.1",
-    "method-override": "2.0.2",
+    "express-session": "~1.6.5",
+    "method-override": "~2.1.1",
     "multiparty": "~3.3.0",
     "morgan": "1.1.1",
     "vhost": "2.0.0"

From 1623936a258da0b17ff26072705756651e9c15a0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 11 Jul 2014 22:48:42 -0400
Subject: [PATCH 0399/1265] deps: send@0.6.0

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 0c3cd8a7c2d..1aea17c1639 100644
--- a/History.md
+++ b/History.md
@@ -21,6 +21,8 @@ unreleased
   * deps: parseurl@~1.1.3
     - faster parsing of href-only URLs
   * deps: path-to-regexp@0.1.3
+  * deps: send@0.6.0
+    - deps: debug@1.0.3
   * perf: fix arguments reassign deopt in some `res` methods
 
 4.5.1 / 2014-07-06
diff --git a/package.json b/package.json
index 2862413bf42..567e17c6cbd 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "path-to-regexp": "0.1.3",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.5.0",
+    "send": "0.6.0",
     "serve-static": "~1.3.0",
     "type-is": "~1.3.2",
     "vary": "0.1.0",

From d29cf4d5e3275fd628c84048f9307bed4cc777ae Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 11 Jul 2014 22:49:49 -0400
Subject: [PATCH 0400/1265] deps: serve-static@~1.3.2

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 1aea17c1639..93e5e21c13c 100644
--- a/History.md
+++ b/History.md
@@ -23,6 +23,9 @@ unreleased
   * deps: path-to-regexp@0.1.3
   * deps: send@0.6.0
     - deps: debug@1.0.3
+  * deps: serve-static@~1.3.2
+    - deps: parseurl@~1.1.3
+    - deps: send@0.6.0
   * perf: fix arguments reassign deopt in some `res` methods
 
 4.5.1 / 2014-07-06
diff --git a/package.json b/package.json
index 567e17c6cbd..976b8d95b63 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.6.0",
-    "serve-static": "~1.3.0",
+    "serve-static": "~1.3.2",
     "type-is": "~1.3.2",
     "vary": "0.1.0",
     "cookie": "0.1.2",

From 82bdbad5e0a29cd9784f8e121d9209c2ec582c7d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 11 Jul 2014 23:00:09 -0400
Subject: [PATCH 0401/1265] deps: finalhandler@0.0.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 93e5e21c13c..9f492c31d77 100644
--- a/History.md
+++ b/History.md
@@ -16,6 +16,8 @@ unreleased
   * router: speed up standard `app.use(fn)`
   * deps: debug@1.0.3
     - Add support for multiple wildcards in namespaces
+  * deps: finalhandler@0.0.3
+    - deps: debug@1.0.3
   * deps: methods@1.1.0
     - add `CONNECT`
   * deps: parseurl@~1.1.3
diff --git a/package.json b/package.json
index 976b8d95b63..66377f30300 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "debug": "1.0.3",
     "depd": "0.3.0",
     "escape-html": "1.0.1",
-    "finalhandler": "0.0.2",
+    "finalhandler": "0.0.3",
     "media-typer": "0.2.0",
     "methods": "1.1.0",
     "parseurl": "~1.1.3",

From 8ba3f39b33042f59d50ef5b5fb87109d3f3a2a26 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 11 Jul 2014 23:31:30 -0400
Subject: [PATCH 0402/1265] 4.6.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 9f492c31d77..cfc93072f56 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.6.0 / 2014-07-11
+==================
 
   * accept multiple callbacks to `app.use()`
   * add explicit "Rosetta Flash JSONP abuse" protection
diff --git a/package.json b/package.json
index 66377f30300..1de2b0af42d 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.5.1",
+  "version": "4.6.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 3e32721e24bb0169cbb348ae4654caa90fdfb1c0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 12 Jul 2014 22:07:43 -0400
Subject: [PATCH 0403/1265] Fix subapp.mountpath regression for app.use(subapp)

fixes #2233
---
 History.md         |  5 +++++
 lib/application.js |  2 +-
 test/app.js        | 13 ++++++++-----
 3 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/History.md b/History.md
index cfc93072f56..b7a26bf42a3 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * fix `subapp.mountpath` regression for `app.use(subapp)`
+
 4.6.0 / 2014-07-11
 ==================
 
diff --git a/lib/application.js b/lib/application.js
index 352d57e3041..2ab00b096bb 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -168,7 +168,7 @@ app.use = function use(path, fn) {
   // express app
   if (mount_app && mount_app.handle && mount_app.set) {
     debug('.use app under %s', mount_path);
-    mount_app.mountpath = path;
+    mount_app.mountpath = mount_path;
     mount_app.parent = this;
 
     // restore .app property on req and res
diff --git a/test/app.js b/test/app.js
index ec2a341d03a..117f4dffeb5 100644
--- a/test/app.js
+++ b/test/app.js
@@ -39,16 +39,19 @@ describe('app.parent', function(){
 
 describe('app.mountpath', function(){
   it('should return the mounted path', function(){
-    var app = express()
-      , blog = express()
-      , blogAdmin = express();
+    var admin = express();
+    var app = express();
+    var blog = express();
+    var fallback = express();
 
     app.use('/blog', blog);
-    blog.use('/admin', blogAdmin);
+    app.use(fallback);
+    blog.use('/admin', admin);
 
+    admin.mountpath.should.equal('/admin');
     app.mountpath.should.equal('/');
     blog.mountpath.should.equal('/blog');
-    blogAdmin.mountpath.should.equal('/admin');
+    fallback.mountpath.should.equal('/');
   })
 })
 

From 112dbb2ab40a6ecdd7ed0de4503dfc56655a24a3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 12 Jul 2014 22:11:48 -0400
Subject: [PATCH 0404/1265] 4.6.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index b7a26bf42a3..3f7b577af49 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.6.1 / 2014-07-12
+==================
 
   * fix `subapp.mountpath` regression for `app.use(subapp)`
 
diff --git a/package.json b/package.json
index 1de2b0af42d..927ebe2eb68 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.6.0",
+  "version": "4.6.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From b43205ca98a7f78d802b93cd15bb67a60ae437cc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 12 Jul 2014 00:18:38 -0400
Subject: [PATCH 0405/1265] perf: prevent multiple Buffer creation in res.send

---
 History.md       |  5 +++++
 lib/response.js  | 23 +++++++++++++++--------
 test/res.send.js |  6 ++++--
 3 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/History.md b/History.md
index 3f7b577af49..a576fd6a0b3 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * perf: prevent multiple `Buffer` creation in `res.send`
+
 4.6.1 / 2014-07-12
 ==================
 
diff --git a/lib/response.js b/lib/response.js
index 4ea938e32df..155bf3980dc 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -145,17 +145,24 @@ res.send = function send(body) {
   }
 
   // populate Content-Length
-  if (chunk !== undefined && !this.get('Content-Length')) {
-    len = Buffer.isBuffer(chunk)
-      ? chunk.length
-      : Buffer.byteLength(chunk, encoding);
+  if (chunk !== undefined) {
+    if (!Buffer.isBuffer(chunk)) {
+      // convert chunk to Buffer; saves later double conversions
+      chunk = new Buffer(chunk, encoding);
+      encoding = undefined;
+    }
+
+    len = chunk.length;
     this.set('Content-Length', len);
   }
 
+  // method check
+  var isHead = req.method === 'HEAD';
+
   // ETag support
-  var etag = len !== undefined && app.get('etag fn');
-  if (etag && ('GET' === req.method || 'HEAD' === req.method)) {
-    if (!this.get('ETag')) {
+  if (len !== undefined && (isHead || req.method === 'GET')) {
+    var etag = app.get('etag fn');
+    if (etag && !this.get('ETag')) {
       etag = etag(chunk, encoding);
       etag && this.set('ETag', etag);
     }
@@ -173,7 +180,7 @@ res.send = function send(body) {
   }
 
   // skip body for HEAD
-  if (req.method === 'HEAD') {
+  if (isHead) {
     this.end();
   }
 
diff --git a/test/res.send.js b/test/res.send.js
index 9ad00b9e8ff..a3d9d2178c5 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -512,8 +512,10 @@ describe('res', function(){
         var app = express()
 
         app.set('etag', function(body, encoding){
-          body.should.equal('hello, world!')
-          encoding.should.equal('utf8')
+          var chunk = !Buffer.isBuffer(body)
+            ? new Buffer(body, encoding)
+            : body;
+          chunk.toString().should.equal('hello, world!')
           return '"custom"'
         });
 

From e29fa25bb49c8266041f36ceac90751706225338 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 13 Jul 2014 23:15:00 -0400
Subject: [PATCH 0406/1265] Add configurable query parser

closes #2215
---
 History.md              |  5 +++
 lib/application.js      |  8 +++-
 lib/middleware/query.js | 31 +++++--------
 lib/utils.js            | 48 +++++++++++++++++++++
 test/req.query.js       | 96 +++++++++++++++++++++++++++++++++--------
 5 files changed, 148 insertions(+), 40 deletions(-)

diff --git a/History.md b/History.md
index a576fd6a0b3..a0d62026ba6 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,11 @@
 unreleased
 ==========
 
+  * configurable query parser with `app.set('query parser', parser)`
+    - `app.set('query parser', 'extended')` parse with "qs" module
+    - `app.set('query parser', 'simple')` parse with "querystring" core module
+    - `app.set('query parser', false)` disable query string parsing
+    - `app.set('query parser', true)` enable simple parsing
   * perf: prevent multiple `Buffer` creation in `res.send`
 
 4.6.1 / 2014-07-12
diff --git a/lib/application.js b/lib/application.js
index 2ab00b096bb..b8b69c0670b 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -12,6 +12,7 @@ var debug = require('debug')('express:application');
 var View = require('./view');
 var http = require('http');
 var compileETag = require('./utils').compileETag;
+var compileQueryParser = require('./utils').compileQueryParser;
 var compileTrust = require('./utils').compileTrust;
 var deprecate = require('depd')('express');
 var resolve = require('path').resolve;
@@ -51,6 +52,7 @@ app.defaultConfiguration = function(){
   this.set('etag', 'weak');
   var env = process.env.NODE_ENV || 'development';
   this.set('env', env);
+  this.set('query parser', 'extended');
   this.set('subdomain offset', 2);
   this.set('trust proxy', false);
 
@@ -104,7 +106,7 @@ app.lazyrouter = function() {
       strict: this.enabled('strict routing')
     });
 
-    this._router.use(query());
+    this._router.use(query(this.get('query parser fn')));
     this._router.use(middleware.init(this));
   }
 };
@@ -306,6 +308,10 @@ app.set = function(setting, val){
       debug('compile etag %s', val);
       this.set('etag fn', compileETag(val));
       break;
+    case 'query parser':
+      debug('compile query parser %s', val);
+      this.set('query parser fn', compileQueryParser(val));
+      break;
     case 'trust proxy':
       debug('compile trust proxy %s', val);
       this.set('trust proxy fn', compileTrust(val));
diff --git a/lib/middleware/query.js b/lib/middleware/query.js
index b828c85ef08..092bbd9985d 100644
--- a/lib/middleware/query.js
+++ b/lib/middleware/query.js
@@ -2,36 +2,27 @@
  * Module dependencies.
  */
 
-var qs = require('qs');
 var parseUrl = require('parseurl');
+var qs = require('qs');
 
 /**
- * Query:
- *
- * Automatically parse the query-string when available,
- * populating the `req.query` object using
- * [qs](https://github.com/visionmedia/node-querystring).
- *
- * Examples:
- *
- *       .use(connect.query())
- *       .use(function(req, res){
- *         res.end(JSON.stringify(req.query));
- *       });
- *
- *  The `options` passed are provided to qs.parse function.
- *
  * @param {Object} options
  * @return {Function}
  * @api public
  */
 
-module.exports = function query(options){
+module.exports = function query(options) {
+  var queryparse = qs.parse;
+
+  if (typeof options === 'function') {
+    queryparse = options;
+    options = undefined;
+  }
+
   return function query(req, res, next){
     if (!req.query) {
-      req.query = ~req.url.indexOf('?')
-        ? qs.parse(parseUrl(req).query, options)
-        : {};
+      var val = parseUrl(req).query;
+      req.query = queryparse(val, options);
     }
 
     next();
diff --git a/lib/utils.js b/lib/utils.js
index d6e6e614869..9f9fdfd6d0e 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -7,6 +7,8 @@ var crc32 = require('buffer-crc32');
 var crypto = require('crypto');
 var basename = require('path').basename;
 var proxyaddr = require('proxy-addr');
+var qs = require('qs');
+var querystring = require('querystring');
 var typer = require('media-typer');
 
 /**
@@ -202,6 +204,41 @@ exports.compileETag = function(val) {
   return fn;
 }
 
+/**
+ * Compile "query parser" value to function.
+ *
+ * @param  {String|Function} val
+ * @return {Function}
+ * @api private
+ */
+
+exports.compileQueryParser = function compileQueryParser(val) {
+  var fn;
+
+  if (typeof val === 'function') {
+    return val;
+  }
+
+  switch (val) {
+    case true:
+      fn = querystring.parse;
+      break;
+    case false:
+      fn = newObject;
+      break;
+    case 'extended':
+      fn = qs.parse;
+      break;
+    case 'simple':
+      fn = querystring.parse;
+      break;
+    default:
+      throw new TypeError('unknown value for query parser function: ' + val);
+  }
+
+  return fn;
+}
+
 /**
  * Compile "proxy trust" value to function.
  *
@@ -252,3 +289,14 @@ exports.setCharset = function(type, charset){
   // format type
   return typer.format(parsed);
 };
+
+/**
+ * Return new empty objet.
+ *
+ * @return {Object}
+ * @api private
+ */
+
+function newObject() {
+  return {};
+}
diff --git a/test/req.query.js b/test/req.query.js
index 10547e4a117..f243293125b 100644
--- a/test/req.query.js
+++ b/test/req.query.js
@@ -5,33 +5,91 @@ var express = require('../')
 describe('req', function(){
   describe('.query', function(){
     it('should default to {}', function(done){
-      var app = express();
-
-      app.use(function(req, res){
-        req.query.should.eql({});
-        res.end();
-      });
+      var app = createApp();
 
       request(app)
       .get('/')
-      .end(function(res){
-        done();
+      .expect(200, '{}', done);
+    });
+
+    it('should default to parse complex keys', function (done) {
+      var app = createApp();
+
+      request(app)
+      .get('/?user[name]=tj')
+      .expect(200, '{"user":{"name":"tj"}}', done);
+    });
+
+    describe('when "query parser" is extended', function () {
+      it('should parse complex keys', function (done) {
+        var app = createApp('extended');
+
+        request(app)
+        .get('/?user[name]=tj')
+        .expect(200, '{"user":{"name":"tj"}}', done);
       });
-    })
+    });
 
-    it('should contain the parsed query-string', function(done){
-      var app = express();
+    describe('when "query parser" is simple', function () {
+      it('should not parse complex keys', function (done) {
+        var app = createApp('simple');
 
-      app.use(function(req, res){
-        req.query.should.eql({ user: { name: 'tj' }});
-        res.end();
+        request(app)
+        .get('/?user[name]=tj')
+        .expect(200, '{"user[name]":"tj"}', done);
       });
+    });
 
-      request(app)
-      .get('/?user[name]=tj')
-      .end(function(res){
-        done();
+    describe('when "query parser" is a function', function () {
+      it('should parse using function', function (done) {
+        var app = createApp(function (str) {
+          return {'length': (str || '').length};
+        });
+
+        request(app)
+        .get('/?user[name]=tj')
+        .expect(200, '{"length":17}', done);
       });
-    })
+    });
+
+    describe('when "query parser" disabled', function () {
+      it('should not parse query', function (done) {
+        var app = createApp(false);
+
+        request(app)
+        .get('/?user[name]=tj')
+        .expect(200, '{}', done);
+      });
+    });
+
+    describe('when "query parser" disabled', function () {
+      it('should not parse complex keys', function (done) {
+        var app = createApp(true);
+
+        request(app)
+        .get('/?user[name]=tj')
+        .expect(200, '{"user[name]":"tj"}', done);
+      });
+    });
+
+    describe('when "query parser" an unknown value', function () {
+      it('should throw', function () {
+        createApp.bind(null, 'bogus').should.throw(/unknown value.*query parser/);
+      });
+    });
   })
 })
+
+function createApp(setting) {
+  var app = express();
+
+  if (setting !== undefined) {
+    app.set('query parser', setting);
+  }
+
+  app.use(function (req, res) {
+    res.send(req.query);
+  });
+
+  return app;
+}

From fd86ab8da22b847b160ef7b5c17cb39481ea4f38 Mon Sep 17 00:00:00 2001
From: Vasilyev Dmitry <vaseker@yandex-team.ru>
Date: Wed, 16 Jul 2014 14:07:31 +0600
Subject: [PATCH 0407/1265] build: fix up jsdoc return values

closes #2243
---
 lib/response.js | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index 155bf3980dc..1654faf2ca9 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -625,7 +625,7 @@ res.get = function(field){
  *
  * @param {String} name
  * @param {Object} options
- * @param {ServerResponse} for chaining
+ * @return {ServerResponse} for chaining
  * @api public
  */
 
@@ -656,6 +656,7 @@ res.clearCookie = function(name, options){
  * @param {String} name
  * @param {String|Object} val
  * @param {Options} options
+ * @return {ServerResponse} for chaining
  * @api public
  */
 
@@ -701,6 +702,7 @@ res.cookie = function(name, val, options){
  *    res.location('../login');
  *
  * @param {String} url
+ * @return {ServerResponse} for chaining
  * @api public
  */
 
@@ -785,7 +787,7 @@ res.redirect = function redirect(url) {
  * this call is simply ignored.
  *
  * @param {Array|String} field
- * @param {ServerResponse} for chaining
+ * @return {ServerResponse} for chaining
  * @api public
  */
 

From 04f383087fc00981d57035129457d053eaad058b Mon Sep 17 00:00:00 2001
From: Young Jae Sim <hanul@hanul.me>
Date: Thu, 17 Jul 2014 00:56:30 +0900
Subject: [PATCH 0408/1265] docs: add expressjs.kr(expressjs.com in Korean)

closes #2242
closes #2244
---
 Readme.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Readme.md b/Readme.md
index 6940c71efdd..4718b833a85 100644
--- a/Readme.md
+++ b/Readme.md
@@ -82,6 +82,7 @@ $ npm start
   * Visit the [Wiki](https://github.com/visionmedia/express/wiki)
   * [Google Group](https://groups.google.com/group/express-js) for discussion
   * [Русскоязычная документация](http://jsman.ru/express/)
+  * [한국어 문서](http://expressjs.kr) - [[website repo](https://github.com/Hanul/expressjs.kr)]
   * Run express examples [online](https://runnable.com/express)
 
 ## Viewing Examples

From d046208ca24000cfd83e474bf2d4340c60ffb520 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Jul 2014 13:10:19 -0400
Subject: [PATCH 0409/1265] build: add Young Jae Sim as contributor

---
 package.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 927ebe2eb68..a6d9a005a94 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,8 @@
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Guillermo Rauch <rauchg@gmail.com>",
     "Jonathan Ong <me@jongleberry.com>",
-    "Roman Shtylman <shtylman+expressjs@gmail.com"
+    "Roman Shtylman <shtylman+expressjs@gmail.com>",
+    "Young Jae Sim <hanul@hanul.me>"
   ],
   "keywords": [
     "express",

From da4c6399546c254952c45242e28d999ada31e611 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Jul 2014 20:44:17 -0400
Subject: [PATCH 0410/1265] deps: debug@1.0.4

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a0d62026ba6..fb02d0f1c15 100644
--- a/History.md
+++ b/History.md
@@ -6,6 +6,7 @@ unreleased
     - `app.set('query parser', 'simple')` parse with "querystring" core module
     - `app.set('query parser', false)` disable query string parsing
     - `app.set('query parser', true)` enable simple parsing
+  * deps: debug@1.0.4
   * perf: prevent multiple `Buffer` creation in `res.send`
 
 4.6.1 / 2014-07-12
diff --git a/package.json b/package.json
index a6d9a005a94..713a68bde20 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
   "dependencies": {
     "accepts": "~1.0.7",
     "buffer-crc32": "0.2.3",
-    "debug": "1.0.3",
+    "debug": "1.0.4",
     "depd": "0.3.0",
     "escape-html": "1.0.1",
     "finalhandler": "0.0.3",

From 21bb2ef30e46eff8216c5fa177997239e7abebc2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Jul 2014 20:47:24 -0400
Subject: [PATCH 0411/1265] deps: finalhandler@0.1.0

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index fb02d0f1c15..114d1cd26b4 100644
--- a/History.md
+++ b/History.md
@@ -7,6 +7,9 @@ unreleased
     - `app.set('query parser', false)` disable query string parsing
     - `app.set('query parser', true)` enable simple parsing
   * deps: debug@1.0.4
+  * deps: finalhandler@0.1.0
+    - Respond after request fully read
+    - deps: debug@1.0.4
   * perf: prevent multiple `Buffer` creation in `res.send`
 
 4.6.1 / 2014-07-12
diff --git a/package.json b/package.json
index 713a68bde20..c5888f2efb5 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,7 @@
     "debug": "1.0.4",
     "depd": "0.3.0",
     "escape-html": "1.0.1",
-    "finalhandler": "0.0.3",
+    "finalhandler": "0.1.0",
     "media-typer": "0.2.0",
     "methods": "1.1.0",
     "parseurl": "~1.1.3",

From fd3b40533bafa7e136f68354d0be470bfe60a51c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 17 Jul 2014 22:49:41 -0400
Subject: [PATCH 0412/1265] Deprecate combined status, response signatures

closes #2227
---
 History.md      |  3 +++
 lib/response.js | 27 ++++++++++-----------------
 2 files changed, 13 insertions(+), 17 deletions(-)

diff --git a/History.md b/History.md
index 114d1cd26b4..37c785197b6 100644
--- a/History.md
+++ b/History.md
@@ -6,6 +6,9 @@ unreleased
     - `app.set('query parser', 'simple')` parse with "querystring" core module
     - `app.set('query parser', false)` disable query string parsing
     - `app.set('query parser', true)` enable simple parsing
+  * deprecate `res.json(status, obj)` -- use `res.status(status).json(obj)` instead
+  * deprecate `res.jsonp(status, obj)` -- use `res.status(status).jsonp(obj)` instead
+  * deprecate `res.send(status, body)` -- use `res.status(status).send(body)` instead
   * deps: debug@1.0.4
   * deps: finalhandler@0.1.0
     - Respond after request fully read
diff --git a/lib/response.js b/lib/response.js
index 1654faf2ca9..6a1db729ee1 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -72,9 +72,8 @@ res.links = function(links){
  *     res.send(new Buffer('wahoo'));
  *     res.send({ some: 'json' });
  *     res.send('<p>some html</p>');
- *     res.send(404, 'Sorry, cant find that');
- *     res.send(404);
  *
+ * @param {string|number|boolean|object|Buffer} body
  * @api public
  */
 
@@ -92,9 +91,10 @@ res.send = function send(body) {
   if (arguments.length === 2) {
     // res.send(body, status) backwards compat
     if (typeof arguments[0] !== 'number' && typeof arguments[1] === 'number') {
-      deprecate('res.send(body, status): Use res.send(status, body) instead');
+      deprecate('res.send(body, status): Use res.status(status).send(body) instead');
       this.statusCode = arguments[1];
     } else {
+      deprecate('res.send(status, body): Use res.status(status).send(body) instead');
       this.statusCode = arguments[0];
       chunk = arguments[1];
     }
@@ -107,6 +107,7 @@ res.send = function send(body) {
       this.type('txt');
     }
 
+    deprecate('res.send(status): Use res.status(status).end() instead');
     this.statusCode = chunk;
     chunk = http.STATUS_CODES[chunk];
   }
@@ -197,9 +198,8 @@ res.send = function send(body) {
  *
  *     res.json(null);
  *     res.json({ user: 'tj' });
- *     res.json(500, 'oh noes!');
- *     res.json(404, 'I dont have that');
  *
+ * @param {string|number|boolean|object} obj
  * @api public
  */
 
@@ -210,13 +210,10 @@ res.json = function json(obj) {
   if (arguments.length === 2) {
     // res.json(body, status) backwards compat
     if (typeof arguments[1] === 'number') {
+      deprecate('res.json(obj, status): Use res.status(status).json(obj) instead');
       this.statusCode = arguments[1];
-      if (typeof arguments[0] === 'number') {
-        deprecate('res.json(obj, status): Use res.json(status, obj) instead');
-      } else {
-        deprecate('res.json(num, status): Use res.status(status).json(num) instead');
-      }
     } else {
+      deprecate('res.json(status, obj): Use res.status(status).json(obj) instead');
       this.statusCode = arguments[0];
       val = arguments[1];
     }
@@ -243,9 +240,8 @@ res.json = function json(obj) {
  *
  *     res.jsonp(null);
  *     res.jsonp({ user: 'tj' });
- *     res.jsonp(500, 'oh noes!');
- *     res.jsonp(404, 'I dont have that');
  *
+ * @param {string|number|boolean|object} obj
  * @api public
  */
 
@@ -256,13 +252,10 @@ res.jsonp = function jsonp(obj) {
   if (arguments.length === 2) {
     // res.json(body, status) backwards compat
     if (typeof arguments[1] === 'number') {
+      deprecate('res.jsonp(obj, status): Use res.status(status).json(obj) instead');
       this.statusCode = arguments[1];
-      if (typeof arguments[0] === 'number') {
-        deprecate('res.jsonp(obj, status): Use res.jsonp(status, obj) instead');
-      } else {
-        deprecate('res.jsonp(num, status): Use res.status(status).jsonp(num) instead');
-      }
     } else {
+      deprecate('res.jsonp(status, obj): Use res.status(status).jsonp(obj) instead');
       this.statusCode = arguments[0];
       val = arguments[1];
     }

From 7414a1f46326669661f5a6190d458531a4fdf11e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 18 Jul 2014 14:18:35 -0400
Subject: [PATCH 0413/1265] deps: debug@1.0.4

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 7bd01d44c65..b8e1af853a6 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+3.x
+===
+
+  * deps: debug@1.0.4
+
 3.14.0 / 2014-07-11
 ===================
 
diff --git a/package.json b/package.json
index 12780bd7552..fb8ce3f64dc 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
     "buffer-crc32": "0.2.3",
     "connect": "2.23.0",
     "commander": "1.3.2",
-    "debug": "1.0.3",
+    "debug": "1.0.4",
     "depd": "0.3.0",
     "escape-html": "1.0.1",
     "media-typer": "0.2.0",

From e4ff5281c9e8d6425096b69171d424d14d650a9c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 22 Jul 2014 23:50:36 -0400
Subject: [PATCH 0414/1265] deps: connect@2.24.0

---
 History.md   | 13 +++++++++++++
 package.json |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index b8e1af853a6..c41022258f1 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,19 @@
 3.x
 ===
 
+  * deps: connect@2.24.0
+    - deps: body-parser@~1.5.0
+    - deps: compression@~1.0.9
+    - deps: connect-timeout@~1.2.1
+    - deps: debug@1.0.4
+    - deps: depd@0.4.2
+    - deps: express-session@~1.7.0
+    - deps: finalhandler@0.1.0
+    - deps: method-override@~2.1.2
+    - deps: morgan@~1.2.0
+    - deps: multiparty@3.3.1
+    - deps: parseurl@~1.2.0
+    - deps: serve-static@~1.4.0
   * deps: debug@1.0.4
 
 3.14.0 / 2014-07-11
diff --git a/package.json b/package.json
index fb8ce3f64dc..52aa7104220 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.23.0",
+    "connect": "2.24.0",
     "commander": "1.3.2",
     "debug": "1.0.4",
     "depd": "0.3.0",

From 683ba1cd7547de87d3e5da7e7c55293a6b738a91 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 22 Jul 2014 23:52:44 -0400
Subject: [PATCH 0415/1265] deps: depd@0.4.2

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c41022258f1..98a1209b131 100644
--- a/History.md
+++ b/History.md
@@ -15,6 +15,11 @@
     - deps: parseurl@~1.2.0
     - deps: serve-static@~1.4.0
   * deps: debug@1.0.4
+  * deps: depd@0.4.2
+    - Add `TRACE_DEPRECATION` environment variable
+    - Remove non-standard grey color from color output
+    - Support `--no-deprecation` argument
+    - Support `--trace-deprecation` argument
 
 3.14.0 / 2014-07-11
 ===================
diff --git a/package.json b/package.json
index 52aa7104220..258b1342830 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "connect": "2.24.0",
     "commander": "1.3.2",
     "debug": "1.0.4",
-    "depd": "0.3.0",
+    "depd": "0.4.2",
     "escape-html": "1.0.1",
     "media-typer": "0.2.0",
     "methods": "1.1.0",

From 1d0da9036b76a25cd1d92d3ea2ce2af060c1d52c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 22 Jul 2014 23:53:50 -0400
Subject: [PATCH 0416/1265] deps: parseurl@~1.2.0

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 98a1209b131..49e0a19e0b0 100644
--- a/History.md
+++ b/History.md
@@ -20,6 +20,10 @@
     - Remove non-standard grey color from color output
     - Support `--no-deprecation` argument
     - Support `--trace-deprecation` argument
+  * deps: parseurl@~1.2.0
+    - Cache URLs based on original value
+    - Remove no-longer-needed URL mis-parse work-around
+    - Simplify the "fast-path" `RegExp`
 
 3.14.0 / 2014-07-11
 ===================
diff --git a/package.json b/package.json
index 258b1342830..e2c16102cc3 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,7 @@
     "media-typer": "0.2.0",
     "methods": "1.1.0",
     "mkdirp": "0.5.0",
-    "parseurl": "~1.1.3",
+    "parseurl": "~1.2.0",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.5.0",

From 323c185079b7fad7d331d04652cbde6e77694869 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 22 Jul 2014 23:55:17 -0400
Subject: [PATCH 0417/1265] deps: send@0.7.0

---
 History.md      | 5 +++++
 lib/response.js | 7 ++++---
 package.json    | 2 +-
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index 49e0a19e0b0..872e6ced5a8 100644
--- a/History.md
+++ b/History.md
@@ -24,6 +24,11 @@
     - Cache URLs based on original value
     - Remove no-longer-needed URL mis-parse work-around
     - Simplify the "fast-path" `RegExp`
+  * deps: send@0.7.0
+    - Add `dotfiles` option
+    - Cap `maxAge` value to 1 year
+    - deps: debug@1.0.4
+    - deps: depd@0.4.2
 
 3.14.0 / 2014-07-11
 ===================
diff --git a/lib/response.js b/lib/response.js
index 2e4b35cb747..fd0318589ba 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -385,9 +385,10 @@ res.sendfile = function(path, options, fn){
   }
 
   // transfer
-  var file = send(req, path);
-  if (options.root) file.root(options.root);
-  file.maxage(options.maxAge || 0);
+  var file = send(req, path, {
+    maxAge: options.maxAge || 0,
+    root: options.root
+  });
   file.on('error', error);
   file.on('directory', next);
   file.on('stream', stream);
diff --git a/package.json b/package.json
index e2c16102cc3..7a5ef69fa18 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "parseurl": "~1.2.0",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.5.0",
+    "send": "0.7.0",
     "vary": "0.1.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",

From 0d77305a1adf860220d61f4bfa2015dafb2a7f70 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Jul 2014 00:08:15 -0400
Subject: [PATCH 0418/1265] Pass options from res.sendfile to send

fixes #2017
---
 History.md           |  1 +
 lib/response.js      | 12 ++++++------
 test/fixtures/.name  |  1 +
 test/res.sendfile.js | 24 ++++++++++++++++++++++++
 4 files changed, 32 insertions(+), 6 deletions(-)
 create mode 100644 test/fixtures/.name

diff --git a/History.md b/History.md
index 872e6ced5a8..e16e92babee 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 3.x
 ===
 
+  * Pass options from `res.sendfile` to `send`
   * deps: connect@2.24.0
     - deps: body-parser@~1.5.0
     - deps: compression@~1.0.9
diff --git a/lib/response.js b/lib/response.js
index fd0318589ba..61c7f16c3ce 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -308,8 +308,11 @@ res.jsonp = function(obj){
  *
  * Options:
  *
- *   - `maxAge` defaulting to 0
- *   - `root`   root directory for relative filenames
+ *   - `maxAge`   defaulting to 0
+ *   - `root`     root directory for relative filenames
+ *   - `dotfiles` serve dotfiles, defaulting to false; can be `"allow"` to send them
+ *
+ * Other options are passed along to `send`.
  *
  * Examples:
  *
@@ -385,10 +388,7 @@ res.sendfile = function(path, options, fn){
   }
 
   // transfer
-  var file = send(req, path, {
-    maxAge: options.maxAge || 0,
-    root: options.root
-  });
+  var file = send(req, path, options);
   file.on('error', error);
   file.on('directory', next);
   file.on('stream', stream);
diff --git a/test/fixtures/.name b/test/fixtures/.name
new file mode 100644
index 00000000000..fa66f37ff21
--- /dev/null
+++ b/test/fixtures/.name
@@ -0,0 +1 @@
+tobi
\ No newline at end of file
diff --git a/test/res.sendfile.js b/test/res.sendfile.js
index 8603f2057ba..27ffba69865 100644
--- a/test/res.sendfile.js
+++ b/test/res.sendfile.js
@@ -106,6 +106,30 @@ describe('res', function(){
   })
 
   describe('.sendfile(path)', function(){
+    it('should not serve dotfiles', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.sendfile('test/fixtures/.name');
+      });
+
+      request(app)
+      .get('/')
+      .expect(404, done);
+    })
+
+    it('should accept dotfiles option', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.sendfile('test/fixtures/.name', { dotfiles: 'allow' });
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, 'tobi', done);
+    })
+
     describe('with an absolute path', function(){
       it('should transfer the file', function(done){
         var app = express();

From 3fc8dc54ee2075b397c2d16c641e761a29fec4ad Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Jul 2014 00:13:21 -0400
Subject: [PATCH 0419/1265] docs: replace Gittip badge

---
 Readme.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 2ce672040ae..e9e45b91eb7 100644
--- a/Readme.md
+++ b/Readme.md
@@ -2,7 +2,10 @@
 
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
-  [![NPM version](https://badge.fury.io/js/express.svg)](http://badge.fury.io/js/express) [![Build Status](https://travis-ci.org/visionmedia/express.svg?branch=master)](https://travis-ci.org/visionmedia/express) [![Coverage Status](https://img.shields.io/coveralls/visionmedia/express.svg)](https://coveralls.io/r/visionmedia/express) [![Gittip](http://img.shields.io/gittip/visionmedia.svg)](https://www.gittip.com/visionmedia/)
+  [![NPM version](https://badge.fury.io/js/express.svg)](http://badge.fury.io/js/express)
+  [![Build Status](https://travis-ci.org/visionmedia/express.svg?branch=master)](https://travis-ci.org/visionmedia/express)
+  [![Coverage Status](https://img.shields.io/coveralls/visionmedia/express.svg)](https://coveralls.io/r/visionmedia/express)
+  [![Gittip](http://img.shields.io/gittip/dougwilson.svg)](https://www.gittip.com/dougwilson/)
 
 ```js
 var express = require('express');

From a28b7a85cf3fc71e1a1bda8d90338741eba8c92b Mon Sep 17 00:00:00 2001
From: Ashley Streb <astreb@circle.com>
Date: Fri, 18 Jul 2014 11:33:16 -0400
Subject: [PATCH 0420/1265] Fix req.protocol for proxy-direct connections

fixes #2252
---
 History.md           |  1 +
 lib/request.js       | 13 ++++++++-----
 test/req.protocol.js | 15 +++++++++++++++
 3 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index e16e92babee..dd015b9a2d8 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 3.x
 ===
 
+  * Fix `req.protocol` for proxy-direct connections
   * Pass options from `res.sendfile` to `send`
   * deps: connect@2.24.0
     - deps: body-parser@~1.5.0
diff --git a/lib/request.js b/lib/request.js
index 065e4c6fe3c..35c48a77dbf 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -341,7 +341,9 @@ req.is = function(type){
  * Return the protocol string "http" or "https"
  * when requested with TLS. When the "trust proxy"
  * setting trusts the socket address, the
- * "X-Forwarded-Proto" header field will be trusted.
+ * "X-Forwarded-Proto" header field will be trusted
+ * and used if present.
+ *
  * If you're running behind a reverse proxy that
  * supplies https for you this may be enabled.
  *
@@ -350,17 +352,18 @@ req.is = function(type){
  */
 
 req.__defineGetter__('protocol', function(){
+  var proto = this.connection.encrypted
+    ? 'https'
+    : 'http';
   var trust = this.app.get('trust proxy fn');
 
   if (!trust(this.connection.remoteAddress)) {
-    return this.connection.encrypted
-      ? 'https'
-      : 'http';
+    return proto;
   }
 
   // Note: X-Forwarded-Proto is normally only ever a
   //       single value, but this is to be safe.
-  var proto = this.get('X-Forwarded-Proto') || 'http';
+  proto = this.get('X-Forwarded-Proto') || proto;
   return proto.split(/\s*,\s*/)[0];
 });
 
diff --git a/test/req.protocol.js b/test/req.protocol.js
index 9a44aeb54c4..80cad8a975f 100644
--- a/test/req.protocol.js
+++ b/test/req.protocol.js
@@ -32,6 +32,21 @@ describe('req', function(){
         .expect('https', done);
       })
 
+      it('should default to the socket addr if X-Forwarded-Proto not present', function(done){
+        var app = express();
+
+        app.enable('trust proxy');
+
+        app.use(function(req, res){
+          req.connection.encrypted = true;
+          res.end(req.protocol);
+        });
+
+        request(app)
+        .get('/')
+        .expect('https', done);
+      })
+
       it('should ignore X-Forwarded-Proto if socket addr not trusted', function(done){
         var app = express();
 

From 928952e7f0f3490619d3c1cd4f98c9de887ffc00 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Jul 2014 00:53:19 -0400
Subject: [PATCH 0421/1265] 3.15.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index dd015b9a2d8..353d8cb9780 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.15.0 / 2014-07-22
+===================
 
   * Fix `req.protocol` for proxy-direct connections
   * Pass options from `res.sendfile` to `send`
diff --git a/package.json b/package.json
index 7a5ef69fa18..2a36da5c2c4 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.14.0",
+  "version": "3.15.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 90194247253deabfa5fa90322925daab76681fb6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 22 Jul 2014 23:52:44 -0400
Subject: [PATCH 0422/1265] deps: depd@0.4.2

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 37c785197b6..1f0896af5c1 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,11 @@ unreleased
   * deprecate `res.jsonp(status, obj)` -- use `res.status(status).jsonp(obj)` instead
   * deprecate `res.send(status, body)` -- use `res.status(status).send(body)` instead
   * deps: debug@1.0.4
+  * deps: depd@0.4.2
+    - Add `TRACE_DEPRECATION` environment variable
+    - Remove non-standard grey color from color output
+    - Support `--no-deprecation` argument
+    - Support `--trace-deprecation` argument
   * deps: finalhandler@0.1.0
     - Respond after request fully read
     - deps: debug@1.0.4
diff --git a/package.json b/package.json
index c5888f2efb5..95928ea7b93 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
     "accepts": "~1.0.7",
     "buffer-crc32": "0.2.3",
     "debug": "1.0.4",
-    "depd": "0.3.0",
+    "depd": "0.4.2",
     "escape-html": "1.0.1",
     "finalhandler": "0.1.0",
     "media-typer": "0.2.0",

From dc054d190aa33b31d5bd15a48d5349f483383e89 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 22 Jul 2014 23:53:50 -0400
Subject: [PATCH 0423/1265] deps: parseurl@~1.2.0

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 1f0896af5c1..a6fff42beed 100644
--- a/History.md
+++ b/History.md
@@ -18,6 +18,10 @@ unreleased
   * deps: finalhandler@0.1.0
     - Respond after request fully read
     - deps: debug@1.0.4
+  * deps: parseurl@~1.2.0
+    - Cache URLs based on original value
+    - Remove no-longer-needed URL mis-parse work-around
+    - Simplify the "fast-path" `RegExp`
   * perf: prevent multiple `Buffer` creation in `res.send`
 
 4.6.1 / 2014-07-12
diff --git a/package.json b/package.json
index 95928ea7b93..d1728b2b8b8 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "finalhandler": "0.1.0",
     "media-typer": "0.2.0",
     "methods": "1.1.0",
-    "parseurl": "~1.1.3",
+    "parseurl": "~1.2.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",

From 7cd86a01da1c0bc8a845ae358edbc92f6fd06086 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Jul 2014 13:04:07 -0400
Subject: [PATCH 0424/1265] deps: update example dependencies

---
 package.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index d1728b2b8b8..445d0d82f62 100644
--- a/package.json
+++ b/package.json
@@ -60,12 +60,12 @@
     "jade": "~1.3.1",
     "marked": "0.3.2",
     "hjs": "~0.0.6",
-    "body-parser": "~1.4.3",
+    "body-parser": "~1.5.0",
     "cookie-parser": "~1.3.1",
-    "express-session": "~1.6.5",
+    "express-session": "~1.7.0",
     "method-override": "~2.1.1",
-    "multiparty": "~3.3.0",
-    "morgan": "1.1.1",
+    "morgan": "~1.2.0",
+    "multiparty": "~3.3.1",
     "vhost": "2.0.0"
   },
   "engines": {

From 3b7ca4317047c916681bb9f50c4cf5c2f9caeca9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Jul 2014 14:01:44 -0400
Subject: [PATCH 0425/1265] deps: jade@~1.5.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 445d0d82f62..7a7160ba82f 100644
--- a/package.json
+++ b/package.json
@@ -57,12 +57,12 @@
     "supertest": "~0.13.0",
     "connect-redis": "~2.0.0",
     "ejs": "~1.0.0",
-    "jade": "~1.3.1",
     "marked": "0.3.2",
     "hjs": "~0.0.6",
     "body-parser": "~1.5.0",
     "cookie-parser": "~1.3.1",
     "express-session": "~1.7.0",
+    "jade": "~1.5.0",
     "method-override": "~2.1.1",
     "morgan": "~1.2.0",
     "multiparty": "~3.3.1",

From 88cffadcaabf7d7a398e5f612bcd27ed2a4f80b3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 22 Jul 2014 23:55:17 -0400
Subject: [PATCH 0426/1265] deps: send@0.7.0

---
 History.md           | 5 +++++
 lib/response.js      | 3 ---
 package.json         | 2 +-
 test/res.sendfile.js | 6 +++---
 4 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/History.md b/History.md
index a6fff42beed..5a4c5ce17e7 100644
--- a/History.md
+++ b/History.md
@@ -22,6 +22,11 @@ unreleased
     - Cache URLs based on original value
     - Remove no-longer-needed URL mis-parse work-around
     - Simplify the "fast-path" `RegExp`
+  * deps: send@0.7.0
+    - Add `dotfiles` option
+    - Cap `maxAge` value to 1 year
+    - deps: debug@1.0.4
+    - deps: depd@0.4.2
   * perf: prevent multiple `Buffer` creation in `res.send`
 
 4.6.1 / 2014-07-12
diff --git a/lib/response.js b/lib/response.js
index 6a1db729ee1..f8baa7065fb 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -386,9 +386,6 @@ res.sendfile = function(path, options, fn){
     req.socket.removeListener('error', error);
   }
 
-  // Back-compat
-  options.maxage = options.maxage || options.maxAge || 0;
-
   // transfer
   var file = send(req, path, options);
   file.on('error', error);
diff --git a/package.json b/package.json
index 7a7160ba82f..2c12c7e61d4 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "path-to-regexp": "0.1.3",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.6.0",
+    "send": "0.7.0",
     "serve-static": "~1.3.2",
     "type-is": "~1.3.2",
     "vary": "0.1.0",
diff --git a/test/res.sendfile.js b/test/res.sendfile.js
index 45e55845bb8..667c83a1624 100644
--- a/test/res.sendfile.js
+++ b/test/res.sendfile.js
@@ -106,7 +106,7 @@ describe('res', function(){
   })
 
   describe('.sendfile(path)', function(){
-    it('should not serve hidden files', function(done){
+    it('should not serve dotfiles', function(done){
       var app = express();
 
       app.use(function(req, res){
@@ -118,11 +118,11 @@ describe('res', function(){
       .expect(404, done);
     })
 
-    it('should accept hidden option', function(done){
+    it('should accept dotfiles option', function(done){
       var app = express();
 
       app.use(function(req, res){
-        res.sendfile('test/fixtures/.name', { hidden: true });
+        res.sendfile('test/fixtures/.name', { dotfiles: 'allow' });
       });
 
       request(app)

From 035685918c556783f7d8d4150f0a410d2e9d7b42 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Jul 2014 14:56:27 -0400
Subject: [PATCH 0427/1265] deps: serve-static@~1.4.0

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5a4c5ce17e7..d7e3b12bcb5 100644
--- a/History.md
+++ b/History.md
@@ -27,6 +27,9 @@ unreleased
     - Cap `maxAge` value to 1 year
     - deps: debug@1.0.4
     - deps: depd@0.4.2
+  * deps: serve-static@~1.4.0
+    - deps: parseurl@~1.2.0
+    - deps: send@0.7.0
   * perf: prevent multiple `Buffer` creation in `res.send`
 
 4.6.1 / 2014-07-12
diff --git a/package.json b/package.json
index 2c12c7e61d4..728522e8aef 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.7.0",
-    "serve-static": "~1.3.2",
+    "serve-static": "~1.4.0",
     "type-is": "~1.3.2",
     "vary": "0.1.0",
     "cookie": "0.1.2",

From 11c74d72ebee6d75d5a1bb6d553a4d49a0aa9628 Mon Sep 17 00:00:00 2001
From: Ashley Streb <astreb@circle.com>
Date: Fri, 18 Jul 2014 11:33:16 -0400
Subject: [PATCH 0428/1265] Fix req.protocol for proxy-direct connections

fixes #2252
---
 History.md           |  1 +
 lib/request.js       | 13 ++++++++-----
 test/req.protocol.js | 15 +++++++++++++++
 3 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index d7e3b12bcb5..47874e18cdf 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * fix `req.protocol` for proxy-direct connections
   * configurable query parser with `app.set('query parser', parser)`
     - `app.set('query parser', 'extended')` parse with "qs" module
     - `app.set('query parser', 'simple')` parse with "querystring" core module
diff --git a/lib/request.js b/lib/request.js
index 514175b0037..ea5d03722ee 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -244,7 +244,9 @@ req.is = function(types){
  * Return the protocol string "http" or "https"
  * when requested with TLS. When the "trust proxy"
  * setting trusts the socket address, the
- * "X-Forwarded-Proto" header field will be trusted.
+ * "X-Forwarded-Proto" header field will be trusted
+ * and used if present.
+ *
  * If you're running behind a reverse proxy that
  * supplies https for you this may be enabled.
  *
@@ -253,17 +255,18 @@ req.is = function(types){
  */
 
 defineGetter(req, 'protocol', function protocol(){
+  var proto = this.connection.encrypted
+    ? 'https'
+    : 'http';
   var trust = this.app.get('trust proxy fn');
 
   if (!trust(this.connection.remoteAddress)) {
-    return this.connection.encrypted
-      ? 'https'
-      : 'http';
+    return proto;
   }
 
   // Note: X-Forwarded-Proto is normally only ever a
   //       single value, but this is to be safe.
-  var proto = this.get('X-Forwarded-Proto') || 'http';
+  proto = this.get('X-Forwarded-Proto') || proto;
   return proto.split(/\s*,\s*/)[0];
 });
 
diff --git a/test/req.protocol.js b/test/req.protocol.js
index 9a44aeb54c4..80cad8a975f 100644
--- a/test/req.protocol.js
+++ b/test/req.protocol.js
@@ -32,6 +32,21 @@ describe('req', function(){
         .expect('https', done);
       })
 
+      it('should default to the socket addr if X-Forwarded-Proto not present', function(done){
+        var app = express();
+
+        app.enable('trust proxy');
+
+        app.use(function(req, res){
+          req.connection.encrypted = true;
+          res.end(req.protocol);
+        });
+
+        request(app)
+        .get('/')
+        .expect('https', done);
+      })
+
       it('should ignore X-Forwarded-Proto if socket addr not trusted', function(done){
         var app = express();
 

From d0b6b3dfcf4f19eb8af7b4a445fa72ef437d3098 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Jul 2014 17:28:14 -0400
Subject: [PATCH 0429/1265] tests: change Route tests to use callback

---
 test/Route.js | 132 +++++++++++++++++++++++++++++---------------------
 1 file changed, 77 insertions(+), 55 deletions(-)

diff --git a/test/Route.js b/test/Route.js
index 8d37a0bb9c1..c979fb110c6 100644
--- a/test/Route.js
+++ b/test/Route.js
@@ -1,4 +1,5 @@
 
+var after = require('after');
 var should = require('should');
 var express = require('../')
   , Route = express.Route
@@ -9,167 +10,182 @@ describe('Route', function(){
 
   describe('.all', function(){
     it('should add handler', function(done){
+      var req = { method: 'GET', url: '/' };
       var route = new Route('/foo');
 
       route.all(function(req, res, next) {
-        assert.equal(req.a, 1);
-        assert.equal(res.b, 2);
+        req.called = true;
         next();
       });
 
-      route.dispatch({ a:1, method: 'GET' }, { b:2 }, done);
+      route.dispatch(req, {}, function (err) {
+        if (err) return done(err);
+        should(req.called).be.ok;
+        done();
+      });
     })
 
     it('should handle VERBS', function(done) {
+      var count = 0;
       var route = new Route('/foo');
+      var cb = after(methods.length, function (err) {
+        if (err) return done(err);
+        count.should.equal(methods.length);
+        done();
+      });
 
-      var count = 0;
       route.all(function(req, res, next) {
         count++;
+        next();
       });
 
       methods.forEach(function testMethod(method) {
-        route.dispatch({ method: method }, {});
+        var req = { method: method, url: '/' };
+        route.dispatch(req, {}, cb);
       });
-
-      assert.equal(count, methods.length);
-      done();
     })
 
     it('should stack', function(done) {
+      var req = { count: 0, method: 'GET', url: '/' };
       var route = new Route('/foo');
 
-      var count = 0;
       route.all(function(req, res, next) {
-        count++;
+        req.count++;
         next();
       });
 
       route.all(function(req, res, next) {
-        count++;
+        req.count++;
         next();
       });
 
-      route.dispatch({ method: 'GET' }, {}, function(err) {
-        assert.ifError(err);
-        count++;
+      route.dispatch(req, {}, function (err) {
+        if (err) return done(err);
+        req.count.should.equal(2);
+        done();
       });
-
-      assert.equal(count, 3);
-      done();
     })
   })
 
   describe('.VERB', function(){
     it('should support .get', function(done){
+      var req = { method: 'GET', url: '/' };
       var route = new Route('');
 
-      var count = 0;
       route.get(function(req, res, next) {
-        count++;
+        req.called = true;
+        next();
       })
 
-      route.dispatch({ method: 'GET' }, {});
-      assert(count);
-      done();
+      route.dispatch(req, {}, function (err) {
+        if (err) return done(err);
+        should(req.called).be.ok;
+        done();
+      });
     })
 
     it('should limit to just .VERB', function(done){
+      var req = { method: 'POST', url: '/' };
       var route = new Route('');
 
       route.get(function(req, res, next) {
-        assert(false);
-        done();
+        throw new Error('not me!');
       })
 
       route.post(function(req, res, next) {
-        assert(true);
+        req.called = true;
+        next();
       })
 
-      route.dispatch({ method: 'post' }, {});
-      done();
+      route.dispatch(req, {}, function (err) {
+        if (err) return done(err);
+        should(req.called).be.true;
+        done();
+      });
     })
 
     it('should allow fallthrough', function(done){
+      var req = { order: '', method: 'GET', url: '/' };
       var route = new Route('');
 
-      var order = '';
       route.get(function(req, res, next) {
-        order += 'a';
+        req.order += 'a';
         next();
       })
 
       route.all(function(req, res, next) {
-        order += 'b';
+        req.order += 'b';
         next();
       });
 
       route.get(function(req, res, next) {
-        order += 'c';
+        req.order += 'c';
+        next();
       })
 
-      route.dispatch({ method: 'get' }, {});
-      assert.equal(order, 'abc');
-      done();
+      route.dispatch(req, {}, function (err) {
+        if (err) return done(err);
+        req.order.should.equal('abc');
+        done();
+      });
     })
   })
 
   describe('errors', function(){
     it('should handle errors via arity 4 functions', function(done){
+      var req = { order: '', method: 'GET', url: '/' };
       var route = new Route('');
 
-      var order = '';
       route.all(function(req, res, next){
         next(new Error('foobar'));
       });
 
       route.all(function(req, res, next){
-        order += '0';
+        req.order += '0';
         next();
       });
 
       route.all(function(err, req, res, next){
-        order += 'a';
+        req.order += 'a';
         next(err);
       });
 
-      route.all(function(err, req, res, next){
-        assert.equal(err.message, 'foobar');
-        assert.equal(order, 'a');
+      route.dispatch(req, {}, function (err) {
+        should(err).be.ok;
+        should(err.message).equal('foobar');
+        req.order.should.equal('a');
         done();
       });
-
-      route.dispatch({ method: 'get' }, {});
     })
 
     it('should handle throw', function(done) {
+      var req = { order: '', method: 'GET', url: '/' };
       var route = new Route('');
 
-      var order = '';
       route.all(function(req, res, next){
         throw new Error('foobar');
       });
 
       route.all(function(req, res, next){
-        order += '0';
+        req.order += '0';
         next();
       });
 
       route.all(function(err, req, res, next){
-        order += 'a';
+        req.order += 'a';
         next(err);
       });
 
-      route.all(function(err, req, res, next){
-        assert.equal(err.message, 'foobar');
-        assert.equal(order, 'a');
+      route.dispatch(req, {}, function (err) {
+        should(err).be.ok;
+        should(err.message).equal('foobar');
+        req.order.should.equal('a');
         done();
       });
-
-      route.dispatch({ method: 'get' }, {});
     });
 
     it('should handle throwing inside error handlers', function(done) {
+      var req = { method: 'GET', url: '/' };
       var route = new Route('');
 
       route.get(function(req, res, next){
@@ -181,21 +197,26 @@ describe('Route', function(){
       });
 
       route.get(function(err, req, res, next){
-        assert.equal(err.message, 'oops');
-        done();
+        req.message = err.message;
+        next();
       });
 
-      route.dispatch({ url: '/', method: 'GET' }, {});
+      route.dispatch(req, {}, function (err) {
+        if (err) return done(err);
+        should(req.message).equal('oops');
+        done();
+      });
     });
 
     it('should handle throw in .all', function(done) {
+      var req = { method: 'GET', url: '/' };
       var route = new Route('');
 
       route.all(function(req, res, next){
         throw new Error('boom!');
       });
 
-      route.dispatch({ url: '/', method: 'GET' }, {}, function(err){
+      route.dispatch(req, {}, function(err){
         should(err).be.ok;
         err.message.should.equal('boom!');
         done();
@@ -203,6 +224,7 @@ describe('Route', function(){
     });
 
     it('should handle single error handler', function(done) {
+      var req = { method: 'GET', url: '/' };
       var route = new Route('');
 
       route.all(function(err, req, res, next){
@@ -210,7 +232,7 @@ describe('Route', function(){
         true.should.be.false;
       });
 
-      route.dispatch({ url: '/', method: 'GET' }, {}, done);
+      route.dispatch(req, {}, done);
     });
   })
 })

From ab8d116f4289bc7c3c1936df1825b3d26caa8738 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Jul 2014 18:17:31 -0400
Subject: [PATCH 0430/1265] tests: bail on failed test for developer

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 728522e8aef..f3a96c3074a 100644
--- a/package.json
+++ b/package.json
@@ -73,7 +73,7 @@
   },
   "scripts": {
     "prepublish": "npm prune",
-    "test": "mocha --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
+    "test": "mocha --require test/support/env --reporter spec --bail --check-leaks test/ test/acceptance/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
     "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/"
   }

From 1a9a837c45a66ee0ea95362cbb077388a3df33dc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 25 Jul 2014 20:26:11 -0400
Subject: [PATCH 0431/1265] 4.7.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 05d0f6d1b2b..eff780c4dfb 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.7.0 / 2014-07-25
+==================
 
   * fix `req.protocol` for proxy-direct connections
   * configurable query parser with `app.set('query parser', parser)`
diff --git a/package.json b/package.json
index f3a96c3074a..fb44aad2a0d 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.6.1",
+  "version": "4.7.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From e7a3fbaf48502341d6317b53d553628c92cc192f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 26 Jul 2014 17:30:13 -0400
Subject: [PATCH 0432/1265] deps: connect@2.24.1

---
 History.md   | 11 +++++++++++
 package.json |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 353d8cb9780..0961e4cdd2c 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,14 @@
+3.x
+===
+
+  * deps: connect@2.24.1
+    - deps: body-parser@~1.5.0
+    - deps: depd@0.4.3
+    - deps: express-session@~1.7.1
+    - deps: morgan@~1.2.1
+    - deps: serve-index@~1.1.4
+    - deps: serve-static@~1.4.1
+
 3.15.0 / 2014-07-22
 ===================
 
diff --git a/package.json b/package.json
index 2a36da5c2c4..1d1dca3a4b4 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.24.0",
+    "connect": "2.24.1",
     "commander": "1.3.2",
     "debug": "1.0.4",
     "depd": "0.4.2",

From e49d0dc9e3abcd094884064ad152cbc7ce9d6f68 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 26 Jul 2014 17:31:22 -0400
Subject: [PATCH 0433/1265] deps: depd@0.4.3

fixes #2262
---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 0961e4cdd2c..1bf67fd7da3 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,8 @@
     - deps: morgan@~1.2.1
     - deps: serve-index@~1.1.4
     - deps: serve-static@~1.4.1
+  * deps: depd@0.4.3
+    - Fix exception when global `Error.stackTraceLimit` is too low
 
 3.15.0 / 2014-07-22
 ===================
diff --git a/package.json b/package.json
index 1d1dca3a4b4..c4ef08bea5b 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "connect": "2.24.1",
     "commander": "1.3.2",
     "debug": "1.0.4",
-    "depd": "0.4.2",
+    "depd": "0.4.3",
     "escape-html": "1.0.1",
     "media-typer": "0.2.0",
     "methods": "1.1.0",

From f724730e1ab259a66f6a0445161261555b6d733f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 26 Jul 2014 17:33:12 -0400
Subject: [PATCH 0434/1265] Adjust wording on deprecation messages

---
 History.md     | 6 +++---
 lib/request.js | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index 1bf67fd7da3..b9728664019 100644
--- a/History.md
+++ b/History.md
@@ -114,8 +114,8 @@
  * deprecate things with `depd` module
  * deps: buffer-crc32@0.2.3
  * deps: connect@2.20.2
-   - deprecate `verify` option to `json` -- use `body-parser` module directly
-   - deprecate `verify` option to `urlencoded` -- use `body-parser` module directly
+   - deprecate `verify` option to `json` -- use `body-parser` npm module instead
+   - deprecate `verify` option to `urlencoded` -- use `body-parser` npm module instead
    - deprecate things with `depd` module
    - use `finalhandler` for final response handling
    - use `media-typer` to parse `content-type` for charset
@@ -189,7 +189,7 @@
 ===================
 
  * deps: connect@2.19.1
-   - deprecate `methodOverride()` -- use `method-override` module directly
+   - deprecate `methodOverride()` -- use `method-override` npm module instead
    - deps: body-parser@1.3.0
    - deps: method-override@2.0.1
    - deps: multiparty@3.2.8
diff --git a/lib/request.js b/lib/request.js
index 35c48a77dbf..03f7cbdabba 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -427,7 +427,7 @@ req.__defineGetter__('ips', function(){
  */
 
 req.__defineGetter__('auth', function(){
-  deprecate('req.auth: Use basic-auth module directly');
+  deprecate('req.auth: Use basic-auth npm module instead');
 
   // credentials
   var creds = auth(this);

From edaabe66cf180b49919e772bba2150666c54251e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 26 Jul 2014 17:34:29 -0400
Subject: [PATCH 0435/1265] deps: send@0.7.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index b9728664019..e5759dad2e3 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,8 @@
     - deps: serve-static@~1.4.1
   * deps: depd@0.4.3
     - Fix exception when global `Error.stackTraceLimit` is too low
+  * deps: send@0.7.1
+    - deps: depd@0.4.3
 
 3.15.0 / 2014-07-22
 ===================
diff --git a/package.json b/package.json
index c4ef08bea5b..e335db7e617 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "parseurl": "~1.2.0",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.7.0",
+    "send": "0.7.1",
     "vary": "0.1.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",

From afea3c0ae88a1c304fb4d424d02220a6538aff26 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 26 Jul 2014 17:35:00 -0400
Subject: [PATCH 0436/1265] deps: mocha@~1.21.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e335db7e617..81ab0b022eb 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
   },
   "devDependencies": {
     "istanbul": "0.3.0",
-    "mocha": "~1.20.0",
+    "mocha": "~1.21.0",
     "should": "~4.0.0",
     "ejs": "~1.0.0",
     "jade": "~1.3.1",

From 9f4968aaa3db6d9fe94be83f95d354be86812aee Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 26 Jul 2014 17:42:18 -0400
Subject: [PATCH 0437/1265] 3.15.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index e5759dad2e3..86274b90c22 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.15.1 / 2014-07-26
+===================
 
   * deps: connect@2.24.1
     - deps: body-parser@~1.5.0
diff --git a/package.json b/package.json
index 81ab0b022eb..b87d69b2ae1 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.15.0",
+  "version": "3.15.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 65f67e2ec0f846338766c9e334a4fe45c8f83b8b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 26 Jul 2014 18:08:02 -0400
Subject: [PATCH 0438/1265] deps: serve-static@~1.4.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 7751effbcac..5f602445e7d 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
     - Fix exception when global `Error.stackTraceLimit` is too low
   * deps: send@0.7.1
     - deps: depd@0.4.3
+  * deps: serve-static@~1.4.1
 
 4.7.0 / 2014-07-25
 ==================
diff --git a/package.json b/package.json
index 6382648f2a4..0cc47847bb3 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.7.1",
-    "serve-static": "~1.4.0",
+    "serve-static": "~1.4.1",
     "type-is": "~1.3.2",
     "vary": "0.1.0",
     "cookie": "0.1.2",

From 8858f20d9399d6eeb01e70475c58bb1da9eb3ef4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 26 Jul 2014 18:53:26 -0400
Subject: [PATCH 0439/1265] 4.7.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 5f602445e7d..00bae2ef2c0 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.7.1 / 2014-07-26
+==================
 
   * deps: depd@0.4.3
     - Fix exception when global `Error.stackTraceLimit` is too low
diff --git a/package.json b/package.json
index 0cc47847bb3..0f5a81a21c0 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.7.0",
+  "version": "4.7.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 06e7685d65581e03c6572ba8cb4eadaab4750d4b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 27 Jul 2014 15:40:19 -0400
Subject: [PATCH 0440/1265] deps: connect@2.24.2

---
 History.md   | 12 +++++++++++-
 package.json |  2 +-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 86274b90c22..80960e91b61 100644
--- a/History.md
+++ b/History.md
@@ -1,8 +1,18 @@
+3.x
+===
+
+  * deps: connect@2.24.2
+    - deps: body-parser@~1.5.2
+    - deps: depd@0.4.4
+    - deps: express-session@~1.7.2
+    - deps: morgan@~1.2.2
+    - deps: serve-static@~1.4.2
+
 3.15.1 / 2014-07-26
 ===================
 
   * deps: connect@2.24.1
-    - deps: body-parser@~1.5.0
+    - deps: body-parser@~1.5.1
     - deps: depd@0.4.3
     - deps: express-session@~1.7.1
     - deps: morgan@~1.2.1
diff --git a/package.json b/package.json
index b87d69b2ae1..018032a6e2f 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.24.1",
+    "connect": "2.24.2",
     "commander": "1.3.2",
     "debug": "1.0.4",
     "depd": "0.4.3",

From baf8b14a71885f6255b2fc484b33440a0f0613d9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 27 Jul 2014 15:41:19 -0400
Subject: [PATCH 0441/1265] deps: depd@0.4.4

fixes #2262
---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 80960e91b61..046270241d9 100644
--- a/History.md
+++ b/History.md
@@ -7,6 +7,8 @@
     - deps: express-session@~1.7.2
     - deps: morgan@~1.2.2
     - deps: serve-static@~1.4.2
+  * deps: depd@0.4.4
+    - Work-around v8 generating empty stack traces
 
 3.15.1 / 2014-07-26
 ===================
diff --git a/package.json b/package.json
index 018032a6e2f..983cce1f5ad 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "connect": "2.24.2",
     "commander": "1.3.2",
     "debug": "1.0.4",
-    "depd": "0.4.3",
+    "depd": "0.4.4",
     "escape-html": "1.0.1",
     "media-typer": "0.2.0",
     "methods": "1.1.0",

From 819265c7ae8c6731a4cea1c887d729fe0e9c2e9a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 27 Jul 2014 15:41:54 -0400
Subject: [PATCH 0442/1265] deps: send@0.7.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 046270241d9..b5331aee2c9 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,8 @@
     - deps: serve-static@~1.4.2
   * deps: depd@0.4.4
     - Work-around v8 generating empty stack traces
+  * deps: send@0.7.2
+    - deps: depd@0.4.4
 
 3.15.1 / 2014-07-26
 ===================
diff --git a/package.json b/package.json
index 983cce1f5ad..00368c9d190 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "parseurl": "~1.2.0",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.7.1",
+    "send": "0.7.2",
     "vary": "0.1.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",

From 696e150f0ab7b11fd7a58832809f2f6393c74186 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 27 Jul 2014 15:53:45 -0400
Subject: [PATCH 0443/1265] 3.15.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index b5331aee2c9..26f9d218eb1 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.15.2 / 2014-07-27
+===================
 
   * deps: connect@2.24.2
     - deps: body-parser@~1.5.2
diff --git a/package.json b/package.json
index 00368c9d190..0fb201d86f7 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.15.1",
+  "version": "3.15.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 0ee4dd82b5a8f0e116fe8d421e207973989a3596 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 27 Jul 2014 15:59:19 -0400
Subject: [PATCH 0444/1265] deps: serve-static@~1.4.2

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ea96f615b82..e370ed4a2a5 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
     - Work-around v8 generating empty stack traces
   * deps: send@0.7.2
     - deps: depd@0.4.4
+  * deps: serve-static@~1.4.2
 
 4.7.1 / 2014-07-26
 ==================
diff --git a/package.json b/package.json
index 1cb37475b9d..e0483918f70 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.7.2",
-    "serve-static": "~1.4.1",
+    "serve-static": "~1.4.2",
     "type-is": "~1.3.2",
     "vary": "0.1.0",
     "cookie": "0.1.2",

From 54d3ffa9a0e987bf3eee2d0d715fdb1fb8619832 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 27 Jul 2014 16:00:17 -0400
Subject: [PATCH 0445/1265] deps: update example dependencies

---
 package.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index e0483918f70..1f106b3bac2 100644
--- a/package.json
+++ b/package.json
@@ -59,12 +59,12 @@
     "ejs": "~1.0.0",
     "marked": "0.3.2",
     "hjs": "~0.0.6",
-    "body-parser": "~1.5.0",
+    "body-parser": "~1.5.2",
     "cookie-parser": "~1.3.1",
-    "express-session": "~1.7.0",
+    "express-session": "~1.7.2",
     "jade": "~1.5.0",
     "method-override": "~2.1.1",
-    "morgan": "~1.2.0",
+    "morgan": "~1.2.2",
     "multiparty": "~3.3.1",
     "vhost": "2.0.0"
   },

From 1854a5d35f28aad84fd47d7484b3d5afd171be88 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 27 Jul 2014 16:00:54 -0400
Subject: [PATCH 0446/1265] 4.7.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index e370ed4a2a5..ad56b365af0 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.7.2 / 2014-07-27
+==================
 
   * deps: depd@0.4.4
     - Work-around v8 generating empty stack traces
diff --git a/package.json b/package.json
index 1f106b3bac2..b261d8dc36c 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.7.1",
+  "version": "4.7.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From d8df26680ffb7095f1204946b39d6b9432bc4f2b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 4 Aug 2014 16:10:32 -0400
Subject: [PATCH 0447/1265] deps: send@0.7.3

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ad56b365af0..b836d22315f 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: send@0.7.3
+    - Fix incorrect 403 on Windows and Node.js 0.11
+
 4.7.2 / 2014-07-27
 ==================
 
diff --git a/package.json b/package.json
index b261d8dc36c..ba7cb0a5b12 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "path-to-regexp": "0.1.3",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.7.2",
+    "send": "0.7.3",
     "serve-static": "~1.4.2",
     "type-is": "~1.3.2",
     "vary": "0.1.0",

From 112bc92d78c9cd2d013b8f01839b201eef9d8904 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 4 Aug 2014 16:11:52 -0400
Subject: [PATCH 0448/1265] deps: serve-static@~1.4.3

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index b836d22315f..4d4b36a4b49 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,9 @@ unreleased
 
   * deps: send@0.7.3
     - Fix incorrect 403 on Windows and Node.js 0.11
+  * deps: serve-static@~1.4.3
+    - Fix incorrect 403 on Windows and Node.js 0.11
+    - deps: send@0.7.3
 
 4.7.2 / 2014-07-27
 ==================
diff --git a/package.json b/package.json
index ba7cb0a5b12..ff8dca71d73 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.7.3",
-    "serve-static": "~1.4.2",
+    "serve-static": "~1.4.3",
     "type-is": "~1.3.2",
     "vary": "0.1.0",
     "cookie": "0.1.2",

From 52775a52ad9e00fbd38056af6ed0cddb4286d3d2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 4 Aug 2014 16:14:29 -0400
Subject: [PATCH 0449/1265] 4.7.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 4d4b36a4b49..83aafc258cd 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.7.3 / 2014-08-04
+==================
 
   * deps: send@0.7.3
     - Fix incorrect 403 on Windows and Node.js 0.11
diff --git a/package.json b/package.json
index ff8dca71d73..543403fb4d5 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.7.2",
+  "version": "4.7.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From df413a41f3bde919ece284c52a61bbe038728755 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 4 Aug 2014 17:14:32 -0400
Subject: [PATCH 0450/1265] deps: serve-static@~1.4.4

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 83aafc258cd..8c83d5e47e2 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: serve-static@~1.4.4
+    - deps: send@0.7.4
+
 4.7.3 / 2014-08-04
 ==================
 
diff --git a/package.json b/package.json
index 543403fb4d5..681d40df035 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.7.3",
-    "serve-static": "~1.4.3",
+    "serve-static": "~1.4.4",
     "type-is": "~1.3.2",
     "vary": "0.1.0",
     "cookie": "0.1.2",

From 767db01b7954a9cc6b6ccea769ccc0072de85f4f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 4 Aug 2014 17:26:43 -0400
Subject: [PATCH 0451/1265] deps: connect@2.24.3

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 26f9d218eb1..7b74aa2f8d7 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+3.x
+===
+
+  * deps: connect@2.24.3
+    - deps: serve-index@~1.1.5
+    - deps: serve-static@~1.4.4
+
 3.15.2 / 2014-07-27
 ===================
 
diff --git a/package.json b/package.json
index 0fb201d86f7..25911bfbe77 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.24.2",
+    "connect": "2.24.3",
     "commander": "1.3.2",
     "debug": "1.0.4",
     "depd": "0.4.4",

From e8b471ff4f8511209cdc9c4d7da62469a4a8e9a2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 4 Aug 2014 17:09:48 -0400
Subject: [PATCH 0452/1265] fix res.sendfile regression for serving directory
 index files

---
 History.md                    |  4 ++++
 package.json                  |  2 +-
 test/fixtures/blog/index.html |  1 +
 test/res.sendfile.js          | 24 ++++++++++++++++++++++++
 4 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 test/fixtures/blog/index.html

diff --git a/History.md b/History.md
index 7b74aa2f8d7..67bd5eaf98a 100644
--- a/History.md
+++ b/History.md
@@ -1,9 +1,13 @@
 3.x
 ===
 
+  * fix `res.sendfile` regression for serving directory index files
   * deps: connect@2.24.3
     - deps: serve-index@~1.1.5
     - deps: serve-static@~1.4.4
+  * deps: send@0.7.4
+    - Fix incorrect 403 on Windows and Node.js 0.11
+    - Fix serving index files without root dir
 
 3.15.2 / 2014-07-27
 ===================
diff --git a/package.json b/package.json
index 25911bfbe77..b51c2d0fc5c 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "parseurl": "~1.2.0",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.7.2",
+    "send": "0.7.4",
     "vary": "0.1.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",
diff --git a/test/fixtures/blog/index.html b/test/fixtures/blog/index.html
new file mode 100644
index 00000000000..bcc6b1822ff
--- /dev/null
+++ b/test/fixtures/blog/index.html
@@ -0,0 +1 @@
+<b>index</b>
\ No newline at end of file
diff --git a/test/res.sendfile.js b/test/res.sendfile.js
index 27ffba69865..24ee88a31da 100644
--- a/test/res.sendfile.js
+++ b/test/res.sendfile.js
@@ -130,6 +130,30 @@ describe('res', function(){
       .expect(200, 'tobi', done);
     })
 
+    it('should transfer a file', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.sendfile('test/fixtures/name.txt');
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, 'tobi', done);
+    });
+
+    it('should transfer a directory index file', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.sendfile('test/fixtures/blog/');
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, '<b>index</b>', done);
+    });
+
     describe('with an absolute path', function(){
       it('should transfer the file', function(done){
         var app = express();

From 15590d75b26f1e4b95b565f8306c763ee860d3e2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 4 Aug 2014 17:31:52 -0400
Subject: [PATCH 0453/1265] 3.15.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 67bd5eaf98a..01bb244c235 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.15.3 / 2014-08-04
+===================
 
   * fix `res.sendfile` regression for serving directory index files
   * deps: connect@2.24.3
diff --git a/package.json b/package.json
index b51c2d0fc5c..3fdc0036c29 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.15.2",
+  "version": "3.15.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From b886eb52cf955c2f29ad31b514607d4e38c1dbaf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 4 Aug 2014 17:36:37 -0400
Subject: [PATCH 0454/1265] 4.7.4

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index c7735d41802..c82e97a937b 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.7.4 / 2014-08-04
+==================
 
   * fix `res.sendfile` regression for serving directory index files
   * deps: send@0.7.4
diff --git a/package.json b/package.json
index 10156dcf97a..460c2e89f00 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.7.3",
+  "version": "4.7.4",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 12e070e39ad98597e9875491055b5d2edde26ba8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 4 Aug 2014 15:34:24 -0400
Subject: [PATCH 0455/1265] tests: add encoding tests for res.sendfile

---
 test/fixtures/% of dogs.txt |  1 +
 test/res.sendfile.js        | 12 ++++++++++++
 2 files changed, 13 insertions(+)
 create mode 100644 test/fixtures/% of dogs.txt

diff --git a/test/fixtures/% of dogs.txt b/test/fixtures/% of dogs.txt
new file mode 100644
index 00000000000..3a4d1342e8b
--- /dev/null
+++ b/test/fixtures/% of dogs.txt	
@@ -0,0 +1 @@
+20%
\ No newline at end of file
diff --git a/test/res.sendfile.js b/test/res.sendfile.js
index 58755ede59d..c6e2fce9927 100644
--- a/test/res.sendfile.js
+++ b/test/res.sendfile.js
@@ -189,6 +189,18 @@ describe('res', function(){
       .expect(200, '<b>index</b>', done);
     });
 
+    it('should transfer a file with urlencoded name', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.sendfile('test/fixtures/%25%20of%20dogs.txt');
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, '20%', done);
+    });
+
     describe('with an absolute path', function(){
       it('should transfer the file', function(done){
         var app = express();

From b24ed1587829185bc5b3ca702807dc40f17872db Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 01:35:00 -0400
Subject: [PATCH 0456/1265] deps: connect@2.25.0

---
 History.md   | 11 +++++++++++
 package.json |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 01bb244c235..b8d52ddad1c 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,14 @@
+3.x
+===
+
+  * deps: connect@2.25.0
+    - deps: body-parser@~1.6.0
+    - deps: compression@~1.0.10
+    - deps: csurf@~1.4.0
+    - deps: express-session@~1.7.4
+    - deps: qs@1.0.2
+    - deps: serve-static@~1.5.0
+
 3.15.3 / 2014-08-04
 ===================
 
diff --git a/package.json b/package.json
index 3fdc0036c29..612507d6738 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.24.3",
+    "connect": "2.25.0",
     "commander": "1.3.2",
     "debug": "1.0.4",
     "depd": "0.4.4",

From 0e42a37edd5b7dd2b66a1ca62927384dfbab4303 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 01:37:13 -0400
Subject: [PATCH 0457/1265] deps: send@0.8.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index b8d52ddad1c..0c22683a3d4 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,8 @@
     - deps: express-session@~1.7.4
     - deps: qs@1.0.2
     - deps: serve-static@~1.5.0
+  * deps: send@0.8.1
+    - Add `extensions` option
 
 3.15.3 / 2014-08-04
 ===================
diff --git a/package.json b/package.json
index 612507d6738..6bb519e1512 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "parseurl": "~1.2.0",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.7.4",
+    "send": "0.8.1",
     "vary": "0.1.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",

From b6c5b0511f5a2e6f2da8d5b371d30618e1616327 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 01:37:58 -0400
Subject: [PATCH 0458/1265] deps: jade@~1.5.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 6bb519e1512..6c6465e3536 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "mocha": "~1.21.0",
     "should": "~4.0.0",
     "ejs": "~1.0.0",
-    "jade": "~1.3.1",
+    "jade": "~1.5.0",
     "hjs": "~0.0.6",
     "marked": "0.3.2",
     "connect-redis": "~1.4.5",

From 19fd6f85b0d534930352f263bf2b15fe288237e5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 01:39:12 -0400
Subject: [PATCH 0459/1265] deps: connect-redis@~1.5.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 6c6465e3536..2a81ff6f47e 100644
--- a/package.json
+++ b/package.json
@@ -46,6 +46,7 @@
     "merge-descriptors": "0.0.2"
   },
   "devDependencies": {
+    "connect-redis": "~1.5.0",
     "istanbul": "0.3.0",
     "mocha": "~1.21.0",
     "should": "~4.0.0",
@@ -53,7 +54,6 @@
     "jade": "~1.5.0",
     "hjs": "~0.0.6",
     "marked": "0.3.2",
-    "connect-redis": "~1.4.5",
     "supertest": "~0.13.0"
   },
   "engines": {

From c652cf7eedc3f4b9eb6de6c1c8c31fcf33f33c85 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 01:40:46 -0400
Subject: [PATCH 0460/1265] 3.16.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 0c22683a3d4..3b0306e578b 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.16.0 / 2014-08-05
+===================
 
   * deps: connect@2.25.0
     - deps: body-parser@~1.6.0
diff --git a/package.json b/package.json
index 2a81ff6f47e..a7243182b04 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.15.3",
+  "version": "3.16.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 7d0f1c3db9d467e68e2ecb59e2d97e647ca99e8b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 01:57:15 -0400
Subject: [PATCH 0461/1265] deps: serve-static@~1.5.0

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index d1f19a40e9a..13868283338 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,9 @@ unreleased
 
   * deps: send@0.8.1
     - Add `extensions` option
+  * deps: serve-static@~1.5.0
+    - Add `extensions` option
+    - deps: send@0.8.1
 
 4.7.4 / 2014-08-04
 ==================
diff --git a/package.json b/package.json
index 336ae236b7e..d815814767c 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.8.1",
-    "serve-static": "~1.4.4",
+    "serve-static": "~1.5.0",
     "type-is": "~1.3.2",
     "vary": "0.1.0",
     "cookie": "0.1.2",

From 1168d0bb8b787bd3a132e605be9c81f207fe2b3f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 01:58:32 -0400
Subject: [PATCH 0462/1265] deps: qs@1.0.2

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 13868283338..1ea2930a3a6 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,11 @@
 unreleased
 ==========
 
+  * deps: qs@1.0.2
+    - Complete rewrite
+    - Limits array length to 20
+    - Limits object depth to 5
+    - Limits parameters to 1,000
   * deps: send@0.8.1
     - Add `extensions` option
   * deps: serve-static@~1.5.0
diff --git a/package.json b/package.json
index d815814767c..a2691339a83 100644
--- a/package.json
+++ b/package.json
@@ -37,6 +37,7 @@
     "parseurl": "~1.2.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "1.0.1",
+    "qs": "1.0.2",
     "range-parser": "1.0.0",
     "send": "0.8.1",
     "serve-static": "~1.5.0",
@@ -46,7 +47,6 @@
     "fresh": "0.2.2",
     "cookie-signature": "1.0.4",
     "merge-descriptors": "0.0.2",
-    "qs": "0.6.6",
     "utils-merge": "1.0.0"
   },
   "devDependencies": {

From 7e32fa1be647515c183d0ef831c391c66f25e69c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 01:59:09 -0400
Subject: [PATCH 0463/1265] deps: update example dependencies

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index a2691339a83..6ef39435ea5 100644
--- a/package.json
+++ b/package.json
@@ -59,7 +59,7 @@
     "ejs": "~1.0.0",
     "marked": "0.3.2",
     "hjs": "~0.0.6",
-    "body-parser": "~1.5.2",
+    "body-parser": "~1.6.0",
     "cookie-parser": "~1.3.1",
     "express-session": "~1.7.2",
     "jade": "~1.5.0",

From 2cb029f896dff3a488dfd0c745997183525b8c05 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 02:09:25 -0400
Subject: [PATCH 0464/1265] Add res.sendFile

fixes #1906
closes #2266
---
 History.md                                |   3 +
 lib/response.js                           | 118 ++++++++++++++++
 test/{res.sendfile.js => res.sendFile.js} | 159 ++++++++++++++++++++++
 3 files changed, 280 insertions(+)
 rename test/{res.sendfile.js => res.sendFile.js} (65%)

diff --git a/History.md b/History.md
index 1ea2930a3a6..d283004df61 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,9 @@
 unreleased
 ==========
 
+  * add `res.sendFile`
+    - accepts a file system path instead of a URL
+    - requires an absolute path or `root` option specified
   * deps: qs@1.0.2
     - Complete rewrite
     - Limits array length to 20
diff --git a/lib/response.js b/lib/response.js
index eff48d74100..ec44796fe5c 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -5,6 +5,7 @@
 var deprecate = require('depd')('express');
 var escapeHtml = require('escape-html');
 var http = require('http');
+var isAbsolute = require('./utils').isAbsolute;
 var path = require('path');
 var mixin = require('utils-merge');
 var sign = require('cookie-signature').sign;
@@ -301,6 +302,123 @@ res.jsonp = function jsonp(obj) {
   return this.send(body);
 };
 
+/**
+ * Transfer the file at the given `path`.
+ *
+ * Automatically sets the _Content-Type_ response header field.
+ * The callback `fn(err)` is invoked when the transfer is complete
+ * or when an error occurs. Be sure to check `res.sentHeader`
+ * if you wish to attempt responding, as the header and some data
+ * may have already been transferred.
+ *
+ * Options:
+ *
+ *   - `maxAge`   defaulting to 0 (can be string converted by `ms`)
+ *   - `root`     root directory for relative filenames
+ *   - `headers`  object of headers to serve with file
+ *   - `dotfiles` serve dotfiles, defaulting to false; can be `"allow"` to send them
+ *
+ * Other options are passed along to `send`.
+ *
+ * Examples:
+ *
+ *  The following example illustrates how `res.sendFile()` may
+ *  be used as an alternative for the `static()` middleware for
+ *  dynamic situations. The code backing `res.sendFile()` is actually
+ *  the same code, so HTTP cache support etc is identical.
+ *
+ *     app.get('/user/:uid/photos/:file', function(req, res){
+ *       var uid = req.params.uid
+ *         , file = req.params.file;
+ *
+ *       req.user.mayViewFilesFrom(uid, function(yes){
+ *         if (yes) {
+ *           res.sendFile('/uploads/' + uid + '/' + file);
+ *         } else {
+ *           res.send(403, 'Sorry! you cant see that.');
+ *         }
+ *       });
+ *     });
+ *
+ * @api public
+ */
+
+res.sendFile = function sendFile(path, options, fn) {
+  var done;
+  var req = this.req;
+  var next = req.next;
+
+  if (!path) {
+    throw new TypeError('path argument is required to res.sendFile');
+  }
+
+  // support function as second arg
+  if (typeof options === 'function') {
+    fn = options;
+    options = {};
+  }
+
+  options = options || {};
+
+  if (!options.root && !isAbsolute(path)) {
+    throw new TypeError('path must be absolute or specify root to res.sendFile');
+  }
+
+  // socket errors
+  req.socket.on('error', onerror);
+
+  // errors
+  function onerror(err) {
+    if (done) return;
+    done = true;
+
+    // clean up
+    cleanup();
+
+    // callback available
+    if (fn) return fn(err);
+
+    // delegate
+    next(err);
+  }
+
+  // streaming
+  function onstream(stream) {
+    if (done) return;
+    cleanup();
+    if (fn) stream.on('end', fn);
+  }
+
+  // cleanup
+  function cleanup() {
+    req.socket.removeListener('error', onerror);
+  }
+
+  // transfer
+  var pathname = encodeURI(path);
+  var file = send(req, pathname, options);
+  file.on('error', onerror);
+  file.on('directory', next);
+  file.on('stream', onstream);
+
+  if (options.headers) {
+    // set headers on successful transfer
+    file.on('headers', function headers(res) {
+      var obj = options.headers;
+      var keys = Object.keys(obj);
+
+      for (var i = 0; i < keys.length; i++) {
+        var k = keys[i];
+        res.setHeader(k, obj[k]);
+      }
+    });
+  }
+
+  // pipe
+  file.pipe(this);
+  this.on('finish', cleanup);
+};
+
 /**
  * Transfer the file at the given `path`.
  *
diff --git a/test/res.sendfile.js b/test/res.sendFile.js
similarity index 65%
rename from test/res.sendfile.js
rename to test/res.sendFile.js
index c6e2fce9927..b9e6007833b 100644
--- a/test/res.sendfile.js
+++ b/test/res.sendFile.js
@@ -1,9 +1,158 @@
 
+var after = require('after');
 var express = require('../')
   , request = require('supertest')
   , assert = require('assert');
+var path = require('path');
+var should = require('should');
+var fixtures = path.join(__dirname, 'fixtures');
 
 describe('res', function(){
+  describe('.sendFile(path)', function () {
+    it('should transfer a file', function (done) {
+      var app = createApp(path.resolve(fixtures, 'name.txt'));
+
+      request(app)
+      .get('/')
+      .expect(200, 'tobi', done);
+    });
+
+    it('should transfer a file with special characters in string', function (done) {
+      var app = createApp(path.resolve(fixtures, '% of dogs.txt'));
+
+      request(app)
+      .get('/')
+      .expect(200, '20%', done);
+    });
+
+    it('should 404 when not found', function (done) {
+      var app = createApp(path.resolve(fixtures, 'does-no-exist'));
+
+      app.use(function (req, res) {
+        res.statusCode = 200;
+        res.send('no!');
+      });
+
+      request(app)
+      .get('/')
+      .expect(404, done);
+    });
+
+    it('should not override manual content-types', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.contentType('application/x-bogus');
+        res.sendFile(path.resolve(fixtures, 'name.txt'));
+      });
+
+      request(app)
+      .get('/')
+      .expect('Content-Type', 'application/x-bogus')
+      .end(done);
+    })
+
+    describe('with "dotfiles" option', function () {
+      it('should not serve dotfiles by default', function (done) {
+        var app = createApp(path.resolve(__dirname, 'fixtures/.name'));
+
+        request(app)
+        .get('/')
+        .expect(404, done);
+      });
+
+      it('should accept dotfiles option', function(done){
+        var app = createApp(path.resolve(__dirname, 'fixtures/.name'), { dotfiles: 'allow' });
+
+        request(app)
+        .get('/')
+        .expect(200, 'tobi', done);
+      });
+    });
+
+    describe('with "headers" option', function () {
+      it('should accept headers option', function (done) {
+        var headers = {
+           'x-success': 'sent',
+           'x-other': 'done'
+        };
+        var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'), { headers: headers });
+
+        request(app)
+        .get('/')
+        .expect('x-success', 'sent')
+        .expect('x-other', 'done')
+        .expect(200, done);
+      });
+
+      it('should ignore headers option on 404', function (done) {
+        var headers = { 'x-success': 'sent' };
+        var app = createApp(path.resolve(__dirname, 'fixtures/does-not-exist'), { headers: headers });
+
+        request(app)
+        .get('/')
+        .expect(404, function (err, res) {
+          if (err) return done(err);
+          res.headers.should.not.have.property('x-success');
+          done();
+        });
+      });
+    });
+
+    describe('with "root" option', function () {
+      it('should not transfer relative with without', function (done) {
+        var app = createApp('test/fixtures/name.txt');
+
+        request(app)
+        .get('/')
+        .expect(500, /must be absolute/, done);
+      })
+
+      it('should serve relative to "root"', function (done) {
+        var app = createApp('name.txt', {root: fixtures});
+
+        request(app)
+        .get('/')
+        .expect(200, 'tobi', done);
+      })
+
+      it('should disallow requesting out of "root"', function (done) {
+        var app = createApp('foo/../../user.html', {root: fixtures});
+
+        request(app)
+        .get('/')
+        .expect(403, done);
+      })
+    })
+  })
+
+  describe('.sendFile(path, fn)', function () {
+    it('should invoke the callback when complete', function (done) {
+      var cb = after(2, done);
+      var app = createApp(path.resolve(fixtures, 'name.txt'), cb);
+
+      request(app)
+      .get('/')
+      .expect(200, cb);
+    })
+
+    it('should invoke the callback on 404', function(done){
+      var app = express();
+
+      app.use(function (req, res) {
+        res.sendFile(path.resolve(fixtures, 'does-not-exist'), function (err) {
+          should(err).be.ok;
+          err.status.should.equal(404);
+          res.send('got it');
+        });
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, 'got it', done);
+    })
+  })
+
   describe('.sendfile(path, fn)', function(){
     it('should invoke the callback when complete', function(done){
       var app = express();
@@ -331,3 +480,13 @@ describe('res', function(){
     })
   })
 })
+
+function createApp(path, options, fn) {
+  var app = express();
+
+  app.use(function (req, res) {
+    res.sendFile(path, options, fn);
+  });
+
+  return app;
+}

From 8449f23f0d74b0f3159f8652a6bc019cb3678847 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 02:27:16 -0400
Subject: [PATCH 0465/1265] Deprecate res.sendfile

---
 History.md      | 1 +
 lib/response.js | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/History.md b/History.md
index d283004df61..3c3bf8a53c5 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,7 @@ unreleased
   * add `res.sendFile`
     - accepts a file system path instead of a URL
     - requires an absolute path or `root` option specified
+  * deprecate `res.sendfile` -- use `res.sendFile` instead
   * deps: qs@1.0.2
     - Complete rewrite
     - Limits array length to 20
diff --git a/lib/response.js b/lib/response.js
index ec44796fe5c..30cd4004c09 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -528,6 +528,9 @@ res.sendfile = function(path, options, fn){
   this.on('finish', cleanup);
 };
 
+res.sendfile = deprecate.function(res.sendfile,
+  'res.sendfile: Use res.sendFile instead');
+
 /**
  * Transfer the file at the given `path` as an attachment.
  *

From 17cea29013c64b169e3fa8ddde903e05ce533ab0 Mon Sep 17 00:00:00 2001
From: Fabien Franzen <info@atelierfabien.be>
Date: Sat, 2 Aug 2014 11:41:35 +0200
Subject: [PATCH 0466/1265] Support mounted app as any argument to app.use()

fixes #2277
---
 History.md         |  1 +
 lib/application.js | 60 ++++++++++++++++++++++++----------------------
 test/app.use.js    | 40 ++++++++++++++++++++++++++++++-
 3 files changed, 72 insertions(+), 29 deletions(-)

diff --git a/History.md b/History.md
index 3c3bf8a53c5..96b64966b9e 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
     - accepts a file system path instead of a URL
     - requires an absolute path or `root` option specified
   * deprecate `res.sendfile` -- use `res.sendFile` instead
+  * support mounted app as any argument to `app.use()`
   * deps: qs@1.0.2
     - Complete rewrite
     - Limits array length to 20
diff --git a/lib/application.js b/lib/application.js
index b8b69c0670b..2214bf6c1f3 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -3,6 +3,7 @@
  */
 
 var finalhandler = require('finalhandler');
+var flatten = require('./utils').flatten;
 var mixin = require('utils-merge');
 var Router = require('./router');
 var methods = require('methods');
@@ -16,6 +17,7 @@ var compileQueryParser = require('./utils').compileQueryParser;
 var compileTrust = require('./utils').compileTrust;
 var deprecate = require('depd')('express');
 var resolve = require('path').resolve;
+var slice = Array.prototype.slice;
 
 /**
  * Application prototype.
@@ -149,34 +151,41 @@ app.handle = function(req, res, done) {
  * @api public
  */
 
-app.use = function use(path, fn) {
-  var mount_app;
-  var mount_path;
-
-  // check for .use(path, app) or .use(app) signature
-  if (arguments.length <= 2) {
-    mount_path = typeof path === 'string'
-      ? path
-      : '/';
-    mount_app = typeof path === 'function'
-      ? path
-      : fn;
+app.use = function use(fn) {
+  var offset = 0;
+  var path = '/';
+  var self = this;
+
+  // default path to '/'
+  if (typeof fn !== 'function') {
+    offset = 1;
+    path = fn;
+  }
+
+  var fns = flatten(slice.call(arguments, offset));
+
+  if (fns.length === 0) {
+    throw new TypeError('app.use() requires middleware functions');
   }
 
   // setup router
   this.lazyrouter();
   var router = this._router;
 
-  // express app
-  if (mount_app && mount_app.handle && mount_app.set) {
-    debug('.use app under %s', mount_path);
-    mount_app.mountpath = mount_path;
-    mount_app.parent = this;
+  fns.forEach(function (fn) {
+    // non-express app
+    if (!fn || !fn.handle || !fn.set) {
+      return router.use(path, fn);
+    }
+
+    debug('.use app under %s', path);
+    fn.mountpath = path;
+    fn.parent = self;
 
     // restore .app property on req and res
-    router.use(mount_path, function mounted_app(req, res, next) {
+    router.use(path, function mounted_app(req, res, next) {
       var orig = req.app;
-      mount_app.handle(req, res, function(err) {
+      fn.handle(req, res, function (err) {
         req.__proto__ = orig.request;
         res.__proto__ = orig.response;
         next(err);
@@ -184,13 +193,8 @@ app.use = function use(path, fn) {
     });
 
     // mounted an app
-    mount_app.emit('mount', this);
-
-    return this;
-  }
-
-  // pass-through use
-  router.use.apply(router, arguments);
+    fn.emit('mount', self);
+  });
 
   return this;
 };
@@ -414,7 +418,7 @@ methods.forEach(function(method){
     this.lazyrouter();
 
     var route = this._router.route(path);
-    route[method].apply(route, [].slice.call(arguments, 1));
+    route[method].apply(route, slice.call(arguments, 1));
     return this;
   };
 });
@@ -433,7 +437,7 @@ app.all = function(path){
   this.lazyrouter();
 
   var route = this._router.route(path);
-  var args = [].slice.call(arguments, 1);
+  var args = slice.call(arguments, 1);
   methods.forEach(function(method){
     route[method].apply(route, args);
   });
diff --git a/test/app.use.js b/test/app.use.js
index 681a6a911de..ee237c88507 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -18,7 +18,7 @@ describe('app', function(){
 
   it('should reject missing functions', function(){
     var app = express();
-    app.use.bind(app, 3).should.throw(/requires callback function/);
+    app.use.bind(app, 3).should.throw(/requires middleware function/);
   })
 
   describe('.use(app)', function(){
@@ -84,6 +84,44 @@ describe('app', function(){
       .get('/post/once-upon-a-time')
       .expect('success', done);
     })
+
+    it('should support mounted app anywhere', function(done){
+      var cb = after(3, done);
+      var blog = express()
+        , other = express()
+        , app = express();
+
+      function fn1(req, res, next) {
+        res.setHeader('x-fn-1', 'hit');
+        next();
+      }
+
+      function fn2(req, res, next) {
+        res.setHeader('x-fn-2', 'hit');
+        next();
+      }
+
+      blog.get('/', function(req, res){
+        res.end('success');
+      });
+
+      blog.once('mount', function (parent) {
+        parent.should.equal(app);
+        cb();
+      });
+      other.once('mount', function (parent) {
+        parent.should.equal(app);
+        cb();
+      });
+
+      app.use('/post/:article', fn1, other, fn2, blog);
+
+      request(app)
+      .get('/post/once-upon-a-time')
+      .expect('x-fn-1', 'hit')
+      .expect('x-fn-2', 'hit')
+      .expect('success', cb);
+    })
   })
 
   describe('.use(middleware)', function(){

From 4aea02310ad7738fb1b3bac08de5424d82bfe4c6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 02:50:59 -0400
Subject: [PATCH 0467/1265] 4.8.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 96b64966b9e..347d24f5e82 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.8.0 / 2014-08-05
+==================
 
   * add `res.sendFile`
     - accepts a file system path instead of a URL
diff --git a/package.json b/package.json
index 6ef39435ea5..718ef05713d 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.7.4",
+  "version": "4.8.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 1150ca7264fe868a7685302987edb5bb564b0faf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 17:48:36 -0400
Subject: [PATCH 0468/1265] Fix incorrect deprecation warnings on res.download

fixes #2284
---
 History.md      |  5 +++++
 lib/response.js | 10 +++++++---
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 347d24f5e82..b89ac19c918 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * fix incorrect deprecation warnings on `res.download`
+
 4.8.0 / 2014-08-05
 ==================
 
diff --git a/lib/response.js b/lib/response.js
index 30cd4004c09..e929291da39 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -19,6 +19,7 @@ var send = require('send');
 var basename = path.basename;
 var extname = path.extname;
 var mime = send.mime;
+var resolve = path.resolve;
 var vary = require('vary');
 
 /**
@@ -544,9 +545,9 @@ res.sendfile = deprecate.function(res.sendfile,
  * @api public
  */
 
-res.download = function(path, filename, fn){
+res.download = function download(path, filename, fn) {
   // support function as second arg
-  if ('function' == typeof filename) {
+  if (typeof filename === 'function') {
     fn = filename;
     filename = null;
   }
@@ -558,7 +559,10 @@ res.download = function(path, filename, fn){
     'Content-Disposition': contentDisposition(filename)
   };
 
-  return this.sendfile(path, { headers: headers }, fn);
+  // Resolve the full path for sendFile
+  var fullPath = resolve(path);
+
+  return this.sendFile(fullPath, { headers: headers }, fn);
 };
 
 /**

From a3b5adcf4aa5bd7df9a0ebc2c870c02bec764ad0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 17:50:08 -0400
Subject: [PATCH 0469/1265] deps: qs@1.1.0

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index b89ac19c918..c7b3603a2d1 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,9 @@ unreleased
 ==========
 
   * fix incorrect deprecation warnings on `res.download`
+  * deps: qs@1.1.0
+    - Accept urlencoded square brackets
+    - Accept empty values in implicit array notation
 
 4.8.0 / 2014-08-05
 ==================
diff --git a/package.json b/package.json
index 718ef05713d..664a3b560f2 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "parseurl": "~1.2.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "1.0.1",
-    "qs": "1.0.2",
+    "qs": "1.1.0",
     "range-parser": "1.0.0",
     "send": "0.8.1",
     "serve-static": "~1.5.0",

From 7f606ebf29f3a0d5fdad8de77f26d757dfb83022 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 18:05:50 -0400
Subject: [PATCH 0470/1265] deps: connect@2.25.1

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 3b0306e578b..3aa1ef5d38f 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+3.x
+===
+
+  * deps: connect@2.25.1
+    - deps: body-parser@~1.6.1
+    - deps: qs@1.1.0
+
 3.16.0 / 2014-08-05
 ===================
 
diff --git a/package.json b/package.json
index a7243182b04..0d8cdb324a6 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.25.0",
+    "connect": "2.25.1",
     "commander": "1.3.2",
     "debug": "1.0.4",
     "depd": "0.4.4",

From 0bd6c311cffc79e5ed14434604c4fb19541378a0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 18:06:19 -0400
Subject: [PATCH 0471/1265] deps: mocha@~1.21.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 0d8cdb324a6..edf7d31a57d 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
   "devDependencies": {
     "connect-redis": "~1.5.0",
     "istanbul": "0.3.0",
-    "mocha": "~1.21.0",
+    "mocha": "~1.21.4",
     "should": "~4.0.0",
     "ejs": "~1.0.0",
     "jade": "~1.5.0",

From ea427c1bb4667be345d786c5120c435dbca3d13a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 18:07:31 -0400
Subject: [PATCH 0472/1265] 3.16.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 3aa1ef5d38f..546e4a0de9e 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.16.1 / 2014-08-06
+===================
 
   * deps: connect@2.25.1
     - deps: body-parser@~1.6.1
diff --git a/package.json b/package.json
index edf7d31a57d..3a3eb89cf17 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.16.0",
+  "version": "3.16.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 4f5b27dd81e15f4d6c8dc551b2d5bd3757579a23 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 18:10:32 -0400
Subject: [PATCH 0473/1265] deps: update example dependencies

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 55a1ef9f3fd..8d516dcd5cb 100644
--- a/package.json
+++ b/package.json
@@ -59,7 +59,7 @@
     "ejs": "~1.0.0",
     "marked": "0.3.2",
     "hjs": "~0.0.6",
-    "body-parser": "~1.6.0",
+    "body-parser": "~1.6.1",
     "cookie-parser": "~1.3.1",
     "express-session": "~1.7.2",
     "jade": "~1.5.0",

From e8f8ea7e05c27eb10286ec62a5f4df533deeeff8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 18:13:54 -0400
Subject: [PATCH 0474/1265] docs: update examples for deprecations

---
 examples/error/index.js       | 3 ++-
 examples/search/index.js      | 4 ++--
 examples/web-service/index.js | 6 ++++--
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/examples/error/index.js b/examples/error/index.js
index 35ba486982f..d7db5015a13 100644
--- a/examples/error/index.js
+++ b/examples/error/index.js
@@ -20,7 +20,8 @@ function error(err, req, res, next) {
   if (!test) console.error(err.stack);
 
   // respond with 500 "Internal Server Error".
-  res.send(500);
+  res.status(500);
+  res.send('Internal Server Error');
 }
 
 app.get('/', function(req, res){
diff --git a/examples/search/index.js b/examples/search/index.js
index cc470c66f29..d614ac24076 100644
--- a/examples/search/index.js
+++ b/examples/search/index.js
@@ -47,14 +47,14 @@ app.get('/search/:query?', function(req, res){
 });
 
 /**
- * GET client javascript. Here we use sendfile()
+ * GET client javascript. Here we use sendFile()
  * because serving __dirname with the static() middleware
  * would also mean serving our server "index.js" and the "search.jade"
  * template.
  */
 
 app.get('/client.js', function(req, res){
-  res.sendfile(__dirname + '/client.js');
+  res.sendFile(__dirname + '/client.js');
 });
 
 /* istanbul ignore next */
diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index 27e746c7c7e..7e51d4fa060 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -93,14 +93,16 @@ app.get('/api/user/:name/repos', function(req, res, next){
 app.use(function(err, req, res, next){
   // whatever you want here, feel free to populate
   // properties on `err` to treat it differently in here.
-  res.send(err.status || 500, { error: err.message });
+  res.status(err.status || 500);
+  res.send({ error: err.message });
 });
 
 // our custom JSON 404 middleware. Since it's placed last
 // it will be the last middleware called, if all others
 // invoke next() and do not respond.
 app.use(function(req, res){
-  res.send(404, { error: "Lame, can't find that" });
+  res.status(404);
+  res.send({ error: "Lame, can't find that" });
 });
 
 /* istanbul ignore next */

From 552b441f8ab3457c284a8d6dc5eeaedc51d52df4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Aug 2014 18:21:55 -0400
Subject: [PATCH 0475/1265] 4.8.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 102f9f1bb67..d0bf6a66f62 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.8.1 / 2014-08-06
+==================
 
   * fix incorrect deprecation warnings on `res.download`
   * deps: qs@1.1.0
diff --git a/package.json b/package.json
index 8d516dcd5cb..c998ab53640 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.8.0",
+  "version": "4.8.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 982d24b47553f72195d0f83581b48f32cb50591a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 7 Aug 2014 11:53:40 -0400
Subject: [PATCH 0476/1265] deps: connect@2.25.2

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 546e4a0de9e..2d18e60b816 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+3.x
+===
+
+  * deps: connect@2.25.2
+    - deps: body-parser@~1.6.2
+    - deps: qs@1.2.0
+
 3.16.1 / 2014-08-06
 ===================
 
diff --git a/package.json b/package.json
index 3a3eb89cf17..17052a0025f 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.25.1",
+    "connect": "2.25.2",
     "commander": "1.3.2",
     "debug": "1.0.4",
     "depd": "0.4.4",

From ddac571fdf36aef1381c53dd4766f5e9054b1aa3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 7 Aug 2014 11:59:54 -0400
Subject: [PATCH 0477/1265] 3.16.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 2d18e60b816..1e4e0cf8159 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.16.2 / 2014-08-07
+===================
 
   * deps: connect@2.25.2
     - deps: body-parser@~1.6.2
diff --git a/package.json b/package.json
index 17052a0025f..3cca5e52c73 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.16.1",
+  "version": "3.16.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 7989c883feacb9de542ce03be372173daebf69d1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 7 Aug 2014 12:03:53 -0400
Subject: [PATCH 0478/1265] deps: qs@1.2.0

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index b9ef0068c3e..6088b540a4f 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: qs@1.2.0
+    - Fix parsing array of objects
+
 4.8.1 / 2014-08-06
 ==================
 
diff --git a/package.json b/package.json
index c998ab53640..9179139bf80 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "parseurl": "~1.2.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "1.0.1",
-    "qs": "1.1.0",
+    "qs": "1.2.0",
     "range-parser": "1.0.0",
     "send": "0.8.1",
     "serve-static": "~1.5.0",

From 22ca953e96e66e142e2e89ba1fa3386a876ce55f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 7 Aug 2014 12:05:02 -0400
Subject: [PATCH 0479/1265] 4.8.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 6088b540a4f..f0ba9ba50e3 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.8.2 / 2014-08-07
+==================
 
   * deps: qs@1.2.0
     - Fix parsing array of objects
diff --git a/package.json b/package.json
index 9179139bf80..fca184e2971 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.8.1",
+  "version": "4.8.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 9204e1f42ab0019dfed3298db96af7646079ebbd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 7 Aug 2014 22:31:53 -0400
Subject: [PATCH 0480/1265] deps: connect@2.25.3

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 1e4e0cf8159..b3173d6ff69 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+3.x
+===
+
+  * deps: connect@2.25.3
+    - deps: multiparty@3.3.2
+
 3.16.2 / 2014-08-07
 ===================
 
diff --git a/package.json b/package.json
index 3cca5e52c73..b9ca3e6072f 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.25.2",
+    "connect": "2.25.3",
     "commander": "1.3.2",
     "debug": "1.0.4",
     "depd": "0.4.4",

From d13e6135844e1c949ac0f10f307130c4df153085 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 7 Aug 2014 22:32:16 -0400
Subject: [PATCH 0481/1265] 3.16.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index b3173d6ff69..cc26e9e2698 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.16.3 / 2014-08-07
+===================
 
   * deps: connect@2.25.3
     - deps: multiparty@3.3.2
diff --git a/package.json b/package.json
index b9ca3e6072f..ffd3e0a3f99 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.16.2",
+  "version": "3.16.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 570f60d36eea61d410e952c57583f6c7b8117cdd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Aug 2014 22:18:12 -0400
Subject: [PATCH 0482/1265] deps: connect@2.25.4

---
 History.md   | 17 +++++++++++++++++
 package.json |  2 +-
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index cc26e9e2698..a8997ae6a36 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,20 @@
+3.x
+===
+
+  * deps: connect@2.25.4
+    - Fix `query` middleware breaking with argument
+    - deps: body-parser@~1.6.3
+    - deps: compression@~1.0.11
+    - deps: connect-timeout@~1.2.2
+    - deps: express-session@~1.7.5
+    - deps: method-override@~2.1.3
+    - deps: on-headers@~1.0.0
+    - deps: parseurl@~1.3.0
+    - deps: qs@1.2.1
+    - deps: response-time@~2.0.1
+    - deps: serve-index@~1.1.6
+    - deps: serve-static@~1.5.1
+
 3.16.3 / 2014-08-07
 ===================
 
diff --git a/package.json b/package.json
index ffd3e0a3f99..37697f27c99 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.25.3",
+    "connect": "2.25.4",
     "commander": "1.3.2",
     "debug": "1.0.4",
     "depd": "0.4.4",

From 4a4ca7347a8ada0de14b83503c9e5c50d4fc97e8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Aug 2014 22:19:10 -0400
Subject: [PATCH 0483/1265] deps: parseurl@~1.3.0

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a8997ae6a36..9222b1382ee 100644
--- a/History.md
+++ b/History.md
@@ -14,6 +14,7 @@
     - deps: response-time@~2.0.1
     - deps: serve-index@~1.1.6
     - deps: serve-static@~1.5.1
+  * deps: parseurl@~1.3.0
 
 3.16.3 / 2014-08-07
 ===================
diff --git a/package.json b/package.json
index 37697f27c99..6b1226c15b2 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,7 @@
     "media-typer": "0.2.0",
     "methods": "1.1.0",
     "mkdirp": "0.5.0",
-    "parseurl": "~1.2.0",
+    "parseurl": "~1.3.0",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.8.1",

From a57efea173240961cd038b2336f36183054d7d97 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Aug 2014 22:20:54 -0400
Subject: [PATCH 0484/1265] Fix original URL parsing in res.location

---
 History.md      | 1 +
 lib/response.js | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 9222b1382ee..0a13e9020ca 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 3.x
 ===
 
+  * Fix original URL parsing in `res.location`
   * deps: connect@2.25.4
     - Fix `query` middleware breaking with argument
     - deps: body-parser@~1.6.3
diff --git a/lib/response.js b/lib/response.js
index 61c7f16c3ce..822b849187e 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -4,6 +4,7 @@
 
 var deprecate = require('depd')('express');
 var escapeHtml = require('escape-html');
+var parseUrl = require('parseurl');
 var vary = require('vary');
 var http = require('http')
   , path = require('path')
@@ -693,7 +694,7 @@ res.location = function(url){
   if (!~url.indexOf('://') && 0 != url.indexOf('//')) {
     // relative to path
     if ('.' == url[0]) {
-      path = req.originalUrl.split('?')[0];
+      path = parseUrl.original(req).pathname;
       path = path + ('/' == path[path.length - 1] ? '' : '/');
       url = resolve(path, url);
       // relative to mount-point

From 7119f2b16d610af6e4eb6d79292c52e2e8c506d9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Aug 2014 22:22:58 -0400
Subject: [PATCH 0485/1265] 3.16.4

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 0a13e9020ca..5b078665702 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.16.4 / 2014-08-10
+===================
 
   * Fix original URL parsing in `res.location`
   * deps: connect@2.25.4
diff --git a/package.json b/package.json
index 6b1226c15b2..6a815860d85 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.16.3",
+  "version": "3.16.4",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 8473b3c3386fa81f3a3b89cb952fd45304430a80 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Aug 2014 22:27:42 -0400
Subject: [PATCH 0486/1265] deps: qs@1.2.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 626bc6a2f4f..ffdac98e56a 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * deps: parseurl@~1.3.0
+  * deps: qs@1.2.1
 
 4.8.2 / 2014-08-07
 ==================
diff --git a/package.json b/package.json
index f3ad70d4db8..55c6093daae 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "1.0.1",
-    "qs": "1.2.0",
+    "qs": "1.2.1",
     "range-parser": "1.0.0",
     "send": "0.8.1",
     "serve-static": "~1.5.0",

From 2594f3103b0a0410aaaa8c1385f82c326afb839e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Aug 2014 22:29:24 -0400
Subject: [PATCH 0487/1265] deps: serve-static@~1.5.1

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ffdac98e56a..88c809173f1 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,10 @@ unreleased
 
   * deps: parseurl@~1.3.0
   * deps: qs@1.2.1
+  * deps: serve-static@~1.5.1
+    - Fix parsing of weird `req.originalUrl` values
+    - deps: parseurl@~1.3.0
+    - deps: utils-merge@1.0.0
 
 4.8.2 / 2014-08-07
 ==================
diff --git a/package.json b/package.json
index 55c6093daae..e6df7cd0869 100644
--- a/package.json
+++ b/package.json
@@ -40,7 +40,7 @@
     "qs": "1.2.1",
     "range-parser": "1.0.0",
     "send": "0.8.1",
-    "serve-static": "~1.5.0",
+    "serve-static": "~1.5.1",
     "type-is": "~1.3.2",
     "vary": "0.1.0",
     "cookie": "0.1.2",

From 1643ae442c724e1ea14383b62675cb13c49e3f49 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Aug 2014 22:30:07 -0400
Subject: [PATCH 0488/1265] 4.8.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 88c809173f1..228e6175e4d 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.8.3 / 2014-08-10
+==================
 
   * deps: parseurl@~1.3.0
   * deps: qs@1.2.1
diff --git a/package.json b/package.json
index e6df7cd0869..8cf9a5d0957 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.8.2",
+  "version": "4.8.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 0f87c6f3929427e07914b77a0e1c28385ab76e02 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 11 Aug 2014 22:29:35 -0400
Subject: [PATCH 0489/1265] deps: connect@2.25.5

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5b078665702..43b7ec81519 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+3.x
+===
+
+  * deps: connect@2.25.5
+    - Fix backwards compatibility in `logger`
+
 3.16.4 / 2014-08-10
 ===================
 
diff --git a/package.json b/package.json
index 6a815860d85..3d2dd22d7a8 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.25.4",
+    "connect": "2.25.5",
     "commander": "1.3.2",
     "debug": "1.0.4",
     "depd": "0.4.4",

From 0dddd772c0096b62ab67295083fb1795c353f0ff Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 11 Aug 2014 22:30:09 -0400
Subject: [PATCH 0490/1265] 3.16.5

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 43b7ec81519..c4f63d1c268 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.16.5 / 2014-08-11
+===================
 
   * deps: connect@2.25.5
     - Fix backwards compatibility in `logger`
diff --git a/package.json b/package.json
index 3d2dd22d7a8..38bcc58f1fb 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.16.4",
+  "version": "3.16.5",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 49947f1476b35276cb280d5a0f7c117020caff57 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 14 Aug 2014 23:49:39 -0400
Subject: [PATCH 0491/1265] deps: connect@2.25.6

---
 History.md   | 8 ++++++++
 package.json | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c4f63d1c268..7ad8528a31f 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,11 @@
+3.x
+===
+
+  * deps: connect@2.25.6
+    - deps: body-parser@~1.6.4
+    - deps: qs@1.2.2
+    - deps: serve-static@~1.5.2
+
 3.16.5 / 2014-08-11
 ===================
 
diff --git a/package.json b/package.json
index 38bcc58f1fb..f8b018293d2 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.25.5",
+    "connect": "2.25.6",
     "commander": "1.3.2",
     "debug": "1.0.4",
     "depd": "0.4.4",

From 059c068c7be185a48935bfb94dc024aaaf7389f5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 14 Aug 2014 23:50:31 -0400
Subject: [PATCH 0492/1265] deps: send@0.8.2

fixes #2300
---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 7ad8528a31f..ce9cb5d93fc 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,8 @@
     - deps: body-parser@~1.6.4
     - deps: qs@1.2.2
     - deps: serve-static@~1.5.2
+  * deps: send@0.8.2
+    - Work around `fd` leak in Node.js 0.10 for `fs.ReadStream`
 
 3.16.5 / 2014-08-11
 ===================
diff --git a/package.json b/package.json
index f8b018293d2..bef56cf789a 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "parseurl": "~1.3.0",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.8.1",
+    "send": "0.8.2",
     "vary": "0.1.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",

From f13f4652da58c42e30c59e2b0b5b0d58b1d97bb7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 14 Aug 2014 23:53:32 -0400
Subject: [PATCH 0493/1265] 3.16.6

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index ce9cb5d93fc..0fcbf87c30f 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.16.6 / 2014-08-14
+===================
 
   * deps: connect@2.25.6
     - deps: body-parser@~1.6.4
diff --git a/package.json b/package.json
index bef56cf789a..f7a4ca679d6 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.16.5",
+  "version": "3.16.6",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 666ffc62d8b3e44da98a3d55aa6cdaa48726e108 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 15 Aug 2014 00:15:28 -0400
Subject: [PATCH 0494/1265] deps: serve-static@~1.5.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 47f626d8c30..4bcaaddde27 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,8 @@ unreleased
 
   * deps: send@0.8.2
     - Work around `fd` leak in Node.js 0.10 for `fs.ReadStream`
+  * deps: serve-static@~1.5.2
+    - deps: send@0.8.2
 
 4.8.3 / 2014-08-10
 ==================
diff --git a/package.json b/package.json
index 17bbe130f79..9cac3ded082 100644
--- a/package.json
+++ b/package.json
@@ -40,7 +40,7 @@
     "qs": "1.2.1",
     "range-parser": "1.0.0",
     "send": "0.8.2",
-    "serve-static": "~1.5.1",
+    "serve-static": "~1.5.2",
     "type-is": "~1.3.2",
     "vary": "0.1.0",
     "cookie": "0.1.2",

From ad3ca25c581e9a32edf8abad8aff9d72d51257fd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 15 Aug 2014 00:16:20 -0400
Subject: [PATCH 0495/1265] deps: qs@1.2.2

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 4bcaaddde27..0a0d6031945 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * deps: qs@1.2.2
   * deps: send@0.8.2
     - Work around `fd` leak in Node.js 0.10 for `fs.ReadStream`
   * deps: serve-static@~1.5.2
diff --git a/package.json b/package.json
index 9cac3ded082..ee249abdda8 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "1.0.1",
-    "qs": "1.2.1",
+    "qs": "1.2.2",
     "range-parser": "1.0.0",
     "send": "0.8.2",
     "serve-static": "~1.5.2",

From fbceae2716e94a69ba47cc7a688567b4392ab6a3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 15 Aug 2014 00:18:54 -0400
Subject: [PATCH 0496/1265] tests: add additional res.sendFile test

closes #2298
---
 test/res.sendFile.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index b9e6007833b..eac1f97c259 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -9,6 +9,14 @@ var fixtures = path.join(__dirname, 'fixtures');
 
 describe('res', function(){
   describe('.sendFile(path)', function () {
+    it('should error missing path', function (done) {
+      var app = createApp();
+
+      request(app)
+      .get('/')
+      .expect(500, /path.*required/, done);
+    });
+
     it('should transfer a file', function (done) {
       var app = createApp(path.resolve(fixtures, 'name.txt'));
 

From 1ca01c0c47ce16ca2dcc34442b1182ac5b4c9704 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 15 Aug 2014 00:22:54 -0400
Subject: [PATCH 0497/1265] tests: add router.use validation tests

closes #2299
---
 test/Router.js | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/test/Router.js b/test/Router.js
index e42d9520108..142b9b33faa 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -297,6 +297,18 @@ describe('Router', function(){
     })
   })
 
+  describe('.use', function() {
+    it('should require arguments', function(){
+      var router = new Router();
+      router.use.bind(router).should.throw(/requires callback function/)
+    })
+
+    it('should not accept non-functions', function(){
+      var router = new Router();
+      router.use.bind(router, '/', 'hello').should.throw(/requires callback function/)
+    })
+  })
+
   describe('.param', function() {
     it('should call param function when routing VERBS', function(done) {
       var router = new Router();

From ef52b80d750b978f65c00305ed73404f688d69ca Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 15 Aug 2014 00:24:28 -0400
Subject: [PATCH 0498/1265] deps: update example dependencies

---
 package.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index ee249abdda8..14b1024ec88 100644
--- a/package.json
+++ b/package.json
@@ -59,13 +59,13 @@
     "ejs": "~1.0.0",
     "marked": "0.3.2",
     "hjs": "~0.0.6",
-    "body-parser": "~1.6.1",
+    "body-parser": "~1.6.4",
     "cookie-parser": "~1.3.1",
-    "express-session": "~1.7.2",
+    "express-session": "~1.7.5",
     "jade": "~1.5.0",
     "method-override": "~2.1.1",
     "morgan": "~1.2.2",
-    "multiparty": "~3.3.1",
+    "multiparty": "~3.3.2",
     "vhost": "2.0.0"
   },
   "engines": {

From 0cf02d4667264cea9682d49941f1242ac6f289df Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 15 Aug 2014 00:26:39 -0400
Subject: [PATCH 0499/1265] 4.8.4

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 0a0d6031945..847f3932647 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.8.4 / 2014-08-14
+==================
 
   * deps: qs@1.2.2
   * deps: send@0.8.2
diff --git a/package.json b/package.json
index 14b1024ec88..b7395839292 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.8.3",
+  "version": "4.8.4",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 7f92fe66e0dbd56629ec5da81ea8a4903044cf68 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 Aug 2014 21:41:14 -0400
Subject: [PATCH 0500/1265] deps: connect@2.25.7

---
 History.md   | 9 +++++++++
 package.json | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 0fcbf87c30f..49ac460b855 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,12 @@
+3.x
+===
+
+  * deps: connect@2.25.7
+    - deps: body-parser@~1.6.5
+    - deps: express-session@~1.7.6
+    - deps: morgan@~1.2.3
+    - deps: serve-static@~1.5.3
+
 3.16.6 / 2014-08-14
 ===================
 
diff --git a/package.json b/package.json
index f7a4ca679d6..3e76378012a 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.25.6",
+    "connect": "2.25.7",
     "commander": "1.3.2",
     "debug": "1.0.4",
     "depd": "0.4.4",

From 1576a95e87672d1987e0f29c0dffa574b5acb007 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 Aug 2014 21:57:29 -0400
Subject: [PATCH 0501/1265] deps: send@0.8.3

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 49ac460b855..1063403b0ba 100644
--- a/History.md
+++ b/History.md
@@ -6,6 +6,9 @@
     - deps: express-session@~1.7.6
     - deps: morgan@~1.2.3
     - deps: serve-static@~1.5.3
+  * deps: send@0.8.3
+    - deps: destroy@1.0.3
+    - deps: on-finished@2.1.0
 
 3.16.6 / 2014-08-14
 ===================
diff --git a/package.json b/package.json
index 3e76378012a..6a5a57461c0 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "parseurl": "~1.3.0",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.8.2",
+    "send": "0.8.3",
     "vary": "0.1.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",

From d7bef52591876e3fa86ed08b5ac0cb5447ba1684 Mon Sep 17 00:00:00 2001
From: Raymond Feng <enjoyjava@gmail.com>
Date: Wed, 30 Jul 2014 15:57:49 -0700
Subject: [PATCH 0502/1265] build: move repository

closes #2268
closes #2270
---
 Readme.md                          | 12 ++++++------
 examples/view-constructor/index.js |  4 ++--
 examples/web-service/index.js      |  2 +-
 package.json                       |  2 +-
 test/acceptance/web-service.js     |  2 +-
 5 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/Readme.md b/Readme.md
index e9e45b91eb7..f39292d74b1 100644
--- a/Readme.md
+++ b/Readme.md
@@ -3,8 +3,8 @@
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
   [![NPM version](https://badge.fury.io/js/express.svg)](http://badge.fury.io/js/express)
-  [![Build Status](https://travis-ci.org/visionmedia/express.svg?branch=master)](https://travis-ci.org/visionmedia/express)
-  [![Coverage Status](https://img.shields.io/coveralls/visionmedia/express.svg)](https://coveralls.io/r/visionmedia/express)
+  [![Build Status](https://travis-ci.org/strongloop/express.svg?branch=master)](https://travis-ci.org/strongloop/express)
+  [![Coverage Status](https://img.shields.io/coveralls/strongloop/express.svg)](https://coveralls.io/r/strongloop/express)
   [![Gittip](http://img.shields.io/gittip/dougwilson.svg)](https://www.gittip.com/dougwilson/)
 
 ```js
@@ -65,11 +65,11 @@ app.listen(3000);
 
 ## More Information
 
-  * [Website and Documentation](http://expressjs.com/) stored at [visionmedia/expressjs.com](https://github.com/visionmedia/expressjs.com)
+  * [Website and Documentation](http://expressjs.com/) stored at [strongloop/expressjs.com](https://github.com/strongloop/expressjs.com)
   * Join #express on freenode
   * [Google Group](http://groups.google.com/group/express-js) for discussion
   * Follow [tjholowaychuk](http://twitter.com/tjholowaychuk) on twitter for updates
-  * Visit the [Wiki](http://github.com/visionmedia/express/wiki)
+  * Visit the [Wiki](http://github.com/strongloop/express/wiki)
   * [Русскоязычная документация](http://jsman.ru/express/)
   * Run express examples [online](https://runnable.com/express)
 
@@ -77,7 +77,7 @@ app.listen(3000);
 
 Clone the Express repo, then install the dev dependencies to install all the example / test suite dependencies:
 
-    $ git clone git://github.com/visionmedia/express.git --depth 1
+    $ git clone git://github.com/strongloop/express.git --depth 1
     $ cd express
     $ npm install
 
@@ -103,7 +103,7 @@ $ npm test
 
 ## Contributors
 
-  https://github.com/visionmedia/express/graphs/contributors
+  https://github.com/strongloop/express/graphs/contributors
 
 ## License
 
diff --git a/examples/view-constructor/index.js b/examples/view-constructor/index.js
index 000f419c04e..b09e1812fdc 100644
--- a/examples/view-constructor/index.js
+++ b/examples/view-constructor/index.js
@@ -24,7 +24,7 @@ app.engine('md', function(str, options, fn){
 })
 
 // pointing to a particular github repo to load files from it
-app.set('views', 'visionmedia/express');
+app.set('views', 'strongloop/express');
 
 // register a new view constructor
 app.set('view', GithubView);
@@ -37,7 +37,7 @@ app.get('/', function(req, res){
 })
 
 app.get('/Readme.md', function(req, res){
-  // rendering a view from https://github.com/visionmedia/express/blob/master/Readme.md
+  // rendering a view from https://github.com/strongloop/express/blob/master/Readme.md
   res.render('Readme.md');
 })
 
diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index f7c990ab543..a81eb08c571 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -73,7 +73,7 @@ var apiKeys = ['foo', 'bar', 'baz'];
 // these two objects will serve as our faux database
 
 var repos = [
-    { name: 'express', url: 'http://github.com/visionmedia/express' }
+    { name: 'express', url: 'http://github.com/strongloop/express' }
   , { name: 'stylus', url: 'http://github.com/learnboost/stylus' }
   , { name: 'cluster', url: 'http://github.com/learnboost/cluster' }
 ];
diff --git a/package.json b/package.json
index 6a5a57461c0..9c905a6119a 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
     "app",
     "api"
   ],
-  "repository": "visionmedia/express",
+  "repository": "strongloop/express",
   "license": "MIT",
   "dependencies": {
     "basic-auth": "1.0.0",
diff --git a/test/acceptance/web-service.js b/test/acceptance/web-service.js
index e0f744adcee..5868e92df95 100644
--- a/test/acceptance/web-service.js
+++ b/test/acceptance/web-service.js
@@ -53,7 +53,7 @@ describe('web-service', function(){
         .get('/api/repos?api-key=foo')
         .expect('Content-Type', 'application/json; charset=utf-8')
         .expect(/"name":"express"/)
-        .expect(/"url":"http:\/\/github.com\/visionmedia\/express"/)
+        .expect(/"url":"http:\/\/github.com\/strongloop\/express"/)
         .expect(200, done)
       })
     })

From 5c145b5490bc00b382d82b52d4308fdfd615c70f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 Aug 2014 22:17:25 -0400
Subject: [PATCH 0503/1265] build: add link to homepage

---
 package.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package.json b/package.json
index 9c905a6119a..ac5d8bec33c 100644
--- a/package.json
+++ b/package.json
@@ -24,6 +24,7 @@
   ],
   "repository": "strongloop/express",
   "license": "MIT",
+  "homepage": "http://expressjs.com/",
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",

From 8c36eab67926a43a2021a9cc31d1137148a99c1b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 Aug 2014 22:19:21 -0400
Subject: [PATCH 0504/1265] docs: use shields.io badges

---
 Readme.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Readme.md b/Readme.md
index f39292d74b1..5db6e3e6179 100644
--- a/Readme.md
+++ b/Readme.md
@@ -2,10 +2,10 @@
 
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
-  [![NPM version](https://badge.fury.io/js/express.svg)](http://badge.fury.io/js/express)
-  [![Build Status](https://travis-ci.org/strongloop/express.svg?branch=master)](https://travis-ci.org/strongloop/express)
+  [![NPM version](https://img.shields.io/npm/v/express.svg)](https://www.npmjs.org/package/express)
+  [![Build Status](https://img.shields.io/travis/strongloop/express.svg)](https://travis-ci.org/strongloop/express)
   [![Coverage Status](https://img.shields.io/coveralls/strongloop/express.svg)](https://coveralls.io/r/strongloop/express)
-  [![Gittip](http://img.shields.io/gittip/dougwilson.svg)](https://www.gittip.com/dougwilson/)
+  [![Gittip](https://img.shields.io/gittip/dougwilson.svg)](https://www.gittip.com/dougwilson/)
 
 ```js
 var express = require('express');

From fdd0ccabe86ecd8ff5f007250961d0e6eba1d7fe Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 Aug 2014 22:45:13 -0400
Subject: [PATCH 0505/1265] docs: flatten badges for github look

---
 Readme.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Readme.md b/Readme.md
index 5db6e3e6179..e63a689a13d 100644
--- a/Readme.md
+++ b/Readme.md
@@ -2,10 +2,10 @@
 
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
-  [![NPM version](https://img.shields.io/npm/v/express.svg)](https://www.npmjs.org/package/express)
-  [![Build Status](https://img.shields.io/travis/strongloop/express.svg)](https://travis-ci.org/strongloop/express)
-  [![Coverage Status](https://img.shields.io/coveralls/strongloop/express.svg)](https://coveralls.io/r/strongloop/express)
-  [![Gittip](https://img.shields.io/gittip/dougwilson.svg)](https://www.gittip.com/dougwilson/)
+  [![NPM version](https://img.shields.io/npm/v/express.svg?style=flat)](https://www.npmjs.org/package/express)
+  [![Build Status](https://img.shields.io/travis/strongloop/express.svg?style=flat)](https://travis-ci.org/strongloop/express)
+  [![Coverage Status](https://img.shields.io/coveralls/strongloop/express.svg?style=flat)](https://coveralls.io/r/strongloop/express)
+  [![Gittip](https://img.shields.io/gittip/dougwilson.svg?style=flat)](https://www.gittip.com/dougwilson/)
 
 ```js
 var express = require('express');

From 0b12cc0cacbd8948079a0ca78b87d540def950eb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 Aug 2014 22:45:17 -0400
Subject: [PATCH 0506/1265] 3.16.7

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 1063403b0ba..6599cfe5ff1 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.16.7 / 2014-08-18
+===================
 
   * deps: connect@2.25.7
     - deps: body-parser@~1.6.5
diff --git a/package.json b/package.json
index ac5d8bec33c..00695c5b88b 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.16.6",
+  "version": "3.16.7",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From f4ddef1570d0dff3f7c5eb38d7b3f1a2b012e8c6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 Aug 2014 22:58:47 -0400
Subject: [PATCH 0507/1265] deps: serve-static@~1.5.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 08ed77970d6..d70b2521b41 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,8 @@ unreleased
   * deps: send@0.8.3
     - deps: destroy@1.0.3
     - deps: on-finished@2.1.0
+  * deps: serve-static@~1.5.3
+    - deps: send@0.8.3
 
 4.8.4 / 2014-08-14
 ==================
diff --git a/package.json b/package.json
index b8098bcd06f..8d872e053af 100644
--- a/package.json
+++ b/package.json
@@ -41,7 +41,7 @@
     "qs": "1.2.2",
     "range-parser": "1.0.0",
     "send": "0.8.3",
-    "serve-static": "~1.5.2",
+    "serve-static": "~1.5.3",
     "type-is": "~1.3.2",
     "vary": "0.1.0",
     "cookie": "0.1.2",

From ff0de5eb27591917593bfbe0340923551aa14d26 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 Aug 2014 23:00:01 -0400
Subject: [PATCH 0508/1265] deps: update example dependencies

---
 package.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 8d872e053af..b60d01fe85a 100644
--- a/package.json
+++ b/package.json
@@ -60,12 +60,12 @@
     "ejs": "~1.0.0",
     "marked": "0.3.2",
     "hjs": "~0.0.6",
-    "body-parser": "~1.6.4",
+    "body-parser": "~1.6.5",
     "cookie-parser": "~1.3.1",
-    "express-session": "~1.7.5",
+    "express-session": "~1.7.6",
     "jade": "~1.5.0",
-    "method-override": "~2.1.1",
-    "morgan": "~1.2.2",
+    "method-override": "~2.1.3",
+    "morgan": "~1.2.3",
     "multiparty": "~3.3.2",
     "vhost": "2.0.0"
   },

From 27f195374d7372f3270357873239f2c2962aafcc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 Aug 2014 23:05:16 -0400
Subject: [PATCH 0509/1265] 4.8.5

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index d70b2521b41..90643dabe25 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.8.5 / 2014-08-18
+==================
 
   * deps: send@0.8.3
     - deps: destroy@1.0.3
diff --git a/package.json b/package.json
index b60d01fe85a..77c942e0710 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.8.4",
+  "version": "4.8.5",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 3de4e4276d7c3c933fb27d5013c2b4926cb2ebe3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 24 Aug 2014 10:05:24 -0400
Subject: [PATCH 0510/1265] docs: fix logo link

---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 654eab8c5df..426bb723f24 100644
--- a/Readme.md
+++ b/Readme.md
@@ -1,4 +1,4 @@
-[![Express Logo](https://i.cloudup.com/zfY6lL7eFa-3000x3000.png)](https://expressjs.com/)
+[![Express Logo](https://i.cloudup.com/zfY6lL7eFa-3000x3000.png)](http://expressjs.com/)
 
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 

From 4986b1cb4c62eb853c5666ed552617d6bb79f38a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Aug 2014 14:36:06 -0400
Subject: [PATCH 0511/1265] tests: add some res.sendfile directory tests

---
 test/res.sendFile.js | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index eac1f97c259..5869503d30a 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -33,6 +33,14 @@ describe('res', function(){
       .expect(200, '20%', done);
     });
 
+    it('should 404 for directory', function (done) {
+      var app = createApp(path.resolve(fixtures, 'blog'));
+
+      request(app)
+      .get('/')
+      .expect(404, done);
+    });
+
     it('should 404 when not found', function (done) {
       var app = createApp(path.resolve(fixtures, 'does-no-exist'));
 
@@ -164,15 +172,15 @@ describe('res', function(){
   describe('.sendfile(path, fn)', function(){
     it('should invoke the callback when complete', function(done){
       var app = express();
+      var cb = after(2, done);
 
       app.use(function(req, res){
-        res.sendfile('test/fixtures/user.html', done)
+        res.sendfile('test/fixtures/user.html', cb)
       });
 
       request(app)
       .get('/')
-      .expect(200)
-      .end(function(){});
+      .expect(200, cb);
     })
 
     it('should utilize the same options as express.static()', function(done){
@@ -346,6 +354,18 @@ describe('res', function(){
       .expect(200, '<b>index</b>', done);
     });
 
+    it('should 404 for directory without trailing slash', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.sendfile('test/fixtures/blog');
+      });
+
+      request(app)
+      .get('/')
+      .expect(404, done);
+    });
+
     it('should transfer a file with urlencoded name', function (done) {
       var app = express();
 

From 6a581c99610f63d8b46b6ddae9de48aef27aa743 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 27 Aug 2014 21:04:41 -0400
Subject: [PATCH 0512/1265] deps: connect@2.25.8

---
 History.md   | 8 ++++++++
 package.json | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 6599cfe5ff1..86f697374ee 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,11 @@
+unreleased
+==========
+
+  * deps: connect@2.25.8
+    - deps: body-parser@~1.6.6
+    - deps: csurf@~1.4.1
+    - deps: qs@2.2.0
+
 3.16.7 / 2014-08-18
 ===================
 
diff --git a/package.json b/package.json
index 00695c5b88b..8a9ca8a03b2 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.25.7",
+    "connect": "2.25.8",
     "commander": "1.3.2",
     "debug": "1.0.4",
     "depd": "0.4.4",

From 0299bee8fae527c02c42dee8ced22a1f63f05093 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 27 Aug 2014 21:09:18 -0400
Subject: [PATCH 0513/1265] 3.16.8

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 86f697374ee..42d0b0b4a48 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+3.16.8 / 2014-08-27
+===================
 
   * deps: connect@2.25.8
     - deps: body-parser@~1.6.6
diff --git a/package.json b/package.json
index 8a9ca8a03b2..c8ce7a03e7e 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.16.7",
+  "version": "3.16.8",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 2b2733c2354996905931a9e410be303dedc50796 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 27 Aug 2014 21:22:41 -0400
Subject: [PATCH 0514/1265] deps: qs@2.2.0

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 2ef64355030..36db1eaf1ba 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+unreleased
+==========
+
+  * deps: qs@2.2.0
+    - Array parsing fix
+    - Performance improvements
+
 4.8.5 / 2014-08-18
 ==================
 
diff --git a/package.json b/package.json
index 77c942e0710..18e2e33b7ab 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "1.0.1",
-    "qs": "1.2.2",
+    "qs": "2.2.0",
     "range-parser": "1.0.0",
     "send": "0.8.3",
     "serve-static": "~1.5.3",

From a206b4e27399bd5176d0d1d2d7328c65b81981a0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 27 Aug 2014 21:25:56 -0400
Subject: [PATCH 0515/1265] deps: update example dependencies

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 18e2e33b7ab..bd5fefc1a97 100644
--- a/package.json
+++ b/package.json
@@ -60,8 +60,8 @@
     "ejs": "~1.0.0",
     "marked": "0.3.2",
     "hjs": "~0.0.6",
-    "body-parser": "~1.6.5",
-    "cookie-parser": "~1.3.1",
+    "body-parser": "~1.6.6",
+    "cookie-parser": "~1.3.2",
     "express-session": "~1.7.6",
     "jade": "~1.5.0",
     "method-override": "~2.1.3",

From b6ae091bdfa5d1717b65eba8dbba3d67ad999438 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 27 Aug 2014 21:51:37 -0400
Subject: [PATCH 0516/1265] 4.8.6

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 36db1eaf1ba..2a8b27df022 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.8.6 / 2014-08-27
+==================
 
   * deps: qs@2.2.0
     - Array parsing fix
diff --git a/package.json b/package.json
index bd5fefc1a97..65d32c9b43b 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.8.5",
+  "version": "4.8.6",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 4127ba10b02cbad9f07f6b4c42c94887d388260e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 30 Aug 2014 01:19:53 -0400
Subject: [PATCH 0517/1265] deps: connect@2.25.9

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 42d0b0b4a48..6d481530d46 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+3.x
+===
+
+  * deps: connect@2.25.9
+    - deps: body-parser@~1.6.7
+    - deps: qs@2.2.2
+
 3.16.8 / 2014-08-27
 ===================
 
diff --git a/package.json b/package.json
index c8ce7a03e7e..931c27a7fab 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.25.8",
+    "connect": "2.25.9",
     "commander": "1.3.2",
     "debug": "1.0.4",
     "depd": "0.4.4",

From 4d032cda058596e1ae89924ff69e80c3849ef4ff Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 30 Aug 2014 01:22:06 -0400
Subject: [PATCH 0518/1265] 3.16.9

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 6d481530d46..f2a931ebeb7 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.16.9 / 2014-08-29
+===================
 
   * deps: connect@2.25.9
     - deps: body-parser@~1.6.7
diff --git a/package.json b/package.json
index 931c27a7fab..89bd79b696a 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.16.8",
+  "version": "3.16.9",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From f6f47f428c63af11a2ac081908483a56320fa89f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 30 Aug 2014 01:30:56 -0400
Subject: [PATCH 0519/1265] deps: qs@2.2.2

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 3dd403591ae..177f30cd3cf 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: qs@2.2.2
+    - Remove unnecessary cloning
+
 4.8.6 / 2014-08-27
 ==================
 
diff --git a/package.json b/package.json
index 65d32c9b43b..bb4a3b9eded 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "1.0.1",
-    "qs": "2.2.0",
+    "qs": "2.2.2",
     "range-parser": "1.0.0",
     "send": "0.8.3",
     "serve-static": "~1.5.3",

From 0b49e7f1fdd18e99d403c4543563628fb6fc8565 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 30 Aug 2014 01:33:05 -0400
Subject: [PATCH 0520/1265] deps: update example dependencies

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index bb4a3b9eded..91e0c7a7e4c 100644
--- a/package.json
+++ b/package.json
@@ -60,7 +60,7 @@
     "ejs": "~1.0.0",
     "marked": "0.3.2",
     "hjs": "~0.0.6",
-    "body-parser": "~1.6.6",
+    "body-parser": "~1.6.7",
     "cookie-parser": "~1.3.2",
     "express-session": "~1.7.6",
     "jade": "~1.5.0",

From 46f0bfc65f151a900e7c36a81b950c79b2c1a596 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 30 Aug 2014 01:37:52 -0400
Subject: [PATCH 0521/1265] 4.8.7

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 177f30cd3cf..ba13f08c839 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.8.7 / 2014-08-29
+==================
 
   * deps: qs@2.2.2
     - Remove unnecessary cloning
diff --git a/package.json b/package.json
index 91e0c7a7e4c..01aac639775 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.8.6",
+  "version": "4.8.7",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 3ce5f9b493602827cf7f6ad2a78899cd09984286 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 5 Sep 2014 01:55:24 -0400
Subject: [PATCH 0522/1265] deps: connect@2.25.10

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f2a931ebeb7..4a516b302e1 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+3.x
+===
+
+  * deps: connect@2.25.10
+    - deps: serve-static@~1.5.4
+
 3.16.9 / 2014-08-29
 ===================
 
diff --git a/package.json b/package.json
index 89bd79b696a..9b7f06040d5 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.25.9",
+    "connect": "2.25.10",
     "commander": "1.3.2",
     "debug": "1.0.4",
     "depd": "0.4.4",

From c8640b346530b1bbcb639319668120763372487c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 5 Sep 2014 01:56:27 -0400
Subject: [PATCH 0523/1265] deps: send@0.8.5

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 4a516b302e1..74045f13f5f 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,9 @@
 
   * deps: connect@2.25.10
     - deps: serve-static@~1.5.4
+  * deps: send@0.8.5
+    - Fix a path traversal issue when using `root`
+    - Fix malicious path detection for empty string path
 
 3.16.9 / 2014-08-29
 ===================
diff --git a/package.json b/package.json
index 9b7f06040d5..8d641adbcd5 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "parseurl": "~1.3.0",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.8.3",
+    "send": "0.8.5",
     "vary": "0.1.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",

From 8327708ec2504d41dbdd6fa6d8d006975a0a6b0a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 5 Sep 2014 01:57:02 -0400
Subject: [PATCH 0524/1265] deps: istanbul@0.3.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 8d641adbcd5..ce14ffe1160 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
   },
   "devDependencies": {
     "connect-redis": "~1.5.0",
-    "istanbul": "0.3.0",
+    "istanbul": "0.3.2",
     "mocha": "~1.21.4",
     "should": "~4.0.0",
     "ejs": "~1.0.0",

From 3d188fe13e1901222cd830dcdc9772a34b9bd745 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 5 Sep 2014 02:17:55 -0400
Subject: [PATCH 0525/1265] 3.16.10

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 74045f13f5f..c6099feb0ee 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.16.10 / 2014-09-04
+====================
 
   * deps: connect@2.25.10
     - deps: serve-static@~1.5.4
diff --git a/package.json b/package.json
index ce14ffe1160..3af4718a345 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.16.9",
+  "version": "3.16.10",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 2d6b735b4f0e21a6ef1c66b4feb157bd1e334868 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 5 Sep 2014 02:21:17 -0400
Subject: [PATCH 0526/1265] deps: serve-static@~1.5.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 16531f92e56..a9033130a65 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,8 @@ unreleased
   * deps: send@0.8.5
     - Fix a path traversal issue when using `root`
     - Fix malicious path detection for empty string path
+  * deps: serve-static@~1.5.4
+    - deps: send@0.8.5
 
 4.8.7 / 2014-08-29
 ==================
diff --git a/package.json b/package.json
index 46946fd745c..e27f90221de 100644
--- a/package.json
+++ b/package.json
@@ -41,7 +41,7 @@
     "qs": "2.2.2",
     "range-parser": "1.0.0",
     "send": "0.8.5",
-    "serve-static": "~1.5.3",
+    "serve-static": "~1.5.4",
     "type-is": "~1.3.2",
     "vary": "0.1.0",
     "cookie": "0.1.2",

From d7e7b2e7d7da7e0ef4fb4fe9d67e65d50cf6e94b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 5 Sep 2014 02:24:02 -0400
Subject: [PATCH 0527/1265] deps: update example dependencies

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index e27f90221de..aac822f22cf 100644
--- a/package.json
+++ b/package.json
@@ -60,14 +60,14 @@
     "ejs": "~1.0.0",
     "marked": "0.3.2",
     "hjs": "~0.0.6",
-    "body-parser": "~1.6.7",
+    "body-parser": "~1.7.0",
     "cookie-parser": "~1.3.2",
     "express-session": "~1.7.6",
     "jade": "~1.5.0",
     "method-override": "~2.1.3",
     "morgan": "~1.2.3",
     "multiparty": "~3.3.2",
-    "vhost": "2.0.0"
+    "vhost": "~3.0.0"
   },
   "engines": {
     "node": ">= 0.10.0"

From 621d074bd87dd7a7064c5607dbed05b97f80fcc0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 5 Sep 2014 02:26:12 -0400
Subject: [PATCH 0528/1265] 4.8.8

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index a9033130a65..94f65088a54 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.8.8 / 2014-09-04
+==================
 
   * deps: send@0.8.5
     - Fix a path traversal issue when using `root`
diff --git a/package.json b/package.json
index aac822f22cf..ecd60876a5f 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.8.7",
+  "version": "4.8.8",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From b97f6eb5068f55b2465d546e9bd8d1b3aff2fc3a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 19:31:58 -0400
Subject: [PATCH 0529/1265] examples: fix github view example

closes #2344
---
 examples/view-constructor/github-view.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/examples/view-constructor/github-view.js b/examples/view-constructor/github-view.js
index d3fb6a1bf1d..d8bff7d080b 100644
--- a/examples/view-constructor/github-view.js
+++ b/examples/view-constructor/github-view.js
@@ -35,13 +35,13 @@ function GithubView(name, options){
 GithubView.prototype.render = function(options, fn){
   var self = this;
   var opts = {
-    host: 'rawgithub.com',
-    port: 80,
+    host: 'raw.githubusercontent.com',
+    port: 443,
     path: this.path,
     method: 'GET'
   };
 
-  http.request(opts, function(res) {
+  https.request(opts, function(res) {
     var buf = '';
     res.setEncoding('utf8');
     res.on('data', function(str){ buf += str });

From 33bb8fc4b61e4d7efedfaadd704ac66d08c43e9e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 20:51:32 -0400
Subject: [PATCH 0530/1265] examples: fix up route-separation code

closes #2341
---
 examples/route-separation/index.js  | 12 +++-
 examples/route-separation/user.js   |  6 +-
 test/acceptance/route-separation.js | 97 +++++++++++++++++++++++++++++
 3 files changed, 111 insertions(+), 4 deletions(-)
 create mode 100644 test/acceptance/route-separation.js

diff --git a/examples/route-separation/index.js b/examples/route-separation/index.js
index 2559f788b89..bac61ea8944 100644
--- a/examples/route-separation/index.js
+++ b/examples/route-separation/index.js
@@ -7,15 +7,23 @@ var app = express();
 var logger = require('morgan');
 var cookieParser = require('cookie-parser');
 var bodyParser = require('body-parser');
+var methodOverride = require('method-override');
 var site = require('./site');
 var post = require('./post');
 var user = require('./user');
 
+module.exports = app;
+
 // Config
 
 app.set('view engine', 'jade');
 app.set('views', __dirname + '/views');
-app.use(logger('dev'));
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.use(express.logger('dev'));
+}
+
 app.use(methodOverride('_method'));
 app.use(cookieParser());
 app.use(bodyParser.urlencoded({ extended: true }));
@@ -27,7 +35,7 @@ app.get('/', site.index);
 
 // User
 
-app.all('/users', user.list);
+app.get('/users', user.list);
 app.all('/user/:id/:op?', user.load);
 app.get('/user/:id', user.view);
 app.get('/user/:id/view', user.view);
diff --git a/examples/route-separation/user.js b/examples/route-separation/user.js
index a5c20410439..ef79b343a28 100644
--- a/examples/route-separation/user.js
+++ b/examples/route-separation/user.js
@@ -15,7 +15,9 @@ exports.load = function(req, res, next){
   if (req.user) {
     next();
   } else {
-    next(new Error('cannot find user ' + id));
+    var err = new Error('cannot find user ' + id);
+    err.status = 404;
+    next(err);
   }
 };
 
@@ -40,4 +42,4 @@ exports.update = function(req, res){
   req.user.name = user.name;
   req.user.email = user.email;
   res.redirect('back');
-};
\ No newline at end of file
+};
diff --git a/test/acceptance/route-separation.js b/test/acceptance/route-separation.js
new file mode 100644
index 00000000000..867fd295271
--- /dev/null
+++ b/test/acceptance/route-separation.js
@@ -0,0 +1,97 @@
+
+var app = require('../../examples/route-separation')
+var request = require('supertest')
+
+describe('route-separation', function () {
+  describe('GET /', function () {
+    it('should respond with index', function (done) {
+      request(app)
+      .get('/')
+      .expect(200, /Route Separation Example/, done)
+    })
+  })
+
+  describe('GET /users', function () {
+    it('should list users', function (done) {
+      request(app)
+      .get('/users')
+      .expect(/TJ/)
+      .expect(/Tobi/)
+      .expect(200, done)
+    })
+  })
+
+  describe('GET /user/:id', function () {
+    it('should get a user', function (done) {
+      request(app)
+      .get('/user/0')
+      .expect(200, /Viewing user TJ/, done)
+    })
+
+    it('should 404 on missing user', function (done) {
+      request(app)
+      .get('/user/10')
+      .expect(404, done)
+    })
+  })
+
+  describe('GET /user/:id/view', function () {
+    it('should get a user', function (done) {
+      request(app)
+      .get('/user/0/view')
+      .expect(200, /Viewing user TJ/, done)
+    })
+
+    it('should 404 on missing user', function (done) {
+      request(app)
+      .get('/user/10/view')
+      .expect(404, done)
+    })
+  })
+
+  describe('GET /user/:id/edit', function () {
+    it('should get a user to edit', function (done) {
+      request(app)
+      .get('/user/0/edit')
+      .expect(200, /Editing user TJ/, done)
+    })
+  })
+
+  describe('PUT /user/:id/edit', function () {
+    it('should edit a user', function (done) {
+      request(app)
+      .put('/user/0/edit')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .send({ user: { name: 'TJ', email: 'tj-invalid@vision-media.ca' } })
+      .expect(302, function (err) {
+        if (err) return done(err)
+        request(app)
+        .get('/user/0')
+        .expect(200, /tj-invalid@vision-media\.ca/, done)
+      })
+    })
+  })
+
+  describe('POST /user/:id/edit?_method=PUT', function () {
+    it('should edit a user', function (done) {
+      request(app)
+      .post('/user/1/edit?_method=PUT')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .send({ user: { name: 'Tobi', email: 'tobi-invalid@vision-media.ca' } })
+      .expect(302, function (err) {
+        if (err) return done(err)
+        request(app)
+        .get('/user/1')
+        .expect(200, /tobi-invalid@vision-media\.ca/, done)
+      })
+    })
+  })
+
+  describe('GET /posts', function () {
+    it('should get a list of posts', function (done) {
+      request(app)
+      .get('/posts')
+      .expect(200, /Posts/, done)
+    })
+  })
+})

From d2d0afff64d72f208a8aa2d9216debf5abef9e40 Mon Sep 17 00:00:00 2001
From: lemmy <lemmy@yandex-team.ru>
Date: Fri, 5 Sep 2014 20:34:19 +0400
Subject: [PATCH 0531/1265] Remove unused variable

closes #2345
---
 lib/response.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/response.js b/lib/response.js
index e929291da39..27b62853e1e 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -16,7 +16,6 @@ var contentDisposition = require('./utils').contentDisposition;
 var statusCodes = http.STATUS_CODES;
 var cookie = require('cookie');
 var send = require('send');
-var basename = path.basename;
 var extname = path.extname;
 var mime = send.mime;
 var resolve = path.resolve;

From 094ff1194907f3f3fc7db2121dd3f2ecbd4a7c49 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 21:09:22 -0400
Subject: [PATCH 0532/1265] deps: connect@2.26.0

---
 History.md   | 25 +++++++++++++++++++++++++
 package.json |  2 +-
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c6099feb0ee..096d886655e 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,28 @@
+3.x
+===
+
+  * deps: connect@2.26.0
+    - deps: body-parser@~1.8.1
+    - deps: compression@~1.1.0
+    - deps: connect-timeout@~1.3.0
+    - deps: cookie-parser@~1.3.3
+    - deps: cookie-signature@1.0.5
+    - deps: csurf@~1.6.1
+    - deps: debug@~2.0.0
+    - deps: errorhandler@~1.2.0
+    - deps: express-session@~1.8.1
+    - deps: finalhandler@0.2.0
+    - deps: fresh@0.2.4
+    - deps: media-typer@0.3.0
+    - deps: method-override@~2.2.0
+    - deps: morgan@~1.3.0
+    - deps: qs@2.2.3
+    - deps: serve-favicon@~2.1.3
+    - deps: serve-index@~1.2.1
+    - deps: serve-static@~1.6.1
+    - deps: type-is@~1.5.1
+    - deps: vhost@~3.0.0
+
 3.16.10 / 2014-09-04
 ====================
 
diff --git a/package.json b/package.json
index 3af4718a345..a191a9dc6b2 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.25.10",
+    "connect": "2.26.0",
     "commander": "1.3.2",
     "debug": "1.0.4",
     "depd": "0.4.4",

From be18487f7d58f340eb696b1e3edb66eb13b309c2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 21:10:57 -0400
Subject: [PATCH 0533/1265] deps: media-typer@0.3.0

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 096d886655e..dccc9c7245d 100644
--- a/History.md
+++ b/History.md
@@ -22,6 +22,8 @@
     - deps: serve-static@~1.6.1
     - deps: type-is@~1.5.1
     - deps: vhost@~3.0.0
+  * deps: media-typer@0.3.0
+    - Throw error when parameter format invalid on parse
 
 3.16.10 / 2014-09-04
 ====================
diff --git a/package.json b/package.json
index a191a9dc6b2..d9801e22e50 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "debug": "1.0.4",
     "depd": "0.4.4",
     "escape-html": "1.0.1",
-    "media-typer": "0.2.0",
+    "media-typer": "0.3.0",
     "methods": "1.1.0",
     "mkdirp": "0.5.0",
     "parseurl": "~1.3.0",

From 49284c236bf263b4933cf0bea786c4044706b75d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 21:11:41 -0400
Subject: [PATCH 0534/1265] deps: debug@~2.0.0

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index dccc9c7245d..6ba9a011ae9 100644
--- a/History.md
+++ b/History.md
@@ -22,6 +22,7 @@
     - deps: serve-static@~1.6.1
     - deps: type-is@~1.5.1
     - deps: vhost@~3.0.0
+  * deps: debug@~2.0.0
   * deps: media-typer@0.3.0
     - Throw error when parameter format invalid on parse
 
diff --git a/package.json b/package.json
index d9801e22e50..9cc3ad00493 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "buffer-crc32": "0.2.3",
     "connect": "2.26.0",
     "commander": "1.3.2",
-    "debug": "1.0.4",
+    "debug": "~2.0.0",
     "depd": "0.4.4",
     "escape-html": "1.0.1",
     "media-typer": "0.3.0",

From d6ed469de3a2210c7d6124bf29599bd039a79257 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 21:13:20 -0400
Subject: [PATCH 0535/1265] deps: send@0.9.1

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 6ba9a011ae9..ca34e85669a 100644
--- a/History.md
+++ b/History.md
@@ -25,6 +25,11 @@
   * deps: debug@~2.0.0
   * deps: media-typer@0.3.0
     - Throw error when parameter format invalid on parse
+  * deps: send@0.9.1
+    - Add `lastModified` option
+    - Use `etag` to generate `ETag` header
+    - deps: debug@~2.0.0
+    - deps: fresh@0.2.4
 
 3.16.10 / 2014-09-04
 ====================
diff --git a/package.json b/package.json
index 9cc3ad00493..3f348bda19b 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "parseurl": "~1.3.0",
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
-    "send": "0.8.5",
+    "send": "0.9.1",
     "vary": "0.1.0",
     "cookie": "0.1.2",
     "fresh": "0.2.2",

From cbb251377ec47d29ae60b8a6e4744b52351677c8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 21:14:27 -0400
Subject: [PATCH 0536/1265] deps: fresh@0.2.4

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ca34e85669a..0200e40ced6 100644
--- a/History.md
+++ b/History.md
@@ -23,6 +23,7 @@
     - deps: type-is@~1.5.1
     - deps: vhost@~3.0.0
   * deps: debug@~2.0.0
+  * deps: fresh@0.2.4
   * deps: media-typer@0.3.0
     - Throw error when parameter format invalid on parse
   * deps: send@0.9.1
diff --git a/package.json b/package.json
index 3f348bda19b..ecb233bab1a 100644
--- a/package.json
+++ b/package.json
@@ -33,6 +33,7 @@
     "debug": "~2.0.0",
     "depd": "0.4.4",
     "escape-html": "1.0.1",
+    "fresh": "0.2.4",
     "media-typer": "0.3.0",
     "methods": "1.1.0",
     "mkdirp": "0.5.0",
@@ -42,7 +43,6 @@
     "send": "0.9.1",
     "vary": "0.1.0",
     "cookie": "0.1.2",
-    "fresh": "0.2.2",
     "cookie-signature": "1.0.4",
     "merge-descriptors": "0.0.2"
   },

From b77aa38c987fab2b1dc1b83747bb10811a5bf43f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 21:17:03 -0400
Subject: [PATCH 0537/1265] deps: cookie-signature@1.0.5

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 0200e40ced6..cd129f193c2 100644
--- a/History.md
+++ b/History.md
@@ -22,6 +22,7 @@
     - deps: serve-static@~1.6.1
     - deps: type-is@~1.5.1
     - deps: vhost@~3.0.0
+  * deps: cookie-signature@1.0.5
   * deps: debug@~2.0.0
   * deps: fresh@0.2.4
   * deps: media-typer@0.3.0
diff --git a/package.json b/package.json
index ecb233bab1a..6472f7a9b5b 100644
--- a/package.json
+++ b/package.json
@@ -30,6 +30,7 @@
     "buffer-crc32": "0.2.3",
     "connect": "2.26.0",
     "commander": "1.3.2",
+    "cookie-signature": "1.0.5",
     "debug": "~2.0.0",
     "depd": "0.4.4",
     "escape-html": "1.0.1",
@@ -43,7 +44,6 @@
     "send": "0.9.1",
     "vary": "0.1.0",
     "cookie": "0.1.2",
-    "cookie-signature": "1.0.4",
     "merge-descriptors": "0.0.2"
   },
   "devDependencies": {

From 9b18461bbcb58450e265484169f143fa69c52a83 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 21:18:28 -0400
Subject: [PATCH 0538/1265] deps: vary@~1.0.0

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index cd129f193c2..d27cf9b5b8c 100644
--- a/History.md
+++ b/History.md
@@ -32,6 +32,8 @@
     - Use `etag` to generate `ETag` header
     - deps: debug@~2.0.0
     - deps: fresh@0.2.4
+  * deps: vary@~1.0.0
+    - Accept valid `Vary` header string as `field`
 
 3.16.10 / 2014-09-04
 ====================
diff --git a/package.json b/package.json
index 6472f7a9b5b..1f8c5240544 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
     "proxy-addr": "1.0.1",
     "range-parser": "1.0.0",
     "send": "0.9.1",
-    "vary": "0.1.0",
+    "vary": "~1.0.0",
     "cookie": "0.1.2",
     "merge-descriptors": "0.0.2"
   },

From d7d6219a1e65a9151f8241753a9091ad9ca93628 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 22:47:54 -0400
Subject: [PATCH 0539/1265] deps: range-parser@~1.0.2

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index d27cf9b5b8c..168953875f0 100644
--- a/History.md
+++ b/History.md
@@ -27,6 +27,7 @@
   * deps: fresh@0.2.4
   * deps: media-typer@0.3.0
     - Throw error when parameter format invalid on parse
+  * deps: range-parser@~1.0.2
   * deps: send@0.9.1
     - Add `lastModified` option
     - Use `etag` to generate `ETag` header
diff --git a/package.json b/package.json
index 1f8c5240544..7c9cc972f73 100644
--- a/package.json
+++ b/package.json
@@ -40,7 +40,7 @@
     "mkdirp": "0.5.0",
     "parseurl": "~1.3.0",
     "proxy-addr": "1.0.1",
-    "range-parser": "1.0.0",
+    "range-parser": "~1.0.2",
     "send": "0.9.1",
     "vary": "~1.0.0",
     "cookie": "0.1.2",

From 4e97533fd20fea890e14d6ca10e0bc49269b4630 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 22:48:47 -0400
Subject: [PATCH 0540/1265] deps: jade@~1.6.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 7c9cc972f73..0455c7c4eb7 100644
--- a/package.json
+++ b/package.json
@@ -52,7 +52,7 @@
     "mocha": "~1.21.4",
     "should": "~4.0.0",
     "ejs": "~1.0.0",
-    "jade": "~1.5.0",
+    "jade": "~1.6.0",
     "hjs": "~0.0.6",
     "marked": "0.3.2",
     "supertest": "~0.13.0"

From d07c06363f00647ab0553ef227b9b65cb4a04ae9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 23:02:42 -0400
Subject: [PATCH 0541/1265] Support X-Forwarded-Host in req.subdomains

---
 History.md             |  1 +
 lib/request.js         |  8 ++++----
 test/req.subdomains.js | 16 ++++++++++++++++
 3 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index 168953875f0..0499b436335 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 3.x
 ===
 
+  * Support `X-Forwarded-Host` in `req.subdomains`
   * deps: connect@2.26.0
     - deps: body-parser@~1.8.1
     - deps: compression@~1.1.0
diff --git a/lib/request.js b/lib/request.js
index 03f7cbdabba..485c2962eb9 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -452,11 +452,11 @@ req.__defineGetter__('auth', function(){
  */
 
 req.__defineGetter__('subdomains', function(){
+  var host = this.host;
   var offset = this.app.get('subdomain offset');
-  return (this.host || '')
-    .split('.')
-    .reverse()
-    .slice(offset);
+  var subdomains = host.split('.').reverse();
+
+  return subdomains.slice(offset);
 });
 
 /**
diff --git a/test/req.subdomains.js b/test/req.subdomains.js
index ec851d2c01a..2ee4280377c 100644
--- a/test/req.subdomains.js
+++ b/test/req.subdomains.js
@@ -49,6 +49,22 @@ describe('req', function(){
       })
     })
 
+    describe('with trusted X-Forwarded-Host', function () {
+      it('should return an array', function (done) {
+        var app = express();
+
+        app.set('trust proxy', true);
+        app.use(function (req, res) {
+          res.send(req.subdomains);
+        });
+
+        request(app)
+        .get('/')
+        .set('X-Forwarded-Host', 'tobi.ferrets.example.com')
+        .expect(['ferrets', 'tobi'], done);
+      })
+    })
+
     describe('when subdomain offset is set', function(){
       describe('when subdomain offset is zero', function(){
         it('should return an array with the whole domain', function(done){

From 2de6514b4b4cc7e9629664faa56859da7e597265 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 23:03:48 -0400
Subject: [PATCH 0542/1265] Support IP address host in req.subdomains

fixes #2308
---
 History.md             |  1 +
 lib/request.js         |  5 +++-
 test/req.subdomains.js | 54 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 59 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 0499b436335..60c04eebd38 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@
 ===
 
   * Support `X-Forwarded-Host` in `req.subdomains`
+  * Support IP address host in `req.subdomains`
   * deps: connect@2.26.0
     - deps: body-parser@~1.8.1
     - deps: compression@~1.1.0
diff --git a/lib/request.js b/lib/request.js
index 485c2962eb9..24e8748d211 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -13,6 +13,7 @@ var http = require('http')
   , parse = require('parseurl')
   , proxyaddr = require('proxy-addr')
   , mime = connect.mime;
+var isIP = require('net').isIP;
 
 /**
  * Request prototype.
@@ -454,7 +455,9 @@ req.__defineGetter__('auth', function(){
 req.__defineGetter__('subdomains', function(){
   var host = this.host;
   var offset = this.app.get('subdomain offset');
-  var subdomains = host.split('.').reverse();
+  var subdomains = !isIP(host)
+    ? host.split('.').reverse()
+    : [host];
 
   return subdomains.slice(offset);
 });
diff --git a/test/req.subdomains.js b/test/req.subdomains.js
index 2ee4280377c..7da382f4788 100644
--- a/test/req.subdomains.js
+++ b/test/req.subdomains.js
@@ -17,6 +17,32 @@ describe('req', function(){
         .set('Host', 'tobi.ferrets.example.com')
         .expect(["ferrets","tobi"], done);
       })
+
+      it('should work with IPv4 address', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          res.send(req.subdomains);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', '127.0.0.1')
+        .expect([], done);
+      })
+
+      it('should work with IPv6 address', function(done){
+        var app = express();
+
+        app.use(function(req, res){
+          res.send(req.subdomains);
+        });
+
+        request(app)
+        .get('/')
+        .set('Host', '[::1]')
+        .expect([], done);
+      })
     })
 
     describe('otherwise', function(){
@@ -80,6 +106,34 @@ describe('req', function(){
           .set('Host', 'tobi.ferrets.sub.example.com')
           .expect(["com","example","sub","ferrets","tobi"], done);
         })
+
+        it('should return an array with the whole IPv4', function (done) {
+          var app = express();
+          app.set('subdomain offset', 0);
+
+          app.use(function(req, res){
+            res.send(req.subdomains);
+          });
+
+          request(app)
+          .get('/')
+          .set('Host', '127.0.0.1')
+          .expect(['127.0.0.1'], done);
+        })
+
+        it('should return an array with the whole IPv6', function (done) {
+          var app = express();
+          app.set('subdomain offset', 0);
+
+          app.use(function(req, res){
+            res.send(req.subdomains);
+          });
+
+          request(app)
+          .get('/')
+          .set('Host', '[::1]')
+          .expect(['[::1]'], done);
+        })
       })
 
       describe('when present', function(){

From fa1fcd9fec14234f3fde38b6f4929bb2043fedef Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 23:07:02 -0400
Subject: [PATCH 0543/1265] 3.17.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 60c04eebd38..0d6b71812ae 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.17.0 / 2014-09-08
+===================
 
   * Support `X-Forwarded-Host` in `req.subdomains`
   * Support IP address host in `req.subdomains`
diff --git a/package.json b/package.json
index 0455c7c4eb7..2a2c2269f2b 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.16.10",
+  "version": "3.17.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 7d277c1c156f0b6b0064500986f689e3d0c09a24 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 23:44:24 -0400
Subject: [PATCH 0544/1265] docs: remove erroneous from history

---
 History.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/History.md b/History.md
index 0d6b71812ae..739302555ec 100644
--- a/History.md
+++ b/History.md
@@ -1,7 +1,6 @@
 3.17.0 / 2014-09-08
 ===================
 
-  * Support `X-Forwarded-Host` in `req.subdomains`
   * Support IP address host in `req.subdomains`
   * deps: connect@2.26.0
     - deps: body-parser@~1.8.1

From 70767b19aca926faf679d6ccdd068ba98c52d480 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 23:45:34 -0400
Subject: [PATCH 0545/1265] Fix error in req.subdomains on empty host

---
 History.md             |  5 +++++
 lib/request.js         |  3 +++
 test/req.subdomains.js | 22 +++++++++++-----------
 3 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/History.md b/History.md
index 739302555ec..e4f2e7bc4b0 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+3.x
+===
+
+  * Fix error in `req.subdomains` on empty host
+
 3.17.0 / 2014-09-08
 ===================
 
diff --git a/lib/request.js b/lib/request.js
index 24e8748d211..683d54805c0 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -454,6 +454,9 @@ req.__defineGetter__('auth', function(){
 
 req.__defineGetter__('subdomains', function(){
   var host = this.host;
+
+  if (!host) return [];
+
   var offset = this.app.get('subdomain offset');
   var subdomains = !isIP(host)
     ? host.split('.').reverse()
diff --git a/test/req.subdomains.js b/test/req.subdomains.js
index 7da382f4788..18e4d80ad32 100644
--- a/test/req.subdomains.js
+++ b/test/req.subdomains.js
@@ -15,7 +15,7 @@ describe('req', function(){
         request(app)
         .get('/')
         .set('Host', 'tobi.ferrets.example.com')
-        .expect(["ferrets","tobi"], done);
+        .expect(200, ['ferrets', 'tobi'], done);
       })
 
       it('should work with IPv4 address', function(done){
@@ -28,7 +28,7 @@ describe('req', function(){
         request(app)
         .get('/')
         .set('Host', '127.0.0.1')
-        .expect([], done);
+        .expect(200, [], done);
       })
 
       it('should work with IPv6 address', function(done){
@@ -41,7 +41,7 @@ describe('req', function(){
         request(app)
         .get('/')
         .set('Host', '[::1]')
-        .expect([], done);
+        .expect(200, [], done);
       })
     })
 
@@ -56,7 +56,7 @@ describe('req', function(){
         request(app)
         .get('/')
         .set('Host', 'example.com')
-        .expect([], done);
+        .expect(200, [], done);
       })
     })
 
@@ -71,7 +71,7 @@ describe('req', function(){
 
         request(app)
         .get('/')
-        .expect([], done);
+        .expect(200, [], done);
       })
     })
 
@@ -87,7 +87,7 @@ describe('req', function(){
         request(app)
         .get('/')
         .set('X-Forwarded-Host', 'tobi.ferrets.example.com')
-        .expect(['ferrets', 'tobi'], done);
+        .expect(200, ['ferrets', 'tobi'], done);
       })
     })
 
@@ -104,7 +104,7 @@ describe('req', function(){
           request(app)
           .get('/')
           .set('Host', 'tobi.ferrets.sub.example.com')
-          .expect(["com","example","sub","ferrets","tobi"], done);
+          .expect(200, ['com', 'example', 'sub', 'ferrets', 'tobi'], done);
         })
 
         it('should return an array with the whole IPv4', function (done) {
@@ -118,7 +118,7 @@ describe('req', function(){
           request(app)
           .get('/')
           .set('Host', '127.0.0.1')
-          .expect(['127.0.0.1'], done);
+          .expect(200, ['127.0.0.1'], done);
         })
 
         it('should return an array with the whole IPv6', function (done) {
@@ -132,7 +132,7 @@ describe('req', function(){
           request(app)
           .get('/')
           .set('Host', '[::1]')
-          .expect(['[::1]'], done);
+          .expect(200, ['[::1]'], done);
         })
       })
 
@@ -148,7 +148,7 @@ describe('req', function(){
           request(app)
           .get('/')
           .set('Host', 'tobi.ferrets.sub.example.com')
-          .expect(["ferrets","tobi"], done);
+          .expect(200, ['ferrets', 'tobi'], done);
         })
       })
 
@@ -164,7 +164,7 @@ describe('req', function(){
           request(app)
           .get('/')
           .set('Host', 'sub.example.com')
-          .expect([], done);
+          .expect(200, [], done);
         })
       })
     })

From 4b1b8e420f4f4ee95e835e2eebc41a66dba556f2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Sep 2014 23:45:38 -0400
Subject: [PATCH 0546/1265] 3.17.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index e4f2e7bc4b0..416ab71b640 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.17.1 / 2014-09-08
+===================
 
   * Fix error in `req.subdomains` on empty host
 
diff --git a/package.json b/package.json
index 2a2c2269f2b..7806cb8ccf1 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.17.0",
+  "version": "3.17.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 6bc7574ab5ae85979551b6a2a037bb291a7f1e23 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Aug 2014 23:34:19 -0400
Subject: [PATCH 0547/1265] docs: typo fixes

closes #2316
---
 History.md                    | 4 ++--
 examples/web-service/index.js | 2 +-
 test/app.router.js            | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index 705d38212fc..501f1d6d996 100644
--- a/History.md
+++ b/History.md
@@ -1978,7 +1978,7 @@ Shaw]
   * Added "encoding" option to Request#render(). Closes #299
   * Added "dump exceptions" setting, which is enabled by default.
   * Added simple ejs template engine support
-  * Added error reponse support for text/plain, application/json. Closes #297
+  * Added error response support for text/plain, application/json. Closes #297
   * Added callback function param to Request#error()
   * Added Request#sendHead()
   * Added Request#stream()
@@ -2192,7 +2192,7 @@ Shaw]
   * Updated sample chat app to show messages on load
   * Updated libxmljs parseString -> parseHtmlString
   * Fixed `make init` to work with older versions of git
-  * Fixed specs can now run independant specs for those who cant build deps. Closes #127
+  * Fixed specs can now run independent specs for those who cant build deps. Closes #127
   * Fixed issues introduced by the node url module changes. Closes 126.
   * Fixed two assertions failing due to Collection#keys() returning strings
   * Fixed faulty Collection#toArray() spec due to keys() returning strings
diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index 73a02ca0b16..4958c22450c 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -28,7 +28,7 @@ function error(status, msg) {
 app.use('/api', function(req, res, next){
   var key = req.query['api-key'];
 
-  // key isnt present
+  // key isn't present
   if (!key) return next(error(400, 'api key required'));
 
   // key is invalid
diff --git a/test/app.router.js b/test/app.router.js
index c0e13fdb75c..ad05a79f517 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -630,7 +630,7 @@ describe('app.router', function(){
       .expect('', done);
     })
 
-    it('should require a preceeding /', function(done){
+    it('should require a preceding /', function(done){
       var app = express();
 
       app.get('/file/*', function(req, res){

From 1768d94a1a2051bf87267b92bd85ea0750847082 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Sep 2014 00:04:08 -0400
Subject: [PATCH 0548/1265] deps: qs@2.2.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 501f1d6d996..e2e7d19848f 100644
--- a/History.md
+++ b/History.md
@@ -7,6 +7,8 @@ unreleased
   * deps: fresh@0.2.4
   * deps: media-typer@0.3.0
     - Throw error when parameter format invalid on parse
+  * deps: qs@2.2.3
+    - Fix issue where first empty value in array is discarded
   * deps: range-parser@~1.0.2
   * deps: send@0.9.1
     - Add `lastModified` option
diff --git a/package.json b/package.json
index d52960c28f3..5ec96ef885c 100644
--- a/package.json
+++ b/package.json
@@ -40,7 +40,7 @@
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "1.0.1",
-    "qs": "2.2.2",
+    "qs": "2.2.3",
     "range-parser": "~1.0.2",
     "send": "0.9.1",
     "serve-static": "~1.5.4",

From 276db8c49a4f363d27bc948e554ac375ae92eb0a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Sep 2014 00:06:27 -0400
Subject: [PATCH 0549/1265] deps: update example dependencies

---
 package.json | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/package.json b/package.json
index 5ec96ef885c..619c33b7abe 100644
--- a/package.json
+++ b/package.json
@@ -56,16 +56,16 @@
     "mocha": "~1.21.4",
     "should": "~4.0.4",
     "supertest": "~0.13.0",
-    "connect-redis": "~2.0.0",
     "ejs": "~1.0.0",
     "marked": "0.3.2",
     "hjs": "~0.0.6",
-    "body-parser": "~1.7.0",
+    "body-parser": "~1.8.1",
+    "connect-redis": "~2.1.0",
     "cookie-parser": "~1.3.2",
-    "express-session": "~1.7.6",
-    "jade": "~1.5.0",
-    "method-override": "~2.1.3",
-    "morgan": "~1.2.3",
+    "express-session": "~1.8.1",
+    "jade": "~1.6.0",
+    "method-override": "~2.2.0",
+    "morgan": "~1.3.0",
     "multiparty": "~3.3.2",
     "vhost": "~3.0.0"
   },

From d9937c628ad31a04950a495fe5bfa17ccf229401 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Sep 2014 00:08:07 -0400
Subject: [PATCH 0550/1265] deps: finalhandler@0.2.0

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e2e7d19848f..8ddd6edf207 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,9 @@ unreleased
   * Support IP address host in `req.subdomains`
   * deps: cookie-signature@1.0.5
   * deps: debug@~2.0.0
+  * deps: finalhandler@0.2.0
+    - Set `X-Content-Type-Options: nosniff` header
+    - deps: debug@~2.0.0
   * deps: fresh@0.2.4
   * deps: media-typer@0.3.0
     - Throw error when parameter format invalid on parse
diff --git a/package.json b/package.json
index 619c33b7abe..63ef13a3705 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "debug": "~2.0.0",
     "depd": "0.4.4",
     "escape-html": "1.0.1",
-    "finalhandler": "0.1.0",
+    "finalhandler": "0.2.0",
     "fresh": "0.2.4",
     "media-typer": "0.3.0",
     "methods": "1.1.0",

From d2b1a89b4a0caa59abc6808b6311cb34cdbf43c8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Sep 2014 00:10:02 -0400
Subject: [PATCH 0551/1265] deps: type-is@~1.5.1

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 8ddd6edf207..1c2f7273340 100644
--- a/History.md
+++ b/History.md
@@ -18,6 +18,10 @@ unreleased
     - Use `etag` to generate `ETag` header
     - deps: debug@~2.0.0
     - deps: fresh@0.2.4
+  * deps: type-is@~1.5.1
+    - fix `hasbody` to be true for `content-length: 0`
+    - deps: media-typer@0.3.0
+    - deps: mime-types@~2.0.1
   * deps: vary@~1.0.0
     - Accept valid `Vary` header string as `field`
 
diff --git a/package.json b/package.json
index 63ef13a3705..9cff99bb49f 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "range-parser": "~1.0.2",
     "send": "0.9.1",
     "serve-static": "~1.5.4",
-    "type-is": "~1.3.2",
+    "type-is": "~1.5.1",
     "vary": "~1.0.0",
     "cookie": "0.1.2",
     "merge-descriptors": "0.0.2",

From e2102263ce08642f613667de0430e811470fce4b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Sep 2014 00:11:04 -0400
Subject: [PATCH 0552/1265] deps: serve-static@~1.6.1

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 1c2f7273340..25bfe6e6339 100644
--- a/History.md
+++ b/History.md
@@ -18,6 +18,9 @@ unreleased
     - Use `etag` to generate `ETag` header
     - deps: debug@~2.0.0
     - deps: fresh@0.2.4
+  * deps: serve-static@~1.6.1
+    - Add `lastModified` option
+    - deps: send@0.9.1
   * deps: type-is@~1.5.1
     - fix `hasbody` to be true for `content-length: 0`
     - deps: media-typer@0.3.0
diff --git a/package.json b/package.json
index 9cff99bb49f..f5f2637f5bf 100644
--- a/package.json
+++ b/package.json
@@ -43,7 +43,7 @@
     "qs": "2.2.3",
     "range-parser": "~1.0.2",
     "send": "0.9.1",
-    "serve-static": "~1.5.4",
+    "serve-static": "~1.6.1",
     "type-is": "~1.5.1",
     "vary": "~1.0.0",
     "cookie": "0.1.2",

From d4de82b853ad5daa387b8853ed697134d9dbac28 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Sep 2014 00:12:10 -0400
Subject: [PATCH 0553/1265] deps: accepts@~1.1.0

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 25bfe6e6339..35de5711ca0 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,8 @@ unreleased
 ==========
 
   * Support IP address host in `req.subdomains`
+  * deps: accepts@~1.1.0
+    - update `mime-types`
   * deps: cookie-signature@1.0.5
   * deps: debug@~2.0.0
   * deps: finalhandler@0.2.0
diff --git a/package.json b/package.json
index f5f2637f5bf..9cdc28a0ffd 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "license": "MIT",
   "homepage": "http://expressjs.com/",
   "dependencies": {
-    "accepts": "~1.0.7",
+    "accepts": "~1.1.0",
     "buffer-crc32": "0.2.3",
     "cookie-signature": "1.0.5",
     "debug": "~2.0.0",

From 2a0c35a10862c00b7d95ff1a088956ac8de2dac6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Aug 2014 14:43:38 -0400
Subject: [PATCH 0554/1265] Invoke callback for sendfile when client aborts

fixes #2189
fixes #2300
closes #2303
closes #2305
---
 History.md           |   3 +
 lib/response.js      | 198 ++++++++++++++++++++-----------------------
 package.json         |   1 +
 test/res.sendFile.js |  77 +++++++++++++++++
 4 files changed, 174 insertions(+), 105 deletions(-)

diff --git a/History.md b/History.md
index 35de5711ca0..e3e5cc34199 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,9 @@
 unreleased
 ==========
 
+  * Invoke callback for sendfile when client aborts
+    - Applies to `res.sendFile`, `res.sendfile`, and `res.download`
+    - `err` will be populated with request aborted error
   * Support IP address host in `req.subdomains`
   * deps: accepts@~1.1.0
     - update `mime-types`
diff --git a/lib/response.js b/lib/response.js
index 27b62853e1e..49624eff8c7 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -6,6 +6,7 @@ var deprecate = require('depd')('express');
 var escapeHtml = require('escape-html');
 var http = require('http');
 var isAbsolute = require('./utils').isAbsolute;
+var onFinished = require('on-finished');
 var path = require('path');
 var mixin = require('utils-merge');
 var sign = require('cookie-signature').sign;
@@ -344,8 +345,8 @@ res.jsonp = function jsonp(obj) {
  */
 
 res.sendFile = function sendFile(path, options, fn) {
-  var done;
   var req = this.req;
+  var res = this;
   var next = req.next;
 
   if (!path) {
@@ -364,59 +365,20 @@ res.sendFile = function sendFile(path, options, fn) {
     throw new TypeError('path must be absolute or specify root to res.sendFile');
   }
 
-  // socket errors
-  req.socket.on('error', onerror);
-
-  // errors
-  function onerror(err) {
-    if (done) return;
-    done = true;
-
-    // clean up
-    cleanup();
-
-    // callback available
-    if (fn) return fn(err);
-
-    // delegate
-    next(err);
-  }
-
-  // streaming
-  function onstream(stream) {
-    if (done) return;
-    cleanup();
-    if (fn) stream.on('end', fn);
-  }
-
-  // cleanup
-  function cleanup() {
-    req.socket.removeListener('error', onerror);
-  }
-
-  // transfer
+  // create file stream
   var pathname = encodeURI(path);
   var file = send(req, pathname, options);
-  file.on('error', onerror);
-  file.on('directory', next);
-  file.on('stream', onstream);
-
-  if (options.headers) {
-    // set headers on successful transfer
-    file.on('headers', function headers(res) {
-      var obj = options.headers;
-      var keys = Object.keys(obj);
 
-      for (var i = 0; i < keys.length; i++) {
-        var k = keys[i];
-        res.setHeader(k, obj[k]);
-      }
-    });
-  }
+  // transfer
+  sendfile(res, file, options, function (err) {
+    if (fn) return fn(err);
+    if (err && err.code === 'EISDIR') return next();
 
-  // pipe
-  file.pipe(this);
-  this.on('finish', cleanup);
+    // next() all but aborted errors
+    if (err && err.code !== 'ECONNABORT') {
+      next(err);
+    }
+  });
 };
 
 /**
@@ -461,71 +423,31 @@ res.sendFile = function sendFile(path, options, fn) {
  */
 
 res.sendfile = function(path, options, fn){
-  options = options || {};
-  var self = this;
-  var req = self.req;
-  var next = this.req.next;
-  var done;
-
+  var req = this.req;
+  var res = this;
+  var next = req.next;
 
   // support function as second arg
-  if ('function' == typeof options) {
+  if (typeof options === 'function') {
     fn = options;
     options = {};
   }
 
-  // socket errors
-  req.socket.on('error', error);
-
-  // errors
-  function error(err) {
-    if (done) return;
-    done = true;
-
-    // clean up
-    cleanup();
-
-    // callback available
-    if (fn) return fn(err);
-
-    // delegate
-    next(err);
-  }
-
-  // streaming
-  function stream(stream) {
-    if (done) return;
-    cleanup();
-    if (fn) stream.on('end', fn);
-  }
-
-  // cleanup
-  function cleanup() {
-    req.socket.removeListener('error', error);
-  }
+  options = options || {};
 
-  // transfer
+  // create file stream
   var file = send(req, path, options);
-  file.on('error', error);
-  file.on('directory', next);
-  file.on('stream', stream);
-
-  if (options.headers) {
-    // set headers on successful transfer
-    file.on('headers', function headers(res) {
-      var obj = options.headers;
-      var keys = Object.keys(obj);
 
-      for (var i = 0; i < keys.length; i++) {
-        var k = keys[i];
-        res.setHeader(k, obj[k]);
-      }
-    });
-  }
+  // transfer
+  sendfile(res, file, options, function (err) {
+    if (fn) return fn(err);
+    if (err && err.code === 'EISDIR') return next();
 
-  // pipe
-  file.pipe(this);
-  this.on('finish', cleanup);
+    // next() all but aborted errors
+    if (err && err.code !== 'ECONNABORT') {
+      next(err);
+    }
+  });
 };
 
 res.sendfile = deprecate.function(res.sendfile,
@@ -953,3 +875,69 @@ res.render = function(view, options, fn){
   // render
   app.render(view, options, fn);
 };
+
+// pipe the send file stream
+function sendfile(res, file, options, callback) {
+  var done = false;
+
+  // directory
+  function ondirectory() {
+    if (done) return;
+    done = true;
+
+    var err = new Error('EISDIR, read');
+    err.code = 'EISDIR';
+    callback(err);
+  }
+
+  // errors
+  function onerror(err) {
+    if (done) return;
+    done = true;
+    callback(err);
+  }
+
+  // ended
+  function onend() {
+    if (done) return;
+    done = true;
+    callback();
+  }
+
+  // finished
+  function onfinish(err) {
+    if (err) return onerror(err);
+    if (done) return;
+
+    setImmediate(function () {
+      if (done) return;
+      done = true;
+
+      // response finished before end of file
+      var err = new Error('Request aborted');
+      err.code = 'ECONNABORT';
+      callback(err);
+    });
+  }
+
+  file.on('end', onend);
+  file.on('error', onerror);
+  file.on('directory', ondirectory);
+  onFinished(res, onfinish);
+
+  if (options.headers) {
+    // set headers on successful transfer
+    file.on('headers', function headers(res) {
+      var obj = options.headers;
+      var keys = Object.keys(obj);
+
+      for (var i = 0; i < keys.length; i++) {
+        var k = keys[i];
+        res.setHeader(k, obj[k]);
+      }
+    });
+  }
+
+  // pipe
+  file.pipe(res);
+}
diff --git a/package.json b/package.json
index 9cdc28a0ffd..688e8b6d830 100644
--- a/package.json
+++ b/package.json
@@ -37,6 +37,7 @@
     "fresh": "0.2.4",
     "media-typer": "0.3.0",
     "methods": "1.1.0",
+    "on-finished": "~2.1.0",
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "1.0.1",
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index 5869503d30a..779f6ca79f9 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -3,6 +3,7 @@ var after = require('after');
 var express = require('../')
   , request = require('supertest')
   , assert = require('assert');
+var onFinished = require('on-finished');
 var path = require('path');
 var should = require('should');
 var fixtures = path.join(__dirname, 'fixtures');
@@ -152,6 +153,44 @@ describe('res', function(){
       .expect(200, cb);
     })
 
+    it('should invoke the callback when client aborts', function (done) {
+      var cb = after(1, done);
+      var app = express();
+
+      app.use(function (req, res) {
+        setImmediate(function () {
+          res.sendFile(path.resolve(fixtures, 'name.txt'), function (err) {
+            should(err).be.ok;
+            err.code.should.equal('ECONNABORT');
+            cb();
+          });
+        });
+        test.abort();
+      });
+
+      var test = request(app).get('/');
+      test.expect(200, cb);
+    })
+
+    it('should invoke the callback when client already aborted', function (done) {
+      var cb = after(1, done);
+      var app = express();
+
+      app.use(function (req, res) {
+        onFinished(res, function () {
+          res.sendFile(path.resolve(fixtures, 'name.txt'), function (err) {
+            should(err).be.ok;
+            err.code.should.equal('ECONNABORT');
+            cb();
+          });
+        });
+        test.abort();
+      });
+
+      var test = request(app).get('/');
+      test.expect(200, cb);
+    })
+
     it('should invoke the callback on 404', function(done){
       var app = express();
 
@@ -196,6 +235,44 @@ describe('res', function(){
       .end(done);
     })
 
+    it('should invoke the callback when client aborts', function (done) {
+      var cb = after(1, done);
+      var app = express();
+
+      app.use(function (req, res) {
+        setImmediate(function () {
+          res.sendfile('test/fixtures/name.txt', function (err) {
+            should(err).be.ok;
+            err.code.should.equal('ECONNABORT');
+            cb();
+          });
+        });
+        test.abort();
+      });
+
+      var test = request(app).get('/');
+      test.expect(200, cb);
+    })
+
+    it('should invoke the callback when client already aborted', function (done) {
+      var cb = after(1, done);
+      var app = express();
+
+      app.use(function (req, res) {
+        onFinished(res, function () {
+          res.sendfile('test/fixtures/name.txt', function (err) {
+            should(err).be.ok;
+            err.code.should.equal('ECONNABORT');
+            cb();
+          });
+        });
+        test.abort();
+      });
+
+      var test = request(app).get('/');
+      test.expect(200, cb);
+    })
+
     it('should invoke the callback on 404', function(done){
       var app = express()
         , calls = 0;

From 51d33edb7973cb9ecec404d03e62d1ef9dff4a92 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 25 Aug 2014 01:07:01 -0400
Subject: [PATCH 0555/1265] Use etag to generate ETag headers

---
 History.md       |  1 +
 lib/utils.js     | 31 ++++++++++---------------------
 package.json     |  1 +
 test/res.send.js | 26 ++++++++++++++------------
 test/utils.js    |  6 +++---
 5 files changed, 29 insertions(+), 36 deletions(-)

diff --git a/History.md b/History.md
index e3e5cc34199..5efd387bd8c 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
     - Applies to `res.sendFile`, `res.sendfile`, and `res.download`
     - `err` will be populated with request aborted error
   * Support IP address host in `req.subdomains`
+  * Use `etag` to generate `ETag` headers
   * deps: accepts@~1.1.0
     - update `mime-types`
   * deps: cookie-signature@1.0.5
diff --git a/lib/utils.js b/lib/utils.js
index 9f9fdfd6d0e..8dd29664cb2 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -3,9 +3,8 @@
  */
 
 var mime = require('send').mime;
-var crc32 = require('buffer-crc32');
-var crypto = require('crypto');
 var basename = require('path').basename;
+var etag = require('etag');
 var proxyaddr = require('proxy-addr');
 var qs = require('qs');
 var querystring = require('querystring');
@@ -20,17 +19,12 @@ var typer = require('media-typer');
  * @api private
  */
 
-exports.etag = function etag(body, encoding){
-  if (body.length === 0) {
-    // fast-path empty body
-    return '"1B2M2Y8AsgTpgAmY7PhCfg=="'
-  }
+exports.etag = function (body, encoding) {
+  var buf = !Buffer.isBuffer(body)
+    ? new Buffer(body, encoding)
+    : body
 
-  var hash = crypto
-    .createHash('md5')
-    .update(body, encoding)
-    .digest('base64')
-  return '"' + hash + '"'
+  return etag(buf, {weak: false})
 };
 
 /**
@@ -43,16 +37,11 @@ exports.etag = function etag(body, encoding){
  */
 
 exports.wetag = function wetag(body, encoding){
-  if (body.length === 0) {
-    // fast-path empty body
-    return 'W/"0-0"'
-  }
+  var buf = !Buffer.isBuffer(body)
+    ? new Buffer(body, encoding)
+    : body
 
-  var buf = Buffer.isBuffer(body)
-    ? body
-    : new Buffer(body, encoding)
-  var len = buf.length
-  return 'W/"' + len.toString(16) + '-' + crc32.unsigned(buf) + '"'
+  return etag(buf, {weak: true})
 };
 
 /**
diff --git a/package.json b/package.json
index 688e8b6d830..d8dfc886522 100644
--- a/package.json
+++ b/package.json
@@ -33,6 +33,7 @@
     "debug": "~2.0.0",
     "depd": "0.4.4",
     "escape-html": "1.0.1",
+    "etag": "~1.3.0",
     "finalhandler": "0.2.0",
     "fresh": "0.2.4",
     "media-typer": "0.3.0",
diff --git a/test/res.send.js b/test/res.send.js
index a3d9d2178c5..6148e00207e 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -118,13 +118,13 @@ describe('res', function(){
       var app = express();
 
       app.use(function(req, res){
-        var str = Array(1024 * 2).join('-');
+        var str = Array(1000).join('-');
         res.send(str);
       });
 
       request(app)
       .get('/')
-      .expect('ETag', 'W/"7ff-2796319984"')
+      .expect('ETag', 'W/"3e7-8084ccd1"')
       .end(done);
     })
 
@@ -132,7 +132,7 @@ describe('res', function(){
       var app = express();
 
       app.use(function(req, res){
-        var str = Array(1024 * 2).join('-');
+        var str = Array(1000).join('-');
         res.send(str);
       });
 
@@ -207,13 +207,13 @@ describe('res', function(){
       var app = express();
 
       app.use(function(req, res){
-        var str = Array(1024 * 2).join('-');
+        var str = Array(1000).join('-');
         res.send(new Buffer(str));
       });
 
       request(app)
       .get('/')
-      .expect('ETag', 'W/"7ff-2796319984"')
+      .expect('ETag', 'W/"3e7-8084ccd1"')
       .end(done);
     })
 
@@ -321,15 +321,17 @@ describe('res', function(){
 
   it('should respond with 304 Not Modified when fresh', function(done){
     var app = express();
+    var etag = '"asdf"';
 
     app.use(function(req, res){
-      var str = Array(1024 * 2).join('-');
+      var str = Array(1000).join('-');
+      res.set('ETag', etag);
       res.send(str);
     });
 
     request(app)
     .get('/')
-    .set('If-None-Match', 'W/"7ff-2796319984"')
+    .set('If-None-Match', etag)
     .expect(304, done);
   })
 
@@ -375,7 +377,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('etag', 'W/"c-1525560792"', done)
+        .expect('etag', 'W/"c-5aee35d8"', done)
       })
 
       it('should send ETag for empty string response', function(done){
@@ -396,7 +398,7 @@ describe('res', function(){
         var app = express();
 
         app.use(function(req, res){
-          var str = Array(1024 * 2).join('-');
+          var str = Array(1000).join('-');
           res.send(str);
         });
 
@@ -404,7 +406,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('etag', 'W/"7ff-2796319984"', done)
+        .expect('etag', 'W/"3e7-8084ccd1"', done)
       });
 
       it('should not override ETag when manually set', function(done){
@@ -445,7 +447,7 @@ describe('res', function(){
         var app = express();
 
         app.use(function(req, res){
-          var str = Array(1024 * 2).join('-');
+          var str = Array(1000).join('-');
           res.send(str);
         });
 
@@ -503,7 +505,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('etag', 'W/"d-1486392595"', done)
+        .expect('etag', 'W/"d-58988d13"', done)
       })
     })
 
diff --git a/test/utils.js b/test/utils.js
index 89601a5e848..399b3f5bcdb 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -28,18 +28,18 @@ describe('utils.etag(body, encoding)', function(){
 describe('utils.wetag(body, encoding)', function(){
   it('should support strings', function(){
     utils.wetag('express!')
-    .should.eql('W/"8-3098196679"')
+    .should.eql('W/"8-b8aabac7"')
   })
 
   it('should support utf8 strings', function(){
     utils.wetag('express❤', 'utf8')
-    .should.eql('W/"a-1751845617"')
+    .should.eql('W/"a-686b0af1"')
   })
 
   it('should support buffer', function(){
     var buf = new Buffer('express!')
     utils.wetag(buf)
-    .should.eql('W/"8-3098196679"');
+    .should.eql('W/"8-b8aabac7"');
   })
 
   it('should support empty string', function(){

From 12f92a50dc59887c30f4c6f23fdfbfc616dcbef5 Mon Sep 17 00:00:00 2001
From: Seth Samuel <seth@admitted.ly>
Date: Wed, 13 Aug 2014 09:09:59 -0400
Subject: [PATCH 0556/1265] Add res.sendStatus

closes #2269
closes #2297
closes #2340
---
 History.md             |  1 +
 lib/response.js        | 24 ++++++++++++++++++++++++
 test/res.sendStatus.js | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 57 insertions(+)
 create mode 100644 test/res.sendStatus.js

diff --git a/History.md b/History.md
index 5efd387bd8c..2b64dd5f34d 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Add `res.sendStatus`
   * Invoke callback for sendfile when client aborts
     - Applies to `res.sendFile`, `res.sendfile`, and `res.download`
     - `err` will be populated with request aborted error
diff --git a/lib/response.js b/lib/response.js
index 49624eff8c7..879dd98a2b6 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -303,6 +303,30 @@ res.jsonp = function jsonp(obj) {
   return this.send(body);
 };
 
+/**
+ * Send given HTTP status code.
+ *
+ * Sets the response status to `statusCode` and the body of the
+ * response to the standard description from node's http.STATUS_CODES
+ * or the statusCode number if no description.
+ *
+ * Examples:
+ *
+ *     res.sendStatus(200);
+ *
+ * @param {number} statusCode
+ * @api public
+ */
+
+res.sendStatus = function sendStatus(statusCode) {
+  var body = http.STATUS_CODES[statusCode] || String(statusCode);
+
+  this.statusCode = statusCode;
+  this.type('txt');
+
+  return this.send(body);
+};
+
 /**
  * Transfer the file at the given `path`.
  *
diff --git a/test/res.sendStatus.js b/test/res.sendStatus.js
new file mode 100644
index 00000000000..a97e1bf8d81
--- /dev/null
+++ b/test/res.sendStatus.js
@@ -0,0 +1,32 @@
+
+var assert = require('assert')
+var express = require('..')
+var request = require('supertest')
+
+describe('res', function () {
+  describe('.sendStatus(statusCode)', function () {
+    it('should send the status code and message as body', function (done) {
+      var app = express();
+
+      app.use(function(req, res){
+        res.sendStatus(201);
+      });
+
+      request(app)
+      .get('/')
+      .expect(201, 'Created', done);
+    })
+
+    it('should work with unknown code', function (done) {
+      var app = express();
+
+      app.use(function(req, res){
+        res.sendStatus(599);
+      });
+
+      request(app)
+      .get('/')
+      .expect(599, '599', done);
+    })
+  })
+})

From 1716e3b067af5acaeeee4165a865e0b670300aee Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Sep 2014 00:32:17 -0400
Subject: [PATCH 0557/1265] 4.9.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 2b64dd5f34d..480cc42347a 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.9.0 / 2014-09-08
+==================
 
   * Add `res.sendStatus`
   * Invoke callback for sendfile when client aborts
diff --git a/package.json b/package.json
index d8dfc886522..a4932e51b03 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.8.8",
+  "version": "4.9.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From cf41a8f25434bde16ee8606ce12bb699ef9de39e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 12 Sep 2014 17:46:49 -0400
Subject: [PATCH 0558/1265] Fix app.use to accept array of middleware without
 path

fixes #2356
---
 History.md         |   5 ++
 lib/application.js |  13 ++-
 test/app.use.js    | 204 +++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 220 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 480cc42347a..32160b82a65 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix `app.use` to accept array of middleware without path
+
 4.9.0 / 2014-09-08
 ==================
 
diff --git a/lib/application.js b/lib/application.js
index 2214bf6c1f3..b5cb883dc8e 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -157,9 +157,18 @@ app.use = function use(fn) {
   var self = this;
 
   // default path to '/'
+  // disambiguate app.use([fn])
   if (typeof fn !== 'function') {
-    offset = 1;
-    path = fn;
+    var arg = fn;
+
+    while (Array.isArray(arg) && arg.length !== 0) {
+      arg = arg[0];
+    }
+
+    if (typeof arg !== 'function' && (arg == null || arg.length !== 0)) {
+      offset = 1;
+      path = fn;
+    }
   }
 
   var fns = flatten(slice.call(arguments, offset));
diff --git a/test/app.use.js b/test/app.use.js
index ee237c88507..8f5698a366d 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -171,6 +171,90 @@ describe('app', function(){
       .post('/foo')
       .expect(200, 'saw POST /foo', cb);
     })
+
+    it('should accept array of middleware', function (done) {
+      var app = express();
+
+      function fn1(req, res, next) {
+        res.setHeader('x-fn-1', 'hit');
+        next();
+      }
+
+      function fn2(req, res, next) {
+        res.setHeader('x-fn-2', 'hit');
+        next();
+      }
+
+      function fn3(req, res, next) {
+        res.setHeader('x-fn-3', 'hit');
+        res.end();
+      }
+
+      app.use([fn1, fn2, fn3]);
+
+      request(app)
+      .get('/')
+      .expect('x-fn-1', 'hit')
+      .expect('x-fn-2', 'hit')
+      .expect('x-fn-3', 'hit')
+      .expect(200, done);
+    })
+
+    it('should accept multiple arrays of middleware', function (done) {
+      var app = express();
+
+      function fn1(req, res, next) {
+        res.setHeader('x-fn-1', 'hit');
+        next();
+      }
+
+      function fn2(req, res, next) {
+        res.setHeader('x-fn-2', 'hit');
+        next();
+      }
+
+      function fn3(req, res, next) {
+        res.setHeader('x-fn-3', 'hit');
+        res.end();
+      }
+
+      app.use([fn1, fn2], [fn3]);
+
+      request(app)
+      .get('/')
+      .expect('x-fn-1', 'hit')
+      .expect('x-fn-2', 'hit')
+      .expect('x-fn-3', 'hit')
+      .expect(200, done);
+    })
+
+    it('should accept nested arrays of middleware', function (done) {
+      var app = express();
+
+      function fn1(req, res, next) {
+        res.setHeader('x-fn-1', 'hit');
+        next();
+      }
+
+      function fn2(req, res, next) {
+        res.setHeader('x-fn-2', 'hit');
+        next();
+      }
+
+      function fn3(req, res, next) {
+        res.setHeader('x-fn-3', 'hit');
+        res.end();
+      }
+
+      app.use([[fn1], fn2], [fn3]);
+
+      request(app)
+      .get('/')
+      .expect('x-fn-1', 'hit')
+      .expect('x-fn-2', 'hit')
+      .expect('x-fn-3', 'hit')
+      .expect(200, done);
+    })
   })
 
   describe('.use(path, middleware)', function(){
@@ -254,6 +338,90 @@ describe('app', function(){
       .expect(200, 'saw POST /bar', cb);
     })
 
+    it('should accept array of middleware', function (done) {
+      var app = express();
+
+      function fn1(req, res, next) {
+        res.setHeader('x-fn-1', 'hit');
+        next();
+      }
+
+      function fn2(req, res, next) {
+        res.setHeader('x-fn-2', 'hit');
+        next();
+      }
+
+      function fn3(req, res, next) {
+        res.setHeader('x-fn-3', 'hit');
+        res.end();
+      }
+
+      app.use('/foo', [fn1, fn2, fn3]);
+
+      request(app)
+      .get('/foo')
+      .expect('x-fn-1', 'hit')
+      .expect('x-fn-2', 'hit')
+      .expect('x-fn-3', 'hit')
+      .expect(200, done);
+    })
+
+    it('should accept multiple arrays of middleware', function (done) {
+      var app = express();
+
+      function fn1(req, res, next) {
+        res.setHeader('x-fn-1', 'hit');
+        next();
+      }
+
+      function fn2(req, res, next) {
+        res.setHeader('x-fn-2', 'hit');
+        next();
+      }
+
+      function fn3(req, res, next) {
+        res.setHeader('x-fn-3', 'hit');
+        res.end();
+      }
+
+      app.use('/foo', [fn1, fn2], [fn3]);
+
+      request(app)
+      .get('/foo')
+      .expect('x-fn-1', 'hit')
+      .expect('x-fn-2', 'hit')
+      .expect('x-fn-3', 'hit')
+      .expect(200, done);
+    })
+
+    it('should accept nested arrays of middleware', function (done) {
+      var app = express();
+
+      function fn1(req, res, next) {
+        res.setHeader('x-fn-1', 'hit');
+        next();
+      }
+
+      function fn2(req, res, next) {
+        res.setHeader('x-fn-2', 'hit');
+        next();
+      }
+
+      function fn3(req, res, next) {
+        res.setHeader('x-fn-3', 'hit');
+        res.end();
+      }
+
+      app.use('/foo', [fn1, [fn2]], [fn3]);
+
+      request(app)
+      .get('/foo')
+      .expect('x-fn-1', 'hit')
+      .expect('x-fn-2', 'hit')
+      .expect('x-fn-3', 'hit')
+      .expect(200, done);
+    })
+
     it('should support array of paths', function (done) {
       var app = express();
       var cb = after(3, done);
@@ -275,6 +443,42 @@ describe('app', function(){
       .expect(200, 'saw GET / through /bar', cb);
     })
 
+    it('should support array of paths with middleware array', function (done) {
+      var app = express();
+      var cb = after(2, done);
+
+      function fn1(req, res, next) {
+        res.setHeader('x-fn-1', 'hit');
+        next();
+      }
+
+      function fn2(req, res, next) {
+        res.setHeader('x-fn-2', 'hit');
+        next();
+      }
+
+      function fn3(req, res, next) {
+        res.setHeader('x-fn-3', 'hit');
+        res.send('saw ' + req.method + ' ' + req.url + ' through ' + req.originalUrl);
+      }
+
+      app.use(['/foo/', '/bar'], [[fn1], fn2], [fn3]);
+
+      request(app)
+      .get('/foo')
+      .expect('x-fn-1', 'hit')
+      .expect('x-fn-2', 'hit')
+      .expect('x-fn-3', 'hit')
+      .expect(200, 'saw GET / through /foo', cb);
+
+      request(app)
+      .get('/bar')
+      .expect('x-fn-1', 'hit')
+      .expect('x-fn-2', 'hit')
+      .expect('x-fn-3', 'hit')
+      .expect(200, 'saw GET / through /bar', cb);
+    })
+
     it('should support regexp path', function (done) {
       var app = express();
       var cb = after(4, done);

From bb8abf1f9017aca26cded6c61043c37dee34a68a Mon Sep 17 00:00:00 2001
From: Fei Yao <gzzyyff@gmail.com>
Date: Sun, 14 Sep 2014 16:20:31 +0800
Subject: [PATCH 0559/1265] Remove unused require in router match

closes #2358
---
 lib/router/match.js | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/lib/router/match.js b/lib/router/match.js
index ce308c41486..9afebfc8b34 100644
--- a/lib/router/match.js
+++ b/lib/router/match.js
@@ -1,8 +1,3 @@
-/**
- * Module dependencies.
- */
-
-var pathRegexp = require('path-to-regexp');
 
 /**
  * Expose `Layer`.

From 80847d8c82513c092f168a9f8d877a7f16866df3 Mon Sep 17 00:00:00 2001
From: Julien Gilli <julien.gilli@joyent.com>
Date: Tue, 2 Sep 2014 17:53:56 -0700
Subject: [PATCH 0560/1265] tests: fix broken tests with node v0.12 branch

Currently, test/req.ip.js assumes that the connection between the client
and the server is an IPv4 connection. However, depending on the
configuration of the host where this test runs, the connection can be an
IPv4 one or an IPv6 one using an IPv4 mapped address. In the future, it
could also be a "full" IPv6 connection.

This change makes this test handle any type of address.

fixes #2342
---
 test/req.ip.js | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/test/req.ip.js b/test/req.ip.js
index 8e5f9f5516c..19d0fee147e 100644
--- a/test/req.ip.js
+++ b/test/req.ip.js
@@ -45,10 +45,9 @@ describe('req', function(){
             res.send(req.ip);
           });
 
-          request(app)
-          .get('/')
-          .set('X-Forwarded-For', 'client, p1, p2')
-          .expect('127.0.0.1', done);
+          var test = request(app).get('/')
+          test.set('X-Forwarded-For', 'client, p1, p2')
+          test.expect(200, getExpectedClientAddress(test._server), done);
         })
       })
     })
@@ -63,10 +62,19 @@ describe('req', function(){
           res.send(req.ip);
         });
 
-        request(app)
-        .get('/')
-        .expect('127.0.0.1', done);
+          var test = request(app).get('/')
+          test.expect(200, getExpectedClientAddress(test._server), done);
       })
     })
   })
 })
+
+/**
+ * Get the local client address depending on AF_NET of server
+ */
+
+function getExpectedClientAddress(server) {
+  return server.address().address === '::'
+    ? '::ffff:127.0.0.1'
+    : '127.0.0.1';
+}

From 534fa181c6bfc695b5724d81ff32b8346986e8f0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 15 Sep 2014 18:56:09 -0700
Subject: [PATCH 0561/1265] Add test-tap npm script for TAP output

closes #2359
---
 package.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package.json b/package.json
index 7806cb8ccf1..b4673599235 100644
--- a/package.json
+++ b/package.json
@@ -67,6 +67,7 @@
     "prepublish": "npm prune",
     "test": "mocha --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
+    "test-tap": "mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/",
     "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/"
   }
 }

From 381f278d0aa6d9ea1abe337686700e35b478f246 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 15 Sep 2014 23:56:36 -0700
Subject: [PATCH 0562/1265] deps: connect@2.26.1

---
 History.md   | 11 +++++++++++
 package.json |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 416ab71b640..842cd6b1cea 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,14 @@
+3.x
+===
+
+  * deps: connect@2.26.1
+    - deps: body-parser@~1.8.2
+    - deps: depd@0.4.5
+    - deps: express-session@~1.8.2
+    - deps: morgan@~1.3.1
+    - deps: serve-favicon@~2.1.3
+    - deps: serve-static@~1.6.2
+
 3.17.1 / 2014-09-08
 ===================
 
diff --git a/package.json b/package.json
index b4673599235..0e2d58e5492 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "buffer-crc32": "0.2.3",
-    "connect": "2.26.0",
+    "connect": "2.26.1",
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",
     "debug": "~2.0.0",

From 178fe15091f87c4147cff150d44ccba8b553318e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 15 Sep 2014 23:57:41 -0700
Subject: [PATCH 0563/1265] deps: depd@0.4.5

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 842cd6b1cea..1871b7eac1b 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,7 @@
     - deps: morgan@~1.3.1
     - deps: serve-favicon@~2.1.3
     - deps: serve-static@~1.6.2
+  * deps: depd@0.4.5
 
 3.17.1 / 2014-09-08
 ===================
diff --git a/package.json b/package.json
index 0e2d58e5492..42d025a8bc6 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,7 @@
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",
     "debug": "~2.0.0",
-    "depd": "0.4.4",
+    "depd": "0.4.5",
     "escape-html": "1.0.1",
     "fresh": "0.2.4",
     "media-typer": "0.3.0",

From 7eb65eeca2a18e9d69a0c57d93e83c5568a78b4b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 15 Sep 2014 23:59:02 -0700
Subject: [PATCH 0564/1265] deps: send@0.9.2

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 1871b7eac1b..ada4894b4c3 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,10 @@
     - deps: serve-favicon@~2.1.3
     - deps: serve-static@~1.6.2
   * deps: depd@0.4.5
+  * deps: send@0.9.2
+    - deps: depd@0.4.5
+    - deps: etag@~1.3.1
+    - deps: range-parser@~1.0.2
 
 3.17.1 / 2014-09-08
 ===================
diff --git a/package.json b/package.json
index 42d025a8bc6..d8a1e4dabbf 100644
--- a/package.json
+++ b/package.json
@@ -41,7 +41,7 @@
     "parseurl": "~1.3.0",
     "proxy-addr": "1.0.1",
     "range-parser": "~1.0.2",
-    "send": "0.9.1",
+    "send": "0.9.2",
     "vary": "~1.0.0",
     "cookie": "0.1.2",
     "merge-descriptors": "0.0.2"

From f6ac068ab040ae008074e2ecc9b935a55310f2f2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Sep 2014 00:11:08 -0700
Subject: [PATCH 0565/1265] Use crc instead of buffer-crc32 for speed

---
 History.md   | 1 +
 lib/utils.js | 4 ++--
 package.json | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index ada4894b4c3..7fe76c91727 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 3.x
 ===
 
+  * Use `crc` instead of `buffer-crc32` for speed
   * deps: connect@2.26.1
     - deps: body-parser@~1.8.2
     - deps: depd@0.4.5
diff --git a/lib/utils.js b/lib/utils.js
index 2d5bfbb33fa..7497fe8eb1b 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -3,9 +3,9 @@
  * Module dependencies.
  */
 
+var crc = require('crc').crc32;
 var mime = require('connect').mime
   , proxyaddr = require('proxy-addr')
-  , crc32 = require('buffer-crc32')
   , crypto = require('crypto');
 var typer = require('media-typer');
 
@@ -56,7 +56,7 @@ exports.wetag = function wetag(body, encoding){
     ? body
     : new Buffer(body, encoding)
   var len = buf.length
-  return 'W/"' + len.toString(16) + '-' + crc32.unsigned(buf) + '"'
+  return 'W/"' + len.toString(16) + '-' + crc(buf) + '"'
 };
 
 /**
diff --git a/package.json b/package.json
index d8a1e4dabbf..5219657cc2d 100644
--- a/package.json
+++ b/package.json
@@ -27,10 +27,10 @@
   "homepage": "http://expressjs.com/",
   "dependencies": {
     "basic-auth": "1.0.0",
-    "buffer-crc32": "0.2.3",
     "connect": "2.26.1",
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",
+    "crc": "3.0.0",
     "debug": "~2.0.0",
     "depd": "0.4.5",
     "escape-html": "1.0.1",

From f29399c4e1f644a64e08a45251f113d361bdfbb3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Sep 2014 00:14:41 -0700
Subject: [PATCH 0566/1265] 3.17.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 7fe76c91727..07349797ee0 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.17.2 / 2014-09-15
+===================
 
   * Use `crc` instead of `buffer-crc32` for speed
   * deps: connect@2.26.1
diff --git a/package.json b/package.json
index 5219657cc2d..92eea497321 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.17.1",
+  "version": "3.17.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From daacb749c12edd70987bd11104f74d6409c40d68 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Sep 2014 23:03:04 -0700
Subject: [PATCH 0567/1265] deps: remove un-used buffer-crc32 dependency

---
 package.json | 1 -
 1 file changed, 1 deletion(-)

diff --git a/package.json b/package.json
index a4932e51b03..33d9de46fd9 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,6 @@
   "homepage": "http://expressjs.com/",
   "dependencies": {
     "accepts": "~1.1.0",
-    "buffer-crc32": "0.2.3",
     "cookie-signature": "1.0.5",
     "debug": "~2.0.0",
     "depd": "0.4.4",

From 2470ae6c7270485717c0f2f9af490815929fd431 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Sep 2014 23:21:45 -0700
Subject: [PATCH 0568/1265] deps: etag@~1.3.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 551c6658d2a..4c2e3a3e907 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,7 @@ unreleased
 
   * Fix `app.use` to accept array of middleware without path
   * deps: depd@0.4.5
+  * deps: etag@~1.3.1
   * deps: send@0.9.2
     - deps: depd@0.4.5
     - deps: etag@~1.3.1
diff --git a/package.json b/package.json
index f6e662a599a..9ab16140945 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,7 @@
     "debug": "~2.0.0",
     "depd": "0.4.5",
     "escape-html": "1.0.1",
-    "etag": "~1.3.0",
+    "etag": "~1.3.1",
     "finalhandler": "0.2.0",
     "fresh": "0.2.4",
     "media-typer": "0.3.0",

From d08fd64190a5850576c54e3e13e535907c1523db Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Sep 2014 23:23:14 -0700
Subject: [PATCH 0569/1265] deps: serve-static@~1.6.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 4c2e3a3e907..96dd8f9c69a 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,8 @@ unreleased
     - deps: depd@0.4.5
     - deps: etag@~1.3.1
     - deps: range-parser@~1.0.2
+  * deps: serve-static@~1.6.2
+    - deps: send@0.9.2
 
 4.9.0 / 2014-09-08
 ==================
diff --git a/package.json b/package.json
index 9ab16140945..0c1a08046e0 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "qs": "2.2.3",
     "range-parser": "~1.0.2",
     "send": "0.9.2",
-    "serve-static": "~1.6.1",
+    "serve-static": "~1.6.2",
     "type-is": "~1.5.1",
     "vary": "~1.0.0",
     "cookie": "0.1.2",

From c5193536e5c1082e0eea7517e4dc326d9a0767e5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Sep 2014 23:24:23 -0700
Subject: [PATCH 0570/1265] deps: update example dependencies

---
 package.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 0c1a08046e0..dd27e3fc2e4 100644
--- a/package.json
+++ b/package.json
@@ -60,13 +60,13 @@
     "ejs": "~1.0.0",
     "marked": "0.3.2",
     "hjs": "~0.0.6",
-    "body-parser": "~1.8.1",
+    "body-parser": "~1.8.2",
     "connect-redis": "~2.1.0",
-    "cookie-parser": "~1.3.2",
-    "express-session": "~1.8.1",
+    "cookie-parser": "~1.3.3",
+    "express-session": "~1.8.2",
     "jade": "~1.6.0",
     "method-override": "~2.2.0",
-    "morgan": "~1.3.0",
+    "morgan": "~1.3.1",
     "multiparty": "~3.3.2",
     "vhost": "~3.0.0"
   },

From 947fb8b27425851f3316ae9d39df5035085dde4a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Sep 2014 23:31:57 -0700
Subject: [PATCH 0571/1265] 4.9.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 96dd8f9c69a..1f0b8e751d6 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.9.1 / 2014-09-16
+==================
 
   * Fix `app.use` to accept array of middleware without path
   * deps: depd@0.4.5
diff --git a/package.json b/package.json
index dd27e3fc2e4..2fb27ccda50 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 3c1a96436237e4dc920786030b05b4903b9dcfff Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Sep 2014 12:17:03 -0700
Subject: [PATCH 0572/1265] Fix regression for empty string path in app.use

fixes #2361
fixes #2362
---
 History.md         |  5 +++++
 lib/application.js |  3 ++-
 test/app.use.js    | 12 ++++++++++++
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 1f0b8e751d6..abd9623a548 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix regression for empty string `path` in `app.use`
+
 4.9.1 / 2014-09-16
 ==================
 
diff --git a/lib/application.js b/lib/application.js
index b5cb883dc8e..2c7cc2de263 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -165,7 +165,8 @@ app.use = function use(fn) {
       arg = arg[0];
     }
 
-    if (typeof arg !== 'function' && (arg == null || arg.length !== 0)) {
+    // first arg is the path
+    if (typeof arg !== 'function') {
       offset = 1;
       path = fn;
     }
diff --git a/test/app.use.js b/test/app.use.js
index 8f5698a366d..c1c511bad92 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -503,5 +503,17 @@ describe('app', function(){
       .get('/get/zoo')
       .expect(404, cb);
     })
+
+    it('should support empty string path', function (done) {
+      var app = express();
+
+      app.use('', function (req, res) {
+        res.send('saw ' + req.method + ' ' + req.url + ' through ' + req.originalUrl);
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, 'saw GET / through /', done);
+    })
   })
 })

From bf1980f1b4f863bf89db2d3066f79bd813bcfe05 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Sep 2014 12:28:48 -0700
Subject: [PATCH 0573/1265] Improve error message for bad app.use arguments

---
 History.md          |  1 +
 lib/router/index.js | 28 +++++++++++++++++++++++-----
 test/Router.js      |  7 +++++--
 test/app.use.js     | 18 +++++++++++++-----
 4 files changed, 42 insertions(+), 12 deletions(-)

diff --git a/History.md b/History.md
index abd9623a548..1e9e7d37966 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Fix regression for empty string `path` in `app.use`
+  * Improve error message for bad `app.use` arguments
 
 4.9.1 / 2014-09-16
 ==================
diff --git a/lib/router/index.js b/lib/router/index.js
index 4e63eb1060f..8bdce9197c5 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -1,3 +1,4 @@
+
 /**
  * Module dependencies.
  */
@@ -8,9 +9,15 @@ var methods = require('methods');
 var mixin = require('utils-merge');
 var debug = require('debug')('express:router');
 var parseUrl = require('parseurl');
+var utils = require('../utils');
+
+/**
+ * Module variables.
+ */
+
+var objectRegExp = /^\[object (\S+)\]$/;
 var slice = Array.prototype.slice;
 var toString = Object.prototype.toString;
-var utils = require('../utils');
 
 /**
  * Initialize a new `Router` with the given `options`.
@@ -413,14 +420,12 @@ proto.use = function use(fn) {
   var callbacks = utils.flatten(slice.call(arguments, offset));
 
   if (callbacks.length === 0) {
-    throw new TypeError('Router.use() requires callback function');
+    throw new TypeError('Router.use() requires middleware functions');
   }
 
   callbacks.forEach(function (fn) {
     if (typeof fn !== 'function') {
-      var type = toString.call(fn);
-      var msg = 'Router.use() requires callback function but got a ' + type;
-      throw new TypeError(msg);
+      throw new TypeError('Router.use() requires middleware function but got a ' + gettype(fn));
     }
 
     // add the middleware
@@ -477,6 +482,19 @@ methods.concat('all').forEach(function(method){
   };
 });
 
+// get type for error message
+function gettype(obj) {
+  var type = typeof obj;
+
+  if (type !== 'object') {
+    return type;
+  }
+
+  // inspect [[Class]] for objects
+  return toString.call(obj)
+    .replace(objectRegExp, '$1');
+}
+
 // merge params with parent params
 function mergeParams(params, parent) {
   if (typeof parent !== 'object' || !parent) {
diff --git a/test/Router.js b/test/Router.js
index 142b9b33faa..9085acd7f0e 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -300,12 +300,15 @@ describe('Router', function(){
   describe('.use', function() {
     it('should require arguments', function(){
       var router = new Router();
-      router.use.bind(router).should.throw(/requires callback function/)
+      router.use.bind(router).should.throw(/requires middleware function/)
     })
 
     it('should not accept non-functions', function(){
       var router = new Router();
-      router.use.bind(router, '/', 'hello').should.throw(/requires callback function/)
+      router.use.bind(router, '/', 'hello').should.throw(/requires middleware function.*string/)
+      router.use.bind(router, '/', 5).should.throw(/requires middleware function.*number/)
+      router.use.bind(router, '/', null).should.throw(/requires middleware function.*Null/)
+      router.use.bind(router, '/', new Date()).should.throw(/requires middleware function.*Date/)
     })
   })
 
diff --git a/test/app.use.js b/test/app.use.js
index c1c511bad92..b2031e4c56c 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -16,11 +16,6 @@ describe('app', function(){
     app.use(blog);
   })
 
-  it('should reject missing functions', function(){
-    var app = express();
-    app.use.bind(app, 3).should.throw(/requires middleware function/);
-  })
-
   describe('.use(app)', function(){
     it('should mount the app', function(done){
       var blog = express()
@@ -258,6 +253,19 @@ describe('app', function(){
   })
 
   describe('.use(path, middleware)', function(){
+    it('should reject missing functions', function () {
+      var app = express();
+      app.use.bind(app, '/').should.throw(/requires middleware function/);
+    })
+
+    it('should reject non-functions as middleware', function () {
+      var app = express();
+      app.use.bind(app, '/', 'hi').should.throw(/requires middleware function.*string/);
+      app.use.bind(app, '/', 5).should.throw(/requires middleware function.*number/);
+      app.use.bind(app, '/', null).should.throw(/requires middleware function.*Null/);
+      app.use.bind(app, '/', new Date()).should.throw(/requires middleware function.*Date/);
+    })
+
     it('should strip path from req.url', function (done) {
       var app = express();
 

From 728917164cc00dd02382560f52c6f78936adb4c3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Sep 2014 12:37:56 -0700
Subject: [PATCH 0574/1265] Fix router.use to accept array of middleware
 without path

---
 History.md          |  1 +
 lib/router/index.js | 14 ++++++++++++--
 test/Router.js      | 22 ++++++++++++++++++++++
 3 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 1e9e7d37966..42b9166c5ea 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Fix regression for empty string `path` in `app.use`
+  * Fix `router.use` to accept array of middleware without path
   * Improve error message for bad `app.use` arguments
 
 4.9.1 / 2014-09-16
diff --git a/lib/router/index.js b/lib/router/index.js
index 8bdce9197c5..64fcd1e3ac0 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -412,9 +412,19 @@ proto.use = function use(fn) {
   var self = this;
 
   // default path to '/'
+  // disambiguate router.use([fn])
   if (typeof fn !== 'function') {
-    offset = 1;
-    path = fn;
+    var arg = fn;
+
+    while (Array.isArray(arg) && arg.length !== 0) {
+      arg = arg[0];
+    }
+
+    // first arg is the path
+    if (typeof arg !== 'function') {
+      offset = 1;
+      path = fn;
+    }
   }
 
   var callbacks = utils.flatten(slice.call(arguments, offset));
diff --git a/test/Router.js b/test/Router.js
index 9085acd7f0e..85a53312073 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -310,6 +310,28 @@ describe('Router', function(){
       router.use.bind(router, '/', null).should.throw(/requires middleware function.*Null/)
       router.use.bind(router, '/', new Date()).should.throw(/requires middleware function.*Date/)
     })
+
+    it('should accept array of middleware', function(done){
+      var count = 0;
+      var router = new Router();
+
+      function fn1(req, res, next){
+        assert.equal(++count, 1);
+        next();
+      }
+
+      function fn2(req, res, next){
+        assert.equal(++count, 2);
+        next();
+      }
+
+      router.use([fn1, fn2], function(req, res){
+        assert.equal(++count, 3);
+        done();
+      });
+
+      router.handle({ url: '/foo', method: 'GET' }, {}, function(){});
+    })
   })
 
   describe('.param', function() {

From 91891e3aee6f2a0b1c4db1e0b499338d05bda91b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Sep 2014 20:49:01 -0700
Subject: [PATCH 0575/1265] 4.9.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 42b9166c5ea..fadebb9b564 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.9.2 / 2014-09-17
+==================
 
   * Fix regression for empty string `path` in `app.use`
   * Fix `router.use` to accept array of middleware without path
diff --git a/package.json b/package.json
index 2fb27ccda50..eea18553c60 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.9.1",
+  "version": "4.9.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From c00f2f859635471cedaef12ecc20bd251d815dc2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Sep 2014 10:36:21 -0700
Subject: [PATCH 0576/1265] deps: proxy-addr@~1.0.2

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 07349797ee0..6c9b8fe3763 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+3.x
+===
+
+  * deps: proxy-addr@~1.0.2
+    - Fix a global leak when multiple subnets are trusted
+    - deps: ipaddr.js@0.1.3
+
 3.17.2 / 2014-09-15
 ===================
 
diff --git a/package.json b/package.json
index 92eea497321..dfaa228aaee 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "methods": "1.1.0",
     "mkdirp": "0.5.0",
     "parseurl": "~1.3.0",
-    "proxy-addr": "1.0.1",
+    "proxy-addr": "~1.0.2",
     "range-parser": "~1.0.2",
     "send": "0.9.2",
     "vary": "~1.0.0",

From 63286e1192c695630a9c221c93b98d3b982fc5c7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Sep 2014 10:38:31 -0700
Subject: [PATCH 0577/1265] 3.17.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 6c9b8fe3763..d34e517ea25 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.17.3 / 2014-09-18
+===================
 
   * deps: proxy-addr@~1.0.2
     - Fix a global leak when multiple subnets are trusted
diff --git a/package.json b/package.json
index dfaa228aaee..b761379d05c 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.17.2",
+  "version": "3.17.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From bc38d896ea6bb8049e08467c0ff7fcf40956e744 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Sep 2014 10:45:35 -0700
Subject: [PATCH 0578/1265] 4.9.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index cd0990c8266..d67cb81691e 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.9.3 / 2014-09-18
+==================
 
   * deps: proxy-addr@~1.0.2
     - Fix a global leak when multiple subnets are trusted
diff --git a/package.json b/package.json
index 95a64f48063..7673de50625 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.9.2",
+  "version": "4.9.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 0e0b259556789538b818a1a691502775e1758b75 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 19 Sep 2014 22:54:39 -0700
Subject: [PATCH 0579/1265] deps: connect@2.26.2

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index d34e517ea25..b0601d4ef58 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+3.x
+===
+
+  * deps: connect@2.26.2
+    - deps: body-parser@~1.8.3
+    - deps: qs@2.2.4
+
 3.17.3 / 2014-09-18
 ===================
 
diff --git a/package.json b/package.json
index b761379d05c..0967c0078d9 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "homepage": "http://expressjs.com/",
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.26.1",
+    "connect": "2.26.2",
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",
     "crc": "3.0.0",

From b09afad7b19d87bbc5acae6220e79f4765fb69c3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 19 Sep 2014 22:57:07 -0700
Subject: [PATCH 0580/1265] 3.17.4

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index b0601d4ef58..4e7dda5208b 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.17.4 / 2014-09-19
+===================
 
   * deps: connect@2.26.2
     - deps: body-parser@~1.8.3
diff --git a/package.json b/package.json
index 0967c0078d9..63489f5dc1f 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.17.3",
+  "version": "3.17.4",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From e4fc09423e467efab58caf073a22898d01571a2d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 19 Sep 2014 23:06:31 -0700
Subject: [PATCH 0581/1265] deps: qs@2.2.4

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 4a091f8538a..a56b4452bf0 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: qs@2.2.4
+    - Fix issue with object keys starting with numbers truncated
+
 4.9.3 / 2014-09-18
 ==================
 
diff --git a/package.json b/package.json
index 7673de50625..3a810beed2a 100644
--- a/package.json
+++ b/package.json
@@ -41,7 +41,7 @@
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "~1.0.2",
-    "qs": "2.2.3",
+    "qs": "2.2.4",
     "range-parser": "~1.0.2",
     "send": "0.9.2",
     "serve-static": "~1.6.2",

From 8e46af1b1dd543b9933b86613a16ddcb7dc286be Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 19 Sep 2014 23:07:58 -0700
Subject: [PATCH 0582/1265] 4.9.4

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index a56b4452bf0..ec5c90b7331 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.9.4 / 2014-09-19
+==================
 
   * deps: qs@2.2.4
     - Fix issue with object keys starting with numbers truncated
diff --git a/package.json b/package.json
index 3a810beed2a..7423c4eddc0 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.9.3",
+  "version": "4.9.4",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 341c1919d9c1280c7a9bbc610bef3ebf8e8d6ad2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Sep 2014 19:12:43 -0400
Subject: [PATCH 0583/1265] deps: connect@2.26.3

---
 History.md   | 8 ++++++++
 package.json | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 4e7dda5208b..5c38c2492b1 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,11 @@
+3.x
+===
+
+  * deps: connect@2.26.3
+    - deps: body-parser@~1.8.4
+    - deps: serve-favicon@~2.1.5
+    - deps: serve-static@~1.6.3
+
 3.17.4 / 2014-09-19
 ===================
 
diff --git a/package.json b/package.json
index 63489f5dc1f..ac147a40780 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "homepage": "http://expressjs.com/",
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.26.2",
+    "connect": "2.26.3",
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",
     "crc": "3.0.0",

From 734bdf5ca15f2b620015d197606df34e3900c7da Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Sep 2014 19:14:33 -0400
Subject: [PATCH 0584/1265] deps: proxy-addr@~1.0.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5c38c2492b1..6740df6502c 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,8 @@
     - deps: body-parser@~1.8.4
     - deps: serve-favicon@~2.1.5
     - deps: serve-static@~1.6.3
+  * deps: proxy-addr@~1.0.3
+    - Use `forwarded` npm module
 
 3.17.4 / 2014-09-19
 ===================
diff --git a/package.json b/package.json
index ac147a40780..f3fa8be1902 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "methods": "1.1.0",
     "mkdirp": "0.5.0",
     "parseurl": "~1.3.0",
-    "proxy-addr": "~1.0.2",
+    "proxy-addr": "~1.0.3",
     "range-parser": "~1.0.2",
     "send": "0.9.2",
     "vary": "~1.0.0",

From 653270bb432ef20646a5cc480c62658e8a4b1c51 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Sep 2014 19:15:46 -0400
Subject: [PATCH 0585/1265] deps: send@0.9.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 6740df6502c..628be16bfc5 100644
--- a/History.md
+++ b/History.md
@@ -7,6 +7,8 @@
     - deps: serve-static@~1.6.3
   * deps: proxy-addr@~1.0.3
     - Use `forwarded` npm module
+  * deps: send@0.9.3
+    - deps: etag@~1.4.0
 
 3.17.4 / 2014-09-19
 ===================
diff --git a/package.json b/package.json
index f3fa8be1902..2383af2bbcc 100644
--- a/package.json
+++ b/package.json
@@ -41,7 +41,7 @@
     "parseurl": "~1.3.0",
     "proxy-addr": "~1.0.3",
     "range-parser": "~1.0.2",
-    "send": "0.9.2",
+    "send": "0.9.3",
     "vary": "~1.0.0",
     "cookie": "0.1.2",
     "merge-descriptors": "0.0.2"

From 43e2cd79cba6acddb0d2c0de6dceb5874e21f5e5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Sep 2014 19:38:35 -0400
Subject: [PATCH 0586/1265] 3.17.5

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 628be16bfc5..6bed7ce12d3 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.17.5 / 2014-09-24
+===================
 
   * deps: connect@2.26.3
     - deps: body-parser@~1.8.4
diff --git a/package.json b/package.json
index 2383af2bbcc..54a05a263fc 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.17.4",
+  "version": "3.17.5",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 3bcba79e2defda3a5a93c87a8f6d1ef08b3cfda2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Sep 2014 20:14:39 -0400
Subject: [PATCH 0587/1265] deps: etag@~1.4.0

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index bc5225ee3a7..6445b2ee59d 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * deps: etag@~1.4.0
   * deps: proxy-addr@~1.0.3
     - Use `forwarded` npm module
   * deps: send@0.9.3
diff --git a/package.json b/package.json
index 1ae9bc3ea5a..72c9ccc2151 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,7 @@
     "debug": "~2.0.0",
     "depd": "0.4.5",
     "escape-html": "1.0.1",
-    "etag": "~1.3.1",
+    "etag": "~1.4.0",
     "finalhandler": "0.2.0",
     "fresh": "0.2.4",
     "media-typer": "0.3.0",

From 590c9192042c5a615be6832634451e079133749b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Sep 2014 20:16:00 -0400
Subject: [PATCH 0588/1265] deps: serve-static@~1.6.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 6445b2ee59d..e2d46155948 100644
--- a/History.md
+++ b/History.md
@@ -6,6 +6,8 @@ unreleased
     - Use `forwarded` npm module
   * deps: send@0.9.3
     - deps: etag@~1.4.0
+  * deps: serve-static@~1.6.3
+    - deps: send@0.9.3
 
 4.9.4 / 2014-09-19
 ==================
diff --git a/package.json b/package.json
index 72c9ccc2151..c1a80aeb765 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "qs": "2.2.4",
     "range-parser": "~1.0.2",
     "send": "0.9.3",
-    "serve-static": "~1.6.2",
+    "serve-static": "~1.6.3",
     "type-is": "~1.5.1",
     "vary": "~1.0.0",
     "cookie": "0.1.2",

From daadf6033b013319360850a6fc51911533a84512 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Sep 2014 20:18:59 -0400
Subject: [PATCH 0589/1265] 4.9.5

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index e2d46155948..8ba25525b46 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.9.5 / 2014-09-24
+==================
 
   * deps: etag@~1.4.0
   * deps: proxy-addr@~1.0.3
diff --git a/package.json b/package.json
index c1a80aeb765..2a578d58067 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.9.4",
+  "version": "4.9.5",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 5603f86eddc5adac4ed868f9f3c593a494039831 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 2 Oct 2014 23:27:41 -0400
Subject: [PATCH 0590/1265] deps: connect@2.26.4

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 6bed7ce12d3..3f6b247d329 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+3.x
+===
+
+  * deps: connect@2.26.4
+    - deps: morgan@~1.3.2
+    - deps: type-is@~1.5.2
+
 3.17.5 / 2014-09-24
 ===================
 
diff --git a/package.json b/package.json
index 54a05a263fc..5df85a1bae6 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "homepage": "http://expressjs.com/",
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.26.3",
+    "connect": "2.26.4",
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",
     "crc": "3.0.0",

From cc18da5cdfd6edbe1878b80f1c37cf0d6b86bcb6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 2 Oct 2014 23:29:40 -0400
Subject: [PATCH 0591/1265] 3.17.6

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 3f6b247d329..ca45081ffc2 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.17.6 / 2014-10-02
+===================
 
   * deps: connect@2.26.4
     - deps: morgan@~1.3.2
diff --git a/package.json b/package.json
index 5df85a1bae6..fef1b98bae6 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.17.5",
+  "version": "3.17.6",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From f45bd632dfada823e4f18bc7f52659e1394f7961 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 8 Oct 2014 16:43:02 -0400
Subject: [PATCH 0592/1265] deps: connect@2.26.5

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ca45081ffc2..bb97145c4fb 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+3.x
+===
+
+  * deps: connect@2.26.5
+    - Fix accepting non-object arguments to `logger`
+    - deps: serve-static@~1.6.4
+
 3.17.6 / 2014-10-02
 ===================
 
diff --git a/package.json b/package.json
index fef1b98bae6..46e6ae8cff6 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "homepage": "http://expressjs.com/",
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.26.4",
+    "connect": "2.26.5",
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",
     "crc": "3.0.0",

From ef3e95ca739a5357f9a8fd9f8a61e1cc26265b28 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 8 Oct 2014 16:44:29 -0400
Subject: [PATCH 0593/1265] deps: supertest@~0.14.0

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 46e6ae8cff6..789bef7a567 100644
--- a/package.json
+++ b/package.json
@@ -51,11 +51,11 @@
     "istanbul": "0.3.2",
     "mocha": "~1.21.4",
     "should": "~4.0.0",
+    "supertest": "~0.14.0",
     "ejs": "~1.0.0",
     "jade": "~1.6.0",
     "hjs": "~0.0.6",
-    "marked": "0.3.2",
-    "supertest": "~0.13.0"
+    "marked": "0.3.2"
   },
   "engines": {
     "node": ">= 0.8.0"

From 9f292d873ef3124ed1760ca3647780452b34daf0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 8 Oct 2014 17:00:45 -0400
Subject: [PATCH 0594/1265] 3.17.7

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index bb97145c4fb..8b402228551 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.17.7 / 2014-10-08
+===================
 
   * deps: connect@2.26.5
     - Fix accepting non-object arguments to `logger`
diff --git a/package.json b/package.json
index 789bef7a567..8f4f9fc819b 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.17.6",
+  "version": "3.17.7",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 2c140961ab5dec6622a6dffbd325d8a31eeb0bb3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 8 Oct 2014 21:48:27 -0400
Subject: [PATCH 0595/1265] deps: accepts@~1.1.1

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e351b409b73..f98b9b4067b 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+unreleased
+==========
+
+  * deps: accepts@~1.1.1
+    - deps: mime-types@~2.0.2
+    - deps: negotiator@0.4.8
+
 4.9.5 / 2014-09-24
 ==================
 
diff --git a/package.json b/package.json
index deff42aeba6..d5c31120122 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "license": "MIT",
   "homepage": "http://expressjs.com/",
   "dependencies": {
-    "accepts": "~1.1.0",
+    "accepts": "~1.1.1",
     "cookie-signature": "1.0.5",
     "debug": "~2.0.0",
     "depd": "0.4.5",

From 61da3c7d0ec6cdf46f6926d44b1e65dc61707591 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 8 Oct 2014 21:50:08 -0400
Subject: [PATCH 0596/1265] deps: serve-static@~1.6.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f98b9b4067b..f2e77ee7bb2 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,8 @@ unreleased
   * deps: accepts@~1.1.1
     - deps: mime-types@~2.0.2
     - deps: negotiator@0.4.8
+  * deps: serve-static@~1.6.4
+    - Fix redirect loop when index file serving disabled
 
 4.9.5 / 2014-09-24
 ==================
diff --git a/package.json b/package.json
index d5c31120122..298a72df82d 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "qs": "2.2.4",
     "range-parser": "~1.0.2",
     "send": "0.9.3",
-    "serve-static": "~1.6.3",
+    "serve-static": "~1.6.4",
     "type-is": "~1.5.1",
     "vary": "~1.0.0",
     "cookie": "0.1.2",

From 3f2454e3dfec27df00212075ed760b922751d2b6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 8 Oct 2014 21:51:10 -0400
Subject: [PATCH 0597/1265] deps: type-is@~1.5.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f2e77ee7bb2..3e50db7d1bf 100644
--- a/History.md
+++ b/History.md
@@ -6,6 +6,8 @@ unreleased
     - deps: negotiator@0.4.8
   * deps: serve-static@~1.6.4
     - Fix redirect loop when index file serving disabled
+  * deps: type-is@~1.5.2
+    - deps: mime-types@~2.0.2
 
 4.9.5 / 2014-09-24
 ==================
diff --git a/package.json b/package.json
index 298a72df82d..e30b7e81393 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "range-parser": "~1.0.2",
     "send": "0.9.3",
     "serve-static": "~1.6.4",
-    "type-is": "~1.5.1",
+    "type-is": "~1.5.2",
     "vary": "~1.0.0",
     "cookie": "0.1.2",
     "merge-descriptors": "0.0.2",

From efd2dfb8c82e42b43f3d7f03181381d390d9174d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 8 Oct 2014 22:33:13 -0400
Subject: [PATCH 0598/1265] 4.9.6

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 3e50db7d1bf..bf123a51b7d 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.9.6 / 2014-10-08
+==================
 
   * deps: accepts@~1.1.1
     - deps: mime-types@~2.0.2
diff --git a/package.json b/package.json
index e30b7e81393..35e5b981442 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.9.5",
+  "version": "4.9.6",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 94f10c26cb6f84960bf2d61cecaf0d64fa5c03da Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 10 Oct 2014 16:31:09 -0400
Subject: [PATCH 0599/1265] Fix using same param name in array of paths

fixes #2389
---
 History.md          |  5 +++++
 lib/router/layer.js | 16 ++++++++++++----
 test/app.router.js  | 17 +++++++++++++++++
 3 files changed, 34 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index bf123a51b7d..8c93cc8a15c 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix using same param name in array of paths
+
 4.9.6 / 2014-10-08
 ==================
 
diff --git a/lib/router/layer.js b/lib/router/layer.js
index e292a13a895..3f15002383e 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -5,6 +5,12 @@
 var pathRegexp = require('path-to-regexp');
 var debug = require('debug')('express:router:layer');
 
+/**
+ * Module variables.
+ */
+
+var hasOwnProperty = Object.prototype.hasOwnProperty;
+
 /**
  * Expose `Layer`.
  */
@@ -110,18 +116,20 @@ Layer.prototype.match = function match(path) {
 
   var keys = this.keys;
   var params = this.params;
+  var prop;
   var n = 0;
   var key;
   var val;
 
   for (var i = 1, len = m.length; i < len; ++i) {
     key = keys[i - 1];
+    prop = key
+      ? key.name
+      : n++;
     val = decode_param(m[i]);
 
-    if (key) {
-      params[key.name] = val;
-    } else {
-      params[n++] = val;
+    if (val !== undefined || !(hasOwnProperty.call(params, prop))) {
+      params[prop] = val;
     }
   }
 
diff --git a/test/app.router.js b/test/app.router.js
index ad05a79f517..4f170ec64ad 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -679,6 +679,23 @@ describe('app.router', function(){
       .get('/user/tj/edit')
       .expect('editing tj', done);
     })
+
+    it('should work in array of paths', function(done){
+      var app = express();
+      var cb = after(2, done);
+
+      app.get(['/user/:user/poke', '/user/:user/pokes'], function(req, res){
+        res.end('poking ' + req.params.user);
+      });
+
+      request(app)
+      .get('/user/tj/poke')
+      .expect('poking tj', cb);
+
+      request(app)
+      .get('/user/tj/pokes')
+      .expect('poking tj', cb);
+    })
   })
 
   describe(':name?', function(){

From b0e4e641f93e422e4704f79f2ba3d3dcd0c5d8e6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 10 Oct 2014 16:40:46 -0400
Subject: [PATCH 0600/1265] 4.9.7

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 8c93cc8a15c..ef605753d3e 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.9.7 / 2014-10-10
+==================
 
   * Fix using same param name in array of paths
 
diff --git a/package.json b/package.json
index 35e5b981442..3cd2773525a 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.9.6",
+  "version": "4.9.7",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From be478d348c56e5961746dc95b4c0305eb1d6b5a9 Mon Sep 17 00:00:00 2001
From: Bessie Chan <chanbessie@gmail.com>
Date: Sat, 11 Oct 2014 13:04:59 -0700
Subject: [PATCH 0601/1265] Fix typo in res.redirect deprecation

closes #2395
---
 lib/response.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/response.js b/lib/response.js
index 822b849187e..0950062e39b 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -738,7 +738,7 @@ res.redirect = function(url){
       status = url;
       url = arguments[1];
     } else {
-      deprecate('res.redirect(ur, status): Use res.redirect(status, url) instead');
+      deprecate('res.redirect(url, status): Use res.redirect(status, url) instead');
       status = arguments[1];
     }
   }

From 33959ed350bbf8d48ac311ec83a94fde693b0bda Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Oct 2014 00:19:47 -0400
Subject: [PATCH 0602/1265] deps: mocha@~1.21.5

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 8f4f9fc819b..2ca5c9d35c9 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
   "devDependencies": {
     "connect-redis": "~1.5.0",
     "istanbul": "0.3.2",
-    "mocha": "~1.21.4",
+    "mocha": "~1.21.5",
     "should": "~4.0.0",
     "supertest": "~0.14.0",
     "ejs": "~1.0.0",

From 159ea677135c5c0d8f5791bc5f9d3d62e29acc1f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Oct 2014 00:24:28 -0400
Subject: [PATCH 0603/1265] deps: connect@2.26.6

---
 History.md   | 8 ++++++++
 package.json | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 8b402228551..ad3885b0481 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,11 @@
+3.x
+===
+
+  * deps: connect@2.26.6
+    - deps: compression@~1.1.2
+    - deps: csurf@~1.6.2
+    - deps: errorhandler@~1.2.2
+
 3.17.7 / 2014-10-08
 ===================
 
diff --git a/package.json b/package.json
index 2ca5c9d35c9..f5a84f9333e 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "homepage": "http://expressjs.com/",
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.26.5",
+    "connect": "2.26.6",
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",
     "crc": "3.0.0",

From 6d39d0f8a809eed1b75e0d5bd4d2dad3d2190f25 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Oct 2014 00:29:56 -0400
Subject: [PATCH 0604/1265] 3.17.8

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index ad3885b0481..9ade9e0bddb 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.17.8 / 2014-10-15
+===================
 
   * deps: connect@2.26.6
     - deps: compression@~1.1.2
diff --git a/package.json b/package.json
index f5a84f9333e..9550df474d0 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.17.7",
+  "version": "3.17.8",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 6f914160209c16c640d36db8565a968c4e63d3dc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Oct 2014 01:29:00 -0400
Subject: [PATCH 0605/1265] deps: accepts@~1.1.2

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e49253ae190..1db825eb694 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+unreleased
+==========
+
+  * deps: accepts@~1.1.2
+    - Fix error when media type has invalid parameter
+    - deps: negotiator@0.4.9
+
 4.9.7 / 2014-10-10
 ==================
 
diff --git a/package.json b/package.json
index 31669009aab..5371d3af9dd 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "license": "MIT",
   "homepage": "http://expressjs.com/",
   "dependencies": {
-    "accepts": "~1.1.1",
+    "accepts": "~1.1.2",
     "cookie-signature": "1.0.5",
     "debug": "~2.0.0",
     "depd": "0.4.5",

From a7064082085e41db5ddbfa97a4021a722ecd3d8f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 17 Oct 2014 20:42:12 -0400
Subject: [PATCH 0606/1265] deps: connect@2.27.0

---
 History.md   | 20 ++++++++++++++++++++
 package.json |  2 +-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 9ade9e0bddb..b4c6f055a36 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,23 @@
+3.x
+===
+
+  * deps: connect@2.27.0
+    - Use `http-errors` module for creating errors
+    - Use `utils-merge` module for merging objects
+    - deps: body-parser@~1.9.0
+    - deps: compression@~1.2.0
+    - deps: connect-timeout@~1.4.0
+    - deps: debug@~2.1.0
+    - deps: depd@~1.0.0
+    - deps: express-session@~1.9.0
+    - deps: finalhandler@0.3.1
+    - deps: method-override@~2.3.0
+    - deps: morgan@~1.4.0
+    - deps: response-time@~2.2.0
+    - deps: serve-favicon@~2.1.6
+    - deps: serve-index@~1.5.0
+    - deps: serve-static@~1.7.0
+
 3.17.8 / 2014-10-15
 ===================
 
diff --git a/package.json b/package.json
index 9550df474d0..f627c3411da 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   "homepage": "http://expressjs.com/",
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.26.6",
+    "connect": "2.27.0",
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",
     "crc": "3.0.0",

From 2e20a858100c0d3cbb611949eb25734709717fb9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 17 Oct 2014 20:43:23 -0400
Subject: [PATCH 0607/1265] deps: debug@~2.1.0

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index b4c6f055a36..eae9e92840d 100644
--- a/History.md
+++ b/History.md
@@ -17,6 +17,8 @@
     - deps: serve-favicon@~2.1.6
     - deps: serve-index@~1.5.0
     - deps: serve-static@~1.7.0
+  * deps: debug@~2.1.0
+    - Implement `DEBUG_FD` env variable support
 
 3.17.8 / 2014-10-15
 ===================
diff --git a/package.json b/package.json
index f627c3411da..0a665a89a98 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,7 @@
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",
     "crc": "3.0.0",
-    "debug": "~2.0.0",
+    "debug": "~2.1.0",
     "depd": "0.4.5",
     "escape-html": "1.0.1",
     "fresh": "0.2.4",

From bc9d8547632189f6bca6fe020e1329d3881a69dd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 17 Oct 2014 20:44:07 -0400
Subject: [PATCH 0608/1265] deps: depd@~1.0.0

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index eae9e92840d..7df29de829d 100644
--- a/History.md
+++ b/History.md
@@ -19,6 +19,7 @@
     - deps: serve-static@~1.7.0
   * deps: debug@~2.1.0
     - Implement `DEBUG_FD` env variable support
+  * deps: depd@~1.0.0
 
 3.17.8 / 2014-10-15
 ===================
diff --git a/package.json b/package.json
index 0a665a89a98..285a0791172 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,7 @@
     "cookie-signature": "1.0.5",
     "crc": "3.0.0",
     "debug": "~2.1.0",
-    "depd": "0.4.5",
+    "depd": "~1.0.0",
     "escape-html": "1.0.1",
     "fresh": "0.2.4",
     "media-typer": "0.3.0",

From 7488e2760913494de753b199df03ac2a1090f03f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 17 Oct 2014 20:45:09 -0400
Subject: [PATCH 0609/1265] deps: send@0.10.0

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 7df29de829d..d440da8b230 100644
--- a/History.md
+++ b/History.md
@@ -20,6 +20,10 @@
   * deps: debug@~2.1.0
     - Implement `DEBUG_FD` env variable support
   * deps: depd@~1.0.0
+  * deps: send@0.10.0
+    - deps: debug@~2.1.0
+    - deps: depd@~1.0.0
+    - deps: etag@~1.5.0
 
 3.17.8 / 2014-10-15
 ===================
diff --git a/package.json b/package.json
index 285a0791172..2848f6a064e 100644
--- a/package.json
+++ b/package.json
@@ -41,7 +41,7 @@
     "parseurl": "~1.3.0",
     "proxy-addr": "~1.0.3",
     "range-parser": "~1.0.2",
-    "send": "0.9.3",
+    "send": "0.10.0",
     "vary": "~1.0.0",
     "cookie": "0.1.2",
     "merge-descriptors": "0.0.2"

From b766aad1125edacf7ea765880e68c0ed248e4216 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 17 Oct 2014 20:45:57 -0400
Subject: [PATCH 0610/1265] deps: jade@~1.7.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 2848f6a064e..d3d48e4dbde 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "should": "~4.0.0",
     "supertest": "~0.14.0",
     "ejs": "~1.0.0",
-    "jade": "~1.6.0",
+    "jade": "~1.7.0",
     "hjs": "~0.0.6",
     "marked": "0.3.2"
   },

From 7a7f18c20bb5a0edd15092f743a269ce09e9422e Mon Sep 17 00:00:00 2001
From: Fishrock123 <fishrock123@rocketmail.com>
Date: Mon, 13 Oct 2014 13:41:45 -0400
Subject: [PATCH 0611/1265] build: misc. updates to packaging

closes #2398
---
 .gitignore   | 38 ++++++++++++++++++++++++--------------
 .npmignore   | 10 ----------
 package.json | 15 +++++++++++----
 3 files changed, 35 insertions(+), 28 deletions(-)
 delete mode 100644 .npmignore

diff --git a/.gitignore b/.gitignore
index e5deefa24ef..9723e60591d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,16 +1,26 @@
-coverage/
-.DS_Store
-*.seed
+# OS X
+.DS_Store*
+Icon?
+._*
+
+# Windows
+Thumbs.db
+ehthumbs.db
+Desktop.ini
+
+# Linux
+.directory
+*~
+
+
+# npm
+node_modules
 *.log
-*.csv
-*.dat
-*.out
-*.pid
-*.swp
-*.swo
+*.gz
+
+
+# Coveralls
+coverage
+
+# Benchmarking
 benchmarks/graphs
-testing
-node_modules/
-testing
-test.js
-.idea
diff --git a/.npmignore b/.npmignore
deleted file mode 100644
index 8c029e8c207..00000000000
--- a/.npmignore
+++ /dev/null
@@ -1,10 +0,0 @@
-.git*
-benchmarks/
-coverage/
-docs/
-examples/
-support/
-test/
-testing.js
-.DS_Store
-.travis.yml
diff --git a/package.json b/package.json
index d3d48e4dbde..63df56002d5 100644
--- a/package.json
+++ b/package.json
@@ -11,6 +11,9 @@
     "Jonathan Ong <me@jongleberry.com>",
     "Roman Shtylman <shtylman+expressjs@gmail.com"
   ],
+  "license": "MIT",
+  "repository": "strongloop/express",
+  "homepage": "http://expressjs.com/",
   "keywords": [
     "express",
     "framework",
@@ -22,9 +25,6 @@
     "app",
     "api"
   ],
-  "repository": "strongloop/express",
-  "license": "MIT",
-  "homepage": "http://expressjs.com/",
   "dependencies": {
     "basic-auth": "1.0.0",
     "connect": "2.27.0",
@@ -63,8 +63,15 @@
   "bin": {
     "express": "./bin/express"
   },
+  "files": [
+    "LICENSE",
+    "History.md",
+    "Readme.md",
+    "index.js",
+    "bin/",
+    "lib/"
+  ],
   "scripts": {
-    "prepublish": "npm prune",
     "test": "mocha --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
     "test-tap": "mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/",

From 0e5613363f3b136e5fa1c159520bdd6e7cd4db99 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 17 Oct 2014 21:08:05 -0400
Subject: [PATCH 0612/1265] Use content-disposition module

---
 History.md      |  3 +++
 lib/response.js | 21 +++++++++++++--------
 package.json    |  1 +
 3 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/History.md b/History.md
index d440da8b230..a2bf229506c 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,9 @@
 3.x
 ===
 
+  * Use `content-disposition` module for `res.attachment`/`res.download`
+    - Sends standards-compliant `Content-Disposition` header
+    - Full Unicode support
   * deps: connect@2.27.0
     - Use `http-errors` module for creating errors
     - Use `utils-merge` module for merging objects
diff --git a/lib/response.js b/lib/response.js
index 0950062e39b..ba6e0e4ad3d 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -2,6 +2,7 @@
  * Module dependencies.
  */
 
+var contentDisposition = require('content-disposition');
 var deprecate = require('depd')('express');
 var escapeHtml = require('escape-html');
 var parseUrl = require('parseurl');
@@ -413,15 +414,17 @@ res.sendfile = function(path, options, fn){
  * @api public
  */
 
-res.download = function(path, filename, fn){
+res.download = function download(path, filename, fn) {
   // support function as second arg
-  if ('function' == typeof filename) {
+  if (typeof filename === 'function') {
     fn = filename;
     filename = null;
   }
 
   filename = filename || path;
-  this.set('Content-Disposition', 'attachment; filename="' + basename(filename) + '"');
+
+  this.set('Content-Disposition', contentDisposition(filename));
+
   return this.sendfile(path, fn);
 };
 
@@ -544,11 +547,13 @@ res.format = function(obj){
  * @api public
  */
 
-res.attachment = function(filename){
-  if (filename) this.type(extname(filename));
-  this.set('Content-Disposition', filename
-    ? 'attachment; filename="' + basename(filename) + '"'
-    : 'attachment');
+res.attachment = function attachment(filename) {
+  if (filename) {
+    this.type(extname(filename));
+  }
+
+  this.set('Content-Disposition', contentDisposition(filename));
+
   return this;
 };
 
diff --git a/package.json b/package.json
index 63df56002d5..c2771189492 100644
--- a/package.json
+++ b/package.json
@@ -28,6 +28,7 @@
   "dependencies": {
     "basic-auth": "1.0.0",
     "connect": "2.27.0",
+    "content-disposition": "0.5.0",
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",
     "crc": "3.0.0",

From 6f0302fb78f636da320d3ffd329c18fed36aeda9 Mon Sep 17 00:00:00 2001
From: Alex Upadhyay <prafu@amazon.com>
Date: Sat, 18 Oct 2014 01:12:47 +0000
Subject: [PATCH 0613/1265] Fix res.redirect body when redirect status
 specified

fixes #2402
fixes #2404
---
 History.md           |  1 +
 lib/response.js      |  4 ++--
 test/res.redirect.js | 30 ++++++++++++++++++++++++++++++
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 1db825eb694..7e3f4528725 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix `res.redirect` body when redirect status specified
   * deps: accepts@~1.1.2
     - Fix error when media type has invalid parameter
     - deps: negotiator@0.4.9
diff --git a/lib/response.js b/lib/response.js
index 32c098af209..c26f68ac8ab 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -818,11 +818,11 @@ res.redirect = function redirect(url) {
   // Support text/{plain,html} by default
   this.format({
     text: function(){
-      body = statusCodes[status] + '. Redirecting to ' + encodeURI(url);
+      body = statusCodes[status] + '. Redirecting to ' + encodeURI(address);
     },
 
     html: function(){
-      var u = escapeHtml(url);
+      var u = escapeHtml(address);
       body = '<p>' + statusCodes[status] + '. Redirecting to <a href="' + u + '">' + u + '</a></p>';
     },
 
diff --git a/test/res.redirect.js b/test/res.redirect.js
index 08ce6e60764..4044ad49ee5 100644
--- a/test/res.redirect.js
+++ b/test/res.redirect.js
@@ -106,6 +106,21 @@ describe('res', function(){
         done();
       })
     })
+
+    it('should include the redirect type', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.redirect(301, 'http://google.com');
+      });
+
+      request(app)
+      .get('/')
+      .set('Accept', 'text/html')
+      .expect('Content-Type', /html/)
+      .expect('Location', 'http://google.com')
+      .expect(301, '<p>Moved Permanently. Redirecting to <a href="http://google.com">http://google.com</a></p>', done);
+    })
   })
 
   describe('when accepting text', function(){
@@ -143,6 +158,21 @@ describe('res', function(){
         done();
       })
     })
+
+    it('should include the redirect type', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.redirect(301, 'http://google.com');
+      });
+
+      request(app)
+      .get('/')
+      .set('Accept', 'text/plain, */*')
+      .expect('Content-Type', /plain/)
+      .expect('Location', 'http://google.com')
+      .expect(301, 'Moved Permanently. Redirecting to http://google.com', done);
+    })
   })
 
   describe('when accepting neither text or html', function(){

From f15bba7309f2e0a17f7b7a5552b9618f074078c8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 17 Oct 2014 22:01:51 -0400
Subject: [PATCH 0614/1265] 4.9.8

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 7e3f4528725..17ba278ac98 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.9.8 / 2014-10-17
+==================
 
   * Fix `res.redirect` body when redirect status specified
   * deps: accepts@~1.1.2
diff --git a/package.json b/package.json
index 5371d3af9dd..a1f7132db83 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.9.7",
+  "version": "4.9.8",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 4f1cd4f73c2b7ee441d375b819acf6428242d557 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 17 Oct 2014 21:13:06 -0400
Subject: [PATCH 0615/1265] deps: etag@~1.5.0

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 17ba278ac98..6cc2877fde0 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+unreleased
+==========
+
+  * deps: etag@~1.5.0
+    - Improve string performance
+    - Slightly improve speed for weak ETags over 1KB
+
 4.9.8 / 2014-10-17
 ==================
 
diff --git a/package.json b/package.json
index a1f7132db83..9f6f1205cc3 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,7 @@
     "debug": "~2.0.0",
     "depd": "0.4.5",
     "escape-html": "1.0.1",
-    "etag": "~1.4.0",
+    "etag": "~1.5.0",
     "finalhandler": "0.2.0",
     "fresh": "0.2.4",
     "media-typer": "0.3.0",

From 6cd48590356c85230ad9b85435b8ee39ce54897d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 17 Oct 2014 21:26:47 -0400
Subject: [PATCH 0616/1265] deps: finalhandler@0.3.1

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 6cc2877fde0..dcf9ca33ce7 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,10 @@ unreleased
   * deps: etag@~1.5.0
     - Improve string performance
     - Slightly improve speed for weak ETags over 1KB
+  * deps: finalhandler@0.3.1
+    - Terminate in progress response only on error
+    - Use `on-finished` to determine request status
+    - deps: debug@~2.1.0
 
 4.9.8 / 2014-10-17
 ==================
diff --git a/package.json b/package.json
index 9f6f1205cc3..e4a4bde01e3 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "depd": "0.4.5",
     "escape-html": "1.0.1",
     "etag": "~1.5.0",
-    "finalhandler": "0.2.0",
+    "finalhandler": "0.3.1",
     "fresh": "0.2.4",
     "media-typer": "0.3.0",
     "methods": "1.1.0",

From 6f31218ecc9170daf2f907a1f98d423ba73eb2d8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 17 Oct 2014 23:45:58 -0400
Subject: [PATCH 0617/1265] Use content-disposition module

---
 History.md             |  3 +++
 lib/response.js        | 10 +++++++---
 lib/utils.js           | 16 ++++------------
 package.json           |  1 +
 test/res.attachment.js |  6 ++----
 5 files changed, 17 insertions(+), 19 deletions(-)

diff --git a/History.md b/History.md
index dcf9ca33ce7..eed38323000 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,9 @@
 unreleased
 ==========
 
+  * Use `content-disposition` module for `res.attachment`/`res.download`
+    - Sends standards-compliant `Content-Disposition` header
+    - Full Unicode support
   * deps: etag@~1.5.0
     - Improve string performance
     - Slightly improve speed for weak ETags over 1KB
diff --git a/lib/response.js b/lib/response.js
index c26f68ac8ab..5ba7aaf9f60 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -2,6 +2,7 @@
  * Module dependencies.
  */
 
+var contentDisposition = require('content-disposition');
 var deprecate = require('depd')('express');
 var escapeHtml = require('escape-html');
 var http = require('http');
@@ -13,7 +14,6 @@ var sign = require('cookie-signature').sign;
 var normalizeType = require('./utils').normalizeType;
 var normalizeTypes = require('./utils').normalizeTypes;
 var setCharset = require('./utils').setCharset;
-var contentDisposition = require('./utils').contentDisposition;
 var statusCodes = http.STATUS_CODES;
 var cookie = require('cookie');
 var send = require('send');
@@ -626,9 +626,13 @@ res.format = function(obj){
  * @api public
  */
 
-res.attachment = function(filename){
-  if (filename) this.type(extname(filename));
+res.attachment = function attachment(filename) {
+  if (filename) {
+    this.type(extname(filename));
+  }
+
   this.set('Content-Disposition', contentDisposition(filename));
+
   return this;
 };
 
diff --git a/lib/utils.js b/lib/utils.js
index 8dd29664cb2..4f7b365f4c5 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -2,6 +2,8 @@
  * Module dependencies.
  */
 
+var contentDisposition = require('content-disposition');
+var deprecate = require('depd')('express');
 var mime = require('send').mime;
 var basename = require('path').basename;
 var etag = require('etag');
@@ -120,18 +122,8 @@ exports.normalizeTypes = function(types){
  * @api private
  */
 
-exports.contentDisposition = function(filename){
-  var ret = 'attachment';
-  if (filename) {
-    filename = basename(filename);
-    // if filename contains non-ascii characters, add a utf-8 version ala RFC 5987
-    ret = /[^\040-\176]/.test(filename)
-      ? 'attachment; filename="' + encodeURI(filename) + '"; filename*=UTF-8\'\'' + encodeURI(filename)
-      : 'attachment; filename="' + filename + '"';
-  }
-
-  return ret;
-};
+exports.contentDisposition = deprecate.function(contentDisposition,
+  'utils.contentDisposition: use content-disposition npm module instead');
 
 /**
  * Parse accept params `str` returning an
diff --git a/package.json b/package.json
index e4a4bde01e3..d78c88cec15 100644
--- a/package.json
+++ b/package.json
@@ -28,6 +28,7 @@
   "homepage": "http://expressjs.com/",
   "dependencies": {
     "accepts": "~1.1.2",
+    "content-disposition": "0.5.0",
     "cookie-signature": "1.0.5",
     "debug": "~2.0.0",
     "depd": "0.4.5",
diff --git a/test/res.attachment.js b/test/res.attachment.js
index be189344749..662b1dd4e01 100644
--- a/test/res.attachment.js
+++ b/test/res.attachment.js
@@ -56,10 +56,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('Content-Disposition', 'attachment;' +
-          ' filename="%E6%97%A5%E6%9C%AC%E8%AA%9E.txt";' +
-          ' filename*=UTF-8\'\'%E6%97%A5%E6%9C%AC%E8%AA%9E.txt',
-        done);
+      .expect('Content-Disposition', 'attachment; filename="???.txt"; filename*=UTF-8\'\'%E6%97%A5%E6%9C%AC%E8%AA%9E.txt')
+      .expect(200, done);
     })
 
     it('should set the Content-Type', function(done){

From 4d1ee23f84de64a4f317384f61d1cd9925849107 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 18 Oct 2014 00:53:17 -0400
Subject: [PATCH 0618/1265] Use etag module to generate ETag headers

---
 History.md       |  1 +
 lib/utils.js     | 35 ++++++++++++-----------------------
 package.json     |  2 +-
 test/res.send.js | 12 ++++++------
 test/utils.js    |  6 +++---
 5 files changed, 23 insertions(+), 33 deletions(-)

diff --git a/History.md b/History.md
index a2bf229506c..29fa5a9af5c 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,7 @@
   * Use `content-disposition` module for `res.attachment`/`res.download`
     - Sends standards-compliant `Content-Disposition` header
     - Full Unicode support
+  * Use `etag` module to generate `ETag` headers
   * deps: connect@2.27.0
     - Use `http-errors` module for creating errors
     - Use `utils-merge` module for merging objects
diff --git a/lib/utils.js b/lib/utils.js
index 7497fe8eb1b..b9ff7bbdf68 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -3,10 +3,9 @@
  * Module dependencies.
  */
 
-var crc = require('crc').crc32;
-var mime = require('connect').mime
-  , proxyaddr = require('proxy-addr')
-  , crypto = require('crypto');
+var etag = require('etag');
+var mime = require('connect').mime;
+var proxyaddr = require('proxy-addr');
 var typer = require('media-typer');
 
 /**
@@ -24,17 +23,12 @@ var toString = {}.toString;
  * @api private
  */
 
-exports.etag = function etag(body, encoding){
-  if (body.length === 0) {
-    // fast-path empty body
-    return '"1B2M2Y8AsgTpgAmY7PhCfg=="'
-  }
+exports.etag = function (body, encoding) {
+  var buf = !Buffer.isBuffer(body)
+    ? new Buffer(body, encoding)
+    : body;
 
-  var hash = crypto
-    .createHash('md5')
-    .update(body, encoding)
-    .digest('base64')
-  return '"' + hash + '"'
+  return etag(buf, {weak: false});
 };
 
 /**
@@ -47,16 +41,11 @@ exports.etag = function etag(body, encoding){
  */
 
 exports.wetag = function wetag(body, encoding){
-  if (body.length === 0) {
-    // fast-path empty body
-    return 'W/"0-0"'
-  }
+  var buf = !Buffer.isBuffer(body)
+    ? new Buffer(body, encoding)
+    : body;
 
-  var buf = Buffer.isBuffer(body)
-    ? body
-    : new Buffer(body, encoding)
-  var len = buf.length
-  return 'W/"' + len.toString(16) + '-' + crc(buf) + '"'
+  return etag(buf, {weak: true});
 };
 
 /**
diff --git a/package.json b/package.json
index c2771189492..a398c117d5f 100644
--- a/package.json
+++ b/package.json
@@ -31,10 +31,10 @@
     "content-disposition": "0.5.0",
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",
-    "crc": "3.0.0",
     "debug": "~2.1.0",
     "depd": "~1.0.0",
     "escape-html": "1.0.1",
+    "etag": "~1.5.0",
     "fresh": "0.2.4",
     "media-typer": "0.3.0",
     "methods": "1.1.0",
diff --git a/test/res.send.js b/test/res.send.js
index a73353c84b2..ad1a703f32b 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -120,7 +120,7 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('ETag', 'W/"7ff-2796319984"')
+      .expect('ETag', 'W/"fz/jGo0ONwzb+aKy/rWipg=="')
       .end(done);
     })
 
@@ -209,7 +209,7 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('ETag', 'W/"7ff-2796319984"')
+      .expect('ETag', 'W/"fz/jGo0ONwzb+aKy/rWipg=="')
       .end(done);
     })
 
@@ -325,7 +325,7 @@ describe('res', function(){
 
     request(app)
     .get('/')
-    .set('If-None-Match', 'W/"7ff-2796319984"')
+    .set('If-None-Match', 'W/"fz/jGo0ONwzb+aKy/rWipg=="')
     .expect(304, done);
   })
 
@@ -371,7 +371,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('etag', 'W/"c-1525560792"', done)
+        .expect('etag', 'W/"c-5aee35d8"', done)
       })
 
       it('should send ETag for empty string response', function(done){
@@ -400,7 +400,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('etag', 'W/"7ff-2796319984"', done)
+        .expect('etag', 'W/"fz/jGo0ONwzb+aKy/rWipg=="', done)
       });
 
       it('should not override ETag when manually set', function(done){
@@ -499,7 +499,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('etag', 'W/"d-1486392595"', done)
+        .expect('etag', 'W/"d-58988d13"', done)
       })
     })
 
diff --git a/test/utils.js b/test/utils.js
index 21594c409e8..b811762c591 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -28,18 +28,18 @@ describe('utils.etag(body, encoding)', function(){
 describe('utils.wetag(body, encoding)', function(){
   it('should support strings', function(){
     utils.wetag('express!')
-    .should.eql('W/"8-3098196679"')
+    .should.eql('W/"8-b8aabac7"')
   })
 
   it('should support utf8 strings', function(){
     utils.wetag('express❤', 'utf8')
-    .should.eql('W/"a-1751845617"')
+    .should.eql('W/"a-686b0af1"')
   })
 
   it('should support buffer', function(){
     var buf = new Buffer('express!')
     utils.wetag(buf)
-    .should.eql('W/"8-3098196679"');
+    .should.eql('W/"8-b8aabac7"');
   })
 
   it('should support empty string', function(){

From 366000184f6fa2ae39b96c4806c7ab625a01e71c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 18 Oct 2014 00:57:48 -0400
Subject: [PATCH 0619/1265] 3.18.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 29fa5a9af5c..b73e51abbd5 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.18.0 / 2014-10-17
+===================
 
   * Use `content-disposition` module for `res.attachment`/`res.download`
     - Sends standards-compliant `Content-Disposition` header
diff --git a/package.json b/package.json
index a398c117d5f..ebc30581575 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.17.8",
+  "version": "3.18.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 9c2c21aaaf2c552ecd0319e322c3cf5397b29539 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 22 Oct 2014 15:08:49 -0400
Subject: [PATCH 0620/1265] deps: mocha@~2.0.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ebc30581575..42c9d881d6f 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
   "devDependencies": {
     "connect-redis": "~1.5.0",
     "istanbul": "0.3.2",
-    "mocha": "~1.21.5",
+    "mocha": "~2.0.0",
     "should": "~4.0.0",
     "supertest": "~0.14.0",
     "ejs": "~1.0.0",

From dd763ec5b8a93419d5524f42998db1774f5bfafa Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 22 Oct 2014 15:10:22 -0400
Subject: [PATCH 0621/1265] deps: should@~4.1.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 42c9d881d6f..fc93f98580a 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
     "connect-redis": "~1.5.0",
     "istanbul": "0.3.2",
     "mocha": "~2.0.0",
-    "should": "~4.0.0",
+    "should": "~4.1.0",
     "supertest": "~0.14.0",
     "ejs": "~1.0.0",
     "jade": "~1.7.0",

From af1043844f3e23ee21fc9584a5074fb3e73437fb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 22 Oct 2014 15:18:10 -0400
Subject: [PATCH 0622/1265] Fix internal utils.merge deprecation warnings

---
 History.md         |  5 +++++
 lib/application.js | 10 ++++++----
 lib/express.js     | 10 +++++-----
 lib/response.js    |  6 +++---
 package.json       |  1 +
 test/res.cookie.js |  4 ++--
 6 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/History.md b/History.md
index b73e51abbd5..d932d10b2b7 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+3.x
+===
+
+  * Fix internal `utils.merge` deprecation warnings
+
 3.18.0 / 2014-10-17
 ===================
 
diff --git a/lib/application.js b/lib/application.js
index 5be5ad45e98..1909fd95754 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -11,9 +11,9 @@ var connect = require('connect')
   , compileETag = require('./utils').compileETag
   , compileTrust = require('./utils').compileTrust
   , View = require('./view')
-  , utils = connect.utils
   , http = require('http');
 var deprecate = require('depd')('express');
+var merge = require('utils-merge');
 
 /**
  * Application prototype.
@@ -484,13 +484,15 @@ app.render = function(name, options, fn){
   }
 
   // merge app.locals
-  utils.merge(opts, this.locals);
+  merge(opts, this.locals);
 
   // merge options._locals
-  if (options._locals) utils.merge(opts, options._locals);
+  if (options._locals) {
+    merge(opts, options._locals);
+  }
 
   // merge options
-  utils.merge(opts, options);
+  merge(opts, options);
 
   // set .cache unless explicitly provided
   opts.cache = null == opts.cache
diff --git a/lib/express.js b/lib/express.js
index 8a976daa4b8..17b32c58e78 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -3,14 +3,14 @@
  */
 
 var deprecate = require('depd')('express');
-var merge = require('merge-descriptors');
+var mixin = require('merge-descriptors');
+var merge = require('utils-merge');
 var connect = require('connect')
   , proto = require('./application')
   , Route = require('./router/route')
   , Router = require('./router')
   , req = require('./request')
-  , res = require('./response')
-  , utils = connect.utils;
+  , res = require('./response');
 
 /**
  * Expose `createApplication()`.
@@ -33,7 +33,7 @@ exports.mime = connect.mime;
 
 function createApplication() {
   var app = connect();
-  utils.merge(app, proto);
+  merge(app, proto);
   app.request = { __proto__: req, app: app };
   app.response = { __proto__: res, app: app };
   app.init();
@@ -45,7 +45,7 @@ function createApplication() {
  * for example `express.logger` etc.
  */
 
-merge(exports, connect.middleware);
+mixin(exports, connect.middleware);
 
 /**
  * Deprecated createServer().
diff --git a/lib/response.js b/lib/response.js
index ba6e0e4ad3d..9404d34f606 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -5,12 +5,12 @@
 var contentDisposition = require('content-disposition');
 var deprecate = require('depd')('express');
 var escapeHtml = require('escape-html');
+var merge = require('utils-merge');
 var parseUrl = require('parseurl');
 var vary = require('vary');
 var http = require('http')
   , path = require('path')
   , connect = require('connect')
-  , utils = connect.utils
   , sign = require('cookie-signature').sign
   , normalizeType = require('./utils').normalizeType
   , normalizeTypes = require('./utils').normalizeTypes
@@ -613,7 +613,7 @@ res.get = function(field){
 res.clearCookie = function(name, options){
   var opts = { expires: new Date(1), path: '/' };
   return this.cookie(name, '', options
-    ? utils.merge(opts, options)
+    ? merge(opts, options)
     : opts);
 };
 
@@ -641,7 +641,7 @@ res.clearCookie = function(name, options){
  */
 
 res.cookie = function(name, val, options){
-  options = utils.merge({}, options);
+  options = merge({}, options);
   var secret = this.req.secret;
   var signed = options.signed;
   if (signed && !secret) throw new Error('connect.cookieParser("secret") required for signed cookies');
diff --git a/package.json b/package.json
index fc93f98580a..212b22990db 100644
--- a/package.json
+++ b/package.json
@@ -43,6 +43,7 @@
     "proxy-addr": "~1.0.3",
     "range-parser": "~1.0.2",
     "send": "0.10.0",
+    "utils-merge": "1.0.0",
     "vary": "~1.0.0",
     "cookie": "0.1.2",
     "merge-descriptors": "0.0.2"
diff --git a/test/res.cookie.js b/test/res.cookie.js
index a00c8d14b40..094d28898a5 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -1,8 +1,8 @@
 
 var express = require('../')
   , request = require('supertest')
-  , utils = require('connect').utils
   , cookie = require('cookie');
+var merge = require('utils-merge');
 
 describe('res', function(){
   describe('.cookie(name, object)', function(){
@@ -111,7 +111,7 @@ describe('res', function(){
         var app = express();
 
         var options = { maxAge: 1000 };
-        var optionsCopy = utils.merge({}, options);
+        var optionsCopy = merge({}, options);
 
         app.use(function(req, res){
           res.cookie('name', 'tobi', options)

From c939a771c0696e6db26b8d16964931c0a738dc7e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Oct 2014 01:23:54 -0400
Subject: [PATCH 0623/1265] deps: connect@2.27.1

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index d932d10b2b7..f4378c722d1 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,13 @@
 ===
 
   * Fix internal `utils.merge` deprecation warnings
+  * deps: connect@2.27.1
+    - deps: body-parser@~1.9.1
+    - deps: express-session@~1.9.1
+    - deps: finalhandler@0.3.2
+    - deps: morgan@~1.4.1
+    - deps: qs@2.3.0
+    - deps: serve-static@~1.7.1
 
 3.18.0 / 2014-10-17
 ===================
diff --git a/package.json b/package.json
index 212b22990db..a50f706d502 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.27.0",
+    "connect": "2.27.1",
     "content-disposition": "0.5.0",
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",

From 5759b3e9f5bf399df8790a8300679fe8ab14d6ac Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Oct 2014 01:25:07 -0400
Subject: [PATCH 0624/1265] deps: send@0.10.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f4378c722d1..8f215fdd548 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,8 @@
     - deps: morgan@~1.4.1
     - deps: qs@2.3.0
     - deps: serve-static@~1.7.1
+  * deps: send@0.10.1
+    - deps: on-finished@~2.1.1
 
 3.18.0 / 2014-10-17
 ===================
diff --git a/package.json b/package.json
index a50f706d502..498e272e5ea 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
     "parseurl": "~1.3.0",
     "proxy-addr": "~1.0.3",
     "range-parser": "~1.0.2",
-    "send": "0.10.0",
+    "send": "0.10.1",
     "utils-merge": "1.0.0",
     "vary": "~1.0.0",
     "cookie": "0.1.2",

From 88dfd36eaafa7a0349401a6142413dbb4030ab78 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Oct 2014 01:26:21 -0400
Subject: [PATCH 0625/1265] 3.18.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 8f215fdd548..ee2a1f75cfc 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.18.1 / 2014-10-22
+===================
 
   * Fix internal `utils.merge` deprecation warnings
   * deps: connect@2.27.1
diff --git a/package.json b/package.json
index 498e272e5ea..c4aede125c7 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.18.0",
+  "version": "3.18.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 4dd970578a5ec4c8a26e85e7f93296ec2de1cfa5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Oct 2014 01:35:16 -0400
Subject: [PATCH 0626/1265] Fix res.send to mention res.sendStatus

---
 History.md      | 1 +
 lib/response.js | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index eed38323000..b1c6a9012a0 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix `res.send(status)` to mention `res.sendStatus(status)`
   * Use `content-disposition` module for `res.attachment`/`res.download`
     - Sends standards-compliant `Content-Disposition` header
     - Full Unicode support
diff --git a/lib/response.js b/lib/response.js
index 5ba7aaf9f60..104c3d06fdb 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -109,7 +109,7 @@ res.send = function send(body) {
       this.type('txt');
     }
 
-    deprecate('res.send(status): Use res.status(status).end() instead');
+    deprecate('res.send(status): Use res.sendStatus(status) instead');
     this.statusCode = chunk;
     chunk = http.STATUS_CODES[chunk];
   }

From 6c2f7fb48d5ed8f4190edf05e961c8304e45ec2a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Oct 2014 01:37:00 -0400
Subject: [PATCH 0627/1265] deps: finalhandler@0.3.2

---
 History.md   | 3 ++-
 package.json | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index b1c6a9012a0..f5a01bf9699 100644
--- a/History.md
+++ b/History.md
@@ -8,10 +8,11 @@ unreleased
   * deps: etag@~1.5.0
     - Improve string performance
     - Slightly improve speed for weak ETags over 1KB
-  * deps: finalhandler@0.3.1
+  * deps: finalhandler@0.3.2
     - Terminate in progress response only on error
     - Use `on-finished` to determine request status
     - deps: debug@~2.1.0
+    - deps: on-finished@~2.1.1
 
 4.9.8 / 2014-10-17
 ==================
diff --git a/package.json b/package.json
index d78c88cec15..e76e398d51d 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "depd": "0.4.5",
     "escape-html": "1.0.1",
     "etag": "~1.5.0",
-    "finalhandler": "0.3.1",
+    "finalhandler": "0.3.2",
     "fresh": "0.2.4",
     "media-typer": "0.3.0",
     "methods": "1.1.0",

From 6a5dd52deb8ba4f105f7d14d14a18b4a11d19254 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Oct 2014 01:38:48 -0400
Subject: [PATCH 0628/1265] deps: qs@2.3.0

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f5a01bf9699..75b4d9d0fe9 100644
--- a/History.md
+++ b/History.md
@@ -13,6 +13,8 @@ unreleased
     - Use `on-finished` to determine request status
     - deps: debug@~2.1.0
     - deps: on-finished@~2.1.1
+  * deps: qs@2.3.0
+    - Fix parsing of mixed implicit and explicit arrays
 
 4.9.8 / 2014-10-17
 ==================
diff --git a/package.json b/package.json
index e76e398d51d..06f7a7c6420 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "~1.0.3",
-    "qs": "2.2.4",
+    "qs": "2.3.0",
     "range-parser": "~1.0.2",
     "send": "0.9.3",
     "serve-static": "~1.6.4",

From ce7bbae007e80a8dd80afff1b76758b589305149 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Oct 2014 01:43:19 -0400
Subject: [PATCH 0629/1265] deps: serve-static@~1.7.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 75b4d9d0fe9..9811a2c2851 100644
--- a/History.md
+++ b/History.md
@@ -15,6 +15,8 @@ unreleased
     - deps: on-finished@~2.1.1
   * deps: qs@2.3.0
     - Fix parsing of mixed implicit and explicit arrays
+  * deps: serve-static@~1.7.1
+    - deps: send@0.10.1
 
 4.9.8 / 2014-10-17
 ==================
diff --git a/package.json b/package.json
index 06f7a7c6420..e9c3ac21ede 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "qs": "2.3.0",
     "range-parser": "~1.0.2",
     "send": "0.9.3",
-    "serve-static": "~1.6.4",
+    "serve-static": "~1.7.1",
     "type-is": "~1.5.2",
     "vary": "~1.0.0",
     "cookie": "0.1.2",

From cd9d2ec6a978fd56206375852de887a2d1126d0b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Oct 2014 01:45:58 -0400
Subject: [PATCH 0630/1265] deps: on-finished@~2.1.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 9811a2c2851..15ac19cb938 100644
--- a/History.md
+++ b/History.md
@@ -13,6 +13,8 @@ unreleased
     - Use `on-finished` to determine request status
     - deps: debug@~2.1.0
     - deps: on-finished@~2.1.1
+  * deps: on-finished@~2.1.1
+    - Fix handling of pipelined requests
   * deps: qs@2.3.0
     - Fix parsing of mixed implicit and explicit arrays
   * deps: serve-static@~1.7.1
diff --git a/package.json b/package.json
index e9c3ac21ede..c4884d4df99 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "fresh": "0.2.4",
     "media-typer": "0.3.0",
     "methods": "1.1.0",
-    "on-finished": "~2.1.0",
+    "on-finished": "~2.1.1",
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "~1.0.3",

From ff3a368b2f9a7e640fb3fd18f116de5352e73d58 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Oct 2014 02:08:34 -0400
Subject: [PATCH 0631/1265] deps: update example dependencies

---
 package.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index f30a497eabd..348517e9f49 100644
--- a/package.json
+++ b/package.json
@@ -61,14 +61,14 @@
     "ejs": "~1.0.0",
     "marked": "0.3.2",
     "hjs": "~0.0.6",
-    "body-parser": "~1.8.2",
+    "body-parser": "~1.9.1",
     "connect-redis": "~2.1.0",
     "cookie-parser": "~1.3.3",
-    "express-session": "~1.8.2",
+    "express-session": "~1.9.1",
     "jade": "~1.7.0",
-    "method-override": "~2.2.0",
-    "morgan": "~1.3.1",
-    "multiparty": "~3.3.2",
+    "method-override": "~2.3.0",
+    "morgan": "~1.4.1",
+    "multiparty": "~4.0.0",
     "vhost": "~3.0.0"
   },
   "engines": {

From 5f7a37ee517e172c0762fc3debaf94c066e531f9 Mon Sep 17 00:00:00 2001
From: Fishrock123 <fishrock123@rocketmail.com>
Date: Sat, 11 Oct 2014 14:12:03 -0400
Subject: [PATCH 0632/1265] docs: misc. tweaks

closes #2394
---
 Readme.md | 95 +++++++++++++++++++++++++++++--------------------------
 1 file changed, 51 insertions(+), 44 deletions(-)

diff --git a/Readme.md b/Readme.md
index 426bb723f24..8dacd469463 100644
--- a/Readme.md
+++ b/Readme.md
@@ -2,10 +2,10 @@
 
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
-  [![NPM Version](https://img.shields.io/npm/v/express.svg?style=flat)](https://www.npmjs.org/package/express)
-  [![Build Status](https://img.shields.io/travis/strongloop/express.svg?style=flat)](https://travis-ci.org/strongloop/express)
-  [![Coverage Status](https://img.shields.io/coveralls/strongloop/express.svg?style=flat)](https://coveralls.io/r/strongloop/express)
-  [![Gittip](https://img.shields.io/gittip/dougwilson.svg?style=flat)](https://www.gittip.com/dougwilson/)
+  [![NPM Version][npm-image]][npm-url]
+  [![NPM Downloads][downloads-image]][downloads-url]
+  [![Build Status][travis-image]][travis-url]
+  [![Test Coverage][coveralls-image]][coveralls-url]
 
 ```js
 var express = require('express')
@@ -18,14 +18,34 @@ app.get('/', function (req, res) {
 app.listen(3000)
 ```
 
-  **PROTIP** Be sure to read [Migrating from 3.x to 4.x](https://github.com/strongloop/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/strongloop/express/wiki/New-features-in-4.x).
-
 ### Installation
 
 ```bash
 $ npm install express
 ```
 
+## Features
+
+  * Robust routing
+  * Focus on high performance
+  * Super-high test coverage
+  * HTTP helpers (redirection, caching, etc)
+  * View system supporting 14+ template engines
+  * Content negotiation
+  * Executable for generating applications quickly
+
+## Docs & Community
+
+  * [Website and Documentation](http://expressjs.com/) - [[website repo](https://github.com/strongloop/expressjs.com)]
+  * [#express](https://webchat.freenode.net/?channels=express) on freenode IRC
+  * [Github Organization](https://github.com/expressjs) for Official Middleware & Modules
+  * Visit the [Wiki](https://github.com/strongloop/express/wiki)
+  * [Google Group](https://groups.google.com/group/express-js) for discussion
+  * [Русскоязычная документация](http://jsman.ru/express/)
+  * [한국어 문서](http://expressjs.kr) - [[website repo](https://github.com/Hanul/expressjs.kr)]
+
+**PROTIP** Be sure to read [Migrating from 3.x to 4.x](https://github.com/strongloop/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/strongloop/express/wiki/New-features-in-4.x).
+
 ## Quick Start
 
   The quickest way to get started with express is to utilize the executable [`express(1)`](https://github.com/expressjs/generator) to generate an application as shown below:
@@ -54,16 +74,6 @@ $ npm install
 $ npm start
 ```
 
-## Features
-
-  * Robust routing
-  * HTTP helpers (redirection, caching, etc)
-  * View system supporting 14+ template engines
-  * Content negotiation
-  * Focus on high performance
-  * Executable for generating applications quickly
-  * High test coverage
-
 ## Philosophy
 
   The Express philosophy is to provide small, robust tooling for HTTP servers, making
@@ -74,20 +84,9 @@ $ npm start
   14 template engines via [Consolidate.js](https://github.com/visionmedia/consolidate.js),
   you can quickly craft your perfect framework.
 
-## More Information
+## Examples
 
-  * [Website and Documentation](http://expressjs.com/) - [[website repo](https://github.com/strongloop/expressjs.com)]
-  * [Github Organization](https://github.com/expressjs) for Official Middleware & Modules
-  * [#express](https://webchat.freenode.net/?channels=express) on freenode IRC
-  * Visit the [Wiki](https://github.com/strongloop/express/wiki)
-  * [Google Group](https://groups.google.com/group/express-js) for discussion
-  * [Русскоязычная документация](http://jsman.ru/express/)
-  * [한국어 문서](http://expressjs.kr) - [[website repo](https://github.com/Hanul/expressjs.kr)]
-  * Run express examples [online](https://runnable.com/express)
-
-## Viewing Examples
-
-  Clone the Express repo, then install the dev dependencies to install all the example / test suite dependencies:
+  To view the examples, clone the Express repo & install the dependancies:
 
 ```bash
 $ git clone git://github.com/strongloop/express.git --depth 1
@@ -97,32 +96,40 @@ $ npm install
 
   Then run whichever example you want:
 
-    $ node examples/content-negotiation
-
-  You can also view live examples here:
-
-  <a href="https://runnable.com/express" target="_blank"><img src="https://runnable.com/external/styles/assets/runnablebtn.png" style="width:67px;height:25px;"></a>
+```bash
+$ node examples/content-negotiation
+```
 
-## Running Tests
+## Tests
 
-  To run the test suite, first invoke the following command within the repo, installing the development dependencies:
+  To run the test suite, first install the dependancies, then run `npm test`:
 
 ```bash
 $ npm install
+$ npm test
 ```
 
-  Then run the tests:
+### People
 
-```bash
-$ npm test
-```
+The original author of Express is [TJ Holowaychuk](https://github.com/visionmedia) [![TJ's Gratipay][gratipay-image-visionmedia]][gratipay-url-visionmedia]
 
-### Contributors
+The current lead maintainer is [Douglas Christopher Wilson](https://github.com/dougwilson) [![Doug's Gratipay][gratipay-image-dougwilson]][gratipay-url-dougwilson]
 
- * Author: [TJ Holowaychuk](https://github.com/visionmedia)
- * Lead Maintainer: [Douglas Christopher Wilson](https://github.com/dougwilson)
- * [All Contributors](https://github.com/strongloop/express/graphs/contributors)
+[List of all contributors](https://github.com/strongloop/express/graphs/contributors)
 
 ### License
 
   [MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/express.svg?style=flat
+[npm-url]: https://npmjs.org/package/express
+[downloads-image]: https://img.shields.io/npm/dm/express.svg?style=flat
+[downloads-url]: https://npmjs.org/package/express
+[travis-image]: https://img.shields.io/travis/strongloop/express.svg?style=flat
+[travis-url]: https://travis-ci.org/strongloop/express
+[coveralls-image]: https://img.shields.io/coveralls/strongloop/express.svg?style=flat
+[coveralls-url]: https://coveralls.io/r/strongloop/express?branch=master
+[gratipay-image-visionmedia]: https://img.shields.io/gratipay/visionmedia.svg?style=flat
+[gratipay-url-visionmedia]: https://gratipay/visionmedia/
+[gratipay-image-dougwilson]: https://img.shields.io/gratipay/dougwilson.svg?style=flat
+[gratipay-url-dougwilson]: https://gratipay/dougwilson/

From e9539fc7803d287c07c2dd7109a6bed434c27800 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Oct 2014 02:20:51 -0400
Subject: [PATCH 0633/1265] docs: visionmedia is now tj on Github

---
 Readme.md             | 4 ++--
 examples/auth/pass.js | 2 +-
 lib/application.js    | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Readme.md b/Readme.md
index 8dacd469463..9fe91d2fc6c 100644
--- a/Readme.md
+++ b/Readme.md
@@ -81,7 +81,7 @@ $ npm start
   HTTP APIs.
 
   Express does not force you to use any specific ORM or template engine. With support for over
-  14 template engines via [Consolidate.js](https://github.com/visionmedia/consolidate.js),
+  14 template engines via [Consolidate.js](https://github.com/tj/consolidate.js),
   you can quickly craft your perfect framework.
 
 ## Examples
@@ -111,7 +111,7 @@ $ npm test
 
 ### People
 
-The original author of Express is [TJ Holowaychuk](https://github.com/visionmedia) [![TJ's Gratipay][gratipay-image-visionmedia]][gratipay-url-visionmedia]
+The original author of Express is [TJ Holowaychuk](https://github.com/tj) [![TJ's Gratipay][gratipay-image-visionmedia]][gratipay-url-visionmedia]
 
 The current lead maintainer is [Douglas Christopher Wilson](https://github.com/dougwilson) [![Doug's Gratipay][gratipay-image-dougwilson]][gratipay-url-dougwilson]
 
diff --git a/examples/auth/pass.js b/examples/auth/pass.js
index 0779c814bd6..fefb25b66a5 100644
--- a/examples/auth/pass.js
+++ b/examples/auth/pass.js
@@ -1,5 +1,5 @@
 
-// check out https://github.com/visionmedia/node-pwd
+// check out https://github.com/tj/node-pwd
 
 /**
  * Module dependencies.
diff --git a/lib/application.js b/lib/application.js
index b9f4198ccb0..d3ba6378822 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -247,7 +247,7 @@ app.route = function(path){
  * so if you're using ".ejs" extensions you dont need to do anything.
  *
  * Some template engines do not follow this convention, the
- * [Consolidate.js](https://github.com/visionmedia/consolidate.js)
+ * [Consolidate.js](https://github.com/tj/consolidate.js)
  * library was created to map all of node's popular template
  * engines to follow this convention, thus allowing them to
  * work seamlessly within Express.

From dfa7ee47322777b3f5f942c584239f1c64ba7766 Mon Sep 17 00:00:00 2001
From: lemmy <lemmy@yandex-team.ru>
Date: Sat, 6 Sep 2014 21:35:17 +0400
Subject: [PATCH 0634/1265] Pass context to .forEach instead of closure

Has a slight performance improvement

closes #2347
---
 lib/application.js  | 16 +++++++---------
 lib/router/index.js |  7 +++----
 lib/router/route.js | 20 +++++++++-----------
 3 files changed, 19 insertions(+), 24 deletions(-)

diff --git a/lib/application.js b/lib/application.js
index d3ba6378822..15b1405bfa1 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -154,7 +154,6 @@ app.handle = function(req, res, done) {
 app.use = function use(fn) {
   var offset = 0;
   var path = '/';
-  var self = this;
 
   // default path to '/'
   // disambiguate app.use([fn])
@@ -190,7 +189,7 @@ app.use = function use(fn) {
 
     debug('.use app under %s', path);
     fn.mountpath = path;
-    fn.parent = self;
+    fn.parent = this;
 
     // restore .app property on req and res
     router.use(path, function mounted_app(req, res, next) {
@@ -203,8 +202,8 @@ app.use = function use(fn) {
     });
 
     // mounted an app
-    fn.emit('mount', self);
-  });
+    fn.emit('mount', this);
+  }, this);
 
   return this;
 };
@@ -278,17 +277,16 @@ app.engine = function(ext, fn){
  */
 
 app.param = function(name, fn){
-  var self = this;
-  self.lazyrouter();
+  this.lazyrouter();
 
   if (Array.isArray(name)) {
     name.forEach(function(key) {
-      self.param(key, fn);
-    });
+      this.param(key, fn);
+    }, this);
     return this;
   }
 
-  self._router.param(name, fn);
+  this._router.param(name, fn);
   return this;
 };
 
diff --git a/lib/router/index.js b/lib/router/index.js
index 64fcd1e3ac0..0ca1b6fee5c 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -409,7 +409,6 @@ proto.process_params = function(layer, called, req, res, done) {
 proto.use = function use(fn) {
   var offset = 0;
   var path = '/';
-  var self = this;
 
   // default path to '/'
   // disambiguate router.use([fn])
@@ -442,15 +441,15 @@ proto.use = function use(fn) {
     debug('use %s %s', path, fn.name || '<anonymous>');
 
     var layer = new Layer(path, {
-      sensitive: self.caseSensitive,
+      sensitive: this.caseSensitive,
       strict: false,
       end: false
     }, fn);
 
     layer.route = undefined;
 
-    self.stack.push(layer);
-  });
+    this.stack.push(layer);
+  }, this);
 
   return this;
 };
diff --git a/lib/router/route.js b/lib/router/route.js
index 6b39211921a..903d1a5e218 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -131,7 +131,6 @@ Route.prototype.dispatch = function(req, res, done){
  */
 
 Route.prototype.all = function(){
-  var self = this;
   var callbacks = utils.flatten([].slice.call(arguments));
   callbacks.forEach(function(fn) {
     if (typeof fn !== 'function') {
@@ -143,16 +142,15 @@ Route.prototype.all = function(){
     var layer = Layer('/', {}, fn);
     layer.method = undefined;
 
-    self.methods._all = true;
-    self.stack.push(layer);
-  });
+    this.methods._all = true;
+    this.stack.push(layer);
+  }, this);
 
-  return self;
+  return this;
 };
 
 methods.forEach(function(method){
   Route.prototype[method] = function(){
-    var self = this;
     var callbacks = utils.flatten([].slice.call(arguments));
 
     callbacks.forEach(function(fn) {
@@ -162,14 +160,14 @@ methods.forEach(function(method){
         throw new Error(msg);
       }
 
-      debug('%s %s', method, self.path);
+      debug('%s %s', method, this.path);
 
       var layer = Layer('/', {}, fn);
       layer.method = method;
 
-      self.methods[method] = true;
-      self.stack.push(layer);
-    });
-    return self;
+      this.methods[method] = true;
+      this.stack.push(layer);
+    }, this);
+    return this;
   };
 });

From b1d0c19ca16c8f302fb674bc51a19af484170b0c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Oct 2014 02:39:38 -0400
Subject: [PATCH 0635/1265] examples: make main app file names consistent

fixes #2408
---
 examples/auth/{app.js => index.js}      | 0
 examples/cookies/{app.js => index.js}   | 0
 examples/downloads/{app.js => index.js} | 0
 examples/params/{app.js => index.js}    | 0
 examples/resource/{app.js => index.js}  | 0
 test/acceptance/auth.js                 | 2 +-
 test/acceptance/cookies.js              | 2 +-
 test/acceptance/downloads.js            | 2 +-
 test/acceptance/params.js               | 2 +-
 test/acceptance/resource.js             | 2 +-
 10 files changed, 5 insertions(+), 5 deletions(-)
 rename examples/auth/{app.js => index.js} (100%)
 rename examples/cookies/{app.js => index.js} (100%)
 rename examples/downloads/{app.js => index.js} (100%)
 rename examples/params/{app.js => index.js} (100%)
 rename examples/resource/{app.js => index.js} (100%)

diff --git a/examples/auth/app.js b/examples/auth/index.js
similarity index 100%
rename from examples/auth/app.js
rename to examples/auth/index.js
diff --git a/examples/cookies/app.js b/examples/cookies/index.js
similarity index 100%
rename from examples/cookies/app.js
rename to examples/cookies/index.js
diff --git a/examples/downloads/app.js b/examples/downloads/index.js
similarity index 100%
rename from examples/downloads/app.js
rename to examples/downloads/index.js
diff --git a/examples/params/app.js b/examples/params/index.js
similarity index 100%
rename from examples/params/app.js
rename to examples/params/index.js
diff --git a/examples/resource/app.js b/examples/resource/index.js
similarity index 100%
rename from examples/resource/app.js
rename to examples/resource/index.js
diff --git a/test/acceptance/auth.js b/test/acceptance/auth.js
index 2645f7b68e4..9a36ea45feb 100644
--- a/test/acceptance/auth.js
+++ b/test/acceptance/auth.js
@@ -1,4 +1,4 @@
-var app = require('../../examples/auth/app')
+var app = require('../../examples/auth')
 var request = require('supertest')
 
 function getCookie(res) {
diff --git a/test/acceptance/cookies.js b/test/acceptance/cookies.js
index f28daa8a64b..86add660c73 100644
--- a/test/acceptance/cookies.js
+++ b/test/acceptance/cookies.js
@@ -1,5 +1,5 @@
 
-var app = require('../../examples/cookies/app')
+var app = require('../../examples/cookies')
   , request = require('supertest');
 
 describe('cookies', function(){
diff --git a/test/acceptance/downloads.js b/test/acceptance/downloads.js
index 674acb15262..ed9a02f9ced 100644
--- a/test/acceptance/downloads.js
+++ b/test/acceptance/downloads.js
@@ -1,5 +1,5 @@
 
-var app = require('../../examples/downloads/app')
+var app = require('../../examples/downloads')
   , request = require('supertest');
 
 describe('downloads', function(){
diff --git a/test/acceptance/params.js b/test/acceptance/params.js
index cfa65896e63..5c7e109188a 100644
--- a/test/acceptance/params.js
+++ b/test/acceptance/params.js
@@ -1,4 +1,4 @@
-var app = require('../../examples/params/app')
+var app = require('../../examples/params')
 var request = require('supertest')
 
 describe('params', function(){
diff --git a/test/acceptance/resource.js b/test/acceptance/resource.js
index 585d09b43e2..a2db7bd3fd2 100644
--- a/test/acceptance/resource.js
+++ b/test/acceptance/resource.js
@@ -1,4 +1,4 @@
-var app = require('../../examples/resource/app')
+var app = require('../../examples/resource')
 var request = require('supertest')
 
 describe('resource', function(){

From 0e5f2f84eacd085438fcdb83ad0a47d3a86a5dae Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Oct 2014 15:55:17 -0400
Subject: [PATCH 0636/1265] Use path.resolve in view lookup

---
 History.md  |  1 +
 lib/view.js | 20 +++++++++++++++++---
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index fc25715224a..037db772646 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
   * Use `content-disposition` module for `res.attachment`/`res.download`
     - Sends standards-compliant `Content-Disposition` header
     - Full Unicode support
+  * Use `path.resolve` in view lookup
   * deps: debug@~2.1.0
     - Implement `DEBUG_FD` env variable support
   * deps: depd@~1.0.0
diff --git a/lib/view.js b/lib/view.js
index 989e8bb251d..e51817583f7 100644
--- a/lib/view.js
+++ b/lib/view.js
@@ -2,14 +2,22 @@
  * Module dependencies.
  */
 
+var debug = require('debug')('express:view');
 var path = require('path');
 var fs = require('fs');
 var utils = require('./utils');
+
+/**
+ * Module variables.
+ * @private
+ */
+
 var dirname = path.dirname;
 var basename = path.basename;
 var extname = path.extname;
 var exists = fs.existsSync || path.existsSync;
 var join = path.join;
+var resolve = path.resolve;
 
 /**
  * Expose `View`.
@@ -52,11 +60,16 @@ function View(name, options) {
  * @api private
  */
 
-View.prototype.lookup = function(path){
+View.prototype.lookup = function lookup(path) {
   var ext = this.ext;
+  var root = this.root;
+
+  debug('lookup "%s"', path);
+
+  // resolve the path
+  path = resolve(root, path);
 
   // <path>.<engine>
-  if (!utils.isAbsolute(path)) path = join(this.root, path);
   if (exists(path)) return path;
 
   // <path>/index.<engine>
@@ -72,6 +85,7 @@ View.prototype.lookup = function(path){
  * @api private
  */
 
-View.prototype.render = function(options, fn){
+View.prototype.render = function render(options, fn) {
+  debug('render "%s"', this.path);
   this.engine(this.path, options, fn);
 };

From 661435256384165bb656cb7b6046b4138ca24c9e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Oct 2014 17:18:26 -0400
Subject: [PATCH 0637/1265] Add support for app.set('views', array)

closes #2320
---
 History.md                             |  2 +
 lib/application.js                     |  5 +-
 lib/view.js                            | 79 +++++++++++++++++++++-----
 test/app.render.js                     | 58 +++++++++++++++++++
 test/fixtures/default_layout/name.jade |  1 +
 test/fixtures/default_layout/user.jade |  1 +
 test/fixtures/local_layout/user.jade   |  1 +
 test/res.render.js                     | 48 ++++++++++++++++
 8 files changed, 180 insertions(+), 15 deletions(-)
 create mode 100644 test/fixtures/default_layout/name.jade
 create mode 100644 test/fixtures/default_layout/user.jade
 create mode 100644 test/fixtures/local_layout/user.jade

diff --git a/History.md b/History.md
index 037db772646..c681d790ebd 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,8 @@
 unreleased
 ==========
 
+  * Add support for `app.set('views', array)`
+    - Views are looked up in sequence in array of directories
   * Fix `res.send(status)` to mention `res.sendStatus(status)`
   * Use `content-disposition` module for `res.attachment`/`res.download`
     - Sends standards-compliant `Content-Disposition` header
diff --git a/lib/application.js b/lib/application.js
index 15b1405bfa1..2fbb5503c7b 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -513,7 +513,10 @@ app.render = function(name, options, fn){
     });
 
     if (!view.path) {
-      var err = new Error('Failed to lookup view "' + name + '" in views directory "' + view.root + '"');
+      var dirs = Array.isArray(view.root) && view.root.length > 1
+        ? 'directories "' + view.root.slice(0, -1).join('", "') + '" or "' + view.root[view.root.length - 1] + '"'
+        : 'directory "' + view.root + '"'
+      var err = new Error('Failed to lookup view "' + name + '" in views ' + dirs);
       err.view = view;
       return fn(err);
     }
diff --git a/lib/view.js b/lib/view.js
index e51817583f7..e0989b4ddac 100644
--- a/lib/view.js
+++ b/lib/view.js
@@ -15,7 +15,6 @@ var utils = require('./utils');
 var dirname = path.dirname;
 var basename = path.basename;
 var extname = path.extname;
-var exists = fs.existsSync || path.existsSync;
 var join = path.join;
 var resolve = path.resolve;
 
@@ -53,28 +52,32 @@ function View(name, options) {
 }
 
 /**
- * Lookup view by the given `path`
+ * Lookup view by the given `name`
  *
- * @param {String} path
+ * @param {String} name
  * @return {String}
  * @api private
  */
 
-View.prototype.lookup = function lookup(path) {
-  var ext = this.ext;
-  var root = this.root;
+View.prototype.lookup = function lookup(name) {
+  var path;
+  var roots = [].concat(this.root);
+
+  debug('lookup "%s"', name);
 
-  debug('lookup "%s"', path);
+  for (var i = 0; i < roots.length && !path; i++) {
+    var root = roots[i];
 
-  // resolve the path
-  path = resolve(root, path);
+    // resolve the path
+    var loc = resolve(root, name);
+    var dir = dirname(loc);
+    var file = basename(loc);
 
-  // <path>.<engine>
-  if (exists(path)) return path;
+    // resolve the file
+    path = this.resolve(dir, file);
+  }
 
-  // <path>/index.<engine>
-  path = join(dirname(path), basename(path, ext), 'index' + ext);
-  if (exists(path)) return path;
+  return path;
 };
 
 /**
@@ -89,3 +92,51 @@ View.prototype.render = function render(options, fn) {
   debug('render "%s"', this.path);
   this.engine(this.path, options, fn);
 };
+
+/**
+ * Resolve the file within the given directory.
+ *
+ * @param {string} dir
+ * @param {string} file
+ * @private
+ */
+
+View.prototype.resolve = function resolve(dir, file) {
+  var ext = this.ext;
+  var path;
+  var stat;
+
+  // <path>.<ext>
+  path = join(dir, file);
+  stat = tryStat(path);
+
+  if (stat && stat.isFile()) {
+    return path;
+  }
+
+  // <path>/index.<ext>
+  path = join(dir, basename(file, ext), 'index' + ext);
+  stat = tryStat(path);
+
+  if (stat && stat.isFile()) {
+    return path;
+  }
+};
+
+/**
+ * Return a stat, maybe.
+ *
+ * @param {string} path
+ * @return {fs.Stats}
+ * @private
+ */
+
+function tryStat(path) {
+  debug('stat "%s"', path);
+
+  try {
+    return fs.statSync(path);
+  } catch (e) {
+    return undefined;
+  }
+}
diff --git a/test/app.render.js b/test/app.render.js
index 4c4c6934a04..6cf5f616131 100644
--- a/test/app.render.js
+++ b/test/app.render.js
@@ -131,6 +131,64 @@ describe('app', function(){
       })
     })
 
+    describe('when "views" is given', function(){
+      it('should lookup the file in the path', function(done){
+        var app = express();
+
+        app.set('views', __dirname + '/fixtures/default_layout');
+        app.locals.user = { name: 'tobi' };
+
+        app.render('user.jade', function(err, str){
+          if (err) return done(err);
+          str.should.equal('<p>tobi</p>');
+          done();
+        })
+      })
+
+      describe('when array of paths', function(){
+        it('should lookup the file in the path', function(done){
+          var app = express();
+          var views = [__dirname + '/fixtures/local_layout', __dirname + '/fixtures/default_layout'];
+
+          app.set('views', views);
+          app.locals.user = { name: 'tobi' };
+
+          app.render('user.jade', function(err, str){
+            if (err) return done(err);
+            str.should.equal('<span>tobi</span>');
+            done();
+          })
+        })
+
+        it('should lookup in later paths until found', function(done){
+          var app = express();
+          var views = [__dirname + '/fixtures/local_layout', __dirname + '/fixtures/default_layout'];
+
+          app.set('views', views);
+          app.locals.name = 'tobi';
+
+          app.render('name.jade', function(err, str){
+            if (err) return done(err);
+            str.should.equal('<p>tobi</p>');
+            done();
+          })
+        })
+
+        it('should error if file does not exist', function(done){
+          var app = express();
+          var views = [__dirname + '/fixtures/local_layout', __dirname + '/fixtures/default_layout'];
+
+          app.set('views', views);
+          app.locals.name = 'tobi';
+
+          app.render('pet.jade', function(err, str){
+            err.message.should.equal('Failed to lookup view "pet.jade" in views directories "' + __dirname + '/fixtures/local_layout" or "' + __dirname + '/fixtures/default_layout"');
+            done();
+          })
+        })
+      })
+    })
+
     describe('when a "view" constructor is given', function(){
       it('should create an instance of it', function(done){
         var app = express();
diff --git a/test/fixtures/default_layout/name.jade b/test/fixtures/default_layout/name.jade
new file mode 100644
index 00000000000..ede3527a79e
--- /dev/null
+++ b/test/fixtures/default_layout/name.jade
@@ -0,0 +1 @@
+p= name
diff --git a/test/fixtures/default_layout/user.jade b/test/fixtures/default_layout/user.jade
new file mode 100644
index 00000000000..623c6654a70
--- /dev/null
+++ b/test/fixtures/default_layout/user.jade
@@ -0,0 +1 @@
+p= user.name
\ No newline at end of file
diff --git a/test/fixtures/local_layout/user.jade b/test/fixtures/local_layout/user.jade
new file mode 100644
index 00000000000..b58bd0d7404
--- /dev/null
+++ b/test/fixtures/local_layout/user.jade
@@ -0,0 +1 @@
+span= user.name
\ No newline at end of file
diff --git a/test/res.render.js b/test/res.render.js
index 6d576dc23b7..ee96ad5e777 100644
--- a/test/res.render.js
+++ b/test/res.render.js
@@ -114,6 +114,54 @@ describe('res', function(){
         .expect('<p>This is an email</p>', done);
       })
     })
+
+    describe('when "views" is given', function(){
+      it('should lookup the file in the path', function(done){
+        var app = express();
+
+        app.set('views', __dirname + '/fixtures/default_layout');
+
+        app.use(function(req, res){
+          res.render('user.jade', { user: { name: 'tobi' } });
+        });
+
+        request(app)
+        .get('/')
+        .expect('<p>tobi</p>', done);
+      })
+
+      describe('when array of paths', function(){
+        it('should lookup the file in the path', function(done){
+          var app = express();
+          var views = [__dirname + '/fixtures/local_layout', __dirname + '/fixtures/default_layout'];
+
+          app.set('views', views);
+
+          app.use(function(req, res){
+            res.render('user.jade', { user: { name: 'tobi' } });
+          });
+
+          request(app)
+          .get('/')
+          .expect('<span>tobi</span>', done);
+        })
+
+        it('should lookup in later paths until found', function(done){
+          var app = express();
+          var views = [__dirname + '/fixtures/local_layout', __dirname + '/fixtures/default_layout'];
+
+          app.set('views', views);
+
+          app.use(function(req, res){
+            res.render('name.jade', { name: 'tobi' });
+          });
+
+          request(app)
+          .get('/')
+          .expect('<p>tobi</p>', done);
+        })
+      })
+    })
   })
 
   describe('.render(name, option)', function(){

From 68290ee87af9d6366e9d153882463f23f4f6bdb5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Oct 2014 21:33:38 -0400
Subject: [PATCH 0638/1265] Fix handling of invalid empty URLs

fixes #2399
---
 History.md          |  1 +
 lib/router/layer.js |  7 +++++++
 test/Router.js      | 10 ++++++++++
 3 files changed, 18 insertions(+)

diff --git a/History.md b/History.md
index c681d790ebd..b75665ee215 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,7 @@ unreleased
   * Add support for `app.set('views', array)`
     - Views are looked up in sequence in array of directories
   * Fix `res.send(status)` to mention `res.sendStatus(status)`
+  * Fix handling of invalid empty URLs
   * Use `content-disposition` module for `res.attachment`/`res.download`
     - Sends standards-compliant `Content-Disposition` header
     - Full Unicode support
diff --git a/lib/router/layer.js b/lib/router/layer.js
index 3f15002383e..88ebd3964c2 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -95,6 +95,13 @@ Layer.prototype.handle_request = function handle(req, res, next) {
  */
 
 Layer.prototype.match = function match(path) {
+  if (path == null) {
+    // no path, nothing matches
+    this.params = undefined;
+    this.path = undefined;
+    return false;
+  }
+
   if (this.regexp.fast_slash) {
     // fast path non-ending match for / (everything matches)
     this.params = {};
diff --git a/test/Router.js b/test/Router.js
index 85a53312073..db2082a4000 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -43,6 +43,16 @@ describe('Router', function(){
     router.handle({ url: '/test/route', method: 'GET' }, { end: done });
   });
 
+  it('should handle blank URL', function(done){
+    var router = new Router();
+
+    router.use(function (req, res) {
+      false.should.be.true;
+    });
+
+    router.handle({ url: '', method: 'GET' }, {}, done);
+  });
+
   describe('.handle', function(){
     it('should dispatch', function(done){
       var router = new Router();

From d40dc651f3561a4978fdc9c40e7fc802261d99ce Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Oct 2014 22:27:45 -0400
Subject: [PATCH 0639/1265] 4.10.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index b75665ee215..baf38d2fa83 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.10.0 / 2014-10-23
+===================
 
   * Add support for `app.set('views', array)`
     - Views are looked up in sequence in array of directories
diff --git a/package.json b/package.json
index 348517e9f49..75d1e51f157 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.9.8",
+  "version": "4.10.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From eabd4564aaa8d209260497b5f3f2dda3591a9dea Mon Sep 17 00:00:00 2001
From: Aria Stewart <aredridel@nbtsc.org>
Date: Tue, 28 Oct 2014 23:39:03 -0400
Subject: [PATCH 0640/1265] Fix handling of URLs containing :// in the path

fixes #2421
---
 History.md          |  5 +++++
 lib/router/index.js |  2 +-
 test/Router.js      | 17 +++++++++++++++++
 3 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index baf38d2fa83..1a61ba1901a 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix handling of URLs containing `://` in the path
+
 4.10.0 / 2014-10-23
 ===================
 
diff --git a/lib/router/index.js b/lib/router/index.js
index 0ca1b6fee5c..c6e6ba21d4a 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -126,7 +126,7 @@ proto.handle = function(req, res, done) {
 
   var search = 1 + req.url.indexOf('?');
   var pathlength = search ? search - 1 : req.url.length;
-  var fqdn = 1 + req.url.substr(0, pathlength).indexOf('://');
+  var fqdn = req.url[0] !== '/' && 1 + req.url.substr(0, pathlength).indexOf('://');
   var protohost = fqdn ? req.url.substr(0, req.url.indexOf('/', 2 + fqdn)) : '';
   var idx = 0;
   var removed = '';
diff --git a/test/Router.js b/test/Router.js
index db2082a4000..880d34b8d53 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -219,6 +219,23 @@ describe('Router', function(){
       });
     });
 
+    it('should ignore FQDN in path', function (done) {
+      var request = { hit: 0, url: '/proxy/http://example.com/blog/post/1', method: 'GET' };
+      var router = new Router();
+
+      router.use('/proxy', function (req, res, next) {
+        assert.equal(req.hit++, 0);
+        assert.equal(req.url, '/http://example.com/blog/post/1');
+        next();
+      });
+
+      router.handle(request, {}, function (err) {
+        if (err) return done(err);
+        assert.equal(request.hit, 1);
+        done();
+      });
+    });
+
     it('should adjust FQDN req.url', function (done) {
       var request = { hit: 0, url: 'http://example.com/blog/post/1', method: 'GET' };
       var router = new Router();

From d53a0cd91e2381607719b1b262668810e2795ce4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 29 Oct 2014 01:08:36 -0400
Subject: [PATCH 0641/1265] deps: connect@2.27.2

---
 History.md   | 8 ++++++++
 package.json | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ee2a1f75cfc..6cb07b4316e 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,11 @@
+3.x
+===
+
+  * deps: connect@2.27.2
+    - Fix handling of URLs containing `://` in the path
+    - deps: body-parser@~1.9.2
+    - deps: qs@2.3.2
+
 3.18.1 / 2014-10-22
 ===================
 
diff --git a/package.json b/package.json
index c4aede125c7..1a0368c38b3 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.27.1",
+    "connect": "2.27.2",
     "content-disposition": "0.5.0",
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",

From a12ae729bdb1e59f4f5962f0429fd116fd1fba24 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 29 Oct 2014 01:10:45 -0400
Subject: [PATCH 0642/1265] 3.18.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 6cb07b4316e..43aa519a375 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.18.2 / 2014-10-28
+===================
 
   * deps: connect@2.27.2
     - Fix handling of URLs containing `://` in the path
diff --git a/package.json b/package.json
index 1a0368c38b3..0740b1d9029 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.18.1",
+  "version": "3.18.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 6c0031bfd8ec03ba242fc53ed40237040347b960 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 29 Oct 2014 01:14:44 -0400
Subject: [PATCH 0643/1265] deps: qs@2.3.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ebbbdfa547b..b791235676a 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,8 @@ unreleased
 ==========
 
   * Fix handling of URLs containing `://` in the path
+  * deps: qs@2.3.2
+    - Fix parsing of mixed objects and values
 
 4.10.0 / 2014-10-23
 ===================
diff --git a/package.json b/package.json
index 75d1e51f157..15d29c6e1ab 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "~1.0.3",
-    "qs": "2.3.0",
+    "qs": "2.3.2",
     "range-parser": "~1.0.2",
     "send": "0.10.1",
     "serve-static": "~1.7.1",

From 8bb013ec9567ae95a649c7537e1689944749d493 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 29 Oct 2014 01:15:58 -0400
Subject: [PATCH 0644/1265] 4.10.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index b791235676a..fc8330b0faf 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.10.1 / 2014-10-28
+===================
 
   * Fix handling of URLs containing `://` in the path
   * deps: qs@2.3.2
diff --git a/package.json b/package.json
index 15d29c6e1ab..e98cd90db3b 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.10.0",
+  "version": "4.10.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 1c96e18d20eecc7dbefabe21f8818192f06eafc9 Mon Sep 17 00:00:00 2001
From: Jaime Agudo <jaimeagudo@users.noreply.github.com>
Date: Thu, 30 Oct 2014 18:22:46 +0000
Subject: [PATCH 0645/1265] docs: fix Gratipay links

fixes #2424
---
 Readme.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Readme.md b/Readme.md
index 9fe91d2fc6c..24bc5822222 100644
--- a/Readme.md
+++ b/Readme.md
@@ -130,6 +130,6 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d
 [coveralls-image]: https://img.shields.io/coveralls/strongloop/express.svg?style=flat
 [coveralls-url]: https://coveralls.io/r/strongloop/express?branch=master
 [gratipay-image-visionmedia]: https://img.shields.io/gratipay/visionmedia.svg?style=flat
-[gratipay-url-visionmedia]: https://gratipay/visionmedia/
+[gratipay-url-visionmedia]: https://gratipay.com/visionmedia/
 [gratipay-image-dougwilson]: https://img.shields.io/gratipay/dougwilson.svg?style=flat
-[gratipay-url-dougwilson]: https://gratipay/dougwilson/
+[gratipay-url-dougwilson]: https://gratipay.com/dougwilson/

From e4debea297397fb32d042fefcf30d174984b68d6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 1 Nov 2014 14:09:12 -0400
Subject: [PATCH 0646/1265] Remove unused source file

---
 lib/router/match.js | 56 ---------------------------------------------
 1 file changed, 56 deletions(-)
 delete mode 100644 lib/router/match.js

diff --git a/lib/router/match.js b/lib/router/match.js
deleted file mode 100644
index 9afebfc8b34..00000000000
--- a/lib/router/match.js
+++ /dev/null
@@ -1,56 +0,0 @@
-
-/**
- * Expose `Layer`.
- */
-
-module.exports = Match;
-
-function Match(layer, path, params) {
-  this.layer = layer;
-  this.params = {};
-  this.path = path || '';
-
-  if (!params) {
-    return this;
-  }
-
-  var keys = layer.keys;
-  var n = 0;
-  var prop;
-  var key;
-  var val;
-
-  for (var i = 0; i < params.length; i++) {
-    key = keys[i];
-    val = decode_param(params[i]);
-    prop = key
-      ? key.name
-      : n++;
-
-    this.params[prop] = val;
-  }
-
-  return this;
-};
-
-/**
- * Decode param value.
- *
- * @param {string} val
- * @return {string}
- * @api private
- */
-
-function decode_param(val){
-  if (typeof val !== 'string') {
-    return val;
-  }
-
-  try {
-    return decodeURIComponent(val);
-  } catch (e) {
-    var err = new TypeError("Failed to decode param '" + val + "'");
-    err.status = 400;
-    throw err;
-  }
-}

From b4eaf891867a4ef68b7ca9578c88fa6a6b71c13d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 6 Nov 2014 21:14:02 -0500
Subject: [PATCH 0647/1265] examples: remove invalid cors example

Not only is the example not even standards-compliant, but it
encourages bad security settings and practices.
---
 examples/cors/index.js          | 48 ---------------------------------
 examples/cors/public/index.html | 12 ---------
 2 files changed, 60 deletions(-)
 delete mode 100644 examples/cors/index.js
 delete mode 100644 examples/cors/public/index.html

diff --git a/examples/cors/index.js b/examples/cors/index.js
deleted file mode 100644
index ac30ac9444e..00000000000
--- a/examples/cors/index.js
+++ /dev/null
@@ -1,48 +0,0 @@
-/**
- * Module dependencies.
- */
-
-var express = require('../..');
-var logger = require('morgan');
-var app = express();
-var bodyParser = require('body-parser');
-var api = express();
-
-// app middleware
-
-app.use(express.static(__dirname + '/public'));
-
-// api middleware
-
-api.use(logger('dev'));
-api.use(bodyParser.json());
-
-/**
- * CORS support.
- */
-
-api.all('*', function(req, res, next){
-  if (!req.get('Origin')) return next();
-  // use "*" here to accept any origin
-  res.set('Access-Control-Allow-Origin', 'http://localhost:3000');
-  res.set('Access-Control-Allow-Methods', 'PUT');
-  res.set('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type');
-  // res.set('Access-Control-Allow-Max-Age', 3600);
-  if ('OPTIONS' == req.method) return res.send(200);
-  next();
-});
-
-/**
- * PUT an existing user.
- */
-
-api.put('/user/:id', function(req, res){
-  console.log(req.body);
-  res.send(204);
-});
-
-app.listen(3000);
-api.listen(3001);
-
-console.log('app listening on 3000');
-console.log('api listening on 3001');
diff --git a/examples/cors/public/index.html b/examples/cors/public/index.html
deleted file mode 100644
index d87edc2255c..00000000000
--- a/examples/cors/public/index.html
+++ /dev/null
@@ -1,12 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <body>
-    <script>
-      var req = new XMLHttpRequest;
-      req.open('PUT', 'http://localhost:3001/user/1', false);
-      req.setRequestHeader('Content-Type', 'application/json');
-      req.send('{"name":"tobi","species":"ferret"}');
-      console.log(req.responseText);
-    </script>
-  </body>
-</html>

From 77c83d0c570a298d26a3f00ee91acf694599a51e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 9 Nov 2014 18:32:43 -0500
Subject: [PATCH 0648/1265] deps: connect@2.27.3

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 43aa519a375..78273a83d77 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+3.x
+===
+
+  * deps: connect@2.27.3
+    - Correctly invoke async callback asynchronously
+    - deps: csurf@~1.6.3
+
 3.18.2 / 2014-10-28
 ===================
 
diff --git a/package.json b/package.json
index 0740b1d9029..ebbf4e99230 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.27.2",
+    "connect": "2.27.3",
     "content-disposition": "0.5.0",
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",

From 01e3530a31dab88be87365199f0fbf5f7cc7b270 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 9 Nov 2014 18:33:17 -0500
Subject: [PATCH 0649/1265] deps: should@~4.2.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ebbf4e99230..037d20cf413 100644
--- a/package.json
+++ b/package.json
@@ -52,7 +52,7 @@
     "connect-redis": "~1.5.0",
     "istanbul": "0.3.2",
     "mocha": "~2.0.0",
-    "should": "~4.1.0",
+    "should": "~4.2.1",
     "supertest": "~0.14.0",
     "ejs": "~1.0.0",
     "jade": "~1.7.0",

From 28c6952d1c40d2ed840967206c1a7fc8d21da71b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 9 Nov 2014 18:35:34 -0500
Subject: [PATCH 0650/1265] 3.18.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 78273a83d77..c6a0371464e 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.18.3 / 2014-11-09
+===================
 
   * deps: connect@2.27.3
     - Correctly invoke async callback asynchronously
diff --git a/package.json b/package.json
index 037d20cf413..b112ca808c9 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.18.2",
+  "version": "3.18.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 0e488c19dfe5a0c7d5600dc3d31e7917ee7ddcec Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 9 Nov 2014 18:41:01 -0500
Subject: [PATCH 0651/1265] deps: accepts@~1.1.3

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index d13437ad436..f0a61188685 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: accepts@~1.1.3
+    - deps: mime-types@~2.0.3
+
 4.10.1 / 2014-10-28
 ===================
 
diff --git a/package.json b/package.json
index 38c59b9cb8d..1a854526aea 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.1.2",
+    "accepts": "~1.1.3",
     "content-disposition": "0.5.0",
     "cookie-signature": "1.0.5",
     "debug": "~2.1.0",

From 881e1ba6600186984df6e2aacdb2a3f3b0b51ce6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 9 Nov 2014 18:42:33 -0500
Subject: [PATCH 0652/1265] deps: type-is@~1.5.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f0a61188685..a27c2076d54 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,8 @@ unreleased
 
   * deps: accepts@~1.1.3
     - deps: mime-types@~2.0.3
+  * deps: type-is@~1.5.3
+    - deps: mime-types@~2.0.3
 
 4.10.1 / 2014-10-28
 ===================
diff --git a/package.json b/package.json
index 1a854526aea..fec3d230f30 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "range-parser": "~1.0.2",
     "send": "0.10.1",
     "serve-static": "~1.7.1",
-    "type-is": "~1.5.2",
+    "type-is": "~1.5.3",
     "vary": "~1.0.0",
     "cookie": "0.1.2",
     "merge-descriptors": "0.0.2",

From 5fab60bc6cbba8f3964575dbcd03671d05662aa5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 9 Nov 2014 18:50:00 -0500
Subject: [PATCH 0653/1265] Correctly invoke async router callback
 asynchronously

---
 History.md          | 1 +
 lib/router/index.js | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a27c2076d54..531235f1631 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Correctly invoke async router callback asynchronously
   * deps: accepts@~1.1.3
     - deps: mime-types@~2.0.3
   * deps: type-is@~1.5.3
diff --git a/lib/router/index.js b/lib/router/index.js
index c6e6ba21d4a..b3a42e290c9 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -183,7 +183,8 @@ proto.handle = function(req, res, done) {
     }
 
     if (!layer) {
-      return done(layerError);
+      setImmediate(done, layerError);
+      return;
     }
 
     self.match_layer(layer, req, res, function (err, path) {

From 6dea32cd18580a1206f1075295679da00d028354 Mon Sep 17 00:00:00 2001
From: Josemar Magalhaes <josemarmagalhaes@hotmail.com>
Date: Sun, 9 Nov 2014 19:46:12 -0200
Subject: [PATCH 0654/1265] examples: add multi router example

closes #2434
---
 examples/multi-router/controllers/api_v1.js | 13 ++++++
 examples/multi-router/controllers/api_v2.js | 13 ++++++
 examples/multi-router/index.js              | 16 ++++++++
 test/acceptance/multi-router.js             | 44 +++++++++++++++++++++
 4 files changed, 86 insertions(+)
 create mode 100644 examples/multi-router/controllers/api_v1.js
 create mode 100644 examples/multi-router/controllers/api_v2.js
 create mode 100644 examples/multi-router/index.js
 create mode 100644 test/acceptance/multi-router.js

diff --git a/examples/multi-router/controllers/api_v1.js b/examples/multi-router/controllers/api_v1.js
new file mode 100644
index 00000000000..08b7b5e6fdd
--- /dev/null
+++ b/examples/multi-router/controllers/api_v1.js
@@ -0,0 +1,13 @@
+var express = require('../../..');
+
+var apiv1 = express.Router();
+
+apiv1.get('/', function(req, res) {
+  res.send('Hello from APIv1 root route.');
+});
+
+apiv1.get('/users', function(req, res) {
+  res.send('List of APIv1 users.');
+});
+
+module.exports = apiv1;
diff --git a/examples/multi-router/controllers/api_v2.js b/examples/multi-router/controllers/api_v2.js
new file mode 100644
index 00000000000..4dd708281c2
--- /dev/null
+++ b/examples/multi-router/controllers/api_v2.js
@@ -0,0 +1,13 @@
+var express = require('../../..');
+
+var apiv2 = express.Router();
+
+apiv2.get('/', function(req, res) {
+  res.send('Hello from APIv2 root route.');
+});
+
+apiv2.get('/users', function(req, res) {
+  res.send('List of APIv2 users.');
+});
+
+module.exports = apiv2;
diff --git a/examples/multi-router/index.js b/examples/multi-router/index.js
new file mode 100644
index 00000000000..ff31e514a56
--- /dev/null
+++ b/examples/multi-router/index.js
@@ -0,0 +1,16 @@
+var express = require('../..');
+
+var app = module.exports = express();
+
+app.use('/api/v1', require('./controllers/api_v1'));
+app.use('/api/v2', require('./controllers/api_v2'));
+
+app.get('/', function(req, res) {
+  res.send('Hello form root route.');
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}
diff --git a/test/acceptance/multi-router.js b/test/acceptance/multi-router.js
new file mode 100644
index 00000000000..9590ee94d41
--- /dev/null
+++ b/test/acceptance/multi-router.js
@@ -0,0 +1,44 @@
+var app = require('../../examples/multi-router')
+var request = require('supertest')
+
+describe('multi-router', function(){
+  describe('GET /',function(){
+    it('should respond with root handler', function(done){
+      request(app)
+      .get('/')
+      .expect(200, 'Hello form root route.', done)
+    })
+  })
+
+  describe('GET /api/v1/',function(){
+    it('should respond with APIv1 root handler', function(done){
+      request(app)
+      .get('/api/v1/')
+      .expect(200, 'Hello from APIv1 root route.', done)
+    })
+  })
+
+  describe('GET /api/v1/users',function(){
+    it('should respond with users from APIv1', function(done){
+      request(app)
+      .get('/api/v1/users')
+      .expect(200, 'List of APIv1 users.', done)
+    })
+  })
+
+  describe('GET /api/v2/',function(){
+    it('should respond with APIv2 root handler', function(done){
+      request(app)
+      .get('/api/v2/')
+      .expect(200, 'Hello from APIv2 root route.', done)
+    })
+  })
+
+  describe('GET /api/v2/users',function(){
+    it('should respond with users from APIv2', function(done){
+      request(app)
+      .get('/api/v2/users')
+      .expect(200, 'List of APIv2 users.', done)
+    })
+  })
+})

From ac56cf46063e461fbaf53c2c869a1a657e8adbe1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 9 Nov 2014 19:09:24 -0500
Subject: [PATCH 0655/1265] 4.10.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 531235f1631..6c23252951d 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.10.2 / 2014-11-09
+===================
 
   * Correctly invoke async router callback asynchronously
   * deps: accepts@~1.1.3
diff --git a/package.json b/package.json
index fec3d230f30..9dcf0e08c52 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.10.1",
+  "version": "4.10.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From eaba4eeb703ee32cdd3ae5e5ec8aa72dfda69d58 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 23 Nov 2014 14:53:23 -0500
Subject: [PATCH 0656/1265] deps: connect@2.27.4

---
 History.md   | 13 +++++++++++++
 package.json |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c6a0371464e..6acbcbad6d0 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,16 @@
+3.x
+===
+
+  * deps: connect@2.27.4
+    - deps: body-parser@~1.9.3
+    - deps: compression@~1.2.1
+    - deps: errorhandler@~1.2.3
+    - deps: express-session@~1.9.2
+    - deps: qs@2.3.3
+    - deps: serve-favicon@~2.1.7
+    - deps: serve-static@~1.5.1
+    - deps: type-is@~1.5.3
+
 3.18.3 / 2014-11-09
 ===================
 
diff --git a/package.json b/package.json
index b112ca808c9..34470268882 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.27.3",
+    "connect": "2.27.4",
     "content-disposition": "0.5.0",
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",

From 13184c4379681a2e3e42e033d1b3b5c5e8366c82 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 23 Nov 2014 14:58:22 -0500
Subject: [PATCH 0657/1265] deps: etag@~1.5.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 6acbcbad6d0..0d69031d4c3 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,7 @@
     - deps: serve-favicon@~2.1.7
     - deps: serve-static@~1.5.1
     - deps: type-is@~1.5.3
+  * deps: etag@~1.5.1
 
 3.18.3 / 2014-11-09
 ===================
diff --git a/package.json b/package.json
index 34470268882..fbbede3e062 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "debug": "~2.1.0",
     "depd": "~1.0.0",
     "escape-html": "1.0.1",
-    "etag": "~1.5.0",
+    "etag": "~1.5.1",
     "fresh": "0.2.4",
     "media-typer": "0.3.0",
     "methods": "1.1.0",

From 8535d3a9900c5fa409f6d7a842ebcad600c11a49 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 23 Nov 2014 14:58:56 -0500
Subject: [PATCH 0658/1265] deps: supertest@~0.15.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index fbbede3e062..b94c1c0141b 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "istanbul": "0.3.2",
     "mocha": "~2.0.0",
     "should": "~4.2.1",
-    "supertest": "~0.14.0",
+    "supertest": "~0.15.0",
     "ejs": "~1.0.0",
     "jade": "~1.7.0",
     "hjs": "~0.0.6",

From ebca5887ccd38d8a5de5269cbac3919e8d6c4d58 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 23 Nov 2014 15:34:57 -0500
Subject: [PATCH 0659/1265] deps: proxy-addr@~1.0.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 0d69031d4c3..7bc7fffaa3e 100644
--- a/History.md
+++ b/History.md
@@ -11,6 +11,8 @@
     - deps: serve-static@~1.5.1
     - deps: type-is@~1.5.3
   * deps: etag@~1.5.1
+  * deps: proxy-addr@~1.0.4
+    - deps: ipaddr.js@0.1.5
 
 3.18.3 / 2014-11-09
 ===================
diff --git a/package.json b/package.json
index b94c1c0141b..a8b82f5a454 100644
--- a/package.json
+++ b/package.json
@@ -40,7 +40,7 @@
     "methods": "1.1.0",
     "mkdirp": "0.5.0",
     "parseurl": "~1.3.0",
-    "proxy-addr": "~1.0.3",
+    "proxy-addr": "~1.0.4",
     "range-parser": "~1.0.2",
     "send": "0.10.1",
     "utils-merge": "1.0.0",

From 95e63ec287ce6c23571379c57a80c5734fc3ebda Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 23 Nov 2014 15:36:59 -0500
Subject: [PATCH 0660/1265] deps: should@~4.3.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index a8b82f5a454..89255de70c6 100644
--- a/package.json
+++ b/package.json
@@ -52,7 +52,7 @@
     "connect-redis": "~1.5.0",
     "istanbul": "0.3.2",
     "mocha": "~2.0.0",
-    "should": "~4.2.1",
+    "should": "~4.3.0",
     "supertest": "~0.15.0",
     "ejs": "~1.0.0",
     "jade": "~1.7.0",

From 6c8bcd5c4e049b5c212036a2e6cfe9ac98d5b9f8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 23 Nov 2014 15:42:03 -0500
Subject: [PATCH 0661/1265] 3.18.4

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 7bc7fffaa3e..9efc8261edf 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.18.4 / 2014-11-23
+===================
 
   * deps: connect@2.27.4
     - deps: body-parser@~1.9.3
diff --git a/package.json b/package.json
index 89255de70c6..f7ade51bd8c 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.18.3",
+  "version": "3.18.4",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 997fd74e8c2166af6f24c61a7e271bfe74da203f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 23 Nov 2014 15:56:59 -0500
Subject: [PATCH 0662/1265] deps: qs@2.3.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c5dbc0b7507..825a28f8c3d 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,8 @@ unreleased
   * deps: etag@~1.5.1
   * deps: proxy-addr@~1.0.4
     - deps: ipaddr.js@0.1.5
+  * deps: qs@2.3.3
+    - Fix `arrayLimit` behavior
 
 4.10.2 / 2014-11-09
 ===================
diff --git a/package.json b/package.json
index 036546c09a8..571942b83a7 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "~1.0.4",
-    "qs": "2.3.2",
+    "qs": "2.3.3",
     "range-parser": "~1.0.2",
     "send": "0.10.1",
     "serve-static": "~1.7.1",

From 869ddd775c07045f0a6ad1278aaa3447e50667d6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 23 Nov 2014 15:58:24 -0500
Subject: [PATCH 0663/1265] deps: update example dependencies

---
 package.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index 571942b83a7..1d6161f18f9 100644
--- a/package.json
+++ b/package.json
@@ -61,13 +61,13 @@
     "ejs": "~1.0.0",
     "marked": "0.3.2",
     "hjs": "~0.0.6",
-    "body-parser": "~1.9.1",
+    "body-parser": "~1.9.3",
     "connect-redis": "~2.1.0",
     "cookie-parser": "~1.3.3",
-    "express-session": "~1.9.1",
+    "express-session": "~1.9.2",
     "jade": "~1.7.0",
     "method-override": "~2.3.0",
-    "morgan": "~1.4.1",
+    "morgan": "~1.5.0",
     "multiparty": "~4.0.0",
     "vhost": "~3.0.0"
   },

From b326ae89df48faac64f22be0eca0a86c87b203ee Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 23 Nov 2014 16:53:11 -0500
Subject: [PATCH 0664/1265] Fix res.sendFile logging standard write errors

fixes #2433
---
 History.md           |  1 +
 lib/response.js      |  4 ++--
 test/res.sendFile.js | 21 +++++++++++++++++++++
 3 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 825a28f8c3d..895ddb1a843 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix `res.sendFile` logging standard write errors
   * deps: etag@~1.5.1
   * deps: proxy-addr@~1.0.4
     - deps: ipaddr.js@0.1.5
diff --git a/lib/response.js b/lib/response.js
index 34e46ad73a6..4dc08f77bf4 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -398,8 +398,8 @@ res.sendFile = function sendFile(path, options, fn) {
     if (fn) return fn(err);
     if (err && err.code === 'EISDIR') return next();
 
-    // next() all but aborted errors
-    if (err && err.code !== 'ECONNABORT') {
+    // next() all but write errors
+    if (err && err.code !== 'ECONNABORT' && err.syscall !== 'write') {
       next(err);
     }
   });
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index 779f6ca79f9..c7631bb522b 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -69,6 +69,27 @@ describe('res', function(){
       .end(done);
     })
 
+    it('should not error if the client aborts', function (done) {
+      var cb = after(1, done);
+      var app = express();
+
+      app.use(function (req, res) {
+        setImmediate(function () {
+          res.sendFile(path.resolve(fixtures, 'name.txt'));
+          cb();
+        });
+        test.abort();
+      });
+
+      app.use(function (err, req, res, next) {
+        err.code.should.be.empty;
+        cb();
+      });
+
+      var test = request(app).get('/');
+      test.expect(200, cb);
+    })
+
     describe('with "dotfiles" option', function () {
       it('should not serve dotfiles by default', function (done) {
         var app = createApp(path.resolve(__dirname, 'fixtures/.name'));

From 7fcc8b190d7a8a3f3743bc19b4ec0d349e50cc20 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 23 Nov 2014 18:48:55 -0500
Subject: [PATCH 0665/1265] 4.10.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 895ddb1a843..33185678594 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.10.3 / 2014-11-23
+===================
 
   * Fix `res.sendFile` logging standard write errors
   * deps: etag@~1.5.1
diff --git a/package.json b/package.json
index 1d6161f18f9..46f042b7810 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.10.2",
+  "version": "4.10.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 4b26bbde2d34e3cc6f03300c36130618546263ad Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 24 Nov 2014 23:28:37 -0500
Subject: [PATCH 0666/1265] Fix res.sendFile logging standard write errors

closes #2451
---
 History.md           |  5 +++++
 lib/response.js      |  4 ++--
 test/res.sendFile.js | 21 +++++++++++++++++++++
 3 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 33185678594..c7dca6b0937 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix `res.sendfile` logging standard write errors
+
 4.10.3 / 2014-11-23
 ===================
 
diff --git a/lib/response.js b/lib/response.js
index 4dc08f77bf4..d040da726bc 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -467,8 +467,8 @@ res.sendfile = function(path, options, fn){
     if (fn) return fn(err);
     if (err && err.code === 'EISDIR') return next();
 
-    // next() all but aborted errors
-    if (err && err.code !== 'ECONNABORT') {
+    // next() all but write errors
+    if (err && err.code !== 'ECONNABORT' && err.syscall !== 'write') {
       next(err);
     }
   });
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index c7631bb522b..4dfb17528b9 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -476,6 +476,27 @@ describe('res', function(){
       .expect(200, '20%', done);
     });
 
+    it('should not error if the client aborts', function (done) {
+      var cb = after(1, done);
+      var app = express();
+
+      app.use(function (req, res) {
+        setImmediate(function () {
+          res.sendfile(path.resolve(fixtures, 'name.txt'));
+          cb();
+        });
+        test.abort();
+      });
+
+      app.use(function (err, req, res, next) {
+        err.code.should.be.empty;
+        cb();
+      });
+
+      var test = request(app).get('/');
+      test.expect(200, cb);
+    })
+
     describe('with an absolute path', function(){
       it('should transfer the file', function(done){
         var app = express();

From 656e214937889536b0faa73097422061315496f2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 25 Nov 2014 00:17:24 -0500
Subject: [PATCH 0667/1265] 4.10.4

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index c7dca6b0937..f48fa494a4f 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.10.4 / 2014-11-24
+===================
 
   * Fix `res.sendfile` logging standard write errors
 
diff --git a/package.json b/package.json
index 46f042b7810..363889e6219 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.10.3",
+  "version": "4.10.4",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 91824514ced78b4122f684e05c91e666cbf01276 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 28 Nov 2014 09:10:44 -0500
Subject: [PATCH 0668/1265] tests: run render tests with internal template
 engine

---
 test/app.render.js                 | 60 ++++++++++++++----------
 test/fixtures/blog/post/index.jade |  1 -
 test/fixtures/blog/post/index.tmpl |  1 +
 test/fixtures/email.jade           |  1 -
 test/fixtures/email.tmpl           |  1 +
 test/fixtures/pet.jade             |  1 -
 test/fixtures/user.jade            |  1 -
 test/fixtures/user.tmpl            |  1 +
 test/res.render.js                 | 73 +++++++++++++++++-------------
 test/support/tmpl.js               | 35 ++++++++++++++
 10 files changed, 114 insertions(+), 61 deletions(-)
 delete mode 100644 test/fixtures/blog/post/index.jade
 create mode 100644 test/fixtures/blog/post/index.tmpl
 delete mode 100644 test/fixtures/email.jade
 create mode 100644 test/fixtures/email.tmpl
 delete mode 100644 test/fixtures/pet.jade
 delete mode 100644 test/fixtures/user.jade
 create mode 100644 test/fixtures/user.tmpl
 create mode 100644 test/support/tmpl.js

diff --git a/test/app.render.js b/test/app.render.js
index a2c1ce69bcf..38ef0cfb803 100644
--- a/test/app.render.js
+++ b/test/app.render.js
@@ -1,14 +1,15 @@
 
-var express = require('../');
+var express = require('..');
+var tmpl = require('./support/tmpl');
 
 describe('app', function(){
   describe('.render(name, fn)', function(){
     it('should support absolute paths', function(done){
-      var app = express();
+      var app = createApp();
 
       app.locals.user = { name: 'tobi' };
 
-      app.render(__dirname + '/fixtures/user.jade', function(err, str){
+      app.render(__dirname + '/fixtures/user.tmpl', function (err, str) {
         if (err) return done(err);
         str.should.equal('<p>tobi</p>');
         done();
@@ -16,9 +17,9 @@ describe('app', function(){
     })
 
     it('should support absolute paths with "view engine"', function(done){
-      var app = express();
+      var app = createApp();
 
-      app.set('view engine', 'jade');
+      app.set('view engine', 'tmpl');
       app.locals.user = { name: 'tobi' };
 
       app.render(__dirname + '/fixtures/user', function(err, str){
@@ -29,12 +30,12 @@ describe('app', function(){
     })
 
     it('should expose app.locals', function(done){
-      var app = express();
+      var app = createApp();
 
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
 
-      app.render('user.jade', function(err, str){
+      app.render('user.tmpl', function (err, str) {
         if (err) return done(err);
         str.should.equal('<p>tobi</p>');
         done();
@@ -42,12 +43,12 @@ describe('app', function(){
     })
 
     it('should support index.<engine>', function(done){
-      var app = express();
+      var app = createApp();
 
       app.set('views', __dirname + '/fixtures');
-      app.set('view engine', 'jade');
+      app.set('view engine', 'tmpl');
 
-      app.render('blog/post', function(err, str){
+      app.render('blog/post', function (err, str) {
         if (err) return done(err);
         str.should.equal('<h1>blog post</h1>');
         done();
@@ -77,10 +78,11 @@ describe('app', function(){
 
     describe('when the file does not exist', function(){
       it('should provide a helpful error', function(done){
-        var app = express();
+        var app = createApp();
+
         app.set('views', __dirname + '/fixtures');
-        app.render('rawr.jade', function(err){
-          err.message.should.equal('Failed to lookup view "rawr.jade" in views directory "' + __dirname + '/fixtures"');
+        app.render('rawr.tmpl', function (err) {
+          err.message.should.equal('Failed to lookup view "rawr.tmpl" in views directory "' + __dirname + '/fixtures"');
           done();
         });
       })
@@ -88,11 +90,11 @@ describe('app', function(){
 
     describe('when an error occurs', function(){
       it('should invoke the callback', function(done){
-        var app = express();
+        var app = createApp();
 
         app.set('views', __dirname + '/fixtures');
 
-        app.render('user.jade', function(err, str){
+        app.render('user.tmpl', function (err, str) {
           // nextTick to prevent cyclic
           process.nextTick(function(){
             err.message.should.match(/Cannot read property 'name' of undefined/);
@@ -104,11 +106,11 @@ describe('app', function(){
 
     describe('when an extension is given', function(){
       it('should render the template', function(done){
-        var app = express();
+        var app = createApp();
 
         app.set('views', __dirname + '/fixtures');
 
-        app.render('email.jade', function(err, str){
+        app.render('email.tmpl', function (err, str) {
           if (err) return done(err);
           str.should.equal('<p>This is an email</p>');
           done();
@@ -118,9 +120,9 @@ describe('app', function(){
 
     describe('when "view engine" is given', function(){
       it('should render the template', function(done){
-        var app = express();
+        var app = createApp();
 
-        app.set('view engine', 'jade');
+        app.set('view engine', 'tmpl');
         app.set('views', __dirname + '/fixtures');
 
         app.render('email', function(err, str){
@@ -219,13 +221,13 @@ describe('app', function(){
 
   describe('.render(name, options, fn)', function(){
     it('should render the template', function(done){
-      var app = express();
+      var app = createApp();
 
       app.set('views', __dirname + '/fixtures');
 
       var user = { name: 'tobi' };
 
-      app.render('user.jade', { user: user }, function(err, str){
+      app.render('user.tmpl', { user: user }, function (err, str) {
         if (err) return done(err);
         str.should.equal('<p>tobi</p>');
         done();
@@ -233,12 +235,12 @@ describe('app', function(){
     })
 
     it('should expose app.locals', function(done){
-      var app = express();
+      var app = createApp();
 
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
 
-      app.render('user.jade', {}, function(err, str){
+      app.render('user.tmpl', {}, function (err, str) {
         if (err) return done(err);
         str.should.equal('<p>tobi</p>');
         done();
@@ -246,13 +248,13 @@ describe('app', function(){
     })
 
     it('should give precedence to app.render() locals', function(done){
-      var app = express();
+      var app = createApp();
 
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
       var jane = { name: 'jane' };
 
-      app.render('user.jade', { user: jane }, function(err, str){
+      app.render('user.tmpl', { user: jane }, function (err, str) {
         if (err) return done(err);
         str.should.equal('<p>jane</p>');
         done();
@@ -292,3 +294,11 @@ describe('app', function(){
     })
   })
 })
+
+function createApp() {
+  var app = express();
+
+  app.engine('.tmpl', tmpl);
+
+  return app;
+}
diff --git a/test/fixtures/blog/post/index.jade b/test/fixtures/blog/post/index.jade
deleted file mode 100644
index 36c8d4d1c48..00000000000
--- a/test/fixtures/blog/post/index.jade
+++ /dev/null
@@ -1 +0,0 @@
-h1 blog post
\ No newline at end of file
diff --git a/test/fixtures/blog/post/index.tmpl b/test/fixtures/blog/post/index.tmpl
new file mode 100644
index 00000000000..a9a2a3b3053
--- /dev/null
+++ b/test/fixtures/blog/post/index.tmpl
@@ -0,0 +1 @@
+<h1>blog post</h1>
\ No newline at end of file
diff --git a/test/fixtures/email.jade b/test/fixtures/email.jade
deleted file mode 100644
index 4475d8d5164..00000000000
--- a/test/fixtures/email.jade
+++ /dev/null
@@ -1 +0,0 @@
-p This is an email
\ No newline at end of file
diff --git a/test/fixtures/email.tmpl b/test/fixtures/email.tmpl
new file mode 100644
index 00000000000..8a2cb77aeb4
--- /dev/null
+++ b/test/fixtures/email.tmpl
@@ -0,0 +1 @@
+<p>This is an email</p>
\ No newline at end of file
diff --git a/test/fixtures/pet.jade b/test/fixtures/pet.jade
deleted file mode 100644
index 8ee192eca90..00000000000
--- a/test/fixtures/pet.jade
+++ /dev/null
@@ -1 +0,0 @@
-p #{first} #{last} is a #{species}
\ No newline at end of file
diff --git a/test/fixtures/user.jade b/test/fixtures/user.jade
deleted file mode 100644
index 623c6654a70..00000000000
--- a/test/fixtures/user.jade
+++ /dev/null
@@ -1 +0,0 @@
-p= user.name
\ No newline at end of file
diff --git a/test/fixtures/user.tmpl b/test/fixtures/user.tmpl
new file mode 100644
index 00000000000..67ef510227b
--- /dev/null
+++ b/test/fixtures/user.tmpl
@@ -0,0 +1 @@
+<p>$user.name</p>
\ No newline at end of file
diff --git a/test/res.render.js b/test/res.render.js
index b55417ff0ca..5285ad95d28 100644
--- a/test/res.render.js
+++ b/test/res.render.js
@@ -1,16 +1,17 @@
 
-var express = require('../')
-  , request = require('supertest');
+var express = require('..');
+var request = require('supertest');
+var tmpl = require('./support/tmpl');
 
 describe('res', function(){
   describe('.render(name)', function(){
     it('should support absolute paths', function(done){
-      var app = express();
+      var app = createApp();
 
       app.locals.user = { name: 'tobi' };
 
       app.use(function(req, res){
-        res.render(__dirname + '/fixtures/user.jade');
+        res.render(__dirname + '/fixtures/user.tmpl');
       });
 
       request(app)
@@ -19,10 +20,10 @@ describe('res', function(){
     })
 
     it('should support absolute paths with "view engine"', function(done){
-      var app = express();
+      var app = createApp();
 
       app.locals.user = { name: 'tobi' };
-      app.set('view engine', 'jade');
+      app.set('view engine', 'tmpl');
 
       app.use(function(req, res){
         res.render(__dirname + '/fixtures/user');
@@ -34,13 +35,13 @@ describe('res', function(){
     })
 
     it('should expose app.locals', function(done){
-      var app = express();
+      var app = createApp();
 
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
 
       app.use(function(req, res){
-        res.render('user.jade');
+        res.render('user.tmpl');
       });
 
       request(app)
@@ -49,10 +50,10 @@ describe('res', function(){
     })
   
     it('should support index.<engine>', function(done){
-      var app = express();
+      var app = createApp();
 
       app.set('views', __dirname + '/fixtures');
-      app.set('view engine', 'jade');
+      app.set('view engine', 'tmpl');
 
       app.use(function(req, res){
         res.render('blog/post');
@@ -65,12 +66,12 @@ describe('res', function(){
 
     describe('when an error occurs', function(){
       it('should next(err)', function(done){
-        var app = express();
+        var app = createApp();
 
         app.set('views', __dirname + '/fixtures');
 
         app.use(function(req, res){
-          res.render('user.jade');
+          res.render('user.tmpl');
         });
 
         app.use(function(err, req, res, next){
@@ -85,9 +86,9 @@ describe('res', function(){
 
     describe('when "view engine" is given', function(){
       it('should render the template', function(done){
-        var app = express();
+        var app = createApp();
 
-        app.set('view engine', 'jade');
+        app.set('view engine', 'tmpl');
         app.set('views', __dirname + '/fixtures');
 
         app.use(function(req, res){
@@ -103,14 +104,14 @@ describe('res', function(){
 
   describe('.render(name, option)', function(){
     it('should render the template', function(done){
-      var app = express();
+      var app = createApp();
 
       app.set('views', __dirname + '/fixtures');
 
       var user = { name: 'tobi' };
 
       app.use(function(req, res){
-        res.render('user.jade', { user: user });
+        res.render('user.tmpl', { user: user });
       });
 
       request(app)
@@ -119,13 +120,13 @@ describe('res', function(){
     })
 
     it('should expose app.locals', function(done){
-      var app = express();
+      var app = createApp();
 
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
 
       app.use(function(req, res){
-        res.render('user.jade');
+        res.render('user.tmpl');
       });
 
       request(app)
@@ -134,13 +135,13 @@ describe('res', function(){
     })
 
     it('should expose res.locals', function(done){
-      var app = express();
+      var app = createApp();
 
       app.set('views', __dirname + '/fixtures');
 
       app.use(function(req, res){
         res.locals.user = { name: 'tobi' };
-        res.render('user.jade');
+        res.render('user.tmpl');
       });
 
       request(app)
@@ -149,14 +150,14 @@ describe('res', function(){
     })
 
     it('should give precedence to res.locals over app.locals', function(done){
-      var app = express();
+      var app = createApp();
 
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
 
       app.use(function(req, res){
         res.locals.user = { name: 'jane' };
-        res.render('user.jade', {});
+        res.render('user.tmpl', {});
       });
 
       request(app)
@@ -165,14 +166,14 @@ describe('res', function(){
     })
 
     it('should give precedence to res.render() locals over res.locals', function(done){
-      var app = express();
+      var app = createApp();
 
       app.set('views', __dirname + '/fixtures');
       var jane = { name: 'jane' };
 
       app.use(function(req, res){
         res.locals.user = { name: 'tobi' };
-        res.render('user.jade', { user: jane });
+        res.render('user.tmpl', { user: jane });
       });
 
       request(app)
@@ -181,14 +182,14 @@ describe('res', function(){
     })
 
     it('should give precedence to res.render() locals over app.locals', function(done){
-      var app = express();
+      var app = createApp();
 
       app.set('views', __dirname + '/fixtures');
       app.locals.user = { name: 'tobi' };
       var jane = { name: 'jane' };
 
       app.use(function(req, res){
-        res.render('user.jade', { user: jane });
+        res.render('user.tmpl', { user: jane });
       });
 
       request(app)
@@ -199,13 +200,13 @@ describe('res', function(){
 
   describe('.render(name, options, fn)', function(){
     it('should pass the resulting string', function(done){
-      var app = express();
+      var app = createApp();
 
       app.set('views', __dirname + '/fixtures');
 
       app.use(function(req, res){
         var tobi = { name: 'tobi' };
-        res.render('user.jade', { user: tobi }, function(err, html){
+        res.render('user.tmpl', { user: tobi }, function (err, html) {
           html = html.replace('tobi', 'loki');
           res.end(html);
         });
@@ -219,13 +220,13 @@ describe('res', function(){
 
   describe('.render(name, fn)', function(){
     it('should pass the resulting string', function(done){
-      var app = express();
+      var app = createApp();
 
       app.set('views', __dirname + '/fixtures');
 
       app.use(function(req, res){
         res.locals.user = { name: 'tobi' };
-        res.render('user.jade', function(err, html){
+        res.render('user.tmpl', function (err, html) {
           html = html.replace('tobi', 'loki');
           res.end(html);
         });
@@ -238,12 +239,12 @@ describe('res', function(){
 
     describe('when an error occurs', function(){
       it('should pass it to the callback', function(done){
-        var app = express();
+        var app = createApp();
 
         app.set('views', __dirname + '/fixtures');
 
         app.use(function(req, res){
-          res.render('user.jade', function(err){
+          res.render('user.tmpl', function (err) {
             res.end(err.message);
           });
         });
@@ -255,3 +256,11 @@ describe('res', function(){
     })
   })
 })
+
+function createApp() {
+  var app = express();
+
+  app.engine('.tmpl', tmpl);
+
+  return app;
+}
diff --git a/test/support/tmpl.js b/test/support/tmpl.js
new file mode 100644
index 00000000000..2e8bec86388
--- /dev/null
+++ b/test/support/tmpl.js
@@ -0,0 +1,35 @@
+var fs = require('fs');
+
+var variableRegExp = /\$([0-9a-zA-Z\.]+)/g;
+
+module.exports = function renderFile(fileName, options, callback) {
+  function onReadFile(err, str) {
+    if (err) {
+      callback(err);
+      return;
+    }
+
+    try {
+      str = str.replace(variableRegExp, generateVariableLookup(options));
+    } catch (e) {
+      err = e;
+    }
+
+    callback(err, str);
+  }
+
+  fs.readFile(fileName, 'utf8', onReadFile);
+};
+
+function generateVariableLookup(data) {
+  return function variableLookup(str, path) {
+    var parts = path.split('.');
+    var value = data;
+
+    for (var i = 0; i < parts.length; i++) {
+      value = value[parts[i]];
+    }
+
+    return value;
+  };
+}

From d23417e6e8b7cdbbfb7c48d5adaabf1612e0a421 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 29 Nov 2014 12:09:00 -0500
Subject: [PATCH 0669/1265] examples: switch examples used in tests to ejs
 engine

---
 examples/error-pages/index.js                |  4 ++--
 examples/error-pages/views/404.ejs           |  3 +++
 examples/error-pages/views/404.jade          |  5 -----
 examples/error-pages/views/500.ejs           |  8 ++++++++
 examples/error-pages/views/500.jade          | 13 -------------
 examples/error-pages/views/error.jade        |  6 ------
 examples/error-pages/views/error_header.ejs  |  8 ++++++++
 examples/error-pages/views/footer.ejs        |  2 ++
 examples/error-pages/views/index.ejs         | 18 ++++++++++++++++++
 examples/error-pages/views/index.jade        | 15 ---------------
 examples/error-pages/views/layout.jade       |  6 ------
 examples/mvc/controllers/pet/index.js        |  2 +-
 examples/mvc/controllers/pet/views/edit.ejs  | 16 ++++++++++++++++
 examples/mvc/controllers/pet/views/edit.jade |  7 -------
 examples/mvc/controllers/pet/views/show.ejs  | 13 +++++++++++++
 examples/mvc/controllers/pet/views/show.jade |  6 ------
 package.json                                 |  1 -
 17 files changed, 71 insertions(+), 62 deletions(-)
 create mode 100644 examples/error-pages/views/404.ejs
 delete mode 100644 examples/error-pages/views/404.jade
 create mode 100644 examples/error-pages/views/500.ejs
 delete mode 100644 examples/error-pages/views/500.jade
 delete mode 100644 examples/error-pages/views/error.jade
 create mode 100644 examples/error-pages/views/error_header.ejs
 create mode 100644 examples/error-pages/views/footer.ejs
 create mode 100644 examples/error-pages/views/index.ejs
 delete mode 100644 examples/error-pages/views/index.jade
 delete mode 100644 examples/error-pages/views/layout.jade
 create mode 100644 examples/mvc/controllers/pet/views/edit.ejs
 delete mode 100644 examples/mvc/controllers/pet/views/edit.jade
 create mode 100644 examples/mvc/controllers/pet/views/show.ejs
 delete mode 100644 examples/mvc/controllers/pet/views/show.jade

diff --git a/examples/error-pages/index.js b/examples/error-pages/index.js
index 2c17d7f0ee5..26835153742 100644
--- a/examples/error-pages/index.js
+++ b/examples/error-pages/index.js
@@ -8,7 +8,7 @@ var express = require('../../')
 
 // general config
 app.set('views', __dirname + '/views');
-app.set('view engine', 'jade');
+app.set('view engine', 'ejs');
 
 // our custom "verbose errors" setting
 // which we can use in the templates
@@ -82,7 +82,7 @@ app.use(function(err, req, res, next){
 // Routes
 
 app.get('/', function(req, res){
-  res.render('index.jade');
+  res.render('index.ejs');
 });
 
 app.get('/404', function(req, res, next){
diff --git a/examples/error-pages/views/404.ejs b/examples/error-pages/views/404.ejs
new file mode 100644
index 00000000000..a72369e2d2c
--- /dev/null
+++ b/examples/error-pages/views/404.ejs
@@ -0,0 +1,3 @@
+<% include error_header %>
+<h2>Cannot find <%= url %></h2>
+<% include footer %>
diff --git a/examples/error-pages/views/404.jade b/examples/error-pages/views/404.jade
deleted file mode 100644
index db7b05d9fcf..00000000000
--- a/examples/error-pages/views/404.jade
+++ /dev/null
@@ -1,5 +0,0 @@
-
-extends error
-
-block content
-  h2 Cannot find #{url}
\ No newline at end of file
diff --git a/examples/error-pages/views/500.ejs b/examples/error-pages/views/500.ejs
new file mode 100644
index 00000000000..8c1e0e80fb8
--- /dev/null
+++ b/examples/error-pages/views/500.ejs
@@ -0,0 +1,8 @@
+<% include error_header %>
+<h2>Error: <%= error.message %></h2>
+<% if (settings['verbose errors']) { %>
+  <pre><%= error.stack %></pre>
+<% } else { %>
+  <p>An error occurred!</p>
+<% } %>
+<% include footer %>
diff --git a/examples/error-pages/views/500.jade b/examples/error-pages/views/500.jade
deleted file mode 100644
index e44489de995..00000000000
--- a/examples/error-pages/views/500.jade
+++ /dev/null
@@ -1,13 +0,0 @@
-
-// note that we extend a different
-// layout with jade for 4xx & 5xx
-// responses
-
-extends error
-
-block content
-  h1 Error: #{error.message}
-  if settings['verbose errors']
-    pre= error.stack
-  else
-    p An error ocurred!
\ No newline at end of file
diff --git a/examples/error-pages/views/error.jade b/examples/error-pages/views/error.jade
deleted file mode 100644
index bf750c00878..00000000000
--- a/examples/error-pages/views/error.jade
+++ /dev/null
@@ -1,6 +0,0 @@
-html
-  head 
-    title Error
-  body
-    h1 An error occurred!
-    block content
\ No newline at end of file
diff --git a/examples/error-pages/views/error_header.ejs b/examples/error-pages/views/error_header.ejs
new file mode 100644
index 00000000000..6d541dd9f5c
--- /dev/null
+++ b/examples/error-pages/views/error_header.ejs
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Error</title>
+</head>
+
+<body>
+<h1>An error occurred!</h1>
diff --git a/examples/error-pages/views/footer.ejs b/examples/error-pages/views/footer.ejs
new file mode 100644
index 00000000000..308b1d01b6c
--- /dev/null
+++ b/examples/error-pages/views/footer.ejs
@@ -0,0 +1,2 @@
+</body>
+</html>
diff --git a/examples/error-pages/views/index.ejs b/examples/error-pages/views/index.ejs
new file mode 100644
index 00000000000..04a1a7847b9
--- /dev/null
+++ b/examples/error-pages/views/index.ejs
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Custom Pages Example</title>
+</head>
+
+<body>
+<h1>My Site</h1>
+<h2>Pages Example</h2>
+
+<ul>
+<li>visit <a href="/500">500</a></li>
+<li>visit <a href="/404">404</a></li>
+<li>visit <a href="/403">403</a></li>
+</ul>
+
+</body>
+</html>
diff --git a/examples/error-pages/views/index.jade b/examples/error-pages/views/index.jade
deleted file mode 100644
index da8f0f1698f..00000000000
--- a/examples/error-pages/views/index.jade
+++ /dev/null
@@ -1,15 +0,0 @@
-
-extends layout
-
-block content
-  h2 Pages Example
-  ul
-    li 
-      | visit 
-      a(href="/500") 500
-    li
-      | visit 
-      a(href="/404") 404
-    li
-      | visit 
-      a(href='/403') 403
\ No newline at end of file
diff --git a/examples/error-pages/views/layout.jade b/examples/error-pages/views/layout.jade
deleted file mode 100644
index 8a6f7b17470..00000000000
--- a/examples/error-pages/views/layout.jade
+++ /dev/null
@@ -1,6 +0,0 @@
-html
-  head 
-    title Custom Pages Example
-  body
-    h1 My Site
-    block content
\ No newline at end of file
diff --git a/examples/mvc/controllers/pet/index.js b/examples/mvc/controllers/pet/index.js
index 9f3c34525ef..a0cbaea59c0 100644
--- a/examples/mvc/controllers/pet/index.js
+++ b/examples/mvc/controllers/pet/index.js
@@ -1,7 +1,7 @@
 
 var db = require('../../db');
 
-exports.engine = 'jade';
+exports.engine = 'ejs';
 
 exports.before = function(req, res, next){
   var pet = db.pets[req.params.pet_id];
diff --git a/examples/mvc/controllers/pet/views/edit.ejs b/examples/mvc/controllers/pet/views/edit.ejs
new file mode 100644
index 00000000000..0158181ba58
--- /dev/null
+++ b/examples/mvc/controllers/pet/views/edit.ejs
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<link rel="stylesheet" href="/style.css">
+<title>Edit <%= pet.name %></title>
+</head>
+
+<body>
+<h1><%= pet.name %></h1>
+<form action="/pet/<%= pet.id %>" method="post">
+  <input type="hidden" name="_method" value="put">
+  <label>Name: <input type="text" name="user[name]" value="<%= pet.name %>"></label>
+  <input type="submit" value="Update">
+</form>
+</body>
+</html>
diff --git a/examples/mvc/controllers/pet/views/edit.jade b/examples/mvc/controllers/pet/views/edit.jade
deleted file mode 100644
index 911a54a3088..00000000000
--- a/examples/mvc/controllers/pet/views/edit.jade
+++ /dev/null
@@ -1,7 +0,0 @@
-link(rel='stylesheet', href='/style.css')
-h1= pet.name
-form(action='/pet/#{pet.id}', method='post')
-  input(type='hidden', name='_method', value='put')
-  label Name: 
-    input(type='text', name='user[name]', value=pet.name)
-  input(type='submit', value='Update')
diff --git a/examples/mvc/controllers/pet/views/show.ejs b/examples/mvc/controllers/pet/views/show.ejs
new file mode 100644
index 00000000000..2ec7b0bf063
--- /dev/null
+++ b/examples/mvc/controllers/pet/views/show.ejs
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<link rel="stylesheet" href="/style.css">
+<title><%= pet.name %></title>
+</head>
+
+<body>
+<h1><%= pet.name %> <a href="/pet/<%= pet.id %>/edit">edit</a></h1>
+
+<p>You are viewing <%= pet.name %></p>
+</body>
+</html>
diff --git a/examples/mvc/controllers/pet/views/show.jade b/examples/mvc/controllers/pet/views/show.jade
deleted file mode 100644
index ad57ae73847..00000000000
--- a/examples/mvc/controllers/pet/views/show.jade
+++ /dev/null
@@ -1,6 +0,0 @@
-link(rel='stylesheet', href='/style.css')
-
-h1= pet.name
-  a(href='/pet/#{pet.id}/edit')  edit
-
-p You are viewing #{pet.name}
diff --git a/package.json b/package.json
index f7ade51bd8c..2a465534251 100644
--- a/package.json
+++ b/package.json
@@ -55,7 +55,6 @@
     "should": "~4.3.0",
     "supertest": "~0.15.0",
     "ejs": "~1.0.0",
-    "jade": "~1.7.0",
     "hjs": "~0.0.6",
     "marked": "0.3.2"
   },

From ebfa00a9c04ba7d911cd5ad88c1e0567c935ae22 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 29 Nov 2014 12:10:30 -0500
Subject: [PATCH 0670/1265] build: remove support folder

---
 support/app.js           | 66 ----------------------------------------
 support/docs             | 21 -------------
 support/views/hello.jade |  1 -
 3 files changed, 88 deletions(-)
 delete mode 100644 support/app.js
 delete mode 100755 support/docs
 delete mode 100644 support/views/hello.jade

diff --git a/support/app.js b/support/app.js
deleted file mode 100644
index 42198d92d99..00000000000
--- a/support/app.js
+++ /dev/null
@@ -1,66 +0,0 @@
-
-/**
- * Module dependencies.
- */
-
-var express = require('../');
-
-var app = express()
-  , blog = express()
-  , admin = express();
-
-// app.use(express.logger('dev'))
-blog.use('/admin', admin);
-app.use('/blog', blog);
-app.set('views', __dirname + '/views');
-app.set('view engine', 'jade');
-app.locals.self = true;
-
-app.get('/render', function(req, res){
-  res.render('hello');
-});
-
-admin.get('/', function(req, res){
-  res.send('Hello World\n');
-});
-
-blog.get('/', function(req, res){
-  res.send('Hello World\n');
-});
-
-app.get('/', function(req, res){
-  res.send('Hello World\n');
-});
-
-app.get('/json', function(req, res){
-  res.send({ name: 'Tobi', role: 'admin' });
-});
-
-app.get('/json/:n', function(req, res){
-  var n = ~~req.params.n;
-  var arr = [];
-  var obj = { name: 'Tobi', role: 'admin' };
-  while (n--) arr.push(obj);
-  res.send(arr);
-});
-
-function foo(req, res, next) {
-  next();
-}
-
-app.get('/middleware', foo, foo, foo, foo, function(req, res){
-  res.send('Hello World\n');
-});
-
-var n = 100;
-while (n--) {
-  app.get('/foo', foo, foo, function(req, res){
-    
-  });
-}
-
-app.get('/match', function(req, res){
-  res.send('Hello World\n');
-});
-
-app.listen(8000);
diff --git a/support/docs b/support/docs
deleted file mode 100755
index f97588a35ce..00000000000
--- a/support/docs
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/usr/bin/env node
-
-var buf = '';
-process.stdin.setEncoding('utf8');
-process.stdin.on('data', function(chunk){
-  buf += chunk;
-}).on('end', function(){
-  var comments = JSON.parse(buf);
-  comments.forEach(function(comment){
-    if (comment.ignore) return;
-    if (comment.isPrivate) return;
-    if (!comment.ctx) return;
-    if (!comment.description.full.indexOf('Module dep')) return;
-    var ctx = comment.ctx;
-    console.log();
-    console.log('# %s', ctx.string);
-    console.log();
-    console.log(comment.description.full.trim().replace(/^/gm, '  '));
-  });
-  console.log();
-}).resume();
\ No newline at end of file
diff --git a/support/views/hello.jade b/support/views/hello.jade
deleted file mode 100644
index 09a0111cce1..00000000000
--- a/support/views/hello.jade
+++ /dev/null
@@ -1 +0,0 @@
-p Hello
\ No newline at end of file

From c24463d8298d9dc2d924d346adc8d4db8f4e1928 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Dec 2014 12:25:43 -0500
Subject: [PATCH 0671/1265] Fix res.send double-calling res.end for HEAD
 requests

fixes #2467
---
 History.md      | 5 +++++
 lib/response.js | 8 ++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index f48fa494a4f..f86b76f9f12 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix `res.send` double-calling `res.end` for `HEAD` requests
+
 4.10.4 / 2014-11-24
 ===================
 
diff --git a/lib/response.js b/lib/response.js
index d040da726bc..f21cbe27de7 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -182,14 +182,14 @@ res.send = function send(body) {
     chunk = '';
   }
 
-  // skip body for HEAD
   if (isHead) {
+    // skip body for HEAD
     this.end();
+  } else {
+    // respond
+    this.end(chunk, encoding);
   }
 
-  // respond
-  this.end(chunk, encoding);
-
   return this;
 };
 

From d5ad34b0e9b57821f70f7659cccfc28b0f1c42e1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Dec 2014 22:55:36 -0500
Subject: [PATCH 0672/1265] deps: connect@2.27.6

---
 History.md   | 10 ++++++++++
 package.json |  2 +-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 9efc8261edf..4f5733b0735 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,13 @@
+3.x
+===
+
+  * deps: connect@2.27.6
+    - deps: compression@~1.2.2
+    - deps: express-session@~1.9.3
+    - deps: http-errors@~1.2.8
+    - deps: serve-index@~1.5.3
+    - deps: type-is@~1.5.4
+
 3.18.4 / 2014-11-23
 ===================
 
diff --git a/package.json b/package.json
index 2a465534251..ea54a9b77c7 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.27.4",
+    "connect": "2.27.6",
     "content-disposition": "0.5.0",
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",

From f0b679d02da97d82705dfa3d23b7821895e65a44 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Dec 2014 23:49:34 -0500
Subject: [PATCH 0673/1265] deps: accepts@~1.1.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f86b76f9f12..04a6d1d5201 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,8 @@ unreleased
 ==========
 
   * Fix `res.send` double-calling `res.end` for `HEAD` requests
+  * deps: accepts@~1.1.4
+    - deps: mime-types@~2.0.4
 
 4.10.4 / 2014-11-24
 ===================
diff --git a/package.json b/package.json
index 363889e6219..fd0f55e2f33 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.1.3",
+    "accepts": "~1.1.4",
     "content-disposition": "0.5.0",
     "cookie-signature": "1.0.5",
     "debug": "~2.1.0",

From 4370908674c21ff88d46f3e99ce2978959168d65 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Dec 2014 23:50:58 -0500
Subject: [PATCH 0674/1265] deps: type-is@~1.5.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 04a6d1d5201..fc0164c14c1 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,8 @@ unreleased
   * Fix `res.send` double-calling `res.end` for `HEAD` requests
   * deps: accepts@~1.1.4
     - deps: mime-types@~2.0.4
+  * deps: type-is@~1.5.4
+    - deps: mime-types@~2.0.4
 
 4.10.4 / 2014-11-24
 ===================
diff --git a/package.json b/package.json
index fd0f55e2f33..4cb2415eb19 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "range-parser": "~1.0.2",
     "send": "0.10.1",
     "serve-static": "~1.7.1",
-    "type-is": "~1.5.3",
+    "type-is": "~1.5.4",
     "vary": "~1.0.0",
     "cookie": "0.1.2",
     "merge-descriptors": "0.0.2",

From 4d8093302f752725874d6b31b57720d4cab6d078 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Dec 2014 23:53:31 -0500
Subject: [PATCH 0675/1265] 4.10.5

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index fc0164c14c1..c6201a11ddb 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.10.5 / 2014-12-10
+===================
 
   * Fix `res.send` double-calling `res.end` for `HEAD` requests
   * deps: accepts@~1.1.4
diff --git a/package.json b/package.json
index 4cb2415eb19..716a9f80bfb 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.10.4",
+  "version": "4.10.5",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From ce89c00cd9848885fbc678fbec22b6b5662f7e70 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 11 Dec 2014 23:01:12 -0500
Subject: [PATCH 0676/1265] deps: istanbul@0.3.5

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ea54a9b77c7..1a8d6e94e67 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
   },
   "devDependencies": {
     "connect-redis": "~1.5.0",
-    "istanbul": "0.3.2",
+    "istanbul": "0.3.5",
     "mocha": "~2.0.0",
     "should": "~4.3.0",
     "supertest": "~0.15.0",

From e77e644224cd071f5c3425b80505fbd4b7bc214f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 11 Dec 2014 23:03:01 -0500
Subject: [PATCH 0677/1265] deps: should@~4.3.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 1a8d6e94e67..4be646f8d1d 100644
--- a/package.json
+++ b/package.json
@@ -52,7 +52,7 @@
     "connect-redis": "~1.5.0",
     "istanbul": "0.3.5",
     "mocha": "~2.0.0",
-    "should": "~4.3.0",
+    "should": "~4.3.1",
     "supertest": "~0.15.0",
     "ejs": "~1.0.0",
     "hjs": "~0.0.6",

From 262b60537fd39c76420246d38c813a1743bf223e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 11 Dec 2014 23:10:34 -0500
Subject: [PATCH 0678/1265] 3.18.5

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 4f5733b0735..74e60c40b0b 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.18.5 / 2014-12-11
+===================
 
   * deps: connect@2.27.6
     - deps: compression@~1.2.2
diff --git a/package.json b/package.json
index 4be646f8d1d..257274382b1 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.18.4",
+  "version": "3.18.5",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 5d74a553d67d23b8fd0c236c162fd0b556b9bdfe Mon Sep 17 00:00:00 2001
From: Troy Goode <troygoode@gmail.com>
Date: Thu, 11 Dec 2014 20:34:26 -0800
Subject: [PATCH 0679/1265] Fix exception in req.fresh/req.stale without
 response headers

fixes #2468
---
 History.md        |  5 +++++
 lib/request.js    |  2 +-
 test/req.fresh.js | 13 +++++++++++++
 test/req.stale.js | 13 +++++++++++++
 4 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 74e60c40b0b..94748f1e15d 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+3.x
+===
+
+  * Fix exception in `req.fresh`/`req.stale` without response headers
+
 3.18.5 / 2014-12-11
 ===================
 
diff --git a/lib/request.js b/lib/request.js
index 683d54805c0..c1392396c19 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -526,7 +526,7 @@ req.__defineGetter__('fresh', function(){
 
   // 2xx or 304 as per rfc2616 14.26
   if ((s >= 200 && s < 300) || 304 == s) {
-    return fresh(this.headers, this.res._headers);
+    return fresh(this.headers, (this.res._headers || {}));
   }
 
   return false;
diff --git a/test/req.fresh.js b/test/req.fresh.js
index be23c43a6de..fdf4b07d591 100644
--- a/test/req.fresh.js
+++ b/test/req.fresh.js
@@ -32,5 +32,18 @@ describe('req', function(){
       .set('If-None-Match', '"12345"')
       .expect(200, 'false', done);
     })
+
+    it('should return false without response headers', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res._headers = undefined;
+        res.send(req.fresh);
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, 'false', done);
+    })
   })
 })
diff --git a/test/req.stale.js b/test/req.stale.js
index a52237f3c06..70fee02c992 100644
--- a/test/req.stale.js
+++ b/test/req.stale.js
@@ -32,5 +32,18 @@ describe('req', function(){
       .set('If-None-Match', '"12345"')
       .expect(200, 'true', done);
     })
+
+    it('should return true without response headers', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res._headers = undefined;
+        res.send(req.stale);
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, 'true', done);
+    })
   })
 })

From 4405b849a9ea62dfa76f32031e187c844f8e217d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 12 Dec 2014 21:39:47 -0500
Subject: [PATCH 0680/1265] 3.18.6

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 94748f1e15d..706d453b85a 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.18.6 / 2014-12-12
+===================
 
   * Fix exception in `req.fresh`/`req.stale` without response headers
 
diff --git a/package.json b/package.json
index 257274382b1..80f4cdfe01e 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.18.5",
+  "version": "3.18.6",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From b78bd3d1fd6caf8228a1875078fecce936cb2e46 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 12 Dec 2014 23:13:34 -0500
Subject: [PATCH 0681/1265] 4.10.6

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index cc89dfa5929..667ee8ff827 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.10.6 / 2014-12-12
+===================
 
   * Fix exception in `req.fresh`/`req.stale` without response headers
 
diff --git a/package.json b/package.json
index 3960bdd1ae5..10fefaeae5f 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.10.5",
+  "version": "4.10.6",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 98585d1d0a789c64df3260a5518c4f7212d0ddf0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Jan 2015 17:40:22 -0500
Subject: [PATCH 0682/1265] deps: finalhandler@0.3.3

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 667ee8ff827..a45a9a113af 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+unreleased
+==========
+
+  * deps: finalhandler@0.3.3
+    - deps: debug@~2.1.1
+    - deps: on-finished@~2.2.0
+
 4.10.6 / 2014-12-12
 ===================
 
diff --git a/package.json b/package.json
index 10fefaeae5f..1ed97aaf91d 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "depd": "~1.0.0",
     "escape-html": "1.0.1",
     "etag": "~1.5.1",
-    "finalhandler": "0.3.2",
+    "finalhandler": "0.3.3",
     "fresh": "0.2.4",
     "media-typer": "0.3.0",
     "methods": "1.1.0",

From 571ce16405ae210d7c1725238f74018c070e40c0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Jan 2015 17:42:57 -0500
Subject: [PATCH 0683/1265] deps: methods@~1.1.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a45a9a113af..a5a188203db 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,7 @@ unreleased
   * deps: finalhandler@0.3.3
     - deps: debug@~2.1.1
     - deps: on-finished@~2.2.0
+  * deps: methods@~1.1.1
 
 4.10.6 / 2014-12-12
 ===================
diff --git a/package.json b/package.json
index 1ed97aaf91d..9583e437152 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "finalhandler": "0.3.3",
     "fresh": "0.2.4",
     "media-typer": "0.3.0",
-    "methods": "1.1.0",
+    "methods": "1.1.1",
     "on-finished": "~2.1.1",
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",

From 6e9cfa2aea35ba3add2e8ff4a4a544723f113cb3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Jan 2015 17:46:41 -0500
Subject: [PATCH 0684/1265] deps: on-finished@~2.2.0

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a5a188203db..1c32c16b916 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
     - deps: debug@~2.1.1
     - deps: on-finished@~2.2.0
   * deps: methods@~1.1.1
+  * deps: on-finished@~2.2.0
 
 4.10.6 / 2014-12-12
 ===================
diff --git a/package.json b/package.json
index 9583e437152..fad5ead2da8 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "fresh": "0.2.4",
     "media-typer": "0.3.0",
     "methods": "1.1.1",
-    "on-finished": "~2.1.1",
+    "on-finished": "~2.2.0",
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "~1.0.4",

From a7227a09649cfb6ebb03885b717ae18a56281085 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Jan 2015 17:47:25 -0500
Subject: [PATCH 0685/1265] deps: debug@~2.1.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 1c32c16b916..17e9dd8a011 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * deps: debug@~2.1.1
   * deps: finalhandler@0.3.3
     - deps: debug@~2.1.1
     - deps: on-finished@~2.2.0
diff --git a/package.json b/package.json
index fad5ead2da8..920a45ecb32 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "accepts": "~1.1.4",
     "content-disposition": "0.5.0",
     "cookie-signature": "1.0.5",
-    "debug": "~2.1.0",
+    "debug": "~2.1.1",
     "depd": "~1.0.0",
     "escape-html": "1.0.1",
     "etag": "~1.5.1",

From 2d6faf6da78e2af3ce5d76bc400a8dd70bf5760d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Jan 2015 17:49:39 -0500
Subject: [PATCH 0686/1265] deps: serve-static@~1.7.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 17e9dd8a011..ce4bc5dc669 100644
--- a/History.md
+++ b/History.md
@@ -7,6 +7,8 @@ unreleased
     - deps: on-finished@~2.2.0
   * deps: methods@~1.1.1
   * deps: on-finished@~2.2.0
+  * deps: serve-static@~1.7.2
+    - Fix potential open redirect when mounted at root
 
 4.10.6 / 2014-12-12
 ===================
diff --git a/package.json b/package.json
index 920a45ecb32..638c3d20ad3 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "qs": "2.3.3",
     "range-parser": "~1.0.2",
     "send": "0.10.1",
-    "serve-static": "~1.7.1",
+    "serve-static": "~1.7.2",
     "type-is": "~1.5.4",
     "vary": "~1.0.0",
     "cookie": "0.1.2",

From f76403b717dc59d0fea41e5da68bd50d95b42fdf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Jan 2015 17:50:42 -0500
Subject: [PATCH 0687/1265] deps: type-is@~1.5.5

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ce4bc5dc669..52a05063734 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,8 @@ unreleased
   * deps: on-finished@~2.2.0
   * deps: serve-static@~1.7.2
     - Fix potential open redirect when mounted at root
+  * deps: type-is@~1.5.5
+    - deps: mime-types@~2.0.7
 
 4.10.6 / 2014-12-12
 ===================
diff --git a/package.json b/package.json
index 638c3d20ad3..4a71c272bfc 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "range-parser": "~1.0.2",
     "send": "0.10.1",
     "serve-static": "~1.7.2",
-    "type-is": "~1.5.4",
+    "type-is": "~1.5.5",
     "vary": "~1.0.0",
     "cookie": "0.1.2",
     "merge-descriptors": "0.0.2",

From 3387916efcac19302188151a24927a0405a373e8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Jan 2015 18:26:15 -0500
Subject: [PATCH 0688/1265] Fix incorrect "Request aborted" for res.sendFile
 when HEAD or 304

fixes #2481
---
 History.md           |  1 +
 lib/response.js      | 23 ++++++++++-
 test/res.sendFile.js | 93 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 115 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 52a05063734..3e859893177 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix incorrect "Request aborted" for `res.sendFile` when `HEAD` or 304
   * deps: debug@~2.1.1
   * deps: finalhandler@0.3.3
     - deps: debug@~2.1.1
diff --git a/lib/response.js b/lib/response.js
index f21cbe27de7..87d1dc5d0a1 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -907,6 +907,7 @@ res.render = function(view, options, fn){
 // pipe the send file stream
 function sendfile(res, file, options, callback) {
   var done = false;
+  var streaming = false;
 
   // directory
   function ondirectory() {
@@ -920,6 +921,7 @@ function sendfile(res, file, options, callback) {
 
   // errors
   function onerror(err) {
+    if (!err) return;
     if (done) return;
     done = true;
     callback(err);
@@ -932,6 +934,11 @@ function sendfile(res, file, options, callback) {
     callback();
   }
 
+  // file
+  function onfile() {
+    onFinished(res, onfinish);
+  }
+
   // finished
   function onfinish(err) {
     if (err) return onerror(err);
@@ -941,6 +948,11 @@ function sendfile(res, file, options, callback) {
       if (done) return;
       done = true;
 
+      if (!streaming) {
+        callback();
+        return;
+      }
+
       // response finished before end of file
       var err = new Error('Request aborted');
       err.code = 'ECONNABORT';
@@ -948,10 +960,17 @@ function sendfile(res, file, options, callback) {
     });
   }
 
+  // streaming
+  function onstream() {
+    streaming = true;
+  }
+
+  file.on('directory', ondirectory);
   file.on('end', onend);
   file.on('error', onerror);
-  file.on('directory', ondirectory);
-  onFinished(res, onfinish);
+  file.on('file', onfile);
+  file.on('stream', onstream);
+  onFinished(res, onerror);
 
   if (options.headers) {
     // set headers on successful transfer
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index 4dfb17528b9..c53e10ae672 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -34,6 +34,31 @@ describe('res', function(){
       .expect(200, '20%', done);
     });
 
+    it('should include ETag', function (done) {
+      var app = createApp(path.resolve(fixtures, 'name.txt'));
+
+      request(app)
+      .get('/')
+      .expect('ETag', /^(?:W\/)?"[^"]+"$/)
+      .expect(200, 'tobi', done);
+    });
+
+    it('should 304 when ETag matches', function (done) {
+      var app = createApp(path.resolve(fixtures, 'name.txt'));
+
+      request(app)
+      .get('/')
+      .expect('ETag', /^(?:W\/)?"[^"]+"$/)
+      .expect(200, 'tobi', function (err, res) {
+        if (err) return done(err);
+        var etag = res.headers.etag;
+        request(app)
+        .get('/')
+        .set('If-None-Match', etag)
+        .expect(304, done);
+      });
+    });
+
     it('should 404 for directory', function (done) {
       var app = createApp(path.resolve(fixtures, 'blog'));
 
@@ -212,6 +237,40 @@ describe('res', function(){
       test.expect(200, cb);
     })
 
+    it('should invoke the callback without error when HEAD', function (done) {
+      var app = express();
+      var cb = after(2, done);
+
+      app.use(function (req, res) {
+        res.sendFile(path.resolve(fixtures, 'name.txt'), cb);
+      });
+
+      request(app)
+      .head('/')
+      .expect(200, cb);
+    });
+
+    it('should invoke the callback without error when 304', function (done) {
+      var app = express();
+      var cb = after(3, done);
+
+      app.use(function (req, res) {
+        res.sendFile(path.resolve(fixtures, 'name.txt'), cb);
+      });
+
+      request(app)
+      .get('/')
+      .expect('ETag', /^(?:W\/)?"[^"]+"$/)
+      .expect(200, 'tobi', function (err, res) {
+        if (err) return cb(err);
+        var etag = res.headers.etag;
+        request(app)
+        .get('/')
+        .set('If-None-Match', etag)
+        .expect(304, cb);
+      });
+    });
+
     it('should invoke the callback on 404', function(done){
       var app = express();
 
@@ -294,6 +353,40 @@ describe('res', function(){
       test.expect(200, cb);
     })
 
+    it('should invoke the callback without error when HEAD', function (done) {
+      var app = express();
+      var cb = after(2, done);
+
+      app.use(function (req, res) {
+        res.sendfile('test/fixtures/name.txt', cb);
+      });
+
+      request(app)
+      .head('/')
+      .expect(200, cb);
+    });
+
+    it('should invoke the callback without error when 304', function (done) {
+      var app = express();
+      var cb = after(3, done);
+
+      app.use(function (req, res) {
+        res.sendfile('test/fixtures/name.txt', cb);
+      });
+
+      request(app)
+      .get('/')
+      .expect('ETag', /^(?:W\/)?"[^"]+"$/)
+      .expect(200, 'tobi', function (err, res) {
+        if (err) return cb(err);
+        var etag = res.headers.etag;
+        request(app)
+        .get('/')
+        .set('If-None-Match', etag)
+        .expect(304, cb);
+      });
+    });
+
     it('should invoke the callback on 404', function(done){
       var app = express()
         , calls = 0;

From 12626aed35a6d1ef4466fa0d67613a53db8b1149 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Jan 2015 19:07:21 -0500
Subject: [PATCH 0689/1265] Fix Allow header for OPTIONS to not contain
 duplicate methods

fixes #2458
---
 History.md          |  1 +
 lib/router/index.js | 12 +++++++++++-
 test/app.options.js | 14 ++++++++++++++
 3 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 3e859893177..57cc574e785 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix `Allow` header for `OPTIONS` to not contain duplicate methods
   * Fix incorrect "Request aborted" for `res.sendFile` when `HEAD` or 304
   * deps: debug@~2.1.1
   * deps: finalhandler@0.3.3
diff --git a/lib/router/index.js b/lib/router/index.js
index b3a42e290c9..488713915e9 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -207,7 +207,7 @@ proto.handle = function(req, res, done) {
 
         // build up automatic options response
         if (!has_method && method === 'OPTIONS') {
-          options.push.apply(options, route._options());
+          appendMethods(options, route._options());
         }
 
         // don't even bother
@@ -492,6 +492,16 @@ methods.concat('all').forEach(function(method){
   };
 });
 
+// append methods to a list of methods
+function appendMethods(list, addition) {
+  for (var i = 0; i < addition.length; i++) {
+    var method = addition[i];
+    if (list.indexOf(method) === -1) {
+      list.push(method);
+    }
+  }
+}
+
 // get type for error message
 function gettype(obj) {
   var type = typeof obj;
diff --git a/test/app.options.js b/test/app.options.js
index 98fefe9a0bd..3d484ef17d0 100644
--- a/test/app.options.js
+++ b/test/app.options.js
@@ -16,6 +16,20 @@ describe('OPTIONS', function(){
     .expect('Allow', 'GET,PUT', done);
   })
 
+  it('should only include each method once', function(done){
+    var app = express();
+
+    app.del('/', function(){});
+    app.get('/users', function(req, res){});
+    app.put('/users', function(req, res){});
+    app.get('/users', function(req, res){});
+
+    request(app)
+    .options('/users')
+    .expect('GET,PUT')
+    .expect('Allow', 'GET,PUT', done);
+  })
+
   it('should not be affected by app.all', function(done){
     var app = express();
 

From d842647217feeb3024e8056fabacc8bab1b382f0 Mon Sep 17 00:00:00 2001
From: Nick Mandel <nrmandel@ucdavis.edu>
Date: Mon, 15 Dec 2014 20:41:05 -0800
Subject: [PATCH 0690/1265] docs: readme tweaks

closes #2471
---
 Readme.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Readme.md b/Readme.md
index 24bc5822222..748e1ee81f3 100644
--- a/Readme.md
+++ b/Readme.md
@@ -18,7 +18,7 @@ app.get('/', function (req, res) {
 app.listen(3000)
 ```
 
-### Installation
+## Installation
 
 ```bash
 $ npm install express
@@ -86,7 +86,7 @@ $ npm start
 
 ## Examples
 
-  To view the examples, clone the Express repo & install the dependancies:
+  To view the examples, clone the Express repo and install the dependancies:
 
 ```bash
 $ git clone git://github.com/strongloop/express.git --depth 1
@@ -109,7 +109,7 @@ $ npm install
 $ npm test
 ```
 
-### People
+## People
 
 The original author of Express is [TJ Holowaychuk](https://github.com/tj) [![TJ's Gratipay][gratipay-image-visionmedia]][gratipay-url-visionmedia]
 
@@ -117,7 +117,7 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d
 
 [List of all contributors](https://github.com/strongloop/express/graphs/contributors)
 
-### License
+## License
 
   [MIT](LICENSE)
 

From ff5e96c88b23ebf0bb9bf99f9195b5b40215502f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Jan 2015 19:33:31 -0500
Subject: [PATCH 0691/1265] 4.10.7

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 57cc574e785..20a7b43566f 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.10.7 / 2015-01-04
+===================
 
   * Fix `Allow` header for `OPTIONS` to not contain duplicate methods
   * Fix incorrect "Request aborted" for `res.sendFile` when `HEAD` or 304
diff --git a/package.json b/package.json
index 4a71c272bfc..5ea14e218f6 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.10.6",
+  "version": "4.10.7",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From a715ba6be40247b360cfbf3ca96efa29be4282af Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Jan 2015 17:06:08 -0500
Subject: [PATCH 0692/1265] docs: Gittip is now Gratipay

---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index e63a689a13d..4200fe730eb 100644
--- a/Readme.md
+++ b/Readme.md
@@ -5,7 +5,7 @@
   [![NPM version](https://img.shields.io/npm/v/express.svg?style=flat)](https://www.npmjs.org/package/express)
   [![Build Status](https://img.shields.io/travis/strongloop/express.svg?style=flat)](https://travis-ci.org/strongloop/express)
   [![Coverage Status](https://img.shields.io/coveralls/strongloop/express.svg?style=flat)](https://coveralls.io/r/strongloop/express)
-  [![Gittip](https://img.shields.io/gittip/dougwilson.svg?style=flat)](https://www.gittip.com/dougwilson/)
+  [![Gratipay](https://img.shields.io/gratipay/dougwilson.svg?style=flat)](https://gratipay.com/dougwilson/)
 
 ```js
 var express = require('express');

From c163d2f33d7aa45746d4cf399b2d5b4d99db21c5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Jan 2015 21:18:56 -0500
Subject: [PATCH 0693/1265] deps: connect@2.28.1

---
 History.md   | 19 +++++++++++++++++++
 package.json |  2 +-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 706d453b85a..ffb3c49297b 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,22 @@
+3.x
+===
+
+  * deps: connect@2.28.1
+    - deps: body-parser@~1.10.1
+    - deps: compression@~1.3.0
+    - deps: connect-timeout@~1.5.0
+    - deps: csurf@~1.6.4
+    - deps: debug@~2.1.1
+    - deps: errorhandler@~1.3.2
+    - deps: express-session@~1.10.1
+    - deps: finalhandler@0.3.3
+    - deps: method-override@~2.3.1
+    - deps: morgan@~1.5.1
+    - deps: serve-favicon@~2.2.0
+    - deps: serve-index@~1.6.0
+    - deps: serve-static@~1.8.0
+    - deps: type-is@~1.5.5
+
 3.18.6 / 2014-12-12
 ===================
 
diff --git a/package.json b/package.json
index 80f4cdfe01e..e156e15706d 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.27.6",
+    "connect": "2.28.1",
     "content-disposition": "0.5.0",
     "commander": "1.3.2",
     "cookie-signature": "1.0.5",

From 33e4193f454ea8df41be0136f3900e29aded97b1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Jan 2015 21:24:28 -0500
Subject: [PATCH 0694/1265] deps: should@~4.4.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e156e15706d..4e045b3d0ea 100644
--- a/package.json
+++ b/package.json
@@ -52,7 +52,7 @@
     "connect-redis": "~1.5.0",
     "istanbul": "0.3.5",
     "mocha": "~2.0.0",
-    "should": "~4.3.1",
+    "should": "~4.4.4",
     "supertest": "~0.15.0",
     "ejs": "~1.0.0",
     "hjs": "~0.0.6",

From 2dd332b4912d19d77f4d6672507636fb388b3f50 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Jan 2015 21:25:17 -0500
Subject: [PATCH 0695/1265] deps: mocha@~2.1.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 4e045b3d0ea..01ecc93e9f4 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
   "devDependencies": {
     "connect-redis": "~1.5.0",
     "istanbul": "0.3.5",
-    "mocha": "~2.0.0",
+    "mocha": "~2.1.0",
     "should": "~4.4.4",
     "supertest": "~0.15.0",
     "ejs": "~1.0.0",

From 224fe056973abf69fef2f17d2881f9014c5b817a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Jan 2015 21:31:32 -0500
Subject: [PATCH 0696/1265] deps: methods@~1.1.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ffb3c49297b..784f165a290 100644
--- a/History.md
+++ b/History.md
@@ -16,6 +16,7 @@
     - deps: serve-index@~1.6.0
     - deps: serve-static@~1.8.0
     - deps: type-is@~1.5.5
+  * deps: methods@~1.1.1
 
 3.18.6 / 2014-12-12
 ===================
diff --git a/package.json b/package.json
index 01ecc93e9f4..e1394cee430 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "etag": "~1.5.1",
     "fresh": "0.2.4",
     "media-typer": "0.3.0",
-    "methods": "1.1.0",
+    "methods": "~1.1.1",
     "mkdirp": "0.5.0",
     "parseurl": "~1.3.0",
     "proxy-addr": "~1.0.4",

From 1afcff955b6b3606c08bbee85b5616953da4d0d6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Jan 2015 22:14:46 -0500
Subject: [PATCH 0697/1265] deps: proxy-addr@~1.0.5

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 784f165a290..82354be189f 100644
--- a/History.md
+++ b/History.md
@@ -17,6 +17,8 @@
     - deps: serve-static@~1.8.0
     - deps: type-is@~1.5.5
   * deps: methods@~1.1.1
+  * deps: proxy-addr@~1.0.5
+    - deps: ipaddr.js@0.1.6
 
 3.18.6 / 2014-12-12
 ===================
diff --git a/package.json b/package.json
index e1394cee430..27782ce4fb4 100644
--- a/package.json
+++ b/package.json
@@ -40,7 +40,7 @@
     "methods": "~1.1.1",
     "mkdirp": "0.5.0",
     "parseurl": "~1.3.0",
-    "proxy-addr": "~1.0.4",
+    "proxy-addr": "~1.0.5",
     "range-parser": "~1.0.2",
     "send": "0.10.1",
     "utils-merge": "1.0.0",

From 192be8fea33489de9982e21e79f9077ab8b3a3a0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Jan 2015 22:15:53 -0500
Subject: [PATCH 0698/1265] deps: send@0.11.0

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 82354be189f..5d681e2a952 100644
--- a/History.md
+++ b/History.md
@@ -19,6 +19,11 @@
   * deps: methods@~1.1.1
   * deps: proxy-addr@~1.0.5
     - deps: ipaddr.js@0.1.6
+  * deps: send@0.11.0
+    - deps: debug@~2.1.1
+    - deps: etag@~1.5.1
+    - deps: ms@0.7.0
+    - deps: on-finished@~2.2.0
 
 3.18.6 / 2014-12-12
 ===================
diff --git a/package.json b/package.json
index 27782ce4fb4..351b56c03fc 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
     "parseurl": "~1.3.0",
     "proxy-addr": "~1.0.5",
     "range-parser": "~1.0.2",
-    "send": "0.10.1",
+    "send": "0.11.0",
     "utils-merge": "1.0.0",
     "vary": "~1.0.0",
     "cookie": "0.1.2",

From 3a1d9b8289884c7d4cb4de8ef9b7dc9a64fa2308 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Jan 2015 22:17:19 -0500
Subject: [PATCH 0699/1265] deps: ejs@2.0.8

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 351b56c03fc..f6c98079ab1 100644
--- a/package.json
+++ b/package.json
@@ -50,11 +50,11 @@
   },
   "devDependencies": {
     "connect-redis": "~1.5.0",
+    "ejs": "2.0.8",
     "istanbul": "0.3.5",
     "mocha": "~2.1.0",
     "should": "~4.4.4",
     "supertest": "~0.15.0",
-    "ejs": "~1.0.0",
     "hjs": "~0.0.6",
     "marked": "0.3.2"
   },

From ec1175daa3700e236814d3f67fc0c851fe71e9dc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Jan 2015 22:21:50 -0500
Subject: [PATCH 0700/1265] Use readline for prompt in express(1)

---
 History.md  |  1 +
 bin/express | 19 ++++++++++++++++++-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5d681e2a952..a9c0a3c8d3e 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 3.x
 ===
 
+  * Use `readline` for prompt in `express(1)`
   * deps: connect@2.28.1
     - deps: body-parser@~1.10.1
     - deps: compression@~1.3.0
diff --git a/bin/express b/bin/express
index a95df72841b..b060062e93d 100755
--- a/bin/express
+++ b/bin/express
@@ -7,6 +7,7 @@
 var program = require('commander')
   , mkdirp = require('mkdirp')
   , pkg = require('../package.json')
+  , readline = require('readline')
   , version = pkg.version
   , os = require('os')
   , fs = require('fs');
@@ -249,7 +250,7 @@ var app = [
     if (empty || program.force) {
       createApplicationAt(path);
     } else {
-      program.confirm('destination is not empty, continue? ', function(ok){
+      confirm('destination is not empty, continue? [y/N] ', function (ok) {
         if (ok) {
           process.stdin.destroy();
           createApplicationAt(path);
@@ -261,6 +262,22 @@ var app = [
   });
 })(path);
 
+/**
+ * Prompt for confirmation on STDOUT/STDIN
+ */
+
+function confirm(msg, callback) {
+  var rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+
+  rl.question(msg, function (input) {
+    rl.close();
+    callback(/^y|yes|ok|true$/i.test(input));
+  });
+}
+
 /**
  * Create application at the given directory `path`.
  *

From b0f8809e3d7940cdf2b1a728c5e1d70b786588bc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Jan 2015 22:23:04 -0500
Subject: [PATCH 0701/1265] deps: commander@2.6.0

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a9c0a3c8d3e..db029f144c1 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@
 ===
 
   * Use `readline` for prompt in `express(1)`
+  * deps: commander@2.6.0
   * deps: connect@2.28.1
     - deps: body-parser@~1.10.1
     - deps: compression@~1.3.0
diff --git a/package.json b/package.json
index f6c98079ab1..b7260d56c72 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
     "basic-auth": "1.0.0",
     "connect": "2.28.1",
     "content-disposition": "0.5.0",
-    "commander": "1.3.2",
+    "commander": "2.6.0",
     "cookie-signature": "1.0.5",
     "debug": "~2.1.0",
     "depd": "~1.0.0",

From 11529a2ea0294e548abae5201eae9ce5bdbb930e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Jan 2015 23:30:42 -0500
Subject: [PATCH 0702/1265] Fix OPTIONS responses to include the HEAD method
 property

fixes #2459
---
 History.md          |  1 +
 lib/router/index.js | 35 +++++++++++++++++++++++++----------
 test/app.options.js |  8 ++++----
 3 files changed, 30 insertions(+), 14 deletions(-)

diff --git a/History.md b/History.md
index db029f144c1..91ea64bc0ea 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 3.x
 ===
 
+  * Fix `OPTIONS` responses to include the `HEAD` method property
   * Use `readline` for prompt in `express(1)`
   * deps: commander@2.6.0
   * deps: connect@2.28.1
diff --git a/lib/router/index.js b/lib/router/index.js
index 79997c6f701..a6bf8a82141 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -196,17 +196,32 @@ Router.prototype._options = function(req, res, next){
  * @api private
  */
 
-Router.prototype._optionsFor = function(path){
-  var self = this;
-  return methods.filter(function(method){
-    var routes = self.map[method];
-    if (!routes || 'options' == method) return;
-    for (var i = 0, len = routes.length; i < len; ++i) {
-      if (routes[i].match(path)) return true;
+Router.prototype._optionsFor = function _optionsFor(path) {
+  var options = [];
+
+  for (var i = 0; i < methods.length; i++) {
+    var method = methods[i];
+
+    if (method === 'options') continue;
+
+    var routes = this.map[method];
+
+    // HEAD methods include GET routes
+    if (!routes && method === 'head') {
+      routes = this.map.get;
     }
-  }).map(function(method){
-    return method.toUpperCase();
-  });
+
+    if (!routes) continue;
+
+    for (var j = 0; j < routes.length; j++) {
+      if (routes[j].match(path)) {
+        options.push(method.toUpperCase());
+        break;
+      }
+    }
+  }
+
+  return options.sort();
 };
 
 /**
diff --git a/test/app.options.js b/test/app.options.js
index 9a9852a7445..790a8925773 100644
--- a/test/app.options.js
+++ b/test/app.options.js
@@ -12,8 +12,8 @@ describe('OPTIONS', function(){
 
     request(app)
     .options('/users')
-    .expect('GET,PUT')
-    .expect('Allow', 'GET,PUT', done);
+    .expect('GET,HEAD,PUT')
+    .expect('Allow', 'GET,HEAD,PUT', done);
   })
 
   it('should not respond if the path is not defined', function(done){
@@ -36,8 +36,8 @@ describe('OPTIONS', function(){
 
     request(app)
     .options('/other')
-    .expect('GET')
-    .expect('Allow', 'GET', done);
+    .expect('GET,HEAD')
+    .expect('Allow', 'GET,HEAD', done);
   })
 })
 

From 34b6385dc3d3a745732b87bfba4c730c6e397bc2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 9 Jan 2015 01:05:41 -0500
Subject: [PATCH 0703/1265] deps: debug@~2.1.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 91ea64bc0ea..d1075f0ebbf 100644
--- a/History.md
+++ b/History.md
@@ -19,6 +19,7 @@
     - deps: serve-index@~1.6.0
     - deps: serve-static@~1.8.0
     - deps: type-is@~1.5.5
+  * deps: debug@~2.1.1
   * deps: methods@~1.1.1
   * deps: proxy-addr@~1.0.5
     - deps: ipaddr.js@0.1.6
diff --git a/package.json b/package.json
index b7260d56c72..10d5350d1f7 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,7 @@
     "content-disposition": "0.5.0",
     "commander": "2.6.0",
     "cookie-signature": "1.0.5",
-    "debug": "~2.1.0",
+    "debug": "~2.1.1",
     "depd": "~1.0.0",
     "escape-html": "1.0.1",
     "etag": "~1.5.1",

From ee3f2b073cbd947a5108b0ed68faf8172a4af2ca Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 9 Jan 2015 01:07:12 -0500
Subject: [PATCH 0704/1265] 3.19.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index d1075f0ebbf..5a7edc26496 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.19.0 / 2015-01-09
+===================
 
   * Fix `OPTIONS` responses to include the `HEAD` method property
   * Use `readline` for prompt in `express(1)`
diff --git a/package.json b/package.json
index 10d5350d1f7..6e97a65db3f 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.18.6",
+  "version": "3.19.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From a3658642291b48dc948809a01e795c3455636caf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 11 Jan 2015 12:09:34 -0500
Subject: [PATCH 0705/1265] deps: proxy-addr@~1.0.5

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 20a7b43566f..3e913c99385 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: proxy-addr@~1.0.5
+    - deps: ipaddr.js@0.1.6
+
 4.10.7 / 2015-01-04
 ===================
 
diff --git a/package.json b/package.json
index 5ea14e218f6..bcb1e2f8c0c 100644
--- a/package.json
+++ b/package.json
@@ -41,7 +41,7 @@
     "on-finished": "~2.2.0",
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
-    "proxy-addr": "~1.0.4",
+    "proxy-addr": "~1.0.5",
     "qs": "2.3.3",
     "range-parser": "~1.0.2",
     "send": "0.10.1",

From 4070dabe532ecb799445920cf9756eb6625a0254 Mon Sep 17 00:00:00 2001
From: Sung Kim <jstkim7@gmail.com>
Date: Sat, 10 Jan 2015 07:32:40 -0500
Subject: [PATCH 0706/1265] Fix typo in comment

closes #2493
---
 lib/middleware/init.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/middleware/init.js b/lib/middleware/init.js
index c09cf0c69c4..1e3e903f04f 100644
--- a/lib/middleware/init.js
+++ b/lib/middleware/init.js
@@ -1,6 +1,6 @@
 /**
  * Initialization middleware, exposing the
- * request and response to eachother, as well
+ * request and response to each other, as well
  * as defaulting the X-Powered-By header field.
  *
  * @param {Function} app

From dab9222942cb9f7c3ff17abad4e0f6137c9e2cfc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Jan 2015 18:00:49 -0500
Subject: [PATCH 0707/1265] Fix crash from error within OPTIONS response
 handler

fixes #2494
---
 History.md          |  1 +
 lib/router/index.js | 15 ++++++++++++---
 test/app.options.js | 22 ++++++++++++++++++++++
 3 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 3e913c99385..8e7daf21854 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix crash from error within `OPTIONS` response handler
   * deps: proxy-addr@~1.0.5
     - deps: ipaddr.js@0.1.6
 
diff --git a/lib/router/index.js b/lib/router/index.js
index 488713915e9..37e3083fb76 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -152,9 +152,7 @@ proto.handle = function(req, res, done) {
   if (req.method === 'OPTIONS') {
     done = wrap(done, function(old, err) {
       if (err || options.length === 0) return old(err);
-
-      var body = options.join(',');
-      return res.set('Allow', body).send(body);
+      sendOptionsResponse(res, options, old);
     });
   }
 
@@ -571,6 +569,17 @@ function restore(fn, obj) {
   };
 }
 
+// send an OPTIONS response
+function sendOptionsResponse(res, options, next) {
+  try {
+    var body = options.join(',');
+    res.set('Allow', body);
+    res.send(body);
+  } catch (err) {
+    next(err);
+  }
+}
+
 // wrap a function
 function wrap(old, fn) {
   return function proxy() {
diff --git a/test/app.options.js b/test/app.options.js
index 3d484ef17d0..30890c05519 100644
--- a/test/app.options.js
+++ b/test/app.options.js
@@ -71,6 +71,28 @@ describe('OPTIONS', function(){
     .expect('GET')
     .expect('Allow', 'GET', done);
   })
+
+  describe('when error occurs in respone handler', function () {
+    it('should pass error to callback', function (done) {
+      var app = express();
+      var router = express.Router();
+
+      router.get('/users', function(req, res){});
+
+      app.use(function (req, res, next) {
+        res.writeHead(200);
+        next();
+      });
+      app.use(router);
+      app.use(function (err, req, res, next) {
+        res.end('true');
+      });
+
+      request(app)
+      .options('/users')
+      .expect(200, 'true', done)
+    })
+  })
 })
 
 describe('app.options()', function(){

From 55699bee8f69c9f711a340e6a9d335a7a7bc90d7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Jan 2015 18:57:16 -0500
Subject: [PATCH 0708/1265] deps: update example dependencies

---
 package.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index bcb1e2f8c0c..b9d1555191a 100644
--- a/package.json
+++ b/package.json
@@ -61,14 +61,14 @@
     "ejs": "~1.0.0",
     "marked": "0.3.2",
     "hjs": "~0.0.6",
-    "body-parser": "~1.9.3",
+    "body-parser": "~1.10.1",
     "connect-redis": "~2.1.0",
     "cookie-parser": "~1.3.3",
     "express-session": "~1.9.2",
-    "jade": "~1.7.0",
-    "method-override": "~2.3.0",
-    "morgan": "~1.5.0",
-    "multiparty": "~4.0.0",
+    "jade": "~1.8.2",
+    "method-override": "~2.3.1",
+    "morgan": "~1.5.1",
+    "multiparty": "~4.1.0",
     "vhost": "~3.0.0"
   },
   "engines": {

From 08939683c7a2e5d7dc928d310ebab65878bffff3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 Jan 2015 12:38:09 -0500
Subject: [PATCH 0709/1265] 4.10.8

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 8e7daf21854..7834fffc0de 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.10.8 / 2015-01-13
+===================
 
   * Fix crash from error within `OPTIONS` response handler
   * deps: proxy-addr@~1.0.5
diff --git a/package.json b/package.json
index b9d1555191a..7eba07aec60 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.10.7",
+  "version": "4.10.8",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From fc4eb6dae01c32fba0af8b67663511583cb3ba5a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 23 Nov 2014 22:30:58 -0500
Subject: [PATCH 0710/1265] Deprecate leading colon in name for app.param

closes #2430
---
 History.md          | 5 +++++
 lib/router/index.js | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/History.md b/History.md
index 7834fffc0de..46f935c5fd7 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Deprecate leading `:` in `name` for `app.param(name, fn)`
+
 4.10.8 / 2015-01-13
 ===================
 
diff --git a/lib/router/index.js b/lib/router/index.js
index 37e3083fb76..4a0a14700d7 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -8,6 +8,7 @@ var Layer = require('./layer');
 var methods = require('methods');
 var mixin = require('utils-merge');
 var debug = require('debug')('express:router');
+var deprecate = require('depd')('express');
 var parseUrl = require('parseurl');
 var utils = require('../utils');
 
@@ -94,6 +95,7 @@ proto.param = function(name, fn){
   var ret;
 
   if (name[0] === ':') {
+    deprecate('name with leading colon: remove leading colon from ' + JSON.stringify(name));
     name = name.substr(1);
   }
 

From 935f05bc8431a0700f737c679aa97d270794c7a5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 Jan 2015 13:26:19 -0500
Subject: [PATCH 0711/1265] Fix OPTIONS responses to include the HEAD method
 properly

fixes #2459
---
 History.md          |  1 +
 lib/router/route.js | 18 ++++++++++++++----
 test/app.options.js | 16 ++++++++--------
 3 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/History.md b/History.md
index 46f935c5fd7..5fddc5792a8 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Deprecate leading `:` in `name` for `app.param(name, fn)`
+  * Fix `OPTIONS` responses to include the `HEAD` method properly
 
 4.10.8 / 2015-01-13
 ===================
diff --git a/lib/router/route.js b/lib/router/route.js
index 903d1a5e218..6213b821704 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -52,10 +52,20 @@ Route.prototype._handles_method = function _handles_method(method) {
  * @api private
  */
 
-Route.prototype._options = function(){
-  return Object.keys(this.methods).map(function(method) {
-    return method.toUpperCase();
-  });
+Route.prototype._options = function _options() {
+  var methods = Object.keys(this.methods);
+
+  // append automatic head
+  if (this.methods.get && !this.methods.head) {
+    methods.push('head');
+  }
+
+  for (var i = 0; i < methods.length; i++) {
+    // make upper case
+    methods[i] = methods[i].toUpperCase();
+  }
+
+  return methods;
 };
 
 /**
diff --git a/test/app.options.js b/test/app.options.js
index 30890c05519..20234723a57 100644
--- a/test/app.options.js
+++ b/test/app.options.js
@@ -12,8 +12,8 @@ describe('OPTIONS', function(){
 
     request(app)
     .options('/users')
-    .expect('GET,PUT')
-    .expect('Allow', 'GET,PUT', done);
+    .expect('Allow', 'GET,HEAD,PUT')
+    .expect(200, 'GET,HEAD,PUT', done);
   })
 
   it('should only include each method once', function(done){
@@ -26,8 +26,8 @@ describe('OPTIONS', function(){
 
     request(app)
     .options('/users')
-    .expect('GET,PUT')
-    .expect('Allow', 'GET,PUT', done);
+    .expect('Allow', 'GET,HEAD,PUT')
+    .expect(200, 'GET,HEAD,PUT', done);
   })
 
   it('should not be affected by app.all', function(done){
@@ -44,8 +44,8 @@ describe('OPTIONS', function(){
     request(app)
     .options('/users')
     .expect('x-hit', '1')
-    .expect('allow', 'GET,PUT')
-    .expect(200, 'GET,PUT', done);
+    .expect('Allow', 'GET,HEAD,PUT')
+    .expect(200, 'GET,HEAD,PUT', done);
   })
 
   it('should not respond if the path is not defined', function(done){
@@ -68,8 +68,8 @@ describe('OPTIONS', function(){
 
     request(app)
     .options('/other')
-    .expect('GET')
-    .expect('Allow', 'GET', done);
+    .expect('Allow', 'GET,HEAD')
+    .expect(200, 'GET,HEAD', done);
   })
 
   describe('when error occurs in respone handler', function () {

From 5312a990b920d5ce1313fafaebcac2d440146c16 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 Jan 2015 15:01:32 -0500
Subject: [PATCH 0712/1265] Fix res.sendFile not always detecting aborted
 connection

fixes #2489
---
 History.md      |  1 +
 lib/response.js | 31 ++++++++++++++++++-------------
 2 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/History.md b/History.md
index 5fddc5792a8..9128b16609a 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,7 @@ unreleased
 
   * Deprecate leading `:` in `name` for `app.param(name, fn)`
   * Fix `OPTIONS` responses to include the `HEAD` method properly
+  * Fix `res.sendFile` not always detecting aborted connection
 
 4.10.8 / 2015-01-13
 ===================
diff --git a/lib/response.js b/lib/response.js
index 87d1dc5d0a1..7d6575c192d 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -907,7 +907,17 @@ res.render = function(view, options, fn){
 // pipe the send file stream
 function sendfile(res, file, options, callback) {
   var done = false;
-  var streaming = false;
+  var streaming;
+
+  // request aborted
+  function onaborted() {
+    if (done) return;
+    done = true;
+
+    var err = new Error('Request aborted');
+    err.code = 'ECONNABORT';
+    callback(err);
+  }
 
   // directory
   function ondirectory() {
@@ -921,7 +931,6 @@ function sendfile(res, file, options, callback) {
 
   // errors
   function onerror(err) {
-    if (!err) return;
     if (done) return;
     done = true;
     callback(err);
@@ -936,7 +945,7 @@ function sendfile(res, file, options, callback) {
 
   // file
   function onfile() {
-    onFinished(res, onfinish);
+    streaming = false;
   }
 
   // finished
@@ -945,18 +954,14 @@ function sendfile(res, file, options, callback) {
     if (done) return;
 
     setImmediate(function () {
-      if (done) return;
-      done = true;
-
-      if (!streaming) {
-        callback();
+      if (streaming !== false && !done) {
+        onaborted();
         return;
       }
 
-      // response finished before end of file
-      var err = new Error('Request aborted');
-      err.code = 'ECONNABORT';
-      callback(err);
+      if (done) return;
+      done = true;
+      callback();
     });
   }
 
@@ -970,7 +975,7 @@ function sendfile(res, file, options, callback) {
   file.on('error', onerror);
   file.on('file', onfile);
   file.on('stream', onstream);
-  onFinished(res, onerror);
+  onFinished(res, onfinish);
 
   if (options.headers) {
     // set headers on successful transfer

From ec8daf0e7b020e5e597e7d7f85c88179a29a09cb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 24 Oct 2014 01:04:41 -0400
Subject: [PATCH 0713/1265] Match routes iteratively to prevent stack overflows

fixes #2412
---
 History.md          |   1 +
 lib/router/index.js | 168 ++++++++++++++++++++++++++------------------
 test/Router.js      |  15 ++++
 3 files changed, 116 insertions(+), 68 deletions(-)

diff --git a/History.md b/History.md
index 9128b16609a..2e5245c8e36 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,7 @@ unreleased
   * Deprecate leading `:` in `name` for `app.param(name, fn)`
   * Fix `OPTIONS` responses to include the `HEAD` method properly
   * Fix `res.sendFile` not always detecting aborted connection
+  * Match routes iteratively to prevent stack overflows
 
 4.10.8 / 2015-01-13
 ===================
diff --git a/lib/router/index.js b/lib/router/index.js
index 4a0a14700d7..7f66579ab03 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -169,74 +169,104 @@ proto.handle = function(req, res, done) {
       ? null
       : err;
 
-    var layer = stack[idx++];
-
+    // remove added slash
     if (slashAdded) {
       req.url = req.url.substr(1);
       slashAdded = false;
     }
 
+    // restore altered req.url
     if (removed.length !== 0) {
       req.baseUrl = parentUrl;
       req.url = protohost + removed + req.url.substr(protohost.length);
       removed = '';
     }
 
-    if (!layer) {
+    // no more matching layers
+    if (idx >= stack.length) {
       setImmediate(done, layerError);
       return;
     }
 
-    self.match_layer(layer, req, res, function (err, path) {
-      if (err || path === undefined) {
-        return next(layerError || err);
+    // get pathname of request
+    var path = getPathname(req);
+
+    if (path == null) {
+      return done(layerError);
+    }
+
+    // find next matching layer
+    var layer;
+    var match;
+    var route;
+
+    while (match !== true && idx < stack.length) {
+      layer = stack[idx++];
+      match = matchLayer(layer, path);
+      route = layer.route;
+
+      if (typeof match !== 'boolean') {
+        // hold on to layerError
+        layerError = layerError || match;
       }
 
-      // route object and not middleware
-      var route = layer.route;
+      if (match !== true) {
+        continue;
+      }
 
-      // if final route, then we support options
-      if (route) {
-        // we don't run any routes with error first
-        if (layerError) {
-          return next(layerError);
-        }
-
-        var method = req.method;
-        var has_method = route._handles_method(method);
-
-        // build up automatic options response
-        if (!has_method && method === 'OPTIONS') {
-          appendMethods(options, route._options());
-        }
-
-        // don't even bother
-        if (!has_method && method !== 'HEAD') {
-          return next();
-        }
-
-        // we can now dispatch to the route
-        req.route = route;
+      if (!route) {
+        // process non-route handlers normally
+        continue;
       }
 
-      // Capture one-time layer values
-      req.params = self.mergeParams
-        ? mergeParams(layer.params, parentParams)
-        : layer.params;
-      var layerPath = layer.path;
+      if (layerError) {
+        // routes do not match with a pending error
+        match = false;
+        continue;
+      }
 
-      // this should be done for the layer
-      self.process_params(layer, paramcalled, req, res, function (err) {
-        if (err) {
-          return next(layerError || err);
-        }
+      var method = req.method;
+      var has_method = route._handles_method(method);
 
-        if (route) {
-          return layer.handle_request(req, res, next);
-        }
+      // build up automatic options response
+      if (!has_method && method === 'OPTIONS') {
+        appendMethods(options, route._options());
+      }
+
+      // don't even bother matching route
+      if (!has_method && method !== 'HEAD') {
+        match = false;
+        continue;
+      }
+    }
 
-        trim_prefix(layer, layerError, layerPath, path);
-      });
+    // no match
+    if (match !== true) {
+      return done(layerError);
+    }
+
+    // store route for dispatch on change
+    if (route) {
+      req.route = route;
+    }
+
+    // Capture one-time layer values
+    req.params = self.mergeParams
+      ? mergeParams(layer.params, parentParams)
+      : layer.params;
+    var layerPath = layer.path;
+
+    // this should be done for the layer
+    self.process_params(layer, paramcalled, req, res, function (err) {
+      if (err) {
+        return next(layerError || err);
+      }
+
+      if (route) {
+        return layer.handle_request(req, res, next);
+      }
+
+      trim_prefix(layer, layerError, layerPath, path);
     });
   }
 
@@ -273,29 +303,6 @@ proto.handle = function(req, res, done) {
   }
 };
 
-/**
- * Match request to a layer.
- *
- * @api private
- */
-
-proto.match_layer = function match_layer(layer, req, res, done) {
-  var error = null;
-  var path;
-
-  try {
-    path = parseUrl(req).pathname;
-
-    if (!layer.match(path)) {
-      path = undefined;
-    }
-  } catch (err) {
-    error = err;
-  }
-
-  done(error, path);
-};
-
 /**
  * Process any parameters for the layer.
  *
@@ -502,6 +509,15 @@ function appendMethods(list, addition) {
   }
 }
 
+// get pathname of request
+function getPathname(req) {
+  try {
+    return parseUrl(req).pathname;
+  } catch (err) {
+    return undefined;
+  }
+}
+
 // get type for error message
 function gettype(obj) {
   var type = typeof obj;
@@ -515,6 +531,22 @@ function gettype(obj) {
     .replace(objectRegExp, '$1');
 }
 
+/**
+ * Match path to a layer.
+ *
+ * @param {Layer} layer
+ * @param {string} path
+ * @private
+ */
+
+function matchLayer(layer, path) {
+  try {
+    return layer.match(path);
+  } catch (err) {
+    return err;
+  }
+}
+
 // merge params with parent params
 function mergeParams(params, parent) {
   if (typeof parent !== 'object' || !parent) {
diff --git a/test/Router.js b/test/Router.js
index 880d34b8d53..21cdff2c6c0 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -53,6 +53,21 @@ describe('Router', function(){
     router.handle({ url: '', method: 'GET' }, {}, done);
   });
 
+  it('should not stack overflow with many registered routes', function(done){
+    var handler = function(req, res){ res.end(new Error('wrong handler')) };
+    var router = new Router();
+
+    for (var i = 0; i < 6000; i++) {
+      router.get('/thing' + i, handler)
+    }
+
+    router.get('/', function (req, res) {
+      res.end();
+    });
+
+    router.handle({ url: '/', method: 'GET' }, { end: done });
+  });
+
   describe('.handle', function(){
     it('should dispatch', function(done){
       var router = new Router();

From 4db51fbeba0cd543949e243672c0e6c3c3c70639 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 Jan 2015 19:17:33 -0500
Subject: [PATCH 0714/1265] Deprecate req.param()

closes #2440
---
 History.md     | 1 +
 lib/request.js | 9 ++++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 2e5245c8e36..7136573f60b 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Deprecate leading `:` in `name` for `app.param(name, fn)`
+  * Deprecate `req.param()` -- use `req.params`, `req.body`, or `req.query` instead
   * Fix `OPTIONS` responses to include the `HEAD` method properly
   * Fix `res.sendFile` not always detecting aborted connection
   * Match routes iteratively to prevent stack overflows
diff --git a/lib/request.js b/lib/request.js
index 36ce1938683..5cd3900ee04 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -200,13 +200,20 @@ req.range = function(size){
  * @api public
  */
 
-req.param = function(name, defaultValue){
+req.param = function param(name, defaultValue) {
   var params = this.params || {};
   var body = this.body || {};
   var query = this.query || {};
+
+  var args = arguments.length === 1
+    ? 'name'
+    : 'name, default';
+  deprecate('req.param(' + args + '): Use req.params, req.body, or req.query instead');
+
   if (null != params[name] && params.hasOwnProperty(name)) return params[name];
   if (null != body[name]) return body[name];
   if (null != query[name]) return query[name];
+
   return defaultValue;
 };
 

From 1616079a2d8fbfbcd29b1b4ac1208df7621432d7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 Jan 2015 19:27:17 -0500
Subject: [PATCH 0715/1265] Improve deprecation message for router.param()

---
 lib/router/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/router/index.js b/lib/router/index.js
index 7f66579ab03..51f2ad31056 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -95,7 +95,7 @@ proto.param = function(name, fn){
   var ret;
 
   if (name[0] === ':') {
-    deprecate('name with leading colon: remove leading colon from ' + JSON.stringify(name));
+    deprecate('router.param(' + JSON.stringify(name) + ', fn): Use router.param(' + JSON.stringify(name.substr(1)) + ', fn) instead');
     name = name.substr(1);
   }
 

From 591e89ed1890c3f519c9a732e164e64e758f6dbb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 Jan 2015 19:28:06 -0500
Subject: [PATCH 0716/1265] Deprecate app.param(fn)

closes #2429
---
 History.md          | 1 +
 lib/router/index.js | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 7136573f60b..5aa328a8199 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,7 @@ unreleased
 
   * Deprecate leading `:` in `name` for `app.param(name, fn)`
   * Deprecate `req.param()` -- use `req.params`, `req.body`, or `req.query` instead
+  * Deprecate `app.param(fn)`
   * Fix `OPTIONS` responses to include the `HEAD` method properly
   * Fix `res.sendFile` not always detecting aborted connection
   * Match routes iteratively to prevent stack overflows
diff --git a/lib/router/index.js b/lib/router/index.js
index 51f2ad31056..209f881b1eb 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -82,9 +82,10 @@ var proto = module.exports = function(options) {
  * @api public
  */
 
-proto.param = function(name, fn){
+proto.param = function param(name, fn) {
   // param logic
-  if ('function' == typeof name) {
+  if (typeof name === 'function') {
+    deprecate('router.param(fn): Refactor to use path params');
     this._params.push(name);
     return;
   }

From f6f78e5f02afb874e916af27e30f56e82e23878c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 Jan 2015 21:05:43 -0500
Subject: [PATCH 0717/1265] Add res.append(field, val) to append headers

closes #2455
---
 History.md         |   1 +
 lib/response.js    |  29 +++++++++++++
 test/res.append.js | 104 +++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 134 insertions(+)
 create mode 100644 test/res.append.js

diff --git a/History.md b/History.md
index 5aa328a8199..38d5f50b1a5 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Add `res.append(field, val)` to append headers
   * Deprecate leading `:` in `name` for `app.param(name, fn)`
   * Deprecate `req.param()` -- use `req.params`, `req.body`, or `req.query` instead
   * Deprecate `app.param(fn)`
diff --git a/lib/response.js b/lib/response.js
index 7d6575c192d..50c313eb461 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -636,6 +636,35 @@ res.attachment = function attachment(filename) {
   return this;
 };
 
+/**
+ * Append additional header `field` with value `val`.
+ *
+ * Example:
+ *
+ *    res.append('Link', ['<http://localhost/>', '<http://localhost:3000/>']);
+ *    res.append('Set-Cookie', 'foo=bar; Path=/; HttpOnly');
+ *    res.append('Warning', '199 Miscellaneous warning');
+ *
+ * @param {String} field
+ * @param {String|Array} val
+ * @return {ServerResponse} for chaining
+ * @api public
+ */
+
+res.append = function append(field, val) {
+  var prev = this.get(field);
+  var value = val;
+
+  if (prev) {
+    // concat the new and prev vals
+    value = Array.isArray(prev) ? prev.concat(val)
+      : Array.isArray(val) ? [prev].concat(val)
+      : [prev, val];
+  }
+
+  return this.set(field, value);
+};
+
 /**
  * Set header `field` to `val`, or pass
  * an object of header fields.
diff --git a/test/res.append.js b/test/res.append.js
new file mode 100644
index 00000000000..f7f1d55b3cb
--- /dev/null
+++ b/test/res.append.js
@@ -0,0 +1,104 @@
+
+var express = require('..')
+var request = require('supertest')
+var should = require('should')
+
+describe('res', function () {
+  // note about these tests: "Link" and "X-*" are chosen because
+  // the common node.js versions white list which _incoming_
+  // headers can appear multiple times; there is no such white list
+  // for outgoing, though
+  describe('.append(field, val)', function () {
+    it('should append multiple headers', function (done) {
+      var app = express()
+
+      app.use(function (req, res, next) {
+        res.append('Link', '<http://localhost/>')
+        next()
+      })
+
+      app.use(function (req, res) {
+        res.append('Link', '<http://localhost:80/>')
+        res.end()
+      })
+
+      request(app)
+      .get('/')
+      .expect('Link', '<http://localhost/>, <http://localhost:80/>', done)
+    })
+
+    it('should accept array of values', function (done) {
+      var app = express()
+
+      app.use(function (req, res, next) {
+        res.append('Set-Cookie', ['foo=bar', 'fizz=buzz'])
+        res.end()
+      })
+
+      request(app)
+      .get('/')
+      .expect(function (res) {
+        should(res.headers['set-cookie']).eql(['foo=bar', 'fizz=buzz'])
+      })
+      .expect(200, done)
+    })
+
+    it('should get reset by res.set(field, val)', function (done) {
+      var app = express()
+
+      app.use(function (req, res, next) {
+        res.append('Link', '<http://localhost/>')
+        res.append('Link', '<http://localhost:80/>')
+        next()
+      })
+
+      app.use(function (req, res) {
+        res.set('Link', '<http://127.0.0.1/>')
+        res.end()
+      });
+
+      request(app)
+      .get('/')
+      .expect('Link', '<http://127.0.0.1/>', done)
+    })
+
+    it('should work with res.set(field, val) first', function (done) {
+      var app = express()
+
+      app.use(function (req, res, next) {
+        res.set('Link', '<http://localhost/>')
+        next()
+      })
+
+      app.use(function(req, res){
+        res.append('Link', '<http://localhost:80/>')
+        res.end()
+      })
+
+      request(app)
+      .get('/')
+      .expect('Link', '<http://localhost/>, <http://localhost:80/>', done)
+    })
+
+    it('should work with cookies', function (done) {
+      var app = express()
+
+      app.use(function (req, res, next) {
+        res.cookie('foo', 'bar')
+        next()
+      })
+
+      app.use(function (req, res) {
+        res.append('Set-Cookie', 'bar=baz')
+        res.end()
+      })
+
+      request(app)
+      .get('/')
+      .expect(function (res) {
+        should(res.headers['set-cookie']).eql(['foo=bar; Path=/', 'bar=baz'])
+      })
+      .expect(200, done)
+    })
+  })
+})

From 0b1cacff03d92189f897c6d41732d569d583fd56 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 Jan 2015 22:16:00 -0500
Subject: [PATCH 0718/1265] deps: accepts@~1.2.2

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c16b4d60a75..62b89233b9e 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,9 @@ unreleased
   * Fix `OPTIONS` responses to include the `HEAD` method properly
   * Fix `res.sendFile` not always detecting aborted connection
   * Match routes iteratively to prevent stack overflows
+  * deps: accepts@~1.2.2
+    - deps: mime-types@~2.0.7
+    - deps: negotiator@0.5.0
   * deps: send@0.11.0
     - deps: debug@~2.1.1
     - deps: etag@~1.5.1
diff --git a/package.json b/package.json
index fb22dd7d927..c1edf63aaae 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.1.4",
+    "accepts": "~1.2.2",
     "content-disposition": "0.5.0",
     "cookie-signature": "1.0.5",
     "debug": "~2.1.1",

From 7d983c94c76c7b07d83d9a1a7c60ac9f5a868cef Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 Jan 2015 22:18:02 -0500
Subject: [PATCH 0719/1265] deps: serve-static@~1.8.0

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 62b89233b9e..7963f07a811 100644
--- a/History.md
+++ b/History.md
@@ -16,6 +16,8 @@ unreleased
     - deps: etag@~1.5.1
     - deps: ms@0.7.0
     - deps: on-finished@~2.2.0
+  * deps: serve-static@~1.8.0
+    - deps: send@0.11.0
 
 4.10.8 / 2015-01-13
 ===================
diff --git a/package.json b/package.json
index c1edf63aaae..f305d31b495 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "qs": "2.3.3",
     "range-parser": "~1.0.2",
     "send": "0.11.0",
-    "serve-static": "~1.7.2",
+    "serve-static": "~1.8.0",
     "type-is": "~1.5.5",
     "vary": "~1.0.0",
     "cookie": "0.1.2",

From 9434ad39e114ea810859cd9c6fef624d4acfbe18 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 Jan 2015 22:19:33 -0500
Subject: [PATCH 0720/1265] deps: update example dependencies

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index f305d31b495..c8ae6f04aef 100644
--- a/package.json
+++ b/package.json
@@ -64,8 +64,8 @@
     "body-parser": "~1.10.1",
     "connect-redis": "~2.1.0",
     "cookie-parser": "~1.3.3",
-    "express-session": "~1.9.2",
-    "jade": "~1.8.2",
+    "express-session": "~1.10.1",
+    "jade": "~1.9.0",
     "method-override": "~2.3.1",
     "morgan": "~1.5.1",
     "multiparty": "~4.1.0",

From 40f7a8eaa297c26f74c1a5dbc13ab705b6f97b45 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 Jan 2015 22:51:55 -0500
Subject: [PATCH 0721/1265] 4.11.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 7963f07a811..b70d9b72425 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.11.0 / 2015-01-13
+===================
 
   * Add `res.append(field, val)` to append headers
   * Deprecate leading `:` in `name` for `app.param(name, fn)`
diff --git a/package.json b/package.json
index c8ae6f04aef..2a26f21f1e1 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.10.8",
+  "version": "4.11.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 548f2865e20efd4affa8138fb7aa55c32a85e210 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Jan 2015 02:03:28 -0500
Subject: [PATCH 0722/1265] deps: connect@2.28.2

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5a7edc26496..9d52592e337 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+3.x
+===
+
+  * deps: connect@2.28.2
+    - deps: body-parser@~1.10.2
+    - deps: serve-static@~1.8.1
+
 3.19.0 / 2015-01-09
 ===================
 
diff --git a/package.json b/package.json
index 6e97a65db3f..d30906f327b 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.28.1",
+    "connect": "2.28.2",
     "content-disposition": "0.5.0",
     "commander": "2.6.0",
     "cookie-signature": "1.0.5",

From 0b25547ca071768160e7a81f3c2c9b8602a51201 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Jan 2015 02:05:03 -0500
Subject: [PATCH 0723/1265] deps: send@0.11.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 9d52592e337..b1997021154 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,8 @@
   * deps: connect@2.28.2
     - deps: body-parser@~1.10.2
     - deps: serve-static@~1.8.1
+  * deps: send@0.11.1
+    - Fix root path disclosure
 
 3.19.0 / 2015-01-09
 ===================
diff --git a/package.json b/package.json
index d30906f327b..4d951f80f9d 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
     "parseurl": "~1.3.0",
     "proxy-addr": "~1.0.5",
     "range-parser": "~1.0.2",
-    "send": "0.11.0",
+    "send": "0.11.1",
     "utils-merge": "1.0.0",
     "vary": "~1.0.0",
     "cookie": "0.1.2",

From ae92db98f3a8d4475d2ac5fb59d8b302da8cf087 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Jan 2015 02:13:17 -0500
Subject: [PATCH 0724/1265] deps: ejs@2.1.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 4d951f80f9d..b01a2106422 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
   },
   "devDependencies": {
     "connect-redis": "~1.5.0",
-    "ejs": "2.0.8",
+    "ejs": "2.1.4",
     "istanbul": "0.3.5",
     "mocha": "~2.1.0",
     "should": "~4.4.4",

From b95f2ee82067bdab2fa282556707fee4888b0620 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Jan 2015 02:14:27 -0500
Subject: [PATCH 0725/1265] deps: should@~4.6.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index b01a2106422..bbbadf87440 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "ejs": "2.1.4",
     "istanbul": "0.3.5",
     "mocha": "~2.1.0",
-    "should": "~4.4.4",
+    "should": "~4.6.1",
     "supertest": "~0.15.0",
     "hjs": "~0.0.6",
     "marked": "0.3.2"

From 855176b633a60a4032d5b35f69183b098ccf5609 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Jan 2015 03:17:30 -0500
Subject: [PATCH 0726/1265] tests: remove more mocking uses

---
 test/req.fresh.js  |   2 +-
 test/req.stale.js  |   2 +-
 test/res.format.js |   2 +-
 test/res.get.js    |  20 ++++++---
 test/res.links.js  |  59 +++++++++++++------------
 test/res.set.js    |  54 ++++++++++++++++-------
 test/res.vary.js   | 105 +++++++++++++++++++++++++++++++--------------
 7 files changed, 159 insertions(+), 85 deletions(-)

diff --git a/test/req.fresh.js b/test/req.fresh.js
index fdf4b07d591..0f1aa982ad2 100644
--- a/test/req.fresh.js
+++ b/test/req.fresh.js
@@ -37,7 +37,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        res._headers = undefined;
+        res._headers = null;
         res.send(req.fresh);
       });
 
diff --git a/test/req.stale.js b/test/req.stale.js
index 70fee02c992..c92c5a9fb8d 100644
--- a/test/req.stale.js
+++ b/test/req.stale.js
@@ -37,7 +37,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        res._headers = undefined;
+        res._headers = null;
         res.send(req.stale);
       });
 
diff --git a/test/res.format.js b/test/res.format.js
index 105c2b05aaa..b7b60afe741 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -81,7 +81,7 @@ describe('res', function(){
       it('should be invoked instead of auto-responding', function(done){
         request(app3)
         .get('/')
-        .set('Accept: text/html')
+        .set('Accept', 'text/html')
         .expect('default', done);
       })
     })
diff --git a/test/res.get.js b/test/res.get.js
index f6da5b50039..a53bdc33805 100644
--- a/test/res.get.js
+++ b/test/res.get.js
@@ -1,14 +1,20 @@
 
-var express = require('../')
-  , res = express.response;
+var express = require('..');
+var request = require('supertest');
 
 describe('res', function(){
   describe('.get(field)', function(){
-    it('should get the response header field', function(){
-      res.setHeader('Content-Type', 'text/x-foo');
-      res.get('Content-Type').should.equal('text/x-foo');
-      res.get('Content-type').should.equal('text/x-foo');
-      res.get('content-type').should.equal('text/x-foo');
+    it('should get the response header field', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.setHeader('Content-Type', 'text/x-foo');
+        res.send(res.get('Content-Type'));
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, 'text/x-foo', done);
     })
   })
 })
diff --git a/test/res.links.js b/test/res.links.js
index 34f3827e818..36630c9ccc5 100644
--- a/test/res.links.js
+++ b/test/res.links.js
@@ -1,41 +1,46 @@
 
-var express = require('../')
-  , res = express.response;
+var express = require('..');
+var request = require('supertest');
 
 describe('res', function(){
-
-  beforeEach(function() {
-    res.removeHeader('link');
-  });
-
   describe('.links(obj)', function(){
-    it('should set Link header field', function(){
-      res.links({
-        next: 'http://api.example.com/users?page=2',
-        last: 'http://api.example.com/users?page=5'
+    it('should set Link header field', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.links({
+          next: 'http://api.example.com/users?page=2',
+          last: 'http://api.example.com/users?page=5'
+        });
+        res.end();
       });
 
-      res.get('link')
-      .should.equal(
-          '<http://api.example.com/users?page=2>; rel="next", '
-        + '<http://api.example.com/users?page=5>; rel="last"');
+      request(app)
+      .get('/')
+      .expect('Link', '<http://api.example.com/users?page=2>; rel="next", <http://api.example.com/users?page=5>; rel="last"')
+      .expect(200, done);
     })
 
-    it('should set Link header field for multiple calls', function() {
-      res.links({
-        next: 'http://api.example.com/users?page=2',
-        last: 'http://api.example.com/users?page=5'
-      });
+    it('should set Link header field for multiple calls', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.links({
+          next: 'http://api.example.com/users?page=2',
+          last: 'http://api.example.com/users?page=5'
+        });
+
+        res.links({
+          prev: 'http://api.example.com/users?page=1'
+        });
 
-      res.links({
-        prev: 'http://api.example.com/users?page=1',
+        res.end();
       });
 
-      res.get('link')
-      .should.equal(
-          '<http://api.example.com/users?page=2>; rel="next", '
-        + '<http://api.example.com/users?page=5>; rel="last", '
-        + '<http://api.example.com/users?page=1>; rel="prev"');
+      request(app)
+      .get('/')
+      .expect('Link', '<http://api.example.com/users?page=2>; rel="next", <http://api.example.com/users?page=5>; rel="last", <http://api.example.com/users?page=1>; rel="prev"')
+      .expect(200, done);
     })
   })
 })
diff --git a/test/res.set.js b/test/res.set.js
index 1017e3aeaa1..a93ebbe20fc 100644
--- a/test/res.set.js
+++ b/test/res.set.js
@@ -1,7 +1,6 @@
 
-var express = require('../')
-  , request = require('supertest')
-  , res = express.response;
+var express = require('..');
+var request = require('supertest');
 
 describe('res', function(){
   describe('.set(field, value)', function(){
@@ -18,10 +17,18 @@ describe('res', function(){
       .end(done);
     })
 
-    it('should coerce to a string', function(){
-      res.headers = {};
-      res.set('X-Number', 123);
-      res.get('X-Number').should.equal('123');
+    it('should coerce to a string', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.set('X-Number', 123);
+        res.end(typeof res.get('X-Number'));
+      });
+
+      request(app)
+      .get('/')
+      .expect('X-Number', '123')
+      .expect(200, 'string', done);
     })
   })
 
@@ -39,11 +46,18 @@ describe('res', function(){
       .expect('["type=ninja","language=javascript"]', done);
     })
 
-    it('should coerce to an array of strings', function(){
-      res.headers = {};
-      res.set('X-Numbers', [123, 456]);
-      JSON.stringify(res.get('X-Numbers'))
-      .should.equal('["123","456"]');
+    it('should coerce to an array of strings', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.set('X-Numbers', [123, 456]);
+        res.end(JSON.stringify(res.get('X-Numbers')));
+      });
+
+      request(app)
+      .get('/')
+      .expect('X-Numbers', '123, 456')
+      .expect(200, '["123","456"]', done);
     })
   })
 
@@ -65,10 +79,18 @@ describe('res', function(){
       .end(done);
     })
 
-    it('should coerce to a string', function(){
-      res.headers = {};
-      res.set({ 'X-Number': 123 });
-      res.get('X-Number').should.equal('123');
+    it('should coerce to a string', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.set({ 'X-Number': 123 });
+        res.end(typeof res.get('X-Number'));
+      });
+
+      request(app)
+      .get('/')
+      .expect('X-Number', '123')
+      .expect(200, 'string', done);
     })
   })
 })
diff --git a/test/res.vary.js b/test/res.vary.js
index 4839c21dfdc..13c3af2bb70 100644
--- a/test/res.vary.js
+++ b/test/res.vary.js
@@ -1,55 +1,96 @@
 
-var express = require('../')
-  , should = require('should');
-
-function response() {
-  var res = Object.create(express.response);
-  res._headers = {};
-  return res;
-}
+var assert = require('assert');
+var express = require('..');
+var request = require('supertest');
 
 describe('res.vary()', function(){
   describe('with no arguments', function(){
-    it('should not set Vary', function(){
-      var res = response();
-      res.vary();
-      should.not.exist(res.get('Vary'));
+    it('should not set Vary', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.vary();
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .expect(shouldNotHaveHeader('Vary'))
+      .expect(200, done);
     })
   })
 
   describe('with an empty array', function(){
-    it('should not set Vary', function(){
-      var res = response();
-      res.vary([]);
-      should.not.exist(res.get('Vary'));
+    it('should not set Vary', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.vary([]);
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .expect(shouldNotHaveHeader('Vary'))
+      .expect(200, done);
     })
   })
 
   describe('with an array', function(){
-    it('should set the values', function(){
-      var res = response();
-      res.vary(['Accept', 'Accept-Language', 'Accept-Encoding']);
-      res.get('Vary').should.equal('Accept, Accept-Language, Accept-Encoding');
+    it('should set the values', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.vary(['Accept', 'Accept-Language', 'Accept-Encoding']);
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .expect('Vary', 'Accept, Accept-Language, Accept-Encoding')
+      .expect(200, done);
     })
   })
 
   describe('with a string', function(){
-    it('should set the value', function(){
-      var res = response();
-      res.vary('Accept');
-      res.get('Vary').should.equal('Accept');
+    it('should set the value', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.vary('Accept');
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .expect('Vary', 'Accept')
+      .expect(200, done);
     })
   })
 
   describe('when the value is present', function(){
-    it('should not add it again', function(){
-      var res = response();
-      res.vary('Accept');
-      res.vary('Accept-Encoding');
-      res.vary('Accept-Encoding');
-      res.vary('Accept-Encoding');
-      res.vary('Accept');
-      res.get('Vary').should.equal('Accept, Accept-Encoding');
+    it('should not add it again', function (done) {
+      var app = express();
+
+      app.use(function (req, res) {
+        res.vary('Accept');
+        res.vary('Accept-Encoding');
+        res.vary('Accept-Encoding');
+        res.vary('Accept-Encoding');
+        res.vary('Accept');
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .expect('Vary', 'Accept, Accept-Encoding')
+      .expect(200, done);
     })
   })
 })
+
+function shouldNotHaveHeader(header) {
+  return function (res) {
+    assert.ok(!(header.toLowerCase() in res.headers), 'should not have header ' + header);
+  };
+}

From 0c567b3282821c98a84640956e7fb4bf236be30e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Jan 2015 03:18:16 -0500
Subject: [PATCH 0727/1265] 3.19.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index b1997021154..76c64f604b8 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.19.1 / 2015-01-20
+===================
 
   * deps: connect@2.28.2
     - deps: body-parser@~1.10.2
diff --git a/package.json b/package.json
index bbbadf87440..55af8f0b10a 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.19.0",
+  "version": "3.19.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From b275613d3ad2c1587db93b7d5def32e7222de7b4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Jan 2015 03:25:25 -0500
Subject: [PATCH 0728/1265] deps: serve-static@~1.8.1

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 3c39c2f1f67..07ba59c0fc7 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,10 @@ unreleased
 
   * deps: send@0.11.1
     - Fix root path disclosure
+  * deps: serve-static@~1.8.1
+    - Fix redirect loop in Node.js 0.11.14
+    - Fix root path disclosure
+    - deps: send@0.11.1
 
 4.11.0 / 2015-01-13
 ===================
diff --git a/package.json b/package.json
index 985993f5e9d..c7af68702b4 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "qs": "2.3.3",
     "range-parser": "~1.0.2",
     "send": "0.11.1",
-    "serve-static": "~1.8.0",
+    "serve-static": "~1.8.1",
     "type-is": "~1.5.5",
     "vary": "~1.0.0",
     "cookie": "0.1.2",

From 41f8435d32237d672cc0f5040c21eeaa5d8ef56a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Jan 2015 03:28:57 -0500
Subject: [PATCH 0729/1265] tests: fix failing test on Node.js 0.11.15

---
 test/app.router.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/app.router.js b/test/app.router.js
index 4f170ec64ad..def50da34fb 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -11,7 +11,7 @@ describe('app.router', function(){
     var router = new express.Router();
 
     function handler1(req, res, next){
-      res.setHeader('x-user-id', req.params.id);
+      res.setHeader('x-user-id', String(req.params.id));
       next()
     }
 
@@ -20,7 +20,7 @@ describe('app.router', function(){
     }
 
     router.use(function(req, res, next){
-      res.setHeader('x-router', req.params.id);
+      res.setHeader('x-router', String(req.params.id));
       next();
     });
 

From 96f47432a5383644328f27394fec1cdf57d864d1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Jan 2015 03:30:16 -0500
Subject: [PATCH 0730/1265] deps: update example dependencies

---
 package.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index c7af68702b4..1ab7176269a 100644
--- a/package.json
+++ b/package.json
@@ -61,14 +61,14 @@
     "supertest": "~0.15.0",
     "marked": "0.3.2",
     "hjs": "~0.0.6",
-    "body-parser": "~1.10.1",
+    "body-parser": "~1.10.2",
     "connect-redis": "~2.1.0",
     "cookie-parser": "~1.3.3",
     "express-session": "~1.10.1",
-    "jade": "~1.9.0",
+    "jade": "~1.9.1",
     "method-override": "~2.3.1",
     "morgan": "~1.5.1",
-    "multiparty": "~4.1.0",
+    "multiparty": "~4.1.1",
     "vhost": "~3.0.0"
   },
   "engines": {

From 45ebb6cdf45710f4fba93ae41c9dbd16afae83fe Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Jan 2015 03:31:11 -0500
Subject: [PATCH 0731/1265] 4.11.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 07ba59c0fc7..aca4495690c 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.11.1 / 2015-01-20
+===================
 
   * deps: send@0.11.1
     - Fix root path disclosure
diff --git a/package.json b/package.json
index 1ab7176269a..ad62cc56a7f 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.11.0",
+  "version": "4.11.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 0b62f74a7f10df869b3ce8441534f2b7fd2126f4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 31 Jan 2015 17:26:35 -0500
Subject: [PATCH 0732/1265] deps: type-is@~1.5.6

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index aca4495690c..473dd8b83fd 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: type-is@~1.5.6
+    - deps: mime-types@~2.0.8
+
 4.11.1 / 2015-01-20
 ===================
 
diff --git a/package.json b/package.json
index ad62cc56a7f..f0f7e2dd8d6 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "range-parser": "~1.0.2",
     "send": "0.11.1",
     "serve-static": "~1.8.1",
-    "type-is": "~1.5.5",
+    "type-is": "~1.5.6",
     "vary": "~1.0.0",
     "cookie": "0.1.2",
     "merge-descriptors": "0.0.2",

From 2ccb6cf3507cac74716f87c6ee056e79f6afdc52 Mon Sep 17 00:00:00 2001
From: Kevin Shay <kshay@sixapart.com>
Date: Sat, 31 Jan 2015 16:23:18 -0500
Subject: [PATCH 0733/1265] Fix res.redirect double-calling res.end for HEAD
 requests

fixes #2521
---
 History.md      | 1 +
 lib/response.js | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 473dd8b83fd..4ed719f2479 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix `res.redirect` double-calling `res.end` for `HEAD` requests
   * deps: type-is@~1.5.6
     - deps: mime-types@~2.0.8
 
diff --git a/lib/response.js b/lib/response.js
index 50c313eb461..14aa9cab221 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -870,9 +870,9 @@ res.redirect = function redirect(url) {
 
   if (this.req.method === 'HEAD') {
     this.end();
+  } else {
+    this.end(body);
   }
-
-  this.end(body);
 };
 
 /**

From fea768dbccc036d883b03e38daebc38e5206031c Mon Sep 17 00:00:00 2001
From: Ivan Fraixedes <ifcdev@gmail.com>
Date: Sun, 1 Feb 2015 00:53:53 +0000
Subject: [PATCH 0734/1265] Fix an incorrect @api jsdoc

closes #2522
---
 lib/application.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/application.js b/lib/application.js
index 2fbb5503c7b..dc18fe37e38 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -563,7 +563,7 @@ app.listen = function(){
 * Log error using console.error.
 *
 * @param {Error} err
-* @api public
+* @api private
 */
 
 function logerror(err){

From fe435e497e9a0a40b4679c0896dd8a5e2ccbbf58 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 1 Feb 2015 14:54:46 -0500
Subject: [PATCH 0735/1265] deps: connect@2.28.3

---
 History.md   | 11 +++++++++++
 package.json |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 76c64f604b8..25e83a26dd2 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,14 @@
+3.x
+===
+
+  * deps: connect@2.28.3
+    - deps: compression@~1.3.1
+    - deps: csurf@~1.6.6
+    - deps: errorhandler@~1.3.3
+    - deps: express-session@~1.10.2
+    - deps: serve-index@~1.6.1
+    - deps: type-is@~1.5.6
+
 3.19.1 / 2015-01-20
 ===================
 
diff --git a/package.json b/package.json
index 55af8f0b10a..dce62b226b6 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.28.2",
+    "connect": "2.28.3",
     "content-disposition": "0.5.0",
     "commander": "2.6.0",
     "cookie-signature": "1.0.5",

From 55f5a2dc8d6b7084805bbb9e8a666938df747fab Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 1 Feb 2015 14:55:42 -0500
Subject: [PATCH 0736/1265] deps: proxy-addr@~1.0.6

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 25e83a26dd2..ffec3334def 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,8 @@
     - deps: express-session@~1.10.2
     - deps: serve-index@~1.6.1
     - deps: type-is@~1.5.6
+  * deps: proxy-addr@~1.0.6
+    - deps: ipaddr.js@0.1.8
 
 3.19.1 / 2015-01-20
 ===================
diff --git a/package.json b/package.json
index dce62b226b6..4862c2c87d2 100644
--- a/package.json
+++ b/package.json
@@ -40,7 +40,7 @@
     "methods": "~1.1.1",
     "mkdirp": "0.5.0",
     "parseurl": "~1.3.0",
-    "proxy-addr": "~1.0.5",
+    "proxy-addr": "~1.0.6",
     "range-parser": "~1.0.2",
     "send": "0.11.1",
     "utils-merge": "1.0.0",

From 926a71f5acf55f1be879e2f0fd6fd6636f4d5482 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 1 Feb 2015 14:56:18 -0500
Subject: [PATCH 0737/1265] deps: should@~4.6.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 4862c2c87d2..e8c90795caa 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "ejs": "2.1.4",
     "istanbul": "0.3.5",
     "mocha": "~2.1.0",
-    "should": "~4.6.1",
+    "should": "~4.6.2",
     "supertest": "~0.15.0",
     "hjs": "~0.0.6",
     "marked": "0.3.2"

From e497d068a1521e515eb1aa051d354a9ace7724ef Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 1 Feb 2015 14:58:19 -0500
Subject: [PATCH 0738/1265] deps: marked@0.3.3

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index e8c90795caa..5821ae96997 100644
--- a/package.json
+++ b/package.json
@@ -52,11 +52,11 @@
     "connect-redis": "~1.5.0",
     "ejs": "2.1.4",
     "istanbul": "0.3.5",
+    "marked": "0.3.3",
     "mocha": "~2.1.0",
     "should": "~4.6.2",
     "supertest": "~0.15.0",
-    "hjs": "~0.0.6",
-    "marked": "0.3.2"
+    "hjs": "~0.0.6"
   },
   "engines": {
     "node": ">= 0.8.0"

From 86328767fe6b253bdbf99343049cc57f1c3a1fbb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 1 Feb 2015 15:15:53 -0500
Subject: [PATCH 0739/1265] 3.19.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index ffec3334def..d701954c50c 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.19.2 / 2015-02-01
+===================
 
   * deps: connect@2.28.3
     - deps: compression@~1.3.1
diff --git a/package.json b/package.json
index 5821ae96997..e038310fc87 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.19.1",
+  "version": "3.19.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 72d35b6b4a06ed52d44a3058fe1d338f8917afc1 Mon Sep 17 00:00:00 2001
From: Vladimir Grinenko <i@tadatuta.com>
Date: Mon, 26 Jan 2015 03:55:23 +0300
Subject: [PATCH 0740/1265] Fix typo in jsdoc description

closes #2514
---
 lib/utils.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/utils.js b/lib/utils.js
index 9814527c0fc..9c004cc764c 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -272,7 +272,7 @@ exports.setCharset = function(type, charset){
 };
 
 /**
- * Return new empty objet.
+ * Return new empty object.
  *
  * @return {Object}
  * @api private

From f5d485235e9054dd4ada01ae129c3a1881344941 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 1 Feb 2015 15:26:04 -0500
Subject: [PATCH 0741/1265] deps: accepts@~1.2.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 2f1cbba4ca0..f3f232ce0c4 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,8 @@ unreleased
 ==========
 
   * Fix `res.redirect` double-calling `res.end` for `HEAD` requests
+  * deps: accepts@~1.2.3
+    - deps: mime-types@~2.0.8
   * deps: proxy-addr@~1.0.6
     - deps: ipaddr.js@0.1.8
   * deps: type-is@~1.5.6
diff --git a/package.json b/package.json
index 42675442ee4..b610b1d6574 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.2.2",
+    "accepts": "~1.2.3",
     "content-disposition": "0.5.0",
     "cookie-signature": "1.0.5",
     "debug": "~2.1.1",

From 13c07237fe79bd3138b6324b16a6c1ec843e7082 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 1 Feb 2015 15:27:48 -0500
Subject: [PATCH 0742/1265] deps: update example dependencies

---
 package.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index b610b1d6574..1d5b640b8ae 100644
--- a/package.json
+++ b/package.json
@@ -61,10 +61,10 @@
     "should": "~4.6.2",
     "supertest": "~0.15.0",
     "hjs": "~0.0.6",
-    "body-parser": "~1.10.2",
-    "connect-redis": "~2.1.0",
+    "body-parser": "~1.11.0",
+    "connect-redis": "~2.2.0",
     "cookie-parser": "~1.3.3",
-    "express-session": "~1.10.1",
+    "express-session": "~1.10.2",
     "jade": "~1.9.1",
     "method-override": "~2.3.1",
     "morgan": "~1.5.1",

From 63ab25579bda70b4927a179b580a9c580b6c7ada Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 1 Feb 2015 15:39:08 -0500
Subject: [PATCH 0743/1265] 4.11.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index f3f232ce0c4..6184768c9ae 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.11.2 / 2015-02-01
+===================
 
   * Fix `res.redirect` double-calling `res.end` for `HEAD` requests
   * deps: accepts@~1.2.3
diff --git a/package.json b/package.json
index 1d5b640b8ae..7179ee7b084 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.11.1",
+  "version": "4.11.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From ca480d7043827884a5fd49d6780c5ccd02aee64f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 4 Feb 2015 00:03:02 -0500
Subject: [PATCH 0744/1265] tests: improve res.download tests

---
 test/res.download.js | 54 +++++++++++++++++++++-----------------------
 1 file changed, 26 insertions(+), 28 deletions(-)

diff --git a/test/res.download.js b/test/res.download.js
index 0b9b0ba4edd..0671d8318c4 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -1,7 +1,8 @@
 
-var express = require('../')
-  , request = require('supertest')
-  , assert = require('assert');
+var after = require('after');
+var assert = require('assert');
+var express = require('..');
+var request = require('supertest');
 
 describe('res', function(){
   describe('.download(path)', function(){
@@ -38,27 +39,25 @@ describe('res', function(){
 
   describe('.download(path, fn)', function(){
     it('should invoke the callback', function(done){
-      var app = express()
-        , calls = 0;
+      var app = express();
+      var cb = after(2, done);
 
       app.use(function(req, res){
-        res.download('test/fixtures/user.html', done);
+        res.download('test/fixtures/user.html', cb);
       });
 
       request(app)
       .get('/')
       .expect('Content-Type', 'text/html; charset=UTF-8')
       .expect('Content-Disposition', 'attachment; filename="user.html"')
-      .expect(200, function(err){
-        assert.ifError(err)
-      })
+      .expect(200, cb);
     })
   })
 
   describe('.download(path, filename, fn)', function(){
     it('should invoke the callback', function(done){
-      var app = express()
-        , calls = 0;
+      var app = express();
+      var cb = after(2, done);
 
       app.use(function(req, res){
         res.download('test/fixtures/user.html', 'document', done);
@@ -68,48 +67,47 @@ describe('res', function(){
       .get('/')
       .expect('Content-Type', 'text/html; charset=UTF-8')
       .expect('Content-Disposition', 'attachment; filename="document"')
-      .expect(200, function(err){
-        assert.ifError(err)
-      })
+      .expect(200, cb);
     })
   })
 
   describe('on failure', function(){
     it('should invoke the callback', function(done){
-      var app = express()
-        , calls = 0;
+      var app = express();
 
-      app.use(function(req, res){
+      app.use(function (req, res, next) {
         res.download('test/fixtures/foobar.html', function(err){
-          assert(404 == err.status);
-          assert('ENOENT' == err.code);
-          done();
+          if (!err) return next(new Error('expected error'));
+          res.send('got ' + err.status + ' ' + err.code);
         });
       });
 
       request(app)
       .get('/')
-      .end(function(){});
+      .expect(200, 'got 404 ENOENT', done);
     })
 
     it('should remove Content-Disposition', function(done){
       var app = express()
         , calls = 0;
 
-      app.use(function(req, res){
+      app.use(function (req, res, next) {
         res.download('test/fixtures/foobar.html', function(err){
+          if (!err) return next(new Error('expected error'));
           res.end('failed');
         });
       });
 
       request(app)
       .get('/')
-      .expect('failed')
-      .end(function(err, res){
-        if (err) return done(err);
-        res.header.should.not.have.property('content-disposition');
-        done();
-      });
+      .expect(shouldNotHaveHeader('Content-Disposition'))
+      .expect(200, 'failed', done);
     })
   })
 })
+
+function shouldNotHaveHeader(header) {
+  return function (res) {
+    assert.ok(!(header.toLowerCase() in res.headers), 'should not have header ' + header);
+  };
+}

From 3610fdce3612eb27c8c8b8c4f683070d9d32d65d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Feb 2015 22:32:18 -0500
Subject: [PATCH 0745/1265] deps: connect@2.29.0

---
 History.md   | 19 +++++++++++++++++++
 package.json |  2 +-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index d701954c50c..fb89295bc2f 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,22 @@
+3.x
+===
+
+  * deps: connect@2.29.0
+    - Use `content-type` to parse `Content-Type` headers
+    - deps: body-parser@~1.12.0
+    - deps: compression@~1.4.1
+    - deps: connect-timeout@~1.6.0
+    - deps: cookie-parser@~1.3.4
+    - deps: cookie-signature@1.0.6
+    - deps: csurf@~1.7.0
+    - deps: errorhandler@~1.3.4
+    - deps: express-session@~1.10.3
+    - deps: http-errors@~1.3.1
+    - deps: response-time@~2.3.0
+    - deps: serve-index@~1.6.2
+    - deps: serve-static@~1.9.1
+    - deps: type-is@~1.6.0
+
 3.19.2 / 2015-02-01
 ===================
 
diff --git a/package.json b/package.json
index e038310fc87..592d14f92bc 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.28.3",
+    "connect": "2.29.0",
     "content-disposition": "0.5.0",
     "commander": "2.6.0",
     "cookie-signature": "1.0.5",

From 829fa34581be0f071433f84518df9d1ee33da82e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Feb 2015 22:37:28 -0500
Subject: [PATCH 0746/1265] build: use Travis CI container infrastructure

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 1ff243c5e64..852ac641db4 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,5 +7,6 @@ matrix:
   allow_failures:
     - node_js: "0.11"
   fast_finish: true
+sudo: false
 script: "npm run-script test-travis"
 after_script: "npm install coveralls@2.10.0 && cat ./coverage/lcov.info | coveralls"

From 2ce05047f83697a05043c7b73826cad2f48880cb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Feb 2015 22:40:51 -0500
Subject: [PATCH 0747/1265] deps: cookie-signature@1.0.6

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index fb89295bc2f..3bb53584236 100644
--- a/History.md
+++ b/History.md
@@ -16,6 +16,7 @@
     - deps: serve-index@~1.6.2
     - deps: serve-static@~1.9.1
     - deps: type-is@~1.6.0
+  * deps: cookie-signature@1.0.6
 
 3.19.2 / 2015-02-01
 ===================
diff --git a/package.json b/package.json
index 592d14f92bc..80f38245a18 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "connect": "2.29.0",
     "content-disposition": "0.5.0",
     "commander": "2.6.0",
-    "cookie-signature": "1.0.5",
+    "cookie-signature": "1.0.6",
     "debug": "~2.1.1",
     "depd": "~1.0.0",
     "escape-html": "1.0.1",

From c2a6c8d3382e9b9ce771b467f0f21910fdd57fe1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Feb 2015 22:42:02 -0500
Subject: [PATCH 0748/1265] deps: send@0.12.1

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 3bb53584236..349b925f4b4 100644
--- a/History.md
+++ b/History.md
@@ -17,6 +17,10 @@
     - deps: serve-static@~1.9.1
     - deps: type-is@~1.6.0
   * deps: cookie-signature@1.0.6
+  * deps: send@0.12.1
+    - Always read the stat size from the file
+    - Fix mutating passed-in `options`
+    - deps: mime@1.3.4
 
 3.19.2 / 2015-02-01
 ===================
diff --git a/package.json b/package.json
index 80f38245a18..22de15b397b 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
     "parseurl": "~1.3.0",
     "proxy-addr": "~1.0.6",
     "range-parser": "~1.0.2",
-    "send": "0.11.1",
+    "send": "0.12.1",
     "utils-merge": "1.0.0",
     "vary": "~1.0.0",
     "cookie": "0.1.2",

From 69a4869db03c1924cfaeff13147272543e9b2c5f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Feb 2015 22:43:38 -0500
Subject: [PATCH 0749/1265] deps: should@~5.0.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 22de15b397b..1e2a7ca5804 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,7 @@
     "istanbul": "0.3.5",
     "marked": "0.3.3",
     "mocha": "~2.1.0",
-    "should": "~4.6.2",
+    "should": "~5.0.0",
     "supertest": "~0.15.0",
     "hjs": "~0.0.6"
   },

From f22937f3d158e5fcb194ec201b1a72ff2d84776d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Feb 2015 22:49:24 -0500
Subject: [PATCH 0750/1265] Use content-type to parse Content-Type headers

---
 History.md   |  1 +
 lib/utils.js | 19 ++++++++++++++-----
 package.json |  2 +-
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/History.md b/History.md
index 349b925f4b4..83b8a5561c9 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 3.x
 ===
 
+  * Use `content-type` to parse `Content-Type` headers
   * deps: connect@2.29.0
     - Use `content-type` to parse `Content-Type` headers
     - deps: body-parser@~1.12.0
diff --git a/lib/utils.js b/lib/utils.js
index b9ff7bbdf68..889b62d5310 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -1,12 +1,19 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
 
 /**
  * Module dependencies.
+ * @api private
  */
 
+var contentType = require('content-type');
 var etag = require('etag');
 var mime = require('connect').mime;
 var proxyaddr = require('proxy-addr');
-var typer = require('media-typer');
 
 /**
  * toString ref.
@@ -393,15 +400,17 @@ exports.compileTrust = function(val) {
  * @api private
  */
 
-exports.setCharset = function(type, charset){
-  if (!type || !charset) return type;
+exports.setCharset = function setCharset(type, charset) {
+  if (!type || !charset) {
+    return type;
+  }
 
   // parse type
-  var parsed = typer.parse(type);
+  var parsed = contentType.parse(type);
 
   // set charset
   parsed.parameters.charset = charset;
 
   // format type
-  return typer.format(parsed);
+  return contentType.format(parsed);
 };
diff --git a/package.json b/package.json
index 1e2a7ca5804..e2dca4d9945 100644
--- a/package.json
+++ b/package.json
@@ -29,6 +29,7 @@
     "basic-auth": "1.0.0",
     "connect": "2.29.0",
     "content-disposition": "0.5.0",
+    "content-type": "~1.0.1",
     "commander": "2.6.0",
     "cookie-signature": "1.0.6",
     "debug": "~2.1.1",
@@ -36,7 +37,6 @@
     "escape-html": "1.0.1",
     "etag": "~1.5.1",
     "fresh": "0.2.4",
-    "media-typer": "0.3.0",
     "methods": "~1.1.1",
     "mkdirp": "0.5.0",
     "parseurl": "~1.3.0",

From e1057bd7fd485f3ae7f6529ded0353ec78d3bd7d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Feb 2015 22:52:23 -0500
Subject: [PATCH 0751/1265] build: support Node.js 0.12

closes #2538
---
 .travis.yml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 852ac641db4..4af6d31b546 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -2,11 +2,7 @@ language: node_js
 node_js:
   - "0.8"
   - "0.10"
-  - "0.11"
-matrix:
-  allow_failures:
-    - node_js: "0.11"
-  fast_finish: true
+  - "0.12"
 sudo: false
 script: "npm run-script test-travis"
 after_script: "npm install coveralls@2.10.0 && cat ./coverage/lcov.info | coveralls"

From eaf3318dd39a83ecfa014cbb073883c63f4ef608 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 18 Feb 2015 00:12:28 -0500
Subject: [PATCH 0752/1265] Generate ETags for all request responses

closes #2546
---
 History.md       |   2 +
 LICENSE          |   2 +
 lib/response.js  |  30 +++++---
 test/res.send.js | 191 +++++++++++++++++++++++++----------------------
 4 files changed, 125 insertions(+), 100 deletions(-)

diff --git a/History.md b/History.md
index 83b8a5561c9..00210c617e4 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,8 @@
 3.x
 ===
 
+  * Generate `ETag`s for all request responses
+    - No longer restricted to only responses for `GET` and `HEAD` requests
   * Use `content-type` to parse `Content-Type` headers
   * deps: connect@2.29.0
     - Use `content-type` to parse `Content-Type` headers
diff --git a/LICENSE b/LICENSE
index d23e93ce9a5..bf9058b447a 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,6 +1,8 @@
 (The MIT License)
 
 Copyright (c) 2009-2013 TJ Holowaychuk <tj@vision-media.ca>
+Copyright (c) 2013 Roman Shtylman <shtylman+expressjs@gmail.com>
+Copyright (c) 2014-2015 Douglas Christopher Wilson <doug@somethingdoug.com>
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
diff --git a/lib/response.js b/lib/response.js
index 9404d34f606..08c68f79e2e 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -1,5 +1,13 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
 /**
  * Module dependencies.
+ * @api private
  */
 
 var contentDisposition = require('content-disposition');
@@ -86,7 +94,6 @@ res.links = function(links){
 
 res.send = function(body){
   var req = this.req;
-  var head = 'HEAD' == req.method;
   var type;
   var encoding;
   var len;
@@ -153,12 +160,12 @@ res.send = function(body){
     this.set('Content-Length', len);
   }
 
-  // ETag support
-  var etag = len !== undefined && app.get('etag fn');
-  if (etag && ('GET' === req.method || 'HEAD' === req.method)) {
-    if (!this.get('ETag')) {
-      etag = etag(body, encoding);
-      etag && this.set('ETag', etag);
+  // populate ETag
+  var etag;
+  var generateETag = len !== undefined && app.get('etag fn');
+  if (typeof generateETag === 'function' && !this.get('ETag')) {
+    if ((etag = generateETag(body, encoding))) {
+      this.set('ETag', etag);
     }
   }
 
@@ -173,8 +180,13 @@ res.send = function(body){
     body = '';
   }
 
-  // respond
-  this.end((head ? null : body), encoding);
+  if (req.method === 'HEAD') {
+    // skip body for HEAD
+    this.end();
+  } else {
+    // respond
+    this.end(body, encoding);
+  }
 
   return this;
 };
diff --git a/test/res.send.js b/test/res.send.js
index ad1a703f32b..9ad8fd88fee 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -1,7 +1,8 @@
 
-var express = require('../')
-  , request = require('supertest')
-  , assert = require('assert');
+var assert = require('assert');
+var express = require('..');
+var methods = require('methods');
+var request = require('supertest');
 
 describe('res', function(){
   describe('.send(null)', function(){
@@ -110,10 +111,10 @@ describe('res', function(){
       })
     })
 
-    it('should set ETag', function(done){
+    it('should set ETag', function (done) {
       var app = express();
 
-      app.use(function(req, res){
+      app.use(function (req, res) {
         var str = Array(1024 * 2).join('-');
         res.send(str);
       });
@@ -121,24 +122,7 @@ describe('res', function(){
       request(app)
       .get('/')
       .expect('ETag', 'W/"fz/jGo0ONwzb+aKy/rWipg=="')
-      .end(done);
-    })
-
-    it('should not set ETag for non-GET/HEAD', function(done){
-      var app = express();
-
-      app.use(function(req, res){
-        var str = Array(1024 * 2).join('-');
-        res.send(str);
-      });
-
-      request(app)
-      .post('/')
-      .end(function(err, res){
-        if (err) return done(err);
-        assert(!res.header.etag, 'has an ETag');
-        done();
-      });
+      .expect(200, done);
     })
 
     it('should not override Content-Type', function(done){
@@ -199,10 +183,10 @@ describe('res', function(){
       })
     })
 
-    it('should set ETag', function(done){
+    it('should set ETag', function (done) {
       var app = express();
 
-      app.use(function(req, res){
+      app.use(function (req, res) {
         var str = Array(1024 * 2).join('-');
         res.send(new Buffer(str));
       });
@@ -210,7 +194,7 @@ describe('res', function(){
       request(app)
       .get('/')
       .expect('ETag', 'W/"fz/jGo0ONwzb+aKy/rWipg=="')
-      .end(done);
+      .expect(200, done);
     })
 
     it('should not override Content-Type', function(done){
@@ -358,12 +342,12 @@ describe('res', function(){
     .expect('{"foo":"bar"}', done);
   })
 
-  describe('"etag" setting', function(){
-    describe('when enabled', function(){
-      it('should send ETag', function(done){
+  describe('"etag" setting', function () {
+    describe('when enabled', function () {
+      it('should send ETag', function (done) {
         var app = express();
 
-        app.use(function(req, res){
+        app.use(function (req, res) {
           res.send('kajdslfkasdf');
         });
 
@@ -371,27 +355,46 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('etag', 'W/"c-5aee35d8"', done)
-      })
+        .expect('ETag', 'W/"c-5aee35d8"')
+        .expect(200, done);
+      });
+
+      methods.forEach(function (method) {
+        if (method === 'connect') return;
 
-      it('should send ETag for empty string response', function(done){
-        var app = express()
+        it('should send ETag in response to ' + method.toUpperCase() + ' request', function (done) {
+          var app = express();
 
-        app.use(function(req, res){
-          res.send('')
+          app[method]('/', function (req, res) {
+            res.send('kajdslfkasdf');
+          });
+
+          request(app)
+          [method]('/')
+          .expect('ETag', 'W/"c-5aee35d8"')
+          .expect(200, done);
+        })
+      });
+
+      it('should send ETag for empty string response', function (done) {
+        var app = express();
+
+        app.use(function (req, res) {
+          res.send('');
         });
 
-        app.enable('etag')
+        app.enable('etag');
 
         request(app)
         .get('/')
-        .expect('etag', 'W/"0-0"', done)
+        .expect('ETag', 'W/"0-0"')
+        .expect(200, done);
       })
 
-      it('should send ETag for long response', function(done){
+      it('should send ETag for long response', function (done) {
         var app = express();
 
-        app.use(function(req, res){
+        app.use(function (req, res) {
           var str = Array(1024 * 2).join('-');
           res.send(str);
         });
@@ -400,13 +403,14 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('etag', 'W/"fz/jGo0ONwzb+aKy/rWipg=="', done)
+        .expect('ETag', 'W/"fz/jGo0ONwzb+aKy/rWipg=="')
+        .expect(200, done);
       });
 
-      it('should not override ETag when manually set', function(done){
+      it('should not override ETag when manually set', function (done) {
         var app = express();
 
-        app.use(function(req, res){
+        app.use(function (req, res) {
           res.set('etag', '"asdf"');
           res.send(200);
         });
@@ -415,32 +419,31 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('etag', '"asdf"', done)
+        .expect('ETag', '"asdf"')
+        .expect(200, done);
       });
 
-      it('should not send ETag for res.send()', function(done){
-        var app = express()
+      it('should not send ETag for res.send()', function (done) {
+        var app = express();
 
-        app.use(function(req, res){
-          res.send()
+        app.use(function (req, res) {
+          res.send();
         });
 
-        app.enable('etag')
+        app.enable('etag');
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.headers.should.not.have.property('etag');
-          done();
-        })
+        .expect(shouldNotHaveHeader('ETag'))
+        .expect(200, done);
       })
     });
 
-    describe('when disabled', function(){
-      it('should send no ETag', function(done){
+    describe('when disabled', function () {
+      it('should send no ETag', function (done) {
         var app = express();
 
-        app.use(function(req, res){
+        app.use(function (req, res) {
           var str = Array(1024 * 2).join('-');
           res.send(str);
         });
@@ -449,97 +452,103 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.headers.should.not.have.property('etag');
-          done();
-        });
+        .expect(shouldNotHaveHeader('ETag'))
+        .expect(200, done);
       });
 
-      it('should send ETag when manually set', function(done){
+      it('should send ETag when manually set', function (done) {
         var app = express();
 
         app.disable('etag');
 
-        app.use(function(req, res){
+        app.use(function (req, res) {
           res.set('etag', '"asdf"');
           res.send(200);
         });
 
         request(app)
         .get('/')
-        .expect('etag', '"asdf"', done)
+        .expect('ETag', '"asdf"')
+        .expect(200, done);
       });
     });
 
-    describe('when "strong"', function(){
-      it('should send strong ETag', function(done){
-        var app = express()
+    describe('when "strong"', function () {
+      it('should send strong ETag', function (done) {
+        var app = express();
 
         app.set('etag', 'strong');
 
-        app.use(function(req, res){
+        app.use(function (req, res) {
           res.send('hello, world!');
         });
 
         request(app)
         .get('/')
-        .expect('etag', '"Otu60XkfuuPskIiUxJY4cA=="', done)
+        .expect('ETag', '"Otu60XkfuuPskIiUxJY4cA=="')
+        .expect(200, done);
       })
     })
 
-    describe('when "weak"', function(){
-      it('should send weak ETag', function(done){
-        var app = express()
+    describe('when "weak"', function () {
+      it('should send weak ETag', function (done) {
+        var app = express();
 
         app.set('etag', 'weak');
 
-        app.use(function(req, res){
+        app.use(function (req, res) {
           res.send('hello, world!');
         });
 
         request(app)
         .get('/')
-        .expect('etag', 'W/"d-58988d13"', done)
+        .expect('ETag', 'W/"d-58988d13"')
+        .expect(200, done)
       })
     })
 
-    describe('when a function', function(){
-      it('should send custom ETag', function(done){
-        var app = express()
+    describe('when a function', function () {
+      it('should send custom ETag', function (done) {
+        var app = express();
 
-        app.set('etag', function(body, encoding){
-          body.should.equal('hello, world!')
-          encoding.should.equal('utf8')
-          return '"custom"'
+        app.set('etag', function (body, encoding) {
+          body.should.equal('hello, world!');
+          encoding.should.equal('utf8');
+          return '"custom"';
         });
 
-        app.use(function(req, res){
+        app.use(function (req, res) {
           res.send('hello, world!');
         });
 
         request(app)
         .get('/')
-        .expect('etag', '"custom"', done)
+        .expect('ETag', '"custom"')
+        .expect(200, done);
       })
 
-      it('should not send falsy ETag', function(done){
-        var app = express()
+      it('should not send falsy ETag', function (done) {
+        var app = express();
 
-        app.set('etag', function(body, encoding){
-          return undefined
+        app.set('etag', function (body, encoding) {
+          return undefined;
         });
 
-        app.use(function(req, res){
+        app.use(function (req, res) {
           res.send('hello, world!');
         });
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.headers.should.not.have.property('etag')
-          done();
-        })
+        .expect(shouldNotHaveHeader('ETag'))
+        .expect(200, done);
       })
     })
   })
 })
+
+function shouldNotHaveHeader(header) {
+  return function (res) {
+    assert.ok(!(header.toLowerCase() in res.headers), 'should not have header ' + header)
+  }
+}

From b40e74d6b6a3c32b9ce1b28ce533e5e322eb502d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 18 Feb 2015 00:59:56 -0500
Subject: [PATCH 0753/1265] Fix "trust proxy" setting to inherit when app is
 mounted

fixes #2550
fixes #2551
---
 History.md         |   1 +
 lib/application.js |  40 +++++++++++++++++-
 test/app.use.js    |   5 ++-
 test/config.js     | 103 ++++++++++++++++++++++++++++++++-------------
 test/req.ip.js     |  17 ++++++++
 5 files changed, 133 insertions(+), 33 deletions(-)

diff --git a/History.md b/History.md
index 00210c617e4..ad53053ae7d 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 3.x
 ===
 
+  * Fix `"trust proxy"` setting to inherit when app is mounted
   * Generate `ETag`s for all request responses
     - No longer restricted to only responses for `GET` and `HEAD` requests
   * Use `content-type` to parse `Content-Type` headers
diff --git a/lib/application.js b/lib/application.js
index 1909fd95754..8b287ae5e0f 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -1,5 +1,14 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
 /**
  * Module dependencies.
+ * @api private
  */
 
 var connect = require('connect')
@@ -21,6 +30,13 @@ var merge = require('utils-merge');
 
 var app = exports = module.exports = {};
 
+/**
+ * Variable for trust proxy inheritance back-compat
+ * @api private
+ */
+
+var trustProxyDefaultSymbol = '@@symbol:trust_proxy_default';
+
 /**
  * Initialize the server.
  *
@@ -53,14 +69,27 @@ app.defaultConfiguration = function(){
   this.set('subdomain offset', 2);
   this.set('trust proxy', false);
 
+  // trust proxy inherit back-compat
+  Object.defineProperty(this.settings, trustProxyDefaultSymbol, {
+    configurable: true,
+    value: true
+  });
+
   debug('booting in %s mode', env);
 
   // implicit middleware
   this.use(connect.query());
   this.use(middleware.init(this));
 
-  // inherit protos
-  this.on('mount', function(parent){
+  this.on('mount', function onmount(parent) {
+    // inherit trust proxy
+    if (this.settings[trustProxyDefaultSymbol] === true
+      && typeof parent.settings['trust proxy fn'] === 'function') {
+      delete this.settings['trust proxy'];
+      delete this.settings['trust proxy fn'];
+    }
+
+    // inherit protos
     this.request.__proto__ = parent.request;
     this.response.__proto__ = parent.response;
     this.engines.__proto__ = parent.engines;
@@ -271,6 +300,13 @@ app.set = function(setting, val){
     case 'trust proxy':
       debug('compile trust proxy %s', val);
       this.set('trust proxy fn', compileTrust(val));
+
+      // trust proxy inherit back-compat
+      Object.defineProperty(this.settings, trustProxyDefaultSymbol, {
+        configurable: true,
+        value: false
+      });
+
       break;
   }
 
diff --git a/test/app.use.js b/test/app.use.js
index d627bdfe658..ab00617e697 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -1,6 +1,7 @@
 
-var express = require('../')
-  , request = require('supertest');
+var assert = require('assert');
+var express = require('..');
+var request = require('supertest');
 
 describe('app', function(){
   it('should emit "mount" when mounted', function(done){
diff --git a/test/config.js b/test/config.js
index 59d38f07a32..e298e76a5c5 100644
--- a/test/config.js
+++ b/test/config.js
@@ -1,30 +1,36 @@
 
-var express = require('../')
-  , assert = require('assert');
+var assert = require('assert');
+var express = require('..');
 
-describe('config', function(){
-  describe('.set()', function(){
-    it('should set a value', function(){
+describe('config', function () {
+  describe('.set()', function () {
+    it('should set a value', function () {
       var app = express();
-      app.set('foo', 'bar').should.equal(app);
+      app.set('foo', 'bar');
+      assert.equal(app.get('foo'), 'bar');
+    })
+
+    it('should return the app', function () {
+      var app = express();
+      assert.equal(app.set('foo', 'bar'), app);
     })
 
-    it('should return the app when undefined', function(){
+    it('should return the app when undefined', function () {
       var app = express();
-      app.set('foo', undefined).should.equal(app);
+      assert.equal(app.set('foo', undefined), app);
     })
 
     describe('"etag"', function(){
       it('should throw on bad value', function(){
-        var app = express()
-        app.set.bind(app, 'etag', 42).should.throw(/unknown value/)
+        var app = express();
+        assert.throws(app.set.bind(app, 'etag', 42), /unknown value/);
       })
 
       it('should set "etag fn"', function(){
         var app = express()
         var fn = function(){}
         app.set('etag', fn)
-        app.get('etag fn').should.equal(fn)
+        assert.equal(app.get('etag fn'), fn)
       })
     })
 
@@ -33,7 +39,7 @@ describe('config', function(){
         var app = express()
         var fn = function(){}
         app.set('trust proxy', fn)
-        app.get('trust proxy fn').should.equal(fn)
+        assert.equal(app.get('trust proxy fn'), fn)
       })
     })
   })
@@ -41,34 +47,73 @@ describe('config', function(){
   describe('.get()', function(){
     it('should return undefined when unset', function(){
       var app = express();
-      assert(undefined === app.get('foo'));
+      assert.strictEqual(app.get('foo'), undefined);
     })
     
     it('should otherwise return the value', function(){
       var app = express();
       app.set('foo', 'bar');
-      app.get('foo').should.equal('bar');
+      assert.equal(app.get('foo'), 'bar');
     })
 
     describe('when mounted', function(){
       it('should default to the parent app', function(){
-        var app = express()
-          , blog = express();
+        var app = express();
+        var blog = express();
 
         app.set('title', 'Express');
         app.use(blog);
-        blog.get('title').should.equal('Express');
+        assert.equal(blog.get('title'), 'Express');
       })
-      
+
       it('should given precedence to the child', function(){
-        var app = express()
-          , blog = express();
+        var app = express();
+        var blog = express();
 
         app.use(blog);
         app.set('title', 'Express');
         blog.set('title', 'Some Blog');
 
-        blog.get('title').should.equal('Some Blog');
+        assert.equal(blog.get('title'), 'Some Blog');
+      })
+
+      it('should inherit "trust proxy" setting', function () {
+        var app = express();
+        var blog = express();
+
+        function fn() { return false }
+
+        app.set('trust proxy', fn);
+        assert.equal(app.get('trust proxy'), fn);
+        assert.equal(app.get('trust proxy fn'), fn);
+
+        app.use(blog);
+
+        assert.equal(blog.get('trust proxy'), fn);
+        assert.equal(blog.get('trust proxy fn'), fn);
+      })
+
+      it('should prefer child "trust proxy" setting', function () {
+        var app = express();
+        var blog = express();
+
+        function fn1() { return false }
+        function fn2() { return true }
+
+        app.set('trust proxy', fn1);
+        assert.equal(app.get('trust proxy'), fn1);
+        assert.equal(app.get('trust proxy fn'), fn1);
+
+        blog.set('trust proxy', fn2);
+        assert.equal(blog.get('trust proxy'), fn2);
+        assert.equal(blog.get('trust proxy fn'), fn2);
+
+        app.use(blog);
+
+        assert.equal(app.get('trust proxy'), fn1);
+        assert.equal(app.get('trust proxy fn'), fn1);
+        assert.equal(blog.get('trust proxy'), fn2);
+        assert.equal(blog.get('trust proxy fn'), fn2);
       })
     })
   })
@@ -76,42 +121,42 @@ describe('config', function(){
   describe('.enable()', function(){
     it('should set the value to true', function(){
       var app = express();
-      app.enable('tobi').should.equal(app);
-      app.get('tobi').should.be.true;
+      assert.equal(app.enable('tobi'), app);
+      assert.strictEqual(app.get('tobi'), true);
     })
   })
   
   describe('.disable()', function(){
     it('should set the value to false', function(){
       var app = express();
-      app.disable('tobi').should.equal(app);
-      app.get('tobi').should.be.false;
+      assert.equal(app.disable('tobi'), app);
+      assert.strictEqual(app.get('tobi'), false);
     })
   })
   
   describe('.enabled()', function(){
     it('should default to false', function(){
       var app = express();
-      app.enabled('foo').should.be.false;
+      assert.strictEqual(app.enabled('foo'), false);
     })
     
     it('should return true when set', function(){
       var app = express();
       app.set('foo', 'bar');
-      app.enabled('foo').should.be.true;
+      assert.strictEqual(app.enabled('foo'), true);
     })
   })
   
   describe('.disabled()', function(){
     it('should default to true', function(){
       var app = express();
-      app.disabled('foo').should.be.true;
+      assert.strictEqual(app.disabled('foo'), true);
     })
     
     it('should return false when set', function(){
       var app = express();
       app.set('foo', 'bar');
-      app.disabled('foo').should.be.false;
+      assert.strictEqual(app.disabled('foo'), false);
     })
   })
 })
diff --git a/test/req.ip.js b/test/req.ip.js
index 19d0fee147e..3ca575e11bd 100644
--- a/test/req.ip.js
+++ b/test/req.ip.js
@@ -35,6 +35,23 @@ describe('req', function(){
           .set('X-Forwarded-For', 'client, p1, p2')
           .expect('p1', done);
         })
+
+        it('should return the addr after trusted proxy, from sub app', function (done) {
+          var app = express();
+          var sub = express();
+
+          app.set('trust proxy', 2);
+          app.use(sub);
+
+          sub.use(function (req, res, next) {
+            res.send(req.ip);
+          });
+
+          request(app)
+          .get('/')
+          .set('X-Forwarded-For', 'client, p1, p2')
+          .expect(200, 'p1', done);
+        })
       })
 
       describe('when "trust proxy" is disabled', function(){

From 85755e32d9d262db702bee84830462b5275c27e4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 18 Feb 2015 21:25:55 -0500
Subject: [PATCH 0754/1265] 3.20.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index ad53053ae7d..3a215127e23 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.20.0 / 2015-02-18
+===================
 
   * Fix `"trust proxy"` setting to inherit when app is mounted
   * Generate `ETag`s for all request responses
diff --git a/package.json b/package.json
index e2dca4d9945..bc2042905d0 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.19.2",
+  "version": "3.20.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 117d0c9796a0a80d09b5eff6542224ea4ac9cbc4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 18 Feb 2015 22:36:20 -0500
Subject: [PATCH 0755/1265] deps: accepts@~1.2.4

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 88cf92df6b0..2979b297a8d 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,10 @@ unreleased
   * Generate `ETag`s for all request responses
     - No longer restricted to only responses for `GET` and `HEAD` requests
   * Use `content-type` to parse `Content-Type` headers
+  * deps: accepts@~1.2.4
+    - Fix preference sorting to be stable for long acceptable lists
+    - deps: mime-types@~2.0.9
+    - deps: negotiator@0.5.1
   * deps: cookie-signature@1.0.6
   * deps: send@0.12.1
     - Always read the stat size from the file
diff --git a/package.json b/package.json
index 6ced2f3caf8..9e9bf1dd0b0 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.2.3",
+    "accepts": "~1.2.4",
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",
     "cookie-signature": "1.0.6",

From e03ed050ef9e8318af45241474d933f5088e2815 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 18 Feb 2015 22:46:34 -0500
Subject: [PATCH 0756/1265] deps: type-is@~1.6.0

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 2979b297a8d..54a2f972da4 100644
--- a/History.md
+++ b/History.md
@@ -14,6 +14,11 @@ unreleased
     - Always read the stat size from the file
     - Fix mutating passed-in `options`
     - deps: mime@1.3.4
+  * deps: type-is@~1.6.0
+    - fix argument reassignment
+    - fix false-positives in `hasBody` `Transfer-Encoding` check
+    - support wildcard for both type and subtype (`*/*`)
+    - deps: mime-types@~2.0.9
 
 4.11.2 / 2015-02-01
 ===================
diff --git a/package.json b/package.json
index 9e9bf1dd0b0..0d394b5761f 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "range-parser": "~1.0.2",
     "send": "0.12.1",
     "serve-static": "~1.8.1",
-    "type-is": "~1.5.6",
+    "type-is": "~1.6.0",
     "vary": "~1.0.0",
     "cookie": "0.1.2",
     "merge-descriptors": "0.0.2",

From ce1abd9f26e262c6232d41e60e33736ccfddc6f5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 18 Feb 2015 22:48:25 -0500
Subject: [PATCH 0757/1265] deps: serve-static@~1.9.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 54a2f972da4..174851d5dc0 100644
--- a/History.md
+++ b/History.md
@@ -14,6 +14,8 @@ unreleased
     - Always read the stat size from the file
     - Fix mutating passed-in `options`
     - deps: mime@1.3.4
+  * deps: serve-static@~1.9.1
+    - deps: send@0.12.1
   * deps: type-is@~1.6.0
     - fix argument reassignment
     - fix false-positives in `hasBody` `Transfer-Encoding` check
diff --git a/package.json b/package.json
index 0d394b5761f..25bcc906a16 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "qs": "2.3.3",
     "range-parser": "~1.0.2",
     "send": "0.12.1",
-    "serve-static": "~1.8.1",
+    "serve-static": "~1.9.1",
     "type-is": "~1.6.0",
     "vary": "~1.0.0",
     "cookie": "0.1.2",

From e56141a7a5a4f3422b6a121682168515078ca8cc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 18 Feb 2015 22:49:12 -0500
Subject: [PATCH 0758/1265] deps: jade@~1.9.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 25bcc906a16..9aa051d23ec 100644
--- a/package.json
+++ b/package.json
@@ -65,7 +65,7 @@
     "connect-redis": "~2.2.0",
     "cookie-parser": "~1.3.3",
     "express-session": "~1.10.2",
-    "jade": "~1.9.1",
+    "jade": "~1.9.2",
     "method-override": "~2.3.1",
     "morgan": "~1.5.1",
     "multiparty": "~4.1.1",

From 9a8cf77c91f6a3597910e0826c8ada4ae8b88ae1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 18 Feb 2015 22:51:18 -0500
Subject: [PATCH 0759/1265] deps: update example dependencies

---
 package.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index 9aa051d23ec..92441cfe303 100644
--- a/package.json
+++ b/package.json
@@ -61,10 +61,10 @@
     "should": "~5.0.0",
     "supertest": "~0.15.0",
     "hjs": "~0.0.6",
-    "body-parser": "~1.11.0",
+    "body-parser": "~1.12.0",
     "connect-redis": "~2.2.0",
-    "cookie-parser": "~1.3.3",
-    "express-session": "~1.10.2",
+    "cookie-parser": "~1.3.4",
+    "express-session": "~1.10.3",
     "jade": "~1.9.2",
     "method-override": "~2.3.1",
     "morgan": "~1.5.1",

From 53e5991dd1a70d5c57bfd45f1023101ecbac3e65 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 18 Feb 2015 22:57:50 -0500
Subject: [PATCH 0760/1265] tests: add extra setCharset tests

---
 test/utils.js | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/test/utils.js b/test/utils.js
index 399b3f5bcdb..ef5a0706eb5 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -1,6 +1,6 @@
 
-var utils = require('../lib/utils')
-  , assert = require('assert');
+var assert = require('assert');
+var utils = require('../lib/utils');
 
 describe('utils.etag(body, encoding)', function(){
   it('should support strings', function(){
@@ -25,6 +25,28 @@ describe('utils.etag(body, encoding)', function(){
   })
 })
 
+describe('utils.setCharset(type, charset)', function () {
+  it('should do anything without type', function () {
+    assert.strictEqual(utils.setCharset(), undefined);
+  });
+
+  it('should return type if not given charset', function () {
+    assert.strictEqual(utils.setCharset('text/html'), 'text/html');
+  });
+
+  it('should keep charset if not given charset', function () {
+    assert.strictEqual(utils.setCharset('text/html; charset=utf-8'), 'text/html; charset=utf-8');
+  });
+
+  it('should set charset', function () {
+    assert.strictEqual(utils.setCharset('text/html', 'utf-8'), 'text/html; charset=utf-8');
+  });
+
+  it('should override charset', function () {
+    assert.strictEqual(utils.setCharset('text/html; charset=iso-8859-1', 'utf-8'), 'text/html; charset=utf-8');
+  });
+});
+
 describe('utils.wetag(body, encoding)', function(){
   it('should support strings', function(){
     utils.wetag('express!')

From 9adfc2d586b18c485c94bf89943d579dd58fd1ba Mon Sep 17 00:00:00 2001
From: Elvin Yung <elvin@eventmobi.com>
Date: Tue, 3 Feb 2015 08:31:25 -0500
Subject: [PATCH 0761/1265] Fix typos in req.accepts jsdoc

closes #2527
---
 lib/request.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/request.js b/lib/request.js
index 5cd3900ee04..9058ca83288 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -63,12 +63,12 @@ req.header = function(name){
  * the best match when true, otherwise `undefined`, in which
  * case you should respond with 406 "Not Acceptable".
  *
- * The `type` value may be a single mime type string
- * such as "application/json", the extension name
- * such as "json", a comma-delimted list such as "json, html, text/plain",
+ * The `type` value may be a single MIME type string
+ * such as "application/json", an extension name
+ * such as "json", a comma-delimited list such as "json, html, text/plain",
  * an argument list such as `"json", "html", "text/plain"`,
  * or an array `["json", "html", "text/plain"]`. When a list
- * or array is given the _best_ match, if any is returned.
+ * or array is given, the _best_ match, if any is returned.
  *
  * Examples:
  *

From 24fce9deb374e7259f518e0bd69da8dffb6e282d Mon Sep 17 00:00:00 2001
From: Dmitriy <developer085@gmail.com>
Date: Mon, 9 Feb 2015 02:27:55 +0300
Subject: [PATCH 0762/1265] examples: fixes to mvc example

closes #2534
---
 examples/mvc/controllers/pet/views/edit.ejs | 2 +-
 examples/mvc/lib/boot.js                    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/mvc/controllers/pet/views/edit.ejs b/examples/mvc/controllers/pet/views/edit.ejs
index 91c52fec59f..fc697c25500 100644
--- a/examples/mvc/controllers/pet/views/edit.ejs
+++ b/examples/mvc/controllers/pet/views/edit.ejs
@@ -8,7 +8,7 @@
 <body>
 <h1><%= pet.name %></h1>
 <form action="/pet/<%= pet.id %>?_method=put" method="post">
-  <label>Name: <input type="text" name="user[name]" value="<%= pet.name %>"></label>
+  <label>Name: <input type="text" name="pet[name]" value="<%= pet.name %>"></label>
   <input type="submit" value="Update">
 </form>
 </body>
diff --git a/examples/mvc/lib/boot.js b/examples/mvc/lib/boot.js
index 82ac8a5186e..78e82db1bfb 100644
--- a/examples/mvc/lib/boot.js
+++ b/examples/mvc/lib/boot.js
@@ -66,7 +66,7 @@ module.exports = function(parent, options){
         app[method](path, obj.before, handler);
         verbose && console.log('     %s %s -> before -> %s', method.toUpperCase(), path, key);
       } else {
-        app[method](path, obj[key]);
+        app[method](path, handler);
         verbose && console.log('     %s %s -> %s', method.toUpperCase(), path, key);
       }
     }

From 3882ba4ba5adbc83ab0657945fa43edb132b74e8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 18 Feb 2015 23:09:47 -0500
Subject: [PATCH 0763/1265] docs: update badges

---
 Readme.md | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/Readme.md b/Readme.md
index 748e1ee81f3..479371e465e 100644
--- a/Readme.md
+++ b/Readme.md
@@ -121,15 +121,15 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d
 
   [MIT](LICENSE)
 
-[npm-image]: https://img.shields.io/npm/v/express.svg?style=flat
+[npm-image]: https://img.shields.io/npm/v/express.svg
 [npm-url]: https://npmjs.org/package/express
-[downloads-image]: https://img.shields.io/npm/dm/express.svg?style=flat
+[downloads-image]: https://img.shields.io/npm/dm/express.svg
 [downloads-url]: https://npmjs.org/package/express
-[travis-image]: https://img.shields.io/travis/strongloop/express.svg?style=flat
+[travis-image]: https://img.shields.io/travis/strongloop/express/master.svg
 [travis-url]: https://travis-ci.org/strongloop/express
-[coveralls-image]: https://img.shields.io/coveralls/strongloop/express.svg?style=flat
+[coveralls-image]: https://img.shields.io/coveralls/strongloop/express/master.svg
 [coveralls-url]: https://coveralls.io/r/strongloop/express?branch=master
-[gratipay-image-visionmedia]: https://img.shields.io/gratipay/visionmedia.svg?style=flat
+[gratipay-image-visionmedia]: https://img.shields.io/gratipay/visionmedia.svg
 [gratipay-url-visionmedia]: https://gratipay.com/visionmedia/
-[gratipay-image-dougwilson]: https://img.shields.io/gratipay/dougwilson.svg?style=flat
+[gratipay-image-dougwilson]: https://img.shields.io/gratipay/dougwilson.svg
 [gratipay-url-dougwilson]: https://gratipay.com/dougwilson/

From 028abf5d70bb610b9858937162e87e0f7674d049 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 18 Feb 2015 23:11:45 -0500
Subject: [PATCH 0764/1265] build: add AppVeyor

---
 .travis.yml  |  2 +-
 Readme.md    |  7 +++++--
 appveyor.yml | 13 +++++++++++++
 package.json |  4 ++--
 4 files changed, 21 insertions(+), 5 deletions(-)
 create mode 100644 appveyor.yml

diff --git a/.travis.yml b/.travis.yml
index c6be98178db..71e514c2a7a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -3,5 +3,5 @@ node_js:
   - "0.10"
   - "0.12"
 sudo: false
-script: "npm run-script test-travis"
+script: "npm run-script test-ci"
 after_script: "npm install coveralls@2.10.0 && cat ./coverage/lcov.info | coveralls"
diff --git a/Readme.md b/Readme.md
index 479371e465e..d2e7a8ba0ba 100644
--- a/Readme.md
+++ b/Readme.md
@@ -4,7 +4,8 @@
 
   [![NPM Version][npm-image]][npm-url]
   [![NPM Downloads][downloads-image]][downloads-url]
-  [![Build Status][travis-image]][travis-url]
+  [![Linux Build][travis-image]][travis-url]
+  [![Windows Build][appveyor-image]][appveyor-url]
   [![Test Coverage][coveralls-image]][coveralls-url]
 
 ```js
@@ -125,8 +126,10 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d
 [npm-url]: https://npmjs.org/package/express
 [downloads-image]: https://img.shields.io/npm/dm/express.svg
 [downloads-url]: https://npmjs.org/package/express
-[travis-image]: https://img.shields.io/travis/strongloop/express/master.svg
+[travis-image]: https://img.shields.io/travis/strongloop/express/master.svg?label=linux
 [travis-url]: https://travis-ci.org/strongloop/express
+[appveyor-image]: https://img.shields.io/appveyor/ci/dougwilson/express/master.svg?label=windows
+[appveyor-url]: https://ci.appveyor.com/project/dougwilson/express
 [coveralls-image]: https://img.shields.io/coveralls/strongloop/express/master.svg
 [coveralls-url]: https://coveralls.io/r/strongloop/express?branch=master
 [gratipay-image-visionmedia]: https://img.shields.io/gratipay/visionmedia.svg
diff --git a/appveyor.yml b/appveyor.yml
new file mode 100644
index 00000000000..c33a4240add
--- /dev/null
+++ b/appveyor.yml
@@ -0,0 +1,13 @@
+environment:
+  matrix:
+    - nodejs_version: "0.10"
+    - nodejs_version: "0.12"
+install:
+  - ps: Install-Product node $env:nodejs_version
+  - npm install
+build: off
+test_script:
+  - node --version
+  - npm --version
+  - npm run test-ci
+version: "{build}"
diff --git a/package.json b/package.json
index 92441cfe303..de02d5cf452 100644
--- a/package.json
+++ b/package.json
@@ -83,8 +83,8 @@
   ],
   "scripts": {
     "test": "mocha --require test/support/env --reporter spec --bail --check-leaks test/ test/acceptance/",
+    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
-    "test-tap": "mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/"
+    "test-tap": "mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/"
   }
 }

From 1507757f49ec70c11c102c98f15bca6f2ec34452 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 20 Feb 2015 19:09:56 -0500
Subject: [PATCH 0765/1265] deps: istanbul@0.3.6

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index de02d5cf452..f8db6413b5f 100644
--- a/package.json
+++ b/package.json
@@ -55,7 +55,7 @@
   "devDependencies": {
     "after": "0.8.1",
     "ejs": "2.1.4",
-    "istanbul": "0.3.5",
+    "istanbul": "0.3.6",
     "marked": "0.3.3",
     "mocha": "~2.1.0",
     "should": "~5.0.0",

From fa546bff852e6cc8aa268840775ae57700431bd4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 21 Feb 2015 15:10:12 -0500
Subject: [PATCH 0766/1265] deps: should@~5.0.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f8db6413b5f..e7b953c97d4 100644
--- a/package.json
+++ b/package.json
@@ -58,7 +58,7 @@
     "istanbul": "0.3.6",
     "marked": "0.3.3",
     "mocha": "~2.1.0",
-    "should": "~5.0.0",
+    "should": "~5.0.1",
     "supertest": "~0.15.0",
     "hjs": "~0.0.6",
     "body-parser": "~1.12.0",

From 8fe5fd89c6392c055bf9a05b7f0fe855b264a91d Mon Sep 17 00:00:00 2001
From: Seth Krasnianski <seth@mojotech.com>
Date: Sat, 21 Feb 2015 13:25:25 -0500
Subject: [PATCH 0767/1265] tests: fix error-handling typo

closes #2557
---
 test/req.signedCookies.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/req.signedCookies.js b/test/req.signedCookies.js
index 719cb464d0d..111a0f77df8 100644
--- a/test/req.signedCookies.js
+++ b/test/req.signedCookies.js
@@ -29,7 +29,7 @@ describe('req', function(){
         .get('/')
         .set('Cookie', cookie)
         .end(function(err, res){
-          if (err) return don(err);
+          if (err) return done(err);
           res.body.should.eql({ obj: { foo: 'bar' } });
           done();
         });

From adb6069bd00d729f9bb4743007c6f116bf7a4468 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 23 Feb 2015 00:27:17 -0500
Subject: [PATCH 0768/1265] deps: ejs@2.3.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e7b953c97d4..ca72762b83f 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,7 @@
   },
   "devDependencies": {
     "after": "0.8.1",
-    "ejs": "2.1.4",
+    "ejs": "2.3.1",
     "istanbul": "0.3.6",
     "marked": "0.3.3",
     "mocha": "~2.1.0",

From 51f960f2977566f8d671fc0e8154466a1b3d78ca Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 23 Feb 2015 00:56:49 -0500
Subject: [PATCH 0769/1265] 4.12.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 174851d5dc0..d32bd91bc79 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.12.0 / 2015-02-23
+===================
 
   * Fix `"trust proxy"` setting to inherit when app is mounted
   * Generate `ETag`s for all request responses
diff --git a/package.json b/package.json
index ca72762b83f..de216aeb92d 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.11.2",
+  "version": "4.12.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From bb4703e199cbbf62203730be275c81a0f7d68d47 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 28 Feb 2015 21:06:03 -0500
Subject: [PATCH 0770/1265] deps: remove un-used devDependency

---
 package.json | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/package.json b/package.json
index bc2042905d0..91744bfa260 100644
--- a/package.json
+++ b/package.json
@@ -55,8 +55,7 @@
     "marked": "0.3.3",
     "mocha": "~2.1.0",
     "should": "~5.0.0",
-    "supertest": "~0.15.0",
-    "hjs": "~0.0.6"
+    "supertest": "~0.15.0"
   },
   "engines": {
     "node": ">= 0.8.0"

From 20aa12616abac9466d590c9fb333fd8a0408eedc Mon Sep 17 00:00:00 2001
From: Paul Serby <paul.serby@clock.co.uk>
Date: Sat, 28 Feb 2015 17:06:37 +0000
Subject: [PATCH 0771/1265] Fix req.protocol/req.secure when using "trust
 proxy" hops count

fixes #2569
closes #2570
---
 History.md           |  5 +++++
 lib/request.js       |  2 +-
 test/req.protocol.js | 17 +++++++++++++++++
 test/req.secure.js   | 17 +++++++++++++++++
 4 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 3a215127e23..0ab72f31169 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+3.x
+===
+
+  * Fix `req.protocol`/`req.secure` when using "trust proxy" hops count
+
 3.20.0 / 2015-02-18
 ===================
 
diff --git a/lib/request.js b/lib/request.js
index c1392396c19..3bae7ad9bc9 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -358,7 +358,7 @@ req.__defineGetter__('protocol', function(){
     : 'http';
   var trust = this.app.get('trust proxy fn');
 
-  if (!trust(this.connection.remoteAddress)) {
+  if (!trust(this.connection.remoteAddress, 0)) {
     return proto;
   }
 
diff --git a/test/req.protocol.js b/test/req.protocol.js
index 80cad8a975f..453ad11ca4a 100644
--- a/test/req.protocol.js
+++ b/test/req.protocol.js
@@ -75,6 +75,23 @@ describe('req', function(){
         .get('/')
         .expect('http', done);
       })
+
+      describe('when trusting hop count', function () {
+        it('should respect X-Forwarded-Proto', function (done) {
+          var app = express();
+
+          app.set('trust proxy', 1);
+
+          app.use(function (req, res) {
+            res.end(req.protocol);
+          });
+
+          request(app)
+          .get('/')
+          .set('X-Forwarded-Proto', 'https')
+          .expect('https', done);
+        })
+      })
     })
 
     describe('when "trust proxy" is disabled', function(){
diff --git a/test/req.secure.js b/test/req.secure.js
index df9ae93fae6..2025c8786b6 100644
--- a/test/req.secure.js
+++ b/test/req.secure.js
@@ -78,6 +78,23 @@ describe('req', function(){
         .set('X-Forwarded-Proto', 'https, http')
         .expect('yes', done)
       })
+
+      describe('when "trust proxy" trusting hop count', function () {
+        it('should respect X-Forwarded-Proto', function (done) {
+          var app = express();
+
+          app.set('trust proxy', 1);
+
+          app.get('/', function (req, res) {
+            res.send(req.secure ? 'yes' : 'no');
+          });
+
+          request(app)
+          .get('/')
+          .set('X-Forwarded-Proto', 'https')
+          .expect('yes', done)
+        })
+      })
     })
   })
 })

From 2e0f5e781717a44fd07f08d1c28122e43794611b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 28 Feb 2015 21:32:51 -0500
Subject: [PATCH 0772/1265] Fix req.host when using "trust proxy" hops count

---
 History.md       |  1 +
 lib/request.js   |  2 +-
 test/req.host.js | 18 ++++++++++++++++++
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 0ab72f31169..96a64b0c668 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 3.x
 ===
 
+  * Fix `req.host` when using "trust proxy" hops count
   * Fix `req.protocol`/`req.secure` when using "trust proxy" hops count
 
 3.20.0 / 2015-02-18
diff --git a/lib/request.js b/lib/request.js
index 3bae7ad9bc9..efa002145fa 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -491,7 +491,7 @@ req.__defineGetter__('host', function(){
   var trust = this.app.get('trust proxy fn');
   var host = this.get('X-Forwarded-Host');
 
-  if (!host || !trust(this.connection.remoteAddress)) {
+  if (!host || !trust(this.connection.remoteAddress, 0)) {
     host = this.get('Host');
   }
 
diff --git a/test/req.host.js b/test/req.host.js
index 66cfff4e549..8fa3409054f 100644
--- a/test/req.host.js
+++ b/test/req.host.js
@@ -117,6 +117,24 @@ describe('req', function(){
         .set('Host', 'example.com')
         .expect('example.com', done);
       })
+
+      describe('when trusting hop count', function () {
+        it('should respect X-Forwarded-Host', function (done) {
+          var app = express();
+
+          app.set('trust proxy', 1);
+
+          app.use(function (req, res) {
+            res.end(req.host);
+          });
+
+          request(app)
+          .get('/')
+          .set('Host', 'localhost')
+          .set('X-Forwarded-Host', 'example.com')
+          .expect('example.com', done);
+        })
+      })
     })
 
     describe('when "trust proxy" is disabled', function(){

From 5873d335bd2d5a1447ef463076ca87413405bfe9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 28 Feb 2015 22:39:06 -0500
Subject: [PATCH 0773/1265] deps: ejs@2.3.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 91744bfa260..1483f009910 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
   },
   "devDependencies": {
     "connect-redis": "~1.5.0",
-    "ejs": "2.1.4",
+    "ejs": "2.3.1",
     "istanbul": "0.3.5",
     "marked": "0.3.3",
     "mocha": "~2.1.0",

From ef71373fa3f5d62cb7932f3dad0abc2d14f81fef Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 28 Feb 2015 22:39:55 -0500
Subject: [PATCH 0774/1265] deps: istanbul@0.3.6

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 1483f009910..2e772efad75 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
   "devDependencies": {
     "connect-redis": "~1.5.0",
     "ejs": "2.3.1",
-    "istanbul": "0.3.5",
+    "istanbul": "0.3.6",
     "marked": "0.3.3",
     "mocha": "~2.1.0",
     "should": "~5.0.0",

From 9ca0c66e23fe44e52500ad5e336014d1dfb808a6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 28 Feb 2015 22:41:01 -0500
Subject: [PATCH 0775/1265] build: skip unnecessary dependency in Travis CI

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 4af6d31b546..a13410d9ece 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -4,5 +4,6 @@ node_js:
   - "0.10"
   - "0.12"
 sudo: false
+before_install: "npm rm --save-dev connect-redis"
 script: "npm run-script test-travis"
 after_script: "npm install coveralls@2.10.0 && cat ./coverage/lcov.info | coveralls"

From b2311c74024ceeb90cd7f4c473b856593106ba65 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 28 Feb 2015 23:16:27 -0500
Subject: [PATCH 0776/1265] 3.20.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 96a64b0c668..606d893ff17 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.20.1 / 2015-02-28
+===================
 
   * Fix `req.host` when using "trust proxy" hops count
   * Fix `req.protocol`/`req.secure` when using "trust proxy" hops count
diff --git a/package.json b/package.json
index 2e772efad75..e33eedd528f 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.20.0",
+  "version": "3.20.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 7ee56bbe9cadd25a64e900c52d2cc6287d73ba9b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 28 Feb 2015 23:31:27 -0500
Subject: [PATCH 0777/1265] build: skip unnecessary depdency in AppVeyor

---
 appveyor.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/appveyor.yml b/appveyor.yml
index c33a4240add..c8b765d509d 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -4,6 +4,7 @@ environment:
     - nodejs_version: "0.12"
 install:
   - ps: Install-Product node $env:nodejs_version
+  - npm rm --save-dev connect-redis
   - npm install
 build: off
 test_script:

From 31cb541b881d40cb0a16de2aab3799785a138357 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 1 Mar 2015 16:33:09 -0500
Subject: [PATCH 0778/1265] Fix constructing application with non-configurable
 prototype properties

fixes #2561
---
 History.md     | 2 ++
 lib/express.js | 4 ++--
 package.json   | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 2770d6bf031..c2f06d42c08 100644
--- a/History.md
+++ b/History.md
@@ -1,8 +1,10 @@
 unreleased
 ==========
 
+  * Fix constructing application with non-configurable prototype properties
   * Fix `req.host` when using "trust proxy" hops count
   * Fix `req.protocol`/`req.secure` when using "trust proxy" hops count
+  * deps: merge-descriptors@1.0.0
 
 4.12.0 / 2015-02-23
 ===================
diff --git a/lib/express.js b/lib/express.js
index 8a6c28464a9..bb8d8082a49 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -28,8 +28,8 @@ function createApplication() {
     app.handle(req, res, next);
   };
 
-  mixin(app, proto);
-  mixin(app, EventEmitter.prototype);
+  mixin(app, EventEmitter.prototype, false);
+  mixin(app, proto, false);
 
   app.request = { __proto__: req, app: app };
   app.response = { __proto__: res, app: app };
diff --git a/package.json b/package.json
index a5bf135c1e0..c126ff9597b 100644
--- a/package.json
+++ b/package.json
@@ -37,6 +37,7 @@
     "etag": "~1.5.1",
     "finalhandler": "0.3.3",
     "fresh": "0.2.4",
+    "merge-descriptors": "1.0.0",
     "methods": "~1.1.1",
     "on-finished": "~2.2.0",
     "parseurl": "~1.3.0",
@@ -49,7 +50,6 @@
     "type-is": "~1.6.0",
     "vary": "~1.0.0",
     "cookie": "0.1.2",
-    "merge-descriptors": "0.0.2",
     "utils-merge": "1.0.0"
   },
   "devDependencies": {

From dbc61fc19186b693329895c6be51f32d262da6ea Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 1 Mar 2015 17:27:50 -0500
Subject: [PATCH 0779/1265] Fix wrong code on aborted connections from
 res.sendFile

---
 History.md           | 1 +
 lib/response.js      | 2 +-
 test/res.sendFile.js | 8 ++++----
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index c2f06d42c08..068ecc89fed 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,7 @@ unreleased
   * Fix constructing application with non-configurable prototype properties
   * Fix `req.host` when using "trust proxy" hops count
   * Fix `req.protocol`/`req.secure` when using "trust proxy" hops count
+  * Fix wrong `code` on aborted connections from `res.sendFile`
   * deps: merge-descriptors@1.0.0
 
 4.12.0 / 2015-02-23
diff --git a/lib/response.js b/lib/response.js
index d3759713a61..168bbf5b886 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -949,7 +949,7 @@ function sendfile(res, file, options, callback) {
     done = true;
 
     var err = new Error('Request aborted');
-    err.code = 'ECONNABORT';
+    err.code = 'ECONNABORTED';
     callback(err);
   }
 
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index c53e10ae672..b80f0462890 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -207,7 +207,7 @@ describe('res', function(){
         setImmediate(function () {
           res.sendFile(path.resolve(fixtures, 'name.txt'), function (err) {
             should(err).be.ok;
-            err.code.should.equal('ECONNABORT');
+            err.code.should.equal('ECONNABORTED');
             cb();
           });
         });
@@ -226,7 +226,7 @@ describe('res', function(){
         onFinished(res, function () {
           res.sendFile(path.resolve(fixtures, 'name.txt'), function (err) {
             should(err).be.ok;
-            err.code.should.equal('ECONNABORT');
+            err.code.should.equal('ECONNABORTED');
             cb();
           });
         });
@@ -323,7 +323,7 @@ describe('res', function(){
         setImmediate(function () {
           res.sendfile('test/fixtures/name.txt', function (err) {
             should(err).be.ok;
-            err.code.should.equal('ECONNABORT');
+            err.code.should.equal('ECONNABORTED');
             cb();
           });
         });
@@ -342,7 +342,7 @@ describe('res', function(){
         onFinished(res, function () {
           res.sendfile('test/fixtures/name.txt', function (err) {
             should(err).be.ok;
-            err.code.should.equal('ECONNABORT');
+            err.code.should.equal('ECONNABORTED');
             cb();
           });
         });

From 14a58759c3955d4129990b14ff7f6f621d446855 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 1 Mar 2015 17:28:48 -0500
Subject: [PATCH 0780/1265] Fix ECONNRESET errors from res.sendFile usage

fixes #2571
---
 History.md      | 1 +
 lib/response.js | 1 +
 2 files changed, 2 insertions(+)

diff --git a/History.md b/History.md
index 068ecc89fed..050ac51befb 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Fix constructing application with non-configurable prototype properties
+  * Fix `ECONNRESET` errors from `res.sendFile` usage
   * Fix `req.host` when using "trust proxy" hops count
   * Fix `req.protocol`/`req.secure` when using "trust proxy" hops count
   * Fix wrong `code` on aborted connections from `res.sendFile`
diff --git a/lib/response.js b/lib/response.js
index 168bbf5b886..a78d894c458 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -984,6 +984,7 @@ function sendfile(res, file, options, callback) {
 
   // finished
   function onfinish(err) {
+    if (err && err.code === 'ECONNRESET') return onaborted();
     if (err) return onerror(err);
     if (done) return;
 

From 1e6d2654a284f00c4bb92e201d87982e3dfb9a7c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 1 Mar 2015 19:11:02 -0500
Subject: [PATCH 0781/1265] 4.12.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 050ac51befb..cdf2bfd0c6a 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.12.1 / 2015-03-01
+===================
 
   * Fix constructing application with non-configurable prototype properties
   * Fix `ECONNRESET` errors from `res.sendFile` usage
diff --git a/package.json b/package.json
index c126ff9597b..25ad015addd 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.12.0",
+  "version": "4.12.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 7e0afa826816bea6fe048691fdb66bacdc517351 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 2 Mar 2015 13:11:31 -0500
Subject: [PATCH 0782/1265] Fix regression where "Request aborted" is logged
 using res.sendFile

closes #2571
---
 History.md      | 5 +++++
 lib/response.js | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index cdf2bfd0c6a..bab38b8deb0 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix regression where `"Request aborted"` is logged using `res.sendFile`
+
 4.12.1 / 2015-03-01
 ===================
 
diff --git a/lib/response.js b/lib/response.js
index a78d894c458..b759eb95e42 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -404,7 +404,7 @@ res.sendFile = function sendFile(path, options, fn) {
     if (err && err.code === 'EISDIR') return next();
 
     // next() all but write errors
-    if (err && err.code !== 'ECONNABORT' && err.syscall !== 'write') {
+    if (err && err.code !== 'ECONNABORTED' && err.syscall !== 'write') {
       next(err);
     }
   });

From dee9fbbbda2f2483c657cf912f68db1a5ba1fcac Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 3 Mar 2015 00:06:24 -0500
Subject: [PATCH 0783/1265] 4.12.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index bab38b8deb0..ee3e97aa5f4 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.12.2 / 2015-03-02
+===================
 
   * Fix regression where `"Request aborted"` is logged using `res.sendFile`
 
diff --git a/package.json b/package.json
index 25ad015addd..4257a7fbf62 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.12.1",
+  "version": "4.12.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From d34d60ce92f363b703fdc7a030e7cd38f17caacc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 00:13:14 -0400
Subject: [PATCH 0784/1265] deps: mocha@~2.2.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e33eedd528f..ff14962cdb3 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "ejs": "2.3.1",
     "istanbul": "0.3.6",
     "marked": "0.3.3",
-    "mocha": "~2.1.0",
+    "mocha": "~2.2.1",
     "should": "~5.0.0",
     "supertest": "~0.15.0"
   },

From 5d8a7a610f99701d694da6a020ad28b4f9f88507 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 00:14:09 -0400
Subject: [PATCH 0785/1265] deps: should@~5.2.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ff14962cdb3..db12797a2c7 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,7 @@
     "istanbul": "0.3.6",
     "marked": "0.3.3",
     "mocha": "~2.2.1",
-    "should": "~5.0.0",
+    "should": "~5.2.0",
     "supertest": "~0.15.0"
   },
   "engines": {

From 20c040db22bd3b7167c32055df6363d1a540c1e2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 00:15:07 -0400
Subject: [PATCH 0786/1265] deps: istanbul@0.3.8

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index db12797a2c7..53d7153bbfa 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
   "devDependencies": {
     "connect-redis": "~1.5.0",
     "ejs": "2.3.1",
-    "istanbul": "0.3.6",
+    "istanbul": "0.3.8",
     "marked": "0.3.3",
     "mocha": "~2.2.1",
     "should": "~5.2.0",

From 100e50f23dc57367dd99f9a401bdd5b355b24193 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 00:17:34 -0400
Subject: [PATCH 0787/1265] deps: connect@2.29.1

---
 History.md   | 18 ++++++++++++++++++
 package.json |  2 +-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 606d893ff17..6ef21f759eb 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,21 @@
+3.x
+===
+
+  * deps: connect@2.29.1
+    - deps: body-parser@~1.12.2
+    - deps: compression@~1.4.3
+    - deps: connect-timeout@~1.6.1
+    - deps: debug@~2.1.3
+    - deps: errorhandler@~1.3.5
+    - deps: express-session@~1.10.4
+    - deps: finalhandler@0.3.4
+    - deps: method-override@~2.3.2
+    - deps: morgan@~1.5.2
+    - deps: qs@2.4.1
+    - deps: serve-index@~1.6.3
+    - deps: serve-static@~1.9.2
+    - deps: type-is@~1.6.1
+
 3.20.1 / 2015-02-28
 ===================
 
diff --git a/package.json b/package.json
index 53d7153bbfa..093df5c2d4d 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.29.0",
+    "connect": "2.29.1",
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",
     "commander": "2.6.0",

From ff44e0f9ae51709eefe93c04cd7ea265b3997771 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 00:21:58 -0400
Subject: [PATCH 0788/1265] deps: send@0.12.2

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 6ef21f759eb..9bc2a129c28 100644
--- a/History.md
+++ b/History.md
@@ -15,6 +15,9 @@
     - deps: serve-index@~1.6.3
     - deps: serve-static@~1.9.2
     - deps: type-is@~1.6.1
+  * deps: send@0.12.2
+    - Throw errors early for invalid `extensions` or `index` options
+    - deps: debug@~2.1.3
 
 3.20.1 / 2015-02-28
 ===================
diff --git a/package.json b/package.json
index 093df5c2d4d..ee809a9900a 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
     "parseurl": "~1.3.0",
     "proxy-addr": "~1.0.6",
     "range-parser": "~1.0.2",
-    "send": "0.12.1",
+    "send": "0.12.2",
     "utils-merge": "1.0.0",
     "vary": "~1.0.0",
     "cookie": "0.1.2",

From d7a6d709affd76b3cf14f7b870c5c09d78644d8f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 00:23:23 -0400
Subject: [PATCH 0789/1265] deps: merge-descriptors@1.0.0

---
 History.md   | 1 +
 package.json | 6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 9bc2a129c28..01453bcadf9 100644
--- a/History.md
+++ b/History.md
@@ -15,6 +15,7 @@
     - deps: serve-index@~1.6.3
     - deps: serve-static@~1.9.2
     - deps: type-is@~1.6.1
+  * deps: merge-descriptors@1.0.0
   * deps: send@0.12.2
     - Throw errors early for invalid `extensions` or `index` options
     - deps: debug@~2.1.3
diff --git a/package.json b/package.json
index ee809a9900a..60ffa192f16 100644
--- a/package.json
+++ b/package.json
@@ -31,12 +31,14 @@
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",
     "commander": "2.6.0",
+    "cookie": "0.1.2",
     "cookie-signature": "1.0.6",
     "debug": "~2.1.1",
     "depd": "~1.0.0",
     "escape-html": "1.0.1",
     "etag": "~1.5.1",
     "fresh": "0.2.4",
+    "merge-descriptors": "1.0.0",
     "methods": "~1.1.1",
     "mkdirp": "0.5.0",
     "parseurl": "~1.3.0",
@@ -44,9 +46,7 @@
     "range-parser": "~1.0.2",
     "send": "0.12.2",
     "utils-merge": "1.0.0",
-    "vary": "~1.0.0",
-    "cookie": "0.1.2",
-    "merge-descriptors": "0.0.2"
+    "vary": "~1.0.0"
   },
   "devDependencies": {
     "connect-redis": "~1.5.0",

From 6744f811b4ba6497683ab1e2327f2156caae700f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 00:25:00 -0400
Subject: [PATCH 0790/1265] deps: debug@~2.1.3

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 01453bcadf9..f9c91ae035a 100644
--- a/History.md
+++ b/History.md
@@ -15,6 +15,9 @@
     - deps: serve-index@~1.6.3
     - deps: serve-static@~1.9.2
     - deps: type-is@~1.6.1
+  * deps: debug@~2.1.3
+    - Fix high intensity foreground color for bold
+    - deps: ms@0.7.0
   * deps: merge-descriptors@1.0.0
   * deps: send@0.12.2
     - Throw errors early for invalid `extensions` or `index` options
diff --git a/package.json b/package.json
index 60ffa192f16..f2a919733a9 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "commander": "2.6.0",
     "cookie": "0.1.2",
     "cookie-signature": "1.0.6",
-    "debug": "~2.1.1",
+    "debug": "~2.1.3",
     "depd": "~1.0.0",
     "escape-html": "1.0.1",
     "etag": "~1.5.1",

From 279c8bbec306768c5a22ca9cd0b237ec1c4c2a00 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 00:47:15 -0400
Subject: [PATCH 0791/1265] deps: proxy-addr@~1.0.7

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f9c91ae035a..4ecb2e35fa5 100644
--- a/History.md
+++ b/History.md
@@ -19,6 +19,8 @@
     - Fix high intensity foreground color for bold
     - deps: ms@0.7.0
   * deps: merge-descriptors@1.0.0
+  * deps: proxy-addr@~1.0.7
+    - deps: ipaddr.js@0.1.9
   * deps: send@0.12.2
     - Throw errors early for invalid `extensions` or `index` options
     - deps: debug@~2.1.3
diff --git a/package.json b/package.json
index f2a919733a9..6d1a39d0a04 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
     "methods": "~1.1.1",
     "mkdirp": "0.5.0",
     "parseurl": "~1.3.0",
-    "proxy-addr": "~1.0.6",
+    "proxy-addr": "~1.0.7",
     "range-parser": "~1.0.2",
     "send": "0.12.2",
     "utils-merge": "1.0.0",

From 389ab1b19fe5af63f4dbd119050c604ddcd60885 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 01:02:08 -0400
Subject: [PATCH 0792/1265] tests: add test for cookie-sessions example

---
 test/acceptance/cookie-sessions.js | 36 ++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 test/acceptance/cookie-sessions.js

diff --git a/test/acceptance/cookie-sessions.js b/test/acceptance/cookie-sessions.js
new file mode 100644
index 00000000000..ad950fc9c21
--- /dev/null
+++ b/test/acceptance/cookie-sessions.js
@@ -0,0 +1,36 @@
+
+var app = require('../../examples/cookie-sessions')
+var request = require('supertest')
+
+function getCookie(res) {
+  return res.headers['set-cookie'][0].split(';')[0]
+}
+
+describe('cookie-sessions', function () {
+  describe('GET /', function () {
+    it('should display no views', function (done) {
+      request(app)
+      .get('/')
+      .expect(200, 'viewed 0 times\n', done)
+    })
+
+    it('should set a session cookie', function (done) {
+      request(app)
+      .get('/')
+      .expect('Set-Cookie', /connect\.sess=/)
+      .expect(200, done)
+    })
+
+    it('should display 1 view on revisit', function (done) {
+      request(app)
+      .get('/')
+      .expect(200, 'viewed 0 times\n', function (err, res) {
+        if (err) return done(err)
+        request(app)
+        .get('/')
+        .set('Cookie', getCookie(res))
+        .expect(200, 'viewed 1 times\n', done)
+      })
+    })
+  })
+})

From 011e5dc24185eb213cfc09e027498ca34c742103 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 01:03:53 -0400
Subject: [PATCH 0793/1265] 3.20.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 4ecb2e35fa5..e1b644528c7 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.20.2 / 2015-03-16
+===================
 
   * deps: connect@2.29.1
     - deps: body-parser@~1.12.2
diff --git a/package.json b/package.json
index 6d1a39d0a04..475efa018a9 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.20.1",
+  "version": "3.20.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 9d16bae6821616033389c6cb20652453d155b586 Mon Sep 17 00:00:00 2001
From: Roman Zubenko <romanz@bu.edu>
Date: Wed, 11 Mar 2015 19:44:45 -0400
Subject: [PATCH 0794/1265] docs: fix typo in readme

closes #2584
---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index d2e7a8ba0ba..65aed5c99ae 100644
--- a/Readme.md
+++ b/Readme.md
@@ -103,7 +103,7 @@ $ node examples/content-negotiation
 
 ## Tests
 
-  To run the test suite, first install the dependancies, then run `npm test`:
+  To run the test suite, first install the dependencies, then run `npm test`:
 
 ```bash
 $ npm install

From 1114ca1ab651707abaf5d7505d9d5144cc1bbd89 Mon Sep 17 00:00:00 2001
From: Phat <damphat@gmail.com>
Date: Sat, 14 Mar 2015 17:52:47 +0700
Subject: [PATCH 0795/1265] tests: fix assert usage mistake

fixes #2592
---
 test/app.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/app.js b/test/app.js
index 117f4dffeb5..941d35ff1cc 100644
--- a/test/app.js
+++ b/test/app.js
@@ -12,7 +12,7 @@ describe('app', function(){
 
   it('should be callable', function(){
     var app = express();
-    assert(typeof app, 'function');
+    assert.equal(typeof app, 'function');
   })
 
   it('should 404 without routes', function(done){

From 01e059ca742dc606a2951f9d8bd5b6bcd31a438c Mon Sep 17 00:00:00 2001
From: Yang Wang <250801860@qq.com>
Date: Fri, 13 Mar 2015 21:13:34 +0800
Subject: [PATCH 0796/1265] examples: add missing cookie-session module

fixes #2589
---
 examples/cookie-sessions/index.js | 1 +
 package.json                      | 1 +
 2 files changed, 2 insertions(+)

diff --git a/examples/cookie-sessions/index.js b/examples/cookie-sessions/index.js
index b7b9ce51e10..73653f63af9 100644
--- a/examples/cookie-sessions/index.js
+++ b/examples/cookie-sessions/index.js
@@ -2,6 +2,7 @@
  * Module dependencies.
  */
 
+var cookieSession = require('cookie-session');
 var express = require('../../');
 
 var app = module.exports = express();
diff --git a/package.json b/package.json
index 4257a7fbf62..344cde52481 100644
--- a/package.json
+++ b/package.json
@@ -63,6 +63,7 @@
     "body-parser": "~1.12.0",
     "connect-redis": "~2.2.0",
     "cookie-parser": "~1.3.4",
+    "cookie-session": "~1.1.0",
     "express-session": "~1.10.3",
     "jade": "~1.9.2",
     "method-override": "~2.3.1",

From 410f561b1bce997a39f119e3691f7fd2727839ae Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 01:57:36 -0400
Subject: [PATCH 0797/1265] deps: serve-static@~1.9.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 2dee7de4563..e1559a0bd82 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,8 @@ unreleased
   * deps: send@0.12.2
     - Throw errors early for invalid `extensions` or `index` options
     - deps: debug@~2.1.3
+  * deps: serve-static@~1.9.2
+    - deps: send@0.12.2
 
 4.12.2 / 2015-03-02
 ===================
diff --git a/package.json b/package.json
index 875dda8f5da..963d6617937 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
     "qs": "2.3.3",
     "range-parser": "~1.0.2",
     "send": "0.12.2",
-    "serve-static": "~1.9.1",
+    "serve-static": "~1.9.2",
     "type-is": "~1.6.0",
     "vary": "~1.0.0",
     "utils-merge": "1.0.0"

From 9e3727bb23ed6f5560565fceb4b9a1be1b3efc41 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 01:58:25 -0400
Subject: [PATCH 0798/1265] deps: finalhandler@0.3.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e1559a0bd82..fe6823e2124 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,8 @@ unreleased
   * deps: debug@~2.1.3
     - Fix high intensity foreground color for bold
     - deps: ms@0.7.0
+  * deps: finalhandler@0.3.4
+    - deps: debug@~2.1.3
   * deps: proxy-addr@~1.0.7
     - deps: ipaddr.js@0.1.9
   * deps: send@0.12.2
diff --git a/package.json b/package.json
index 963d6617937..f801e1d082c 100644
--- a/package.json
+++ b/package.json
@@ -36,7 +36,7 @@
     "depd": "~1.0.0",
     "escape-html": "1.0.1",
     "etag": "~1.5.1",
-    "finalhandler": "0.3.3",
+    "finalhandler": "0.3.4",
     "fresh": "0.2.4",
     "merge-descriptors": "1.0.0",
     "methods": "~1.1.1",

From 07217205bb6bf04a7740cf178dbe375c65cac39a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 01:59:10 -0400
Subject: [PATCH 0799/1265] deps: type-is@~1.6.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index fe6823e2124..102659723a2 100644
--- a/History.md
+++ b/History.md
@@ -13,6 +13,8 @@ unreleased
     - deps: debug@~2.1.3
   * deps: serve-static@~1.9.2
     - deps: send@0.12.2
+  * deps: type-is@~1.6.1
+    - deps: mime-types@~2.0.10
 
 4.12.2 / 2015-03-02
 ===================
diff --git a/package.json b/package.json
index f801e1d082c..e8021c6cf6c 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "range-parser": "~1.0.2",
     "send": "0.12.2",
     "serve-static": "~1.9.2",
-    "type-is": "~1.6.0",
+    "type-is": "~1.6.1",
     "vary": "~1.0.0",
     "utils-merge": "1.0.0"
   },

From d0a830bb425c687337629ddbb815077858cdbc51 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 02:00:03 -0400
Subject: [PATCH 0800/1265] deps: accepts@~1.2.5

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 102659723a2..328cbeae43b 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,8 @@
 unreleased
 ==========
 
+  * deps: accepts@~1.2.5
+    - deps: mime-types@~2.0.10
   * deps: debug@~2.1.3
     - Fix high intensity foreground color for bold
     - deps: ms@0.7.0
diff --git a/package.json b/package.json
index e8021c6cf6c..982e68f91ac 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.2.4",
+    "accepts": "~1.2.5",
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",
     "cookie": "0.1.2",

From 8ddf158d8960e2dfe7b2f90c9025564832dadcba Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 02:00:56 -0400
Subject: [PATCH 0801/1265] deps: qs@2.4.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 328cbeae43b..8b528a793ab 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,8 @@ unreleased
     - deps: debug@~2.1.3
   * deps: proxy-addr@~1.0.7
     - deps: ipaddr.js@0.1.9
+  * deps: qs@2.4.1
+    - Fix error when parameter `hasOwnProperty` is present
   * deps: send@0.12.2
     - Throw errors early for invalid `extensions` or `index` options
     - deps: debug@~2.1.3
diff --git a/package.json b/package.json
index 982e68f91ac..34b663fd1f0 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "~1.0.7",
-    "qs": "2.3.3",
+    "qs": "2.4.1",
     "range-parser": "~1.0.2",
     "send": "0.12.2",
     "serve-static": "~1.9.2",

From 4597e118ae7c5d945d4374b572a2a570fc2acf84 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 02:02:23 -0400
Subject: [PATCH 0802/1265] deps: update example dependencies

---
 package.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 34b663fd1f0..be40affcc49 100644
--- a/package.json
+++ b/package.json
@@ -60,14 +60,14 @@
     "mocha": "~2.2.1",
     "should": "~5.2.0",
     "supertest": "~0.15.0",
-    "body-parser": "~1.12.0",
+    "body-parser": "~1.12.2",
     "connect-redis": "~2.2.0",
     "cookie-parser": "~1.3.4",
     "cookie-session": "~1.1.0",
-    "express-session": "~1.10.3",
+    "express-session": "~1.10.4",
     "jade": "~1.9.2",
-    "method-override": "~2.3.1",
-    "morgan": "~1.5.1",
+    "method-override": "~2.3.2",
+    "morgan": "~1.5.2",
     "multiparty": "~4.1.1",
     "vhost": "~3.0.0"
   },

From c894c84e4ab1d3bc08d7776d437131244bc6329b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 02:03:36 -0400
Subject: [PATCH 0803/1265] build: support io.js 1.x

closes #2539
---
 .travis.yml          |  2 ++
 appveyor.yml         |  2 ++
 test/res.send.js     |  7 ++-----
 test/res.sendFile.js | 13 ++++---------
 4 files changed, 10 insertions(+), 14 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 91038947d01..dc2e2c8e236 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -2,6 +2,8 @@ language: node_js
 node_js:
   - "0.10"
   - "0.12"
+  - "1.0"
+  - "1.5"
 sudo: false
 before_install: "npm rm --save-dev connect-redis"
 script: "npm run-script test-ci"
diff --git a/appveyor.yml b/appveyor.yml
index c8b765d509d..eb8dbcc6d1b 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -2,6 +2,8 @@ environment:
   matrix:
     - nodejs_version: "0.10"
     - nodejs_version: "0.12"
+    - nodejs_version: "1.0"
+    - nodejs_version: "1.5"
 install:
   - ps: Install-Product node $env:nodejs_version
   - npm rm --save-dev connect-redis
diff --git a/test/res.send.js b/test/res.send.js
index 6c1361b5b1c..c5040631fe6 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -16,7 +16,7 @@ describe('res', function(){
       request(app)
       .get('/')
       .expect('Content-Length', '0')
-      .expect('', done);
+      .expect(200, '', done);
     })
   })
 
@@ -30,10 +30,7 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('', function(req, res){
-        res.header.should.not.have.property('content-length');
-        done();
-      });
+      .expect(200, '', done);
     })
   })
 
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index b80f0462890..f4868b39766 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -388,12 +388,12 @@ describe('res', function(){
     });
 
     it('should invoke the callback on 404', function(done){
-      var app = express()
-        , calls = 0;
+      var app = express();
+      var calls = 0;
 
       app.use(function(req, res){
         res.sendfile('test/fixtures/nope.html', function(err){
-          ++calls;
+          assert.equal(calls++, 0);
           assert(!res.headersSent);
           res.send(err.message);
         });
@@ -401,12 +401,7 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        assert(1 == calls, 'called too many times');
-        res.text.should.startWith("ENOENT, stat");
-        res.statusCode.should.equal(200);
-        done();
-      });
+      .expect(200, /^ENOENT.*?, stat/, done);
     })
 
     it('should not override manual content-types', function(done){

From f56463f8bf24015736978d0dc4d398fa22a9d758 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 17 Mar 2015 10:59:48 -0400
Subject: [PATCH 0804/1265] 4.12.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 8b528a793ab..c0b9ed6e602 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.12.3 / 2015-03-17
+===================
 
   * deps: accepts@~1.2.5
     - deps: mime-types@~2.0.10
diff --git a/package.json b/package.json
index be40affcc49..3c693a57700 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.12.2",
+  "version": "4.12.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 2f8a69b7101e212e0e18bed1509cd2e7343148db Mon Sep 17 00:00:00 2001
From: Igor Mozharovsky <unix.nb@gmail.com>
Date: Wed, 18 Mar 2015 20:25:11 +0200
Subject: [PATCH 0805/1265] docs: fix typo in readme

closes #2598
---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 65aed5c99ae..8da83a517e1 100644
--- a/Readme.md
+++ b/Readme.md
@@ -87,7 +87,7 @@ $ npm start
 
 ## Examples
 
-  To view the examples, clone the Express repo and install the dependancies:
+  To view the examples, clone the Express repo and install the dependencies:
 
 ```bash
 $ git clone git://github.com/strongloop/express.git --depth 1

From bbcc1e1f52cb3706660d88bc2884057d71ae1f92 Mon Sep 17 00:00:00 2001
From: Alex Dixon <email@alexdixon.io>
Date: Thu, 19 Mar 2015 17:54:36 -0700
Subject: [PATCH 0806/1265] examples: fix route-separation example's dev logger

closes #2599
---
 examples/route-separation/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/route-separation/index.js b/examples/route-separation/index.js
index bac61ea8944..3d93d5cfd9c 100644
--- a/examples/route-separation/index.js
+++ b/examples/route-separation/index.js
@@ -21,7 +21,7 @@ app.set('views', __dirname + '/views');
 
 /* istanbul ignore next */
 if (!module.parent) {
-  app.use(express.logger('dev'));
+  app.use(logger('dev'));
 }
 
 app.use(methodOverride('_method'));

From ab3e7b2465e07f0c63c66a4c520ed87c861b704f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 11 Apr 2015 09:54:09 -0400
Subject: [PATCH 0807/1265] examples: remove problematic file from download
 example

closes #2393
---
 .../files/utf-8 \355\225\234\344\270\255\346\227\245.txt"        | 1 -
 examples/downloads/index.js                                      | 1 -
 2 files changed, 2 deletions(-)
 delete mode 100644 "examples/downloads/files/utf-8 \355\225\234\344\270\255\346\227\245.txt"

diff --git "a/examples/downloads/files/utf-8 \355\225\234\344\270\255\346\227\245.txt" "b/examples/downloads/files/utf-8 \355\225\234\344\270\255\346\227\245.txt"
deleted file mode 100644
index 2a4ee9c7d25..00000000000
--- "a/examples/downloads/files/utf-8 \355\225\234\344\270\255\346\227\245.txt"	
+++ /dev/null
@@ -1 +0,0 @@
-한中日
\ No newline at end of file
diff --git a/examples/downloads/index.js b/examples/downloads/index.js
index d7bdc0c0430..6ab6ba0213e 100644
--- a/examples/downloads/index.js
+++ b/examples/downloads/index.js
@@ -8,7 +8,6 @@ var app = module.exports = express();
 app.get('/', function(req, res){
   res.send('<ul>'
     + '<li>Download <a href="/files/amazing.txt">amazing.txt</a>.</li>'
-    + '<li>Download <a href="/files/utf-8 한中日.txt">utf-8 한中日.txt</a>.</li>'
     + '<li>Download <a href="/files/missing.txt">missing.txt</a>.</li>'
     + '<li>Download <a href="/files/CCTV大赛上海分赛区.txt">CCTV大赛上海分赛区.txt</a>.</li>'
     + '</ul>');

From 8dd1b3a61802a4bd74cd803c6f8a95783dfc1f6a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 11 Apr 2015 09:59:44 -0400
Subject: [PATCH 0808/1265] build: io.js@1.6

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index dc2e2c8e236..d51b8d188dc 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -3,7 +3,7 @@ node_js:
   - "0.10"
   - "0.12"
   - "1.0"
-  - "1.5"
+  - "1.6"
 sudo: false
 before_install: "npm rm --save-dev connect-redis"
 script: "npm run-script test-ci"
diff --git a/appveyor.yml b/appveyor.yml
index eb8dbcc6d1b..1f48f1812a0 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -3,7 +3,7 @@ environment:
     - nodejs_version: "0.10"
     - nodejs_version: "0.12"
     - nodejs_version: "1.0"
-    - nodejs_version: "1.5"
+    - nodejs_version: "1.6"
 install:
   - ps: Install-Product node $env:nodejs_version
   - npm rm --save-dev connect-redis

From ea6e4d3b6f434016a60e4d077d37fd7e76744eb6 Mon Sep 17 00:00:00 2001
From: Ignacio Carbajo <icarbajop@gmail.com>
Date: Fri, 1 May 2015 16:15:27 +0200
Subject: [PATCH 0809/1265] tests: add a missing test description

closes #2631
---
 test/app.all.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/app.all.js b/test/app.all.js
index a0c68d429d5..e9ef08831df 100644
--- a/test/app.all.js
+++ b/test/app.all.js
@@ -19,7 +19,7 @@ describe('app.all()', function(){
     });
   })
 
-  it('should ', function(done){
+  it('should run the callback for a method just once', function(done){
     var app = express()
       , n = 0;
 

From 6d43bacb4691f255e8d67a8d074e7a3062c8cd5a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 1 May 2015 22:24:05 -0400
Subject: [PATCH 0810/1265] build: io.js@1.8

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index d51b8d188dc..b163d5dc22d 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -3,7 +3,7 @@ node_js:
   - "0.10"
   - "0.12"
   - "1.0"
-  - "1.6"
+  - "1.8"
 sudo: false
 before_install: "npm rm --save-dev connect-redis"
 script: "npm run-script test-ci"
diff --git a/appveyor.yml b/appveyor.yml
index 1f48f1812a0..8be4511b02a 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -3,7 +3,7 @@ environment:
     - nodejs_version: "0.10"
     - nodejs_version: "0.12"
     - nodejs_version: "1.0"
-    - nodejs_version: "1.6"
+    - nodejs_version: "1.8"
 install:
   - ps: Install-Product node $env:nodejs_version
   - npm rm --save-dev connect-redis

From d0e8ac795d580a4da9a84aa6574fe6d8134ace9f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 17 May 2015 20:56:52 -0400
Subject: [PATCH 0811/1265] deps: connect@2.29.2

---
 History.md   | 20 ++++++++++++++++++++
 package.json |  2 +-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e1b644528c7..426ba80dfb4 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,23 @@
+3.x
+===
+
+  * deps: connect@2.29.2
+    - deps: body-parser@~1.12.4
+    - deps: compression@~1.4.4
+    - deps: connect-timeout@~1.6.2
+    - deps: debug@~2.2.0
+    - deps: depd@~1.0.1
+    - deps: errorhandler@~1.3.6
+    - deps: finalhandler@0.3.6
+    - deps: method-override@~2.3.3
+    - deps: morgan@~1.5.3
+    - deps: qs@2.4.2
+    - deps: response-time@~2.3.1
+    - deps: serve-favicon@~2.2.1
+    - deps: serve-index@~1.6.4
+    - deps: serve-static@~1.9.3
+    - deps: type-is@~1.6.2
+
 3.20.2 / 2015-03-16
 ===================
 
diff --git a/package.json b/package.json
index 475efa018a9..72dd1d49320 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.29.1",
+    "connect": "2.29.2",
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",
     "commander": "2.6.0",

From cac867da843e611c26bb208eb98f6c76dbade826 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 17 May 2015 20:58:21 -0400
Subject: [PATCH 0812/1265] deps: istanbul@0.3.9

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 72dd1d49320..eab6e8f5051 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
   "devDependencies": {
     "connect-redis": "~1.5.0",
     "ejs": "2.3.1",
-    "istanbul": "0.3.8",
+    "istanbul": "0.3.9",
     "marked": "0.3.3",
     "mocha": "~2.2.1",
     "should": "~5.2.0",

From c90de122c8fe8e3296275d74eb3db6c0bc7c2f25 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 17 May 2015 20:59:02 -0400
Subject: [PATCH 0813/1265] deps: mocha@2.2.5

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index eab6e8f5051..62274cca2a9 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "ejs": "2.3.1",
     "istanbul": "0.3.9",
     "marked": "0.3.3",
-    "mocha": "~2.2.1",
+    "mocha": "2.2.5",
     "should": "~5.2.0",
     "supertest": "~0.15.0"
   },

From f7455227e05b55f21ece5064688c66f5b3f10a90 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 17 May 2015 21:04:02 -0400
Subject: [PATCH 0814/1265] deps: proxy-addr@~1.0.8

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 426ba80dfb4..b13be3bc43b 100644
--- a/History.md
+++ b/History.md
@@ -17,6 +17,8 @@
     - deps: serve-index@~1.6.4
     - deps: serve-static@~1.9.3
     - deps: type-is@~1.6.2
+  * deps: proxy-addr@~1.0.8
+    - deps: ipaddr.js@1.0.1
 
 3.20.2 / 2015-03-16
 ===================
diff --git a/package.json b/package.json
index 62274cca2a9..5c5fcfbc3d0 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
     "methods": "~1.1.1",
     "mkdirp": "0.5.0",
     "parseurl": "~1.3.0",
-    "proxy-addr": "~1.0.7",
+    "proxy-addr": "~1.0.8",
     "range-parser": "~1.0.2",
     "send": "0.12.2",
     "utils-merge": "1.0.0",

From 519f655f1785f8f66cfa26053efabaf250c06465 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 17 May 2015 21:07:06 -0400
Subject: [PATCH 0815/1265] deps: send@0.12.3

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index b13be3bc43b..b699462ea1e 100644
--- a/History.md
+++ b/History.md
@@ -19,6 +19,12 @@
     - deps: type-is@~1.6.2
   * deps: proxy-addr@~1.0.8
     - deps: ipaddr.js@1.0.1
+  * deps: send@0.12.3
+    - deps: debug@~2.2.0
+    - deps: depd@~1.0.1
+    - deps: etag@~1.6.0
+    - deps: ms@0.7.1
+    - deps: on-finished@~2.2.1
 
 3.20.2 / 2015-03-16
 ===================
diff --git a/package.json b/package.json
index 5c5fcfbc3d0..722d0b17188 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "parseurl": "~1.3.0",
     "proxy-addr": "~1.0.8",
     "range-parser": "~1.0.2",
-    "send": "0.12.2",
+    "send": "0.12.3",
     "utils-merge": "1.0.0",
     "vary": "~1.0.0"
   },

From 96b4a76382a274f1d68b2f69bf0b9502062d51ef Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 17 May 2015 23:38:35 -0400
Subject: [PATCH 0816/1265] deps: depd@~1.0.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index b699462ea1e..80aec28c521 100644
--- a/History.md
+++ b/History.md
@@ -17,6 +17,7 @@
     - deps: serve-index@~1.6.4
     - deps: serve-static@~1.9.3
     - deps: type-is@~1.6.2
+  * deps: depd@~1.0.1
   * deps: proxy-addr@~1.0.8
     - deps: ipaddr.js@1.0.1
   * deps: send@0.12.3
diff --git a/package.json b/package.json
index 722d0b17188..d3bd623f423 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "cookie": "0.1.2",
     "cookie-signature": "1.0.6",
     "debug": "~2.1.3",
-    "depd": "~1.0.0",
+    "depd": "~1.0.1",
     "escape-html": "1.0.1",
     "etag": "~1.5.1",
     "fresh": "0.2.4",

From 7df8fa3be5a3a5b528f6192afe9b1b04cefce6c5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 17 May 2015 23:44:09 -0400
Subject: [PATCH 0817/1265] deps: supertest@1.0.1

---
 examples/params/app.js    | 12 ++++++++++--
 package.json              |  2 +-
 test/acceptance/mvc.js    |  4 ++--
 test/acceptance/params.js |  8 ++++----
 4 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/examples/params/app.js b/examples/params/app.js
index 69973c878cd..e1a4b693aa7 100644
--- a/examples/params/app.js
+++ b/examples/params/app.js
@@ -16,12 +16,20 @@ var users = [
   , { name: 'bandit' }
 ];
 
+// Create HTTP error
+
+function createError(status, message) {
+  var err = new Error(message);
+  err.status = status;
+  return err;
+}
+
 // Convert :to and :from to integers
 
 app.param(['to', 'from'], function(req, res, next, num, name){ 
   req.params[name] = parseInt(num, 10);
   if( isNaN(req.params[name]) ){
-    next(new Error('failed to parseInt '+num));
+    next(createError(400, 'failed to parseInt '+num));
   } else {
     next();
   }
@@ -33,7 +41,7 @@ app.param('user', function(req, res, next, id){
   if (req.user = users[id]) {
     next();
   } else {
-    next(new Error('failed to find user'));
+    next(createError(404, 'failed to find user'));
   }
 });
 
diff --git a/package.json b/package.json
index d3bd623f423..1033c10967f 100644
--- a/package.json
+++ b/package.json
@@ -55,7 +55,7 @@
     "marked": "0.3.3",
     "mocha": "2.2.5",
     "should": "~5.2.0",
-    "supertest": "~0.15.0"
+    "supertest": "1.0.1"
   },
   "engines": {
     "node": ">= 0.8.0"
diff --git a/test/acceptance/mvc.js b/test/acceptance/mvc.js
index df0ce7d9bf9..8b97a7ddbf9 100644
--- a/test/acceptance/mvc.js
+++ b/test/acceptance/mvc.js
@@ -35,7 +35,7 @@ describe('mvc', function(){
       .put('/pet/3')
       .set('Content-Type', 'application/x-www-form-urlencoded')
       .send({ pet: { name: 'Boots' } })
-      .end(function(err, res){
+      .expect(302, function (err, res) {
         if (err) return done(err);
         request(app)
         .get('/pet/3/edit')
@@ -98,7 +98,7 @@ describe('mvc', function(){
       .put('/user/1')
       .set('Content-Type', 'application/x-www-form-urlencoded')
       .send({ user: { name: 'Tobo' }})
-      .end(function(err, res){
+      .expect(302, function (err, res) {
         if (err) return done(err);
         request(app)
         .get('/user/1/edit')
diff --git a/test/acceptance/params.js b/test/acceptance/params.js
index cfa65896e63..1b5e1d5efe8 100644
--- a/test/acceptance/params.js
+++ b/test/acceptance/params.js
@@ -21,8 +21,8 @@ describe('params', function(){
   describe('GET /user/9', function(){
     it('should fail to find user', function(done){
       request(app)
-        .get('/user/9')
-        .expect(/failed to find user/,done)
+      .get('/user/9')
+      .expect(404, /failed to find user/, done)
     })
   })
 
@@ -37,8 +37,8 @@ describe('params', function(){
   describe('GET /users/foo-bar', function(){
     it('should fail integer parsing', function(done){
       request(app)
-        .get('/users/foo-bar')
-        .expect(/failed to parseInt foo/,done)
+      .get('/users/foo-bar')
+      .expect(400, /failed to parseInt foo/, done)
     })
   })
 })

From ee2e4f17bb21c8667adcb07cd1b89ed176662456 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 17 May 2015 23:53:35 -0400
Subject: [PATCH 0818/1265] deps: should@6.0.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 1033c10967f..0635d10777c 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,7 @@
     "istanbul": "0.3.9",
     "marked": "0.3.3",
     "mocha": "2.2.5",
-    "should": "~5.2.0",
+    "should": "6.0.1",
     "supertest": "1.0.1"
   },
   "engines": {

From 630c650c3ec7ff370308963e211673cab89434bb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 17 May 2015 23:54:59 -0400
Subject: [PATCH 0819/1265] deps: debug@~2.2.0

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 80aec28c521..47b50f45bf3 100644
--- a/History.md
+++ b/History.md
@@ -17,6 +17,8 @@
     - deps: serve-index@~1.6.4
     - deps: serve-static@~1.9.3
     - deps: type-is@~1.6.2
+  * deps: debug@~2.2.0
+    - deps: ms@0.7.1
   * deps: depd@~1.0.1
   * deps: proxy-addr@~1.0.8
     - deps: ipaddr.js@1.0.1
diff --git a/package.json b/package.json
index 0635d10777c..dc33f604fa1 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "commander": "2.6.0",
     "cookie": "0.1.2",
     "cookie-signature": "1.0.6",
-    "debug": "~2.1.3",
+    "debug": "~2.2.0",
     "depd": "~1.0.1",
     "escape-html": "1.0.1",
     "etag": "~1.5.1",

From 057898bbe8ae0a9d462eda7dc11ba0a04bf3a54f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 May 2015 00:03:54 -0400
Subject: [PATCH 0820/1265] docs: update badges

---
 Readme.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Readme.md b/Readme.md
index 4200fe730eb..0c84aa6183c 100644
--- a/Readme.md
+++ b/Readme.md
@@ -2,10 +2,10 @@
 
   Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
 
-  [![NPM version](https://img.shields.io/npm/v/express.svg?style=flat)](https://www.npmjs.org/package/express)
-  [![Build Status](https://img.shields.io/travis/strongloop/express.svg?style=flat)](https://travis-ci.org/strongloop/express)
-  [![Coverage Status](https://img.shields.io/coveralls/strongloop/express.svg?style=flat)](https://coveralls.io/r/strongloop/express)
-  [![Gratipay](https://img.shields.io/gratipay/dougwilson.svg?style=flat)](https://gratipay.com/dougwilson/)
+  [![NPM version](https://img.shields.io/npm/v/express.svg)](https://www.npmjs.org/package/express)
+  [![Build Status](https://img.shields.io/travis/strongloop/express/3.x.svg)](https://travis-ci.org/strongloop/express)
+  [![Coverage Status](https://img.shields.io/coveralls/strongloop/express/3.x.svg)](https://coveralls.io/r/strongloop/express)
+  [![Gratipay](https://img.shields.io/gratipay/dougwilson.svg)](https://gratipay.com/dougwilson/)
 
 ```js
 var express = require('express');

From b149430114b42299be84b5c1dfe25a8303605db5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 May 2015 00:04:41 -0400
Subject: [PATCH 0821/1265] 3.20.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 47b50f45bf3..fbbed9e1357 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.20.3 / 2015-05-17
+===================
 
   * deps: connect@2.29.2
     - deps: body-parser@~1.12.4
diff --git a/package.json b/package.json
index dc33f604fa1..6dfbe7e3628 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.20.2",
+  "version": "3.20.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 13300f48339b138a10e2b924cb35b4a102cd2bc1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 May 2015 00:13:48 -0400
Subject: [PATCH 0822/1265] deps: serve-static@~1.9.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5e197c35bcc..716de5f7eb3 100644
--- a/History.md
+++ b/History.md
@@ -12,6 +12,8 @@ unreleased
     - deps: etag@~1.6.0
     - deps: ms@0.7.1
     - deps: on-finished@~2.2.1
+  * deps: serve-static@~1.9.3
+    - deps: send@0.12.3
 
 4.12.3 / 2015-03-17
 ===================
diff --git a/package.json b/package.json
index 26a82d2d583..2211fd4ef89 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
     "qs": "2.4.1",
     "range-parser": "~1.0.2",
     "send": "0.12.3",
-    "serve-static": "~1.9.2",
+    "serve-static": "~1.9.3",
     "type-is": "~1.6.1",
     "vary": "~1.0.0",
     "utils-merge": "1.0.0"

From cd52263d232067c19c4ebdf8761209083acbbfef Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 May 2015 00:15:11 -0400
Subject: [PATCH 0823/1265] deps: finalhandler@0.3.6

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 716de5f7eb3..a1fa11c280f 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,9 @@ unreleased
   * deps: debug@~2.2.0
     - deps: ms@0.7.1
   * deps: depd@~1.0.1
+  * deps: finalhandler@0.3.6
+    - deps: debug@~2.2.0
+    - deps: on-finished@~2.2.1
   * deps: proxy-addr@~1.0.8
     - deps: ipaddr.js@1.0.1
   * deps: send@0.12.3
diff --git a/package.json b/package.json
index 2211fd4ef89..af2a327b790 100644
--- a/package.json
+++ b/package.json
@@ -36,7 +36,7 @@
     "depd": "~1.0.1",
     "escape-html": "1.0.1",
     "etag": "~1.5.1",
-    "finalhandler": "0.3.4",
+    "finalhandler": "0.3.6",
     "fresh": "0.2.4",
     "merge-descriptors": "1.0.0",
     "methods": "~1.1.1",

From 57252060b2eaaa582027cbad46a6db093f1a6433 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 May 2015 00:16:14 -0400
Subject: [PATCH 0824/1265] deps: type-is@~1.6.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a1fa11c280f..99a0d6baaa3 100644
--- a/History.md
+++ b/History.md
@@ -17,6 +17,8 @@ unreleased
     - deps: on-finished@~2.2.1
   * deps: serve-static@~1.9.3
     - deps: send@0.12.3
+  * deps: type-is@~1.6.2
+    - deps: mime-types@~2.0.11
 
 4.12.3 / 2015-03-17
 ===================
diff --git a/package.json b/package.json
index af2a327b790..96da188b39f 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "range-parser": "~1.0.2",
     "send": "0.12.3",
     "serve-static": "~1.9.3",
-    "type-is": "~1.6.1",
+    "type-is": "~1.6.2",
     "vary": "~1.0.0",
     "utils-merge": "1.0.0"
   },

From d84bdd6e7d345876a47f860234ed24788d877b34 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 May 2015 00:17:10 -0400
Subject: [PATCH 0825/1265] deps: qs@2.4.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 99a0d6baaa3..ab698508a7c 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,8 @@ unreleased
     - deps: on-finished@~2.2.1
   * deps: proxy-addr@~1.0.8
     - deps: ipaddr.js@1.0.1
+  * deps: qs@2.4.2
+   - Fix allowing parameters like `constructor`
   * deps: send@0.12.3
     - deps: debug@~2.2.0
     - deps: depd@~1.0.1
diff --git a/package.json b/package.json
index 96da188b39f..d7bbd888b28 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "~1.0.8",
-    "qs": "2.4.1",
+    "qs": "2.4.2",
     "range-parser": "~1.0.2",
     "send": "0.12.3",
     "serve-static": "~1.9.3",

From 1255bca3529541d41cc270eb73fbd1cfe76e4da4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 May 2015 00:18:19 -0400
Subject: [PATCH 0826/1265] deps: on-finished@~2.2.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ab698508a7c..7aadf628389 100644
--- a/History.md
+++ b/History.md
@@ -7,6 +7,8 @@ unreleased
   * deps: finalhandler@0.3.6
     - deps: debug@~2.2.0
     - deps: on-finished@~2.2.1
+  * deps: on-finished@~2.2.1
+    - Fix `isFinished(req)` when data buffered
   * deps: proxy-addr@~1.0.8
     - deps: ipaddr.js@1.0.1
   * deps: qs@2.4.2
diff --git a/package.json b/package.json
index d7bbd888b28..9dca3eab930 100644
--- a/package.json
+++ b/package.json
@@ -40,7 +40,7 @@
     "fresh": "0.2.4",
     "merge-descriptors": "1.0.0",
     "methods": "~1.1.1",
-    "on-finished": "~2.2.0",
+    "on-finished": "~2.2.1",
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "~1.0.8",

From 2efe7da0a053be4f2ce4a273f1ceb22abe346537 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 May 2015 00:19:43 -0400
Subject: [PATCH 0827/1265] deps: accepts@~1.2.7

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 7aadf628389..9c2e4e760b3 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,9 @@
 unreleased
 ==========
 
+  * deps: accepts@~1.2.7
+    - deps: mime-types@~2.0.11
+    - deps: negotiator@0.5.3
   * deps: debug@~2.2.0
     - deps: ms@0.7.1
   * deps: depd@~1.0.1
diff --git a/package.json b/package.json
index 9dca3eab930..4d4887a6dbd 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.2.5",
+    "accepts": "~1.2.7",
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",
     "cookie": "0.1.2",

From 18c30d46aa6f411b5f710202c14b191d226b3a0c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 May 2015 00:21:33 -0400
Subject: [PATCH 0828/1265] deps: update example dependencies

---
 package.json | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/package.json b/package.json
index 4d4887a6dbd..30b90646103 100644
--- a/package.json
+++ b/package.json
@@ -60,15 +60,15 @@
     "mocha": "2.2.5",
     "should": "6.0.1",
     "supertest": "1.0.1",
-    "body-parser": "~1.12.2",
-    "connect-redis": "~2.2.0",
+    "body-parser": "~1.12.4",
+    "connect-redis": "~2.3.0",
     "cookie-parser": "~1.3.4",
     "cookie-session": "~1.1.0",
-    "express-session": "~1.10.4",
+    "express-session": "~1.11.2",
     "jade": "~1.9.2",
-    "method-override": "~2.3.2",
-    "morgan": "~1.5.2",
-    "multiparty": "~4.1.1",
+    "method-override": "~2.3.3",
+    "morgan": "~1.5.3",
+    "multiparty": "~4.1.2",
     "vhost": "~3.0.0"
   },
   "engines": {

From 4952127f5bddad74bf292f80ed156391d86285db Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 May 2015 00:24:03 -0400
Subject: [PATCH 0829/1265] deps: etag@~1.6.0

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 9c2e4e760b3..b873ef0bcfb 100644
--- a/History.md
+++ b/History.md
@@ -7,6 +7,9 @@ unreleased
   * deps: debug@~2.2.0
     - deps: ms@0.7.1
   * deps: depd@~1.0.1
+  * deps: etag@~1.6.0
+    - Improve support for JXcore
+    - Support "fake" stats objects in environments without `fs`
   * deps: finalhandler@0.3.6
     - deps: debug@~2.2.0
     - deps: on-finished@~2.2.1
diff --git a/package.json b/package.json
index 30b90646103..afa86c3ef77 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,7 @@
     "debug": "~2.2.0",
     "depd": "~1.0.1",
     "escape-html": "1.0.1",
-    "etag": "~1.5.1",
+    "etag": "~1.6.0",
     "finalhandler": "0.3.6",
     "fresh": "0.2.4",
     "merge-descriptors": "1.0.0",

From e9c9f95ade0f20a048861ac886d4767a839d5286 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 May 2015 00:38:34 -0400
Subject: [PATCH 0830/1265] 4.12.4

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index b873ef0bcfb..3ce212fa52c 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.12.4 / 2015-05-17
+===================
 
   * deps: accepts@~1.2.7
     - deps: mime-types@~2.0.11
diff --git a/package.json b/package.json
index afa86c3ef77..63fe46b3dcc 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.12.3",
+  "version": "4.12.4",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 9ae08f932e11dcf53f938c8e6ef184cc2c5adf68 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Jun 2015 01:17:42 -0400
Subject: [PATCH 0831/1265] build: should@6.0.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 6dfbe7e3628..57f85757014 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,7 @@
     "istanbul": "0.3.9",
     "marked": "0.3.3",
     "mocha": "2.2.5",
-    "should": "6.0.1",
+    "should": "6.0.3",
     "supertest": "1.0.1"
   },
   "engines": {

From a20a9a1a2e4dee052ca6832af6ae16a74c1ed9e0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Jun 2015 01:21:20 -0400
Subject: [PATCH 0832/1265] deps: mkdirp@0.5.1

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index fbbed9e1357..8aa0e86df18 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+3.x
+===
+
+  * deps: mkdirp@0.5.1
+    - Work in global strict mode
+
 3.20.3 / 2015-05-17
 ===================
 
diff --git a/package.json b/package.json
index 57f85757014..f4642558481 100644
--- a/package.json
+++ b/package.json
@@ -40,7 +40,7 @@
     "fresh": "0.2.4",
     "merge-descriptors": "1.0.0",
     "methods": "~1.1.1",
-    "mkdirp": "0.5.0",
+    "mkdirp": "0.5.1",
     "parseurl": "~1.3.0",
     "proxy-addr": "~1.0.8",
     "range-parser": "~1.0.2",

From 29f51c67a612ecdf08494bc440f22918ce72a32e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Jun 2015 01:24:21 -0400
Subject: [PATCH 0833/1265] docs: fix typos in history

closes #2676
closes #2677
closes #2678
---
 History.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 8aa0e86df18..e6af31f0b63 100644
--- a/History.md
+++ b/History.md
@@ -852,7 +852,7 @@
  * update commander
  * jsonp: check if callback is a function
  * router: wrap encodeURIComponent in a try/catch #1735 (@lxe)
- * res.format: now includes chraset @1747 (@sorribas)
+ * res.format: now includes charset @1747 (@sorribas)
  * res.links: allow multiple calls @1746 (@sorribas)
 
 3.4.0 / 2013-09-07
@@ -1131,7 +1131,7 @@
   * Added another example to content-negotiation
   * Added `fresh` dep
   * Changed: `res.send()` always checks freshness
-  * Fixed: expose connects mime module. Cloases #1165
+  * Fixed: expose connects mime module. Closes #1165
 
 3.0.0beta2 / 2012-06-06
 ==================
@@ -1213,7 +1213,7 @@
   * Added `req.ips`
   * Added `req.fresh`
   * Added `req.stale`
-  * Added comma-delmited / array support for `req.accepts()`
+  * Added comma-delimited / array support for `req.accepts()`
   * Added debug instrumentation
   * Added `res.set(obj)`
   * Added `res.set(field, value)`

From 62dfa792b26e32c99c27b07d490fa156d61a7782 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 20:08:32 -0400
Subject: [PATCH 0834/1265] deps: connect@2.30.0

---
 History.md   | 16 ++++++++++++++++
 package.json |  2 +-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e6af31f0b63..4fc52c4b75e 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,22 @@
 3.x
 ===
 
+  * deps: connect@2.30.0
+    - deps: body-parser@~1.13.1
+    - deps: bytes@2.1.0
+    - deps: compression@~1.5.0
+    - deps: cookie@0.1.3
+    - deps: cookie-parser@~1.3.5
+    - deps: csurf@~1.8.3
+    - deps: errorhandler@~1.4.0
+    - deps: express-session@~1.11.3
+    - deps: finalhandler@0.4.0
+    - deps: fresh@0.3.0
+    - deps: morgan@~1.6.0
+    - deps: serve-favicon@~2.3.0
+    - deps: serve-index@~1.7.0
+    - deps: serve-static@~1.10.0
+    - deps: type-is@~1.6.3
   * deps: mkdirp@0.5.1
     - Work in global strict mode
 
diff --git a/package.json b/package.json
index f4642558481..e060ace59a4 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "basic-auth": "1.0.0",
-    "connect": "2.29.2",
+    "connect": "2.30.0",
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",
     "commander": "2.6.0",

From 92b5fa8c53fd451623523a41c3cedfd2efb8f4aa Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 20:10:16 -0400
Subject: [PATCH 0835/1265] build: should@7.0.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e060ace59a4..123a2c5ee64 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,7 @@
     "istanbul": "0.3.9",
     "marked": "0.3.3",
     "mocha": "2.2.5",
-    "should": "6.0.3",
+    "should": "7.0.1",
     "supertest": "1.0.1"
   },
   "engines": {

From 5207b99e0874df268cb8f54eabedb314485890cd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 20:34:04 -0400
Subject: [PATCH 0836/1265] deps: basic-auth@1.0.2

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 4fc52c4b75e..e681d5d75b1 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,11 @@
 3.x
 ===
 
+  * deps: basic-auth@1.0.2
+    - perf: enable strict mode
+    - perf: hoist regular expression
+    - perf: parse with regular expressions
+    - perf: remove argument reassignment
   * deps: connect@2.30.0
     - deps: body-parser@~1.13.1
     - deps: bytes@2.1.0
diff --git a/package.json b/package.json
index 123a2c5ee64..7ce2bfc0c3e 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "api"
   ],
   "dependencies": {
-    "basic-auth": "1.0.0",
+    "basic-auth": "1.0.2",
     "connect": "2.30.0",
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",

From 77402110b9402a6d327e232cc1518bc5110e651c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 20:35:56 -0400
Subject: [PATCH 0837/1265] deps: cookie@0.1.3

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e681d5d75b1..3d09788d390 100644
--- a/History.md
+++ b/History.md
@@ -22,6 +22,9 @@
     - deps: serve-index@~1.7.0
     - deps: serve-static@~1.10.0
     - deps: type-is@~1.6.3
+  * deps: cookie@0.1.3
+    - perf: deduce the scope of try-catch deopt
+    - perf: remove argument reassignments
   * deps: mkdirp@0.5.1
     - Work in global strict mode
 
diff --git a/package.json b/package.json
index 7ce2bfc0c3e..80e444a6749 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,7 @@
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",
     "commander": "2.6.0",
-    "cookie": "0.1.2",
+    "cookie": "0.1.3",
     "cookie-signature": "1.0.6",
     "debug": "~2.2.0",
     "depd": "~1.0.1",

From 0fbf2078e16cd315fd1b1769c430488f70e7faba Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 20:36:48 -0400
Subject: [PATCH 0838/1265] deps: escape-html@1.0.2

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 3d09788d390..a533c2415db 100644
--- a/History.md
+++ b/History.md
@@ -25,6 +25,7 @@
   * deps: cookie@0.1.3
     - perf: deduce the scope of try-catch deopt
     - perf: remove argument reassignments
+  * deps: escape-html@1.0.2
   * deps: mkdirp@0.5.1
     - Work in global strict mode
 
diff --git a/package.json b/package.json
index 80e444a6749..a771f9f42f4 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,7 @@
     "cookie-signature": "1.0.6",
     "debug": "~2.2.0",
     "depd": "~1.0.1",
-    "escape-html": "1.0.1",
+    "escape-html": "1.0.2",
     "etag": "~1.5.1",
     "fresh": "0.2.4",
     "merge-descriptors": "1.0.0",

From c8d61b62693948568083d5ad3c4491e5cc6f5338 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 20:54:26 -0400
Subject: [PATCH 0839/1265] deps: etag@~1.7.0

fixes #2667
---
 History.md       |  8 ++++++++
 package.json     |  2 +-
 test/res.send.js | 18 +++++++++---------
 test/utils.js    | 16 ++++++++--------
 4 files changed, 26 insertions(+), 18 deletions(-)

diff --git a/History.md b/History.md
index a533c2415db..6ed7c762c23 100644
--- a/History.md
+++ b/History.md
@@ -26,6 +26,14 @@
     - perf: deduce the scope of try-catch deopt
     - perf: remove argument reassignments
   * deps: escape-html@1.0.2
+  * deps: etag@~1.7.0
+    - Always include entity length in ETags for hash length extensions
+    - Generate non-Stats ETags using MD5 only (no longer CRC32)
+    - Improve stat performance by removing hashing
+    - Improve support for JXcore
+    - Remove base64 padding in ETags to shorten
+    - Support "fake" stats objects in environments without fs
+    - Use MD5 instead of MD4 in weak ETags over 1KB
   * deps: mkdirp@0.5.1
     - Work in global strict mode
 
diff --git a/package.json b/package.json
index a771f9f42f4..f3d51791a9d 100644
--- a/package.json
+++ b/package.json
@@ -36,7 +36,7 @@
     "debug": "~2.2.0",
     "depd": "~1.0.1",
     "escape-html": "1.0.2",
-    "etag": "~1.5.1",
+    "etag": "~1.7.0",
     "fresh": "0.2.4",
     "merge-descriptors": "1.0.0",
     "methods": "~1.1.1",
diff --git a/test/res.send.js b/test/res.send.js
index 9ad8fd88fee..67f872285c5 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -121,7 +121,7 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('ETag', 'W/"fz/jGo0ONwzb+aKy/rWipg=="')
+      .expect('ETag', 'W/"7ff-fFD7Se+Vsq6deAl063thow"')
       .expect(200, done);
     })
 
@@ -193,7 +193,7 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('ETag', 'W/"fz/jGo0ONwzb+aKy/rWipg=="')
+      .expect('ETag', 'W/"7ff-fFD7Se+Vsq6deAl063thow"')
       .expect(200, done);
     })
 
@@ -309,7 +309,7 @@ describe('res', function(){
 
     request(app)
     .get('/')
-    .set('If-None-Match', 'W/"fz/jGo0ONwzb+aKy/rWipg=="')
+    .set('If-None-Match', 'W/"7ff-fFD7Se+Vsq6deAl063thow"')
     .expect(304, done);
   })
 
@@ -355,7 +355,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('ETag', 'W/"c-5aee35d8"')
+        .expect('ETag', 'W/"c-ZUfd0NJ26qwjlKF4r8qb2g"')
         .expect(200, done);
       });
 
@@ -371,7 +371,7 @@ describe('res', function(){
 
           request(app)
           [method]('/')
-          .expect('ETag', 'W/"c-5aee35d8"')
+          .expect('ETag', 'W/"c-ZUfd0NJ26qwjlKF4r8qb2g"')
           .expect(200, done);
         })
       });
@@ -387,7 +387,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('ETag', 'W/"0-0"')
+        .expect('ETag', 'W/"0-1B2M2Y8AsgTpgAmY7PhCfg"')
         .expect(200, done);
       })
 
@@ -403,7 +403,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('ETag', 'W/"fz/jGo0ONwzb+aKy/rWipg=="')
+        .expect('ETag', 'W/"7ff-fFD7Se+Vsq6deAl063thow"')
         .expect(200, done);
       });
 
@@ -485,7 +485,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('ETag', '"Otu60XkfuuPskIiUxJY4cA=="')
+        .expect('ETag', '"d-Otu60XkfuuPskIiUxJY4cA"')
         .expect(200, done);
       })
     })
@@ -502,7 +502,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('ETag', 'W/"d-58988d13"')
+        .expect('ETag', 'W/"d-Otu60XkfuuPskIiUxJY4cA"')
         .expect(200, done)
       })
     })
diff --git a/test/utils.js b/test/utils.js
index b811762c591..750c84605f3 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -5,46 +5,46 @@ var utils = require('../lib/utils')
 describe('utils.etag(body, encoding)', function(){
   it('should support strings', function(){
     utils.etag('express!')
-    .should.eql('"zZdv4imtWD49AHEviejT6A=="')
+    .should.eql('"8-zZdv4imtWD49AHEviejT6A"')
   })
 
   it('should support utf8 strings', function(){
     utils.etag('express❤', 'utf8')
-    .should.eql('"fsFba4IxwQS6h6Umb+FNxw=="')
+    .should.eql('"a-fsFba4IxwQS6h6Umb+FNxw"')
   })
 
   it('should support buffer', function(){
     var buf = new Buffer('express!')
     utils.etag(buf)
-    .should.eql('"zZdv4imtWD49AHEviejT6A=="');
+    .should.eql('"8-zZdv4imtWD49AHEviejT6A"');
   })
 
   it('should support empty string', function(){
     utils.etag('')
-    .should.eql('"1B2M2Y8AsgTpgAmY7PhCfg=="');
+    .should.eql('"0-1B2M2Y8AsgTpgAmY7PhCfg"');
   })
 })
 
 describe('utils.wetag(body, encoding)', function(){
   it('should support strings', function(){
     utils.wetag('express!')
-    .should.eql('W/"8-b8aabac7"')
+    .should.eql('W/"8-zZdv4imtWD49AHEviejT6A"')
   })
 
   it('should support utf8 strings', function(){
     utils.wetag('express❤', 'utf8')
-    .should.eql('W/"a-686b0af1"')
+    .should.eql('W/"a-fsFba4IxwQS6h6Umb+FNxw"')
   })
 
   it('should support buffer', function(){
     var buf = new Buffer('express!')
     utils.wetag(buf)
-    .should.eql('W/"8-b8aabac7"');
+    .should.eql('W/"8-zZdv4imtWD49AHEviejT6A"');
   })
 
   it('should support empty string', function(){
     utils.wetag('')
-    .should.eql('W/"0-0"');
+    .should.eql('W/"0-1B2M2Y8AsgTpgAmY7PhCfg"');
   })
 })
 

From 14b849246e9b72eb61dd9118b0409ca49d50f55e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 20:56:03 -0400
Subject: [PATCH 0840/1265] deps: send@0.13.0

---
 History.md   | 13 +++++++++++++
 package.json |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 6ed7c762c23..6c3684d8942 100644
--- a/History.md
+++ b/History.md
@@ -36,6 +36,19 @@
     - Use MD5 instead of MD4 in weak ETags over 1KB
   * deps: mkdirp@0.5.1
     - Work in global strict mode
+  * deps: send@0.13.0
+    - Allow Node.js HTTP server to set `Date` response header
+    - Fix incorrectly removing `Content-Location` on 304 response
+    - Improve the default redirect response headers
+    - Send appropriate headers on default error response
+    - Use `http-errors` for standard emitted errors
+    - Use `statuses` instead of `http` module for status messages
+    - deps: escape-html@1.0.2
+    - deps: etag@~1.7.0
+    - deps: fresh@0.3.0
+    - deps: on-finished@~2.3.0
+    - perf: enable strict mode
+    - perf: remove unnecessary array allocations
 
 3.20.3 / 2015-05-17
 ===================
diff --git a/package.json b/package.json
index f3d51791a9d..a36a43c3824 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "parseurl": "~1.3.0",
     "proxy-addr": "~1.0.8",
     "range-parser": "~1.0.2",
-    "send": "0.12.3",
+    "send": "0.13.0",
     "utils-merge": "1.0.0",
     "vary": "~1.0.0"
   },

From 4729685912b8d69c53739b04a2f3477b67dcc602 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 20:56:48 -0400
Subject: [PATCH 0841/1265] deps: fresh@0.3.0

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 6c3684d8942..dbe149cddd5 100644
--- a/History.md
+++ b/History.md
@@ -34,6 +34,8 @@
     - Remove base64 padding in ETags to shorten
     - Support "fake" stats objects in environments without fs
     - Use MD5 instead of MD4 in weak ETags over 1KB
+  * deps: fresh@0.3.0
+    - Add weak `ETag` matching support
   * deps: mkdirp@0.5.1
     - Work in global strict mode
   * deps: send@0.13.0
diff --git a/package.json b/package.json
index a36a43c3824..7b077c9b9ad 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "depd": "~1.0.1",
     "escape-html": "1.0.2",
     "etag": "~1.7.0",
-    "fresh": "0.2.4",
+    "fresh": "0.3.0",
     "merge-descriptors": "1.0.0",
     "methods": "~1.1.1",
     "mkdirp": "0.5.1",

From 115dbe1a4d817d925d2dc87731a7ceb1663152ed Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 21:14:56 -0400
Subject: [PATCH 0842/1265] 3.21.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index dbe149cddd5..bb06bdb6f42 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.21.0 / 2015-06-18
+===================
 
   * deps: basic-auth@1.0.2
     - perf: enable strict mode
diff --git a/package.json b/package.json
index 7b077c9b9ad..e8d2f00395f 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.20.3",
+  "version": "3.21.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 4b70375d2280e3b9a0d69e2d57e7e7a609fec206 Mon Sep 17 00:00:00 2001
From: Phat <damphat@gmail.com>
Date: Sun, 22 Mar 2015 19:21:48 +0700
Subject: [PATCH 0843/1265] docs: update res.set jsdoc

closes #2600
---
 lib/response.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index b759eb95e42..1874300c514 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -682,8 +682,8 @@ res.append = function append(field, val) {
  *
  * Aliased as `res.header()`.
  *
- * @param {String|Object|Array} field
- * @param {String} val
+ * @param {String|Object} field
+ * @param {String|Array} val
  * @return {ServerResponse} for chaining
  * @api public
  */

From fce3d14b5ce51e75a1636ac4ebc251c4017e038b Mon Sep 17 00:00:00 2001
From: Alexander Marenin <comrade.muchacho@gmail.com>
Date: Thu, 28 May 2015 18:09:05 +0300
Subject: [PATCH 0844/1265] docs: update return types for req.accept*()

closes #2663
---
 lib/request.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/request.js b/lib/request.js
index e52dfe554e9..99964925572 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -98,7 +98,7 @@ req.header = function(name){
  *     // => "json"
  *
  * @param {String|Array} type(s)
- * @return {String}
+ * @return {String|Array|Boolean}
  * @api public
  */
 
@@ -111,7 +111,7 @@ req.accepts = function(){
  * Check if the given `encoding`s are accepted.
  *
  * @param {String} ...encoding
- * @return {Boolean}
+ * @return {String|Array}
  * @api public
  */
 
@@ -128,7 +128,7 @@ req.acceptsEncoding = deprecate.function(req.acceptsEncodings,
  * otherwise you should respond with 406 "Not Acceptable".
  *
  * @param {String} ...charset
- * @return {Boolean}
+ * @return {String|Array}
  * @api public
  */
 
@@ -145,7 +145,7 @@ req.acceptsCharset = deprecate.function(req.acceptsCharsets,
  * otherwise you should respond with 406 "Not Acceptable".
  *
  * @param {String} ...lang
- * @return {Boolean}
+ * @return {String|Array}
  * @api public
  */
 

From 8da51e3acc0520f67daa92309e294a72a6256726 Mon Sep 17 00:00:00 2001
From: Radu Dan <za_creature@yahoo.com>
Date: Tue, 19 May 2015 22:37:06 +0300
Subject: [PATCH 0845/1265] Fix issue where next('route') in app.param would
 incorrectly skip values

fixes #2655
---
 History.md          |  1 +
 lib/router/index.js |  3 ++-
 test/app.param.js   | 60 +++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 63 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 0f57672d34e..06c2c2be323 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix issue where `next('route')` in `app.param` would incorrectly skip values
   * deps: cookie@0.1.3
     - perf: deduce the scope of try-catch deopt
     - perf: remove argument reassignments
diff --git a/lib/router/index.js b/lib/router/index.js
index 209f881b1eb..a20c592f075 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -357,7 +357,8 @@ proto.process_params = function(layer, called, req, res, done) {
     }
 
     // param previously called with same value or error occurred
-    if (paramCalled && (paramCalled.error || paramCalled.match === paramVal)) {
+    if (paramCalled && (paramCalled.match === paramVal
+      || (paramCalled.error && paramCalled.error !== 'route'))) {
       // restore value
       req.params[name] = paramCalled.value;
 
diff --git a/test/app.param.js b/test/app.param.js
index 858ea2d5f6a..30885bcdc89 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -303,5 +303,65 @@ describe('app', function(){
       .get('/user/new')
       .expect('get.new', done);
     })
+
+    it('should not call when values differ on error', function(done) {
+      var app = express();
+      var called = 0;
+      var count = 0;
+
+      app.param('user', function(req, res, next, user) {
+        called++;
+        if (user === 'foo') throw new Error('err!');
+        req.user = user;
+        next();
+      });
+
+      app.get('/:user/bob', function(req, res, next) {
+        count++;
+        next();
+      });
+      app.get('/foo/:user', function(req, res, next) {
+        count++;
+        next();
+      });
+
+      app.use(function(err, req, res, next) {
+        res.status(500);
+        res.send([count, called, err.message].join(' '));
+      });
+
+      request(app)
+      .get('/foo/bob')
+      .expect(500, '0 1 err!', done)
+    });
+
+    it('should call when values differ when using "next"', function(done) {
+      var app = express();
+      var called = 0;
+      var count = 0;
+
+      app.param('user', function(req, res, next, user) {
+        called++;
+        if (user === 'foo') return next('route');
+        req.user = user;
+        next();
+      });
+
+      app.get('/:user/bob', function(req, res, next) {
+        count++;
+        next();
+      });
+      app.get('/foo/:user', function(req, res, next) {
+        count++;
+        next();
+      });
+      app.use(function(req, res) {
+        res.end([count, called, req.user].join(' '));
+      });
+
+      request(app)
+      .get('/foo/bob')
+      .expect('1 2 bob', done);
+    })
   })
 })

From f7e94a30bce66ba4de1b6388910bfdd8b1e6edd1 Mon Sep 17 00:00:00 2001
From: Deepak Kapoor <kapoordeepak@gmail.com>
Date: Wed, 22 Apr 2015 17:36:55 +1000
Subject: [PATCH 0846/1265] Use array-flatten module for flattening arrays

closes #2624
---
 History.md          |  1 +
 lib/application.js  |  2 +-
 lib/router/index.js |  4 ++--
 lib/router/route.js |  6 +++---
 lib/utils.js        | 15 +++------------
 package.json        |  1 +
 6 files changed, 11 insertions(+), 18 deletions(-)

diff --git a/History.md b/History.md
index 06c2c2be323..de6a68f0ca8 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Fix issue where `next('route')` in `app.param` would incorrectly skip values
+  * Use `array-flatten` module for flattening arrays
   * deps: cookie@0.1.3
     - perf: deduce the scope of try-catch deopt
     - perf: remove argument reassignments
diff --git a/lib/application.js b/lib/application.js
index 5ec44248cad..fe386d7b368 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -12,7 +12,6 @@
  */
 
 var finalhandler = require('finalhandler');
-var flatten = require('./utils').flatten;
 var Router = require('./router');
 var methods = require('methods');
 var middleware = require('./middleware/init');
@@ -24,6 +23,7 @@ var compileETag = require('./utils').compileETag;
 var compileQueryParser = require('./utils').compileQueryParser;
 var compileTrust = require('./utils').compileTrust;
 var deprecate = require('depd')('express');
+var flatten = require('array-flatten');
 var merge = require('utils-merge');
 var resolve = require('path').resolve;
 var slice = Array.prototype.slice;
diff --git a/lib/router/index.js b/lib/router/index.js
index a20c592f075..d0989da2090 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -9,8 +9,8 @@ var methods = require('methods');
 var mixin = require('utils-merge');
 var debug = require('debug')('express:router');
 var deprecate = require('depd')('express');
+var flatten = require('array-flatten');
 var parseUrl = require('parseurl');
-var utils = require('../utils');
 
 /**
  * Module variables.
@@ -436,7 +436,7 @@ proto.use = function use(fn) {
     }
   }
 
-  var callbacks = utils.flatten(slice.call(arguments, offset));
+  var callbacks = flatten(slice.call(arguments, offset));
 
   if (callbacks.length === 0) {
     throw new TypeError('Router.use() requires middleware functions');
diff --git a/lib/router/route.js b/lib/router/route.js
index 6213b821704..d3ef53bc176 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -3,9 +3,9 @@
  */
 
 var debug = require('debug')('express:router:route');
+var flatten = require('array-flatten');
 var Layer = require('./layer');
 var methods = require('methods');
-var utils = require('../utils');
 
 /**
  * Expose `Route`.
@@ -141,7 +141,7 @@ Route.prototype.dispatch = function(req, res, done){
  */
 
 Route.prototype.all = function(){
-  var callbacks = utils.flatten([].slice.call(arguments));
+  var callbacks = flatten([].slice.call(arguments));
   callbacks.forEach(function(fn) {
     if (typeof fn !== 'function') {
       var type = {}.toString.call(fn);
@@ -161,7 +161,7 @@ Route.prototype.all = function(){
 
 methods.forEach(function(method){
   Route.prototype[method] = function(){
-    var callbacks = utils.flatten([].slice.call(arguments));
+    var callbacks = flatten([].slice.call(arguments));
 
     callbacks.forEach(function(fn) {
       if (typeof fn !== 'function') {
diff --git a/lib/utils.js b/lib/utils.js
index ce53ad8b99b..42ea76acde6 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -13,6 +13,7 @@
 var contentDisposition = require('content-disposition');
 var contentType = require('content-type');
 var deprecate = require('depd')('express');
+var flatten = require('array-flatten');
 var mime = require('send').mime;
 var basename = require('path').basename;
 var etag = require('etag');
@@ -76,18 +77,8 @@ exports.isAbsolute = function(path){
  * @api private
  */
 
-exports.flatten = function(arr, ret){
-  ret = ret || [];
-  var len = arr.length;
-  for (var i = 0; i < len; ++i) {
-    if (Array.isArray(arr[i])) {
-      exports.flatten(arr[i], ret);
-    } else {
-      ret.push(arr[i]);
-    }
-  }
-  return ret;
-};
+exports.flatten = deprecate.function(flatten,
+  'utils.flatten: use array-flatten npm module instead');
 
 /**
  * Normalize the given `type`, for example "html" becomes "text/html".
diff --git a/package.json b/package.json
index 74efb91cc06..e14953f13b9 100644
--- a/package.json
+++ b/package.json
@@ -28,6 +28,7 @@
   ],
   "dependencies": {
     "accepts": "~1.2.7",
+    "array-flatten": "1.1.0",
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",
     "cookie": "0.1.3",

From b5f98ab3b3861161a92fee7f64a22cbb04f85ba9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 22:26:48 -0400
Subject: [PATCH 0847/1265] deps: serve-static@~1.10.0

---
 History.md   | 9 +++++++++
 package.json | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index de6a68f0ca8..1acab96b1ef 100644
--- a/History.md
+++ b/History.md
@@ -30,6 +30,15 @@ unreleased
     - deps: on-finished@~2.3.0
     - perf: enable strict mode
     - perf: remove unnecessary array allocations
+  * deps: serve-static@~1.10.0
+    - Add `fallthrough` option
+    - Fix reading options from options prototype
+    - Improve the default redirect response headers
+    - Malformed URLs now `next()` instead of 400
+    - deps: escape-html@1.0.2
+    - deps: send@0.13.0
+    - perf: enable strict mode
+    - perf: remove argument reassignment
 
 4.12.4 / 2015-05-17
 ===================
diff --git a/package.json b/package.json
index e14953f13b9..2e3fa5be1ed 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "qs": "2.4.2",
     "range-parser": "~1.0.2",
     "send": "0.13.0",
-    "serve-static": "~1.9.3",
+    "serve-static": "~1.10.0",
     "type-is": "~1.6.2",
     "vary": "~1.0.0",
     "utils-merge": "1.0.0"

From 7b7aaf0bf3c8a245c7e9a0ac91af314adba4ea1d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 22:39:57 -0400
Subject: [PATCH 0848/1265] deps: finalhandler@0.4.0

---
 History.md   | 8 ++++++++
 package.json | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 1acab96b1ef..2f41a60a81b 100644
--- a/History.md
+++ b/History.md
@@ -15,6 +15,14 @@ unreleased
     - Remove base64 padding in ETags to shorten
     - Support "fake" stats objects in environments without fs
     - Use MD5 instead of MD4 in weak ETags over 1KB
+  * deps: finalhandler@0.4.0
+    - Fix a false-positive when unpiping in Node.js 0.8
+    - Support `statusCode` property on `Error` objects
+    - Use `unpipe` module for unpiping requests
+    - deps: escape-html@1.0.2
+    - deps: on-finished@~2.3.0
+    - perf: enable strict mode
+    - perf: remove argument reassignment
   * deps: fresh@0.3.0
     - Add weak `ETag` matching support
   * deps: send@0.13.0
diff --git a/package.json b/package.json
index 2e3fa5be1ed..a2e66089bcf 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "depd": "~1.0.1",
     "escape-html": "1.0.2",
     "etag": "~1.7.0",
-    "finalhandler": "0.3.6",
+    "finalhandler": "0.4.0",
     "fresh": "0.3.0",
     "merge-descriptors": "1.0.0",
     "methods": "~1.1.1",

From 8ad7e8f5e143768ef62adbde899e5b9099185f52 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 22:41:28 -0400
Subject: [PATCH 0849/1265] deps: on-finished@~2.3.0

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 2f41a60a81b..65de61f8729 100644
--- a/History.md
+++ b/History.md
@@ -25,6 +25,10 @@ unreleased
     - perf: remove argument reassignment
   * deps: fresh@0.3.0
     - Add weak `ETag` matching support
+  * deps: on-finished@~2.3.0
+    - Add defined behavior for HTTP `CONNECT` requests
+    - Add defined behavior for HTTP `Upgrade` requests
+    - deps: ee-first@1.1.1
   * deps: send@0.13.0
     - Allow Node.js HTTP server to set `Date` response header
     - Fix incorrectly removing `Content-Location` on 304 response
diff --git a/package.json b/package.json
index a2e66089bcf..19cf6ad615a 100644
--- a/package.json
+++ b/package.json
@@ -41,7 +41,7 @@
     "fresh": "0.3.0",
     "merge-descriptors": "1.0.0",
     "methods": "~1.1.1",
-    "on-finished": "~2.2.1",
+    "on-finished": "~2.3.0",
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.3",
     "proxy-addr": "~1.0.8",

From 7b86a0ec98690784f196efa6ca5ba1ccf4c9e10f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 22:42:19 -0400
Subject: [PATCH 0850/1265] deps: type-is@~1.6.3

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 65de61f8729..9a0f49ac0fd 100644
--- a/History.md
+++ b/History.md
@@ -51,6 +51,10 @@ unreleased
     - deps: send@0.13.0
     - perf: enable strict mode
     - perf: remove argument reassignment
+  * deps: type-is@~1.6.3
+    - deps: mime-types@~2.1.1
+    - perf: reduce try block size
+    - perf: remove bitwise operations
 
 4.12.4 / 2015-05-17
 ===================
diff --git a/package.json b/package.json
index 19cf6ad615a..43376f4a817 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "range-parser": "~1.0.2",
     "send": "0.13.0",
     "serve-static": "~1.10.0",
-    "type-is": "~1.6.2",
+    "type-is": "~1.6.3",
     "vary": "~1.0.0",
     "utils-merge": "1.0.0"
   },

From 4212efad74aa002d0e722b80c66f058b6b2b3969 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 22:43:51 -0400
Subject: [PATCH 0851/1265] deps: accepts@~1.2.9

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 9a0f49ac0fd..0db529dcfd5 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,12 @@ unreleased
 
   * Fix issue where `next('route')` in `app.param` would incorrectly skip values
   * Use `array-flatten` module for flattening arrays
+  * deps: accepts@~1.2.9
+    - deps: mime-types@~2.1.1
+    - perf: avoid argument reassignment & argument slice
+    - perf: avoid negotiator recursive construction
+    - perf: enable strict mode
+    - perf: remove unnecessary bitwise operator
   * deps: cookie@0.1.3
     - perf: deduce the scope of try-catch deopt
     - perf: remove argument reassignments
diff --git a/package.json b/package.json
index 43376f4a817..e5a66451b4c 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.2.7",
+    "accepts": "~1.2.9",
     "array-flatten": "1.1.0",
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",

From 9073bb4fbc7e5b4b53d00696a3cda0678502379a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 22:45:33 -0400
Subject: [PATCH 0852/1265] deps: update example dependencies

---
 package.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index e5a66451b4c..0d1858911e5 100644
--- a/package.json
+++ b/package.json
@@ -61,14 +61,14 @@
     "mocha": "2.2.5",
     "should": "7.0.1",
     "supertest": "1.0.1",
-    "body-parser": "~1.12.4",
+    "body-parser": "~1.13.1",
     "connect-redis": "~2.3.0",
-    "cookie-parser": "~1.3.4",
+    "cookie-parser": "~1.3.5",
     "cookie-session": "~1.1.0",
-    "express-session": "~1.11.2",
-    "jade": "~1.9.2",
+    "express-session": "~1.11.3",
+    "jade": "~1.11.0",
     "method-override": "~2.3.3",
-    "morgan": "~1.5.3",
+    "morgan": "~1.6.0",
     "multiparty": "~4.1.2",
     "vhost": "~3.0.0"
   },

From 91731b4b9ce23fe4bb702f341d0a46d78c8ccdbf Mon Sep 17 00:00:00 2001
From: Thomas Cort <linuxgeek@gmail.com>
Date: Mon, 23 Mar 2015 07:31:21 -0400
Subject: [PATCH 0853/1265] perf: use saved reference to http.STATUS_CODES

closes #2602
---
 History.md      | 1 +
 lib/response.js | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 0db529dcfd5..d33981cdf8f 100644
--- a/History.md
+++ b/History.md
@@ -61,6 +61,7 @@ unreleased
     - deps: mime-types@~2.1.1
     - perf: reduce try block size
     - perf: remove bitwise operations
+  * perf: use saved reference to `http.STATUS_CODES`
 
 4.12.4 / 2015-05-17
 ===================
diff --git a/lib/response.js b/lib/response.js
index 1874300c514..8a976217a24 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -119,7 +119,7 @@ res.send = function send(body) {
 
     deprecate('res.send(status): Use res.sendStatus(status) instead');
     this.statusCode = chunk;
-    chunk = http.STATUS_CODES[chunk];
+    chunk = statusCodes[chunk];
   }
 
   switch (typeof chunk) {
@@ -324,7 +324,7 @@ res.jsonp = function jsonp(obj) {
  */
 
 res.sendStatus = function sendStatus(statusCode) {
-  var body = http.STATUS_CODES[statusCode] || String(statusCode);
+  var body = statusCodes[statusCode] || String(statusCode);
 
   this.statusCode = statusCode;
   this.type('txt');

From 95ad276cad3369bf5f7253d0110a6e04425bd32a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 23:00:20 -0400
Subject: [PATCH 0854/1265] docs: add license comments

---
 index.js                | 7 +++++++
 lib/express.js          | 8 ++++++++
 lib/middleware/init.js  | 8 ++++++++
 lib/middleware/query.js | 8 ++++++++
 lib/request.js          | 8 ++++++++
 lib/router/index.js     | 7 +++++++
 lib/router/layer.js     | 8 ++++++++
 lib/router/route.js     | 8 ++++++++
 lib/view.js             | 8 ++++++++
 9 files changed, 70 insertions(+)

diff --git a/index.js b/index.js
index 3da33783794..e6cf8225c2e 100644
--- a/index.js
+++ b/index.js
@@ -1,2 +1,9 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
 
 module.exports = require('./lib/express');
diff --git a/lib/express.js b/lib/express.js
index bb8d8082a49..0d06c8205d7 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -1,3 +1,11 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
 /**
  * Module dependencies.
  */
diff --git a/lib/middleware/init.js b/lib/middleware/init.js
index 1e3e903f04f..0c3644da1b9 100644
--- a/lib/middleware/init.js
+++ b/lib/middleware/init.js
@@ -1,3 +1,11 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
 /**
  * Initialization middleware, exposing the
  * request and response to each other, as well
diff --git a/lib/middleware/query.js b/lib/middleware/query.js
index 092bbd9985d..80d65859e98 100644
--- a/lib/middleware/query.js
+++ b/lib/middleware/query.js
@@ -1,3 +1,11 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
 /**
  * Module dependencies.
  */
diff --git a/lib/request.js b/lib/request.js
index 99964925572..4d756deb900 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -1,3 +1,11 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
 /**
  * Module dependencies.
  */
diff --git a/lib/router/index.js b/lib/router/index.js
index d0989da2090..d79a1eb4ce3 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -1,3 +1,10 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
 
 /**
  * Module dependencies.
diff --git a/lib/router/layer.js b/lib/router/layer.js
index 88ebd3964c2..cc8a1f2c7b4 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -1,3 +1,11 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
 /**
  * Module dependencies.
  */
diff --git a/lib/router/route.js b/lib/router/route.js
index d3ef53bc176..adb833cef96 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -1,3 +1,11 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
 /**
  * Module dependencies.
  */
diff --git a/lib/view.js b/lib/view.js
index e0989b4ddac..acde752ebbd 100644
--- a/lib/view.js
+++ b/lib/view.js
@@ -1,3 +1,11 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
 /**
  * Module dependencies.
  */

From e71014f522fb8db9ba1ef634f2e9f2c8069e4b6c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 23:01:18 -0400
Subject: [PATCH 0855/1265] perf: enable strict mode

---
 History.md              | 1 +
 index.js                | 2 ++
 lib/application.js      | 2 ++
 lib/express.js          | 2 ++
 lib/middleware/init.js  | 2 ++
 lib/middleware/query.js | 2 ++
 lib/request.js          | 2 ++
 lib/response.js         | 2 ++
 lib/router/index.js     | 2 ++
 lib/router/layer.js     | 2 ++
 lib/router/route.js     | 2 ++
 lib/utils.js            | 2 ++
 lib/view.js             | 2 ++
 13 files changed, 25 insertions(+)

diff --git a/History.md b/History.md
index d33981cdf8f..f36c515619f 100644
--- a/History.md
+++ b/History.md
@@ -61,6 +61,7 @@ unreleased
     - deps: mime-types@~2.1.1
     - perf: reduce try block size
     - perf: remove bitwise operations
+  * perf: enable strict mode
   * perf: use saved reference to `http.STATUS_CODES`
 
 4.12.4 / 2015-05-17
diff --git a/index.js b/index.js
index e6cf8225c2e..d219b0c878d 100644
--- a/index.js
+++ b/index.js
@@ -6,4 +6,6 @@
  * MIT Licensed
  */
 
+'use strict';
+
 module.exports = require('./lib/express');
diff --git a/lib/application.js b/lib/application.js
index fe386d7b368..b31c88b7b05 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -6,6 +6,8 @@
  * MIT Licensed
  */
 
+'use strict';
+
 /**
  * Module dependencies.
  * @api private
diff --git a/lib/express.js b/lib/express.js
index 0d06c8205d7..540c8be6f41 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -6,6 +6,8 @@
  * MIT Licensed
  */
 
+'use strict';
+
 /**
  * Module dependencies.
  */
diff --git a/lib/middleware/init.js b/lib/middleware/init.js
index 0c3644da1b9..f3119ed3a15 100644
--- a/lib/middleware/init.js
+++ b/lib/middleware/init.js
@@ -6,6 +6,8 @@
  * MIT Licensed
  */
 
+'use strict';
+
 /**
  * Initialization middleware, exposing the
  * request and response to each other, as well
diff --git a/lib/middleware/query.js b/lib/middleware/query.js
index 80d65859e98..d86474a05a5 100644
--- a/lib/middleware/query.js
+++ b/lib/middleware/query.js
@@ -6,6 +6,8 @@
  * MIT Licensed
  */
 
+'use strict';
+
 /**
  * Module dependencies.
  */
diff --git a/lib/request.js b/lib/request.js
index 4d756deb900..962f48d094d 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -6,6 +6,8 @@
  * MIT Licensed
  */
 
+'use strict';
+
 /**
  * Module dependencies.
  */
diff --git a/lib/response.js b/lib/response.js
index 8a976217a24..50b0579b57e 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -5,6 +5,8 @@
  * MIT Licensed
  */
 
+'use strict';
+
 /**
  * Module dependencies.
  * @api private
diff --git a/lib/router/index.js b/lib/router/index.js
index d79a1eb4ce3..8786dc15d3e 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -6,6 +6,8 @@
  * MIT Licensed
  */
 
+'use strict';
+
 /**
  * Module dependencies.
  */
diff --git a/lib/router/layer.js b/lib/router/layer.js
index cc8a1f2c7b4..4747f70bea4 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -6,6 +6,8 @@
  * MIT Licensed
  */
 
+'use strict';
+
 /**
  * Module dependencies.
  */
diff --git a/lib/router/route.js b/lib/router/route.js
index adb833cef96..dadd2c7b6d4 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -6,6 +6,8 @@
  * MIT Licensed
  */
 
+'use strict';
+
 /**
  * Module dependencies.
  */
diff --git a/lib/utils.js b/lib/utils.js
index 42ea76acde6..d10391c43d9 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -5,6 +5,8 @@
  * MIT Licensed
  */
 
+'use strict';
+
 /**
  * Module dependencies.
  * @api private
diff --git a/lib/view.js b/lib/view.js
index acde752ebbd..072422180c6 100644
--- a/lib/view.js
+++ b/lib/view.js
@@ -6,6 +6,8 @@
  * MIT Licensed
  */
 
+'use strict';
+
 /**
  * Module dependencies.
  */

From 24d1c98c0ae4cc5dfd79bfff5d536a95034f7569 Mon Sep 17 00:00:00 2001
From: Behcet Uyar <behcet@liveintent.com>
Date: Fri, 29 May 2015 17:13:15 -0400
Subject: [PATCH 0856/1265] Fix res.format error when only default provided

fixes #2665
---
 History.md         |  1 +
 lib/response.js    |  4 +++-
 test/res.format.js | 15 +++++++++++++++
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f36c515619f..7c33d28450f 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix `res.format` error when only `default` provided
   * Fix issue where `next('route')` in `app.param` would incorrectly skip values
   * Use `array-flatten` module for flattening arrays
   * deps: accepts@~1.2.9
diff --git a/lib/response.js b/lib/response.js
index 50b0579b57e..5334515eeb4 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -606,7 +606,9 @@ res.format = function(obj){
   if (fn) delete obj.default;
   var keys = Object.keys(obj);
 
-  var key = req.accepts(keys);
+  var key = keys.length > 0
+    ? req.accepts(keys)
+    : false;
 
   this.vary("Accept");
 
diff --git a/test/res.format.js b/test/res.format.js
index 28534a199a1..2b0dfd517e7 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -67,6 +67,14 @@ app4.use(function(err, req, res, next){
   res.send(err.status, 'Supports: ' + err.types.join(', '));
 })
 
+var app5 = express();
+
+app5.use(function (req, res, next) {
+  res.format({
+    default: function () { res.send('hey') }
+  });
+});
+
 describe('res', function(){
   describe('.format(obj)', function(){
     describe('with canonicalized mime types', function(){
@@ -102,6 +110,13 @@ describe('res', function(){
         .set('Accept', 'text/html')
         .expect('default', done);
       })
+
+      it('should work when only .default is provided', function (done) {
+        request(app5)
+        .get('/')
+        .set('Accept', '*/*')
+        .expect('hey', done);
+      })
     })
 
     describe('in router', function(){

From e66bb4f328c80540ba1b66ec4b8275d1a43941b5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 Jun 2015 23:15:13 -0400
Subject: [PATCH 0857/1265] deps: path-to-regexp@0.1.4

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 7c33d28450f..4db593509e8 100644
--- a/History.md
+++ b/History.md
@@ -36,6 +36,7 @@ unreleased
     - Add defined behavior for HTTP `CONNECT` requests
     - Add defined behavior for HTTP `Upgrade` requests
     - deps: ee-first@1.1.1
+  * deps: path-to-regexp@0.1.4
   * deps: send@0.13.0
     - Allow Node.js HTTP server to set `Date` response header
     - Fix incorrectly removing `Content-Location` on 304 response
diff --git a/package.json b/package.json
index 0d1858911e5..ba69a020565 100644
--- a/package.json
+++ b/package.json
@@ -43,7 +43,7 @@
     "methods": "~1.1.1",
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.0",
-    "path-to-regexp": "0.1.3",
+    "path-to-regexp": "0.1.4",
     "proxy-addr": "~1.0.8",
     "qs": "2.4.2",
     "range-parser": "~1.0.2",

From 60e2008dee01a90551623371da939de41c05422e Mon Sep 17 00:00:00 2001
From: Blake Embrey <hello@blakeembrey.com>
Date: Fri, 19 Jun 2015 22:13:57 +1000
Subject: [PATCH 0858/1265] deps: path-to-regexp@0.1.6

fixes #2491
fixes #2617
closes #2637
closes #2683
---
 History.md          |  4 +++-
 lib/router/layer.js | 16 +++++-----------
 package.json        |  2 +-
 test/app.router.js  | 41 +++++++++++++++++++++++++++++++++++++++++
 4 files changed, 50 insertions(+), 13 deletions(-)

diff --git a/History.md b/History.md
index 4db593509e8..c6b3cf81f8f 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,8 @@ unreleased
 
   * Fix `res.format` error when only `default` provided
   * Fix issue where `next('route')` in `app.param` would incorrectly skip values
+  * Fix using `*` before params in routes
+  * Fix using capture groups before params in routes
   * Use `array-flatten` module for flattening arrays
   * deps: accepts@~1.2.9
     - deps: mime-types@~2.1.1
@@ -36,7 +38,7 @@ unreleased
     - Add defined behavior for HTTP `CONNECT` requests
     - Add defined behavior for HTTP `Upgrade` requests
     - deps: ee-first@1.1.1
-  * deps: path-to-regexp@0.1.4
+  * deps: path-to-regexp@0.1.6
   * deps: send@0.13.0
     - Allow Node.js HTTP server to set `Date` response header
     - Fix incorrectly removing `Content-Location` on 304 response
diff --git a/lib/router/layer.js b/lib/router/layer.js
index 4747f70bea4..b5c1f58958b 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -133,17 +133,11 @@ Layer.prototype.match = function match(path) {
 
   var keys = this.keys;
   var params = this.params;
-  var prop;
-  var n = 0;
-  var key;
-  var val;
-
-  for (var i = 1, len = m.length; i < len; ++i) {
-    key = keys[i - 1];
-    prop = key
-      ? key.name
-      : n++;
-    val = decode_param(m[i]);
+
+  for (var i = 1; i < m.length; i++) {
+    var key = keys[i - 1];
+    var prop = key.name;
+    var val = decode_param(m[i]);
 
     if (val !== undefined || !(hasOwnProperty.call(params, prop))) {
       params[prop] = val;
diff --git a/package.json b/package.json
index ba69a020565..95a4a472f87 100644
--- a/package.json
+++ b/package.json
@@ -43,7 +43,7 @@
     "methods": "~1.1.1",
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.0",
-    "path-to-regexp": "0.1.4",
+    "path-to-regexp": "0.1.6",
     "proxy-addr": "~1.0.8",
     "qs": "2.4.2",
     "range-parser": "~1.0.2",
diff --git a/test/app.router.js b/test/app.router.js
index def50da34fb..491de358f07 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -641,6 +641,30 @@ describe('app.router', function(){
       .get('/file')
       .expect(404, done);
     })
+
+    it('should keep correct parameter indexes', function(done){
+      var app = express();
+
+      app.get('/*/user/:id', function (req, res) {
+        res.send(req.params);
+      });
+
+      request(app)
+      .get('/1/user/2')
+      .expect(200, '{"0":"1","id":"2"}', done);
+    })
+
+    it('should work within arrays', function(done){
+      var app = express();
+
+      app.get(['/user/:id', '/foo/*', '/:bar'], function (req, res) {
+        res.send(req.params.bar);
+      });
+
+      request(app)
+      .get('/test')
+      .expect(200, 'test', done);
+    })
   })
 
   describe(':name', function(){
@@ -680,6 +704,23 @@ describe('app.router', function(){
       .expect('editing tj', done);
     })
 
+    it('should work following a partial capture group', function(done){
+      var app = express();
+      var cb = after(2, done);
+
+      app.get('/user(s)?/:user/:op', function(req, res){
+        res.end(req.params.op + 'ing ' + req.params.user + (req.params[0] ? ' (old)' : ''));
+      });
+
+      request(app)
+      .get('/user/tj/edit')
+      .expect('editing tj', cb);
+
+      request(app)
+      .get('/users/tj/edit')
+      .expect('editing tj (old)', cb);
+    })
+
     it('should work in array of paths', function(done){
       var app = express();
       var cb = after(2, done);

From 0634e7e189a0ea12261b8fa81c7ca7234994b26d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 20 Jun 2015 12:54:52 -0400
Subject: [PATCH 0859/1265] tests: add test for rendering extensionless file
 without view engine

---
 test/res.render.js | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/test/res.render.js b/test/res.render.js
index a843b2af159..d4d2a7616d1 100644
--- a/test/res.render.js
+++ b/test/res.render.js
@@ -34,6 +34,20 @@ describe('res', function(){
       .expect('<p>tobi</p>', done);
     })
 
+    it('should error without "view engine" set and no file extension', function (done) {
+      var app = createApp();
+
+      app.locals.user = { name: 'tobi' };
+
+      app.use(function(req, res){
+        res.render(__dirname + '/fixtures/user');
+      });
+
+      request(app)
+      .get('/')
+      .expect(500, /No default engine was specified/, done);
+    })
+
     it('should expose app.locals', function(done){
       var app = createApp();
 

From a8a8564459688bdc0b2653da2f28a4fefde7dfdb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 20 Jun 2015 13:06:08 -0400
Subject: [PATCH 0860/1265] perf: remove argument reassignments in View

---
 History.md  |  1 +
 lib/view.js | 73 ++++++++++++++++++++++++++++++++++-------------------
 2 files changed, 48 insertions(+), 26 deletions(-)

diff --git a/History.md b/History.md
index c6b3cf81f8f..c1cef158219 100644
--- a/History.md
+++ b/History.md
@@ -66,6 +66,7 @@ unreleased
     - perf: reduce try block size
     - perf: remove bitwise operations
   * perf: enable strict mode
+  * perf: remove argument reassignments in `View`
   * perf: use saved reference to `http.STATUS_CODES`
 
 4.12.4 / 2015-05-17
diff --git a/lib/view.js b/lib/view.js
index 072422180c6..52415d4c28b 100644
--- a/lib/view.js
+++ b/lib/view.js
@@ -10,6 +10,7 @@
 
 /**
  * Module dependencies.
+ * @private
  */
 
 var debug = require('debug')('express:view');
@@ -29,7 +30,8 @@ var join = path.join;
 var resolve = path.resolve;
 
 /**
- * Expose `View`.
+ * Module exports.
+ * @public
  */
 
 module.exports = View;
@@ -43,30 +45,51 @@ module.exports = View;
  *   - `engines` template engine require() cache
  *   - `root` root path for view lookup
  *
- * @param {String} name
- * @param {Object} options
- * @api private
+ * @param {string} name
+ * @param {object} options
+ * @public
  */
 
 function View(name, options) {
-  options = options || {};
+  var opts = options || {};
+
+  this.defaultEngine = opts.defaultEngine;
+  this.ext = extname(name);
   this.name = name;
-  this.root = options.root;
-  var engines = options.engines;
-  this.defaultEngine = options.defaultEngine;
-  var ext = this.ext = extname(name);
-  if (!ext && !this.defaultEngine) throw new Error('No default engine was specified and no extension was provided.');
-  if (!ext) name += (ext = this.ext = ('.' != this.defaultEngine[0] ? '.' : '') + this.defaultEngine);
-  this.engine = engines[ext] || (engines[ext] = require(ext.slice(1)).__express);
-  this.path = this.lookup(name);
+  this.root = opts.root;
+
+  if (!this.ext && !this.defaultEngine) {
+    throw new Error('No default engine was specified and no extension was provided.');
+  }
+
+  var fileName = name;
+
+  if (!this.ext) {
+    // get extension from default engine name
+    this.ext = this.defaultEngine[0] !== '.'
+      ? '.' + this.defaultEngine
+      : this.defaultEngine;
+
+    fileName += this.ext;
+  }
+
+  if (!opts.engines[this.ext]) {
+    // load engine
+    opts.engines[this.ext] = require(this.ext.substr(1)).__express;
+  }
+
+  // store loaded engine
+  this.engine = opts.engines[this.ext];
+
+  // lookup path
+  this.path = this.lookup(fileName);
 }
 
 /**
  * Lookup view by the given `name`
  *
- * @param {String} name
- * @return {String}
- * @api private
+ * @param {string} name
+ * @private
  */
 
 View.prototype.lookup = function lookup(name) {
@@ -91,16 +114,16 @@ View.prototype.lookup = function lookup(name) {
 };
 
 /**
- * Render with the given `options` and callback `fn(err, str)`.
+ * Render with the given options.
  *
- * @param {Object} options
- * @param {Function} fn
- * @api private
+ * @param {object} options
+ * @param {function} callback
+ * @private
  */
 
-View.prototype.render = function render(options, fn) {
+View.prototype.render = function render(options, callback) {
   debug('render "%s"', this.path);
-  this.engine(this.path, options, fn);
+  this.engine(this.path, options, callback);
 };
 
 /**
@@ -113,12 +136,10 @@ View.prototype.render = function render(options, fn) {
 
 View.prototype.resolve = function resolve(dir, file) {
   var ext = this.ext;
-  var path;
-  var stat;
 
   // <path>.<ext>
-  path = join(dir, file);
-  stat = tryStat(path);
+  var path = join(dir, file);
+  var stat = tryStat(path);
 
   if (stat && stat.isFile()) {
     return path;

From 10502480d0f286442654852dba4ec57f8d3391fd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 20 Jun 2015 13:31:03 -0400
Subject: [PATCH 0861/1265] perf: remove argument reassignments in application

---
 History.md         |   1 +
 lib/application.js | 174 ++++++++++++++++++++++++++-------------------
 2 files changed, 101 insertions(+), 74 deletions(-)

diff --git a/History.md b/History.md
index c1cef158219..84738af0966 100644
--- a/History.md
+++ b/History.md
@@ -66,6 +66,7 @@ unreleased
     - perf: reduce try block size
     - perf: remove bitwise operations
   * perf: enable strict mode
+  * perf: remove argument reassignments in application
   * perf: remove argument reassignments in `View`
   * perf: use saved reference to `http.STATUS_CODES`
 
diff --git a/lib/application.js b/lib/application.js
index b31c88b7b05..7db0f14d4ac 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -10,7 +10,7 @@
 
 /**
  * Module dependencies.
- * @api private
+ * @private
  */
 
 var finalhandler = require('finalhandler');
@@ -38,7 +38,7 @@ var app = exports = module.exports = {};
 
 /**
  * Variable for trust proxy inheritance back-compat
- * @api private
+ * @private
  */
 
 var trustProxyDefaultSymbol = '@@symbol:trust_proxy_default';
@@ -50,27 +50,28 @@ var trustProxyDefaultSymbol = '@@symbol:trust_proxy_default';
  *   - setup default middleware
  *   - setup route reflection methods
  *
- * @api private
+ * @private
  */
 
-app.init = function(){
+app.init = function init() {
   this.cache = {};
-  this.settings = {};
   this.engines = {};
+  this.settings = {};
+
   this.defaultConfiguration();
 };
 
 /**
  * Initialize application configuration.
- *
- * @api private
+ * @private
  */
 
-app.defaultConfiguration = function(){
+app.defaultConfiguration = function defaultConfiguration() {
+  var env = process.env.NODE_ENV || 'development';
+
   // default settings
   this.enable('x-powered-by');
   this.set('etag', 'weak');
-  var env = process.env.NODE_ENV || 'development';
   this.set('env', env);
   this.set('query parser', 'extended');
   this.set('subdomain offset', 2);
@@ -130,9 +131,9 @@ app.defaultConfiguration = function(){
  * We cannot add the base router in the defaultConfiguration because
  * it reads app settings which might be set after that has run.
  *
- * @api private
+ * @private
  */
-app.lazyrouter = function() {
+app.lazyrouter = function lazyrouter() {
   if (!this._router) {
     this._router = new Router({
       caseSensitive: this.enabled('case sensitive routing'),
@@ -147,17 +148,17 @@ app.lazyrouter = function() {
 /**
  * Dispatch a req, res pair into the application. Starts pipeline processing.
  *
- * If no _done_ callback is provided, then default error handlers will respond
+ * If no callback is provided, then default error handlers will respond
  * in the event of an error bubbling through the stack.
  *
- * @api private
+ * @private
  */
 
-app.handle = function(req, res, done) {
+app.handle = function handle(req, res, callback) {
   var router = this._router;
 
   // final handler
-  done = done || finalhandler(req, res, {
+  var done = callback || finalhandler(req, res, {
     env: this.get('env'),
     onerror: logerror.bind(this)
   });
@@ -179,7 +180,7 @@ app.handle = function(req, res, done) {
  * If the _fn_ parameter is an express app, then it will be
  * mounted at the _route_ specified.
  *
- * @api public
+ * @public
  */
 
 app.use = function use(fn) {
@@ -246,10 +247,10 @@ app.use = function use(fn) {
  * Routes are isolated middleware stacks for specific paths.
  * See the Route api docs for details.
  *
- * @api public
+ * @public
  */
 
-app.route = function(path){
+app.route = function route(path) {
   this.lazyrouter();
   return this._router.route(path);
 };
@@ -285,13 +286,22 @@ app.route = function(path){
  * @param {String} ext
  * @param {Function} fn
  * @return {app} for chaining
- * @api public
+ * @public
  */
 
-app.engine = function(ext, fn){
-  if ('function' != typeof fn) throw new Error('callback function required');
-  if ('.' != ext[0]) ext = '.' + ext;
-  this.engines[ext] = fn;
+app.engine = function engine(ext, fn) {
+  if (typeof fn !== 'function') {
+    throw new Error('callback function required');
+  }
+
+  // get file extension
+  var extension = ext[0] !== '.'
+    ? '.' + ext
+    : ext;
+
+  // store engine
+  this.engines[extension] = fn;
+
   return this;
 };
 
@@ -304,20 +314,22 @@ app.engine = function(ext, fn){
  * @param {String|Array} name
  * @param {Function} fn
  * @return {app} for chaining
- * @api public
+ * @public
  */
 
-app.param = function(name, fn){
+app.param = function param(name, fn) {
   this.lazyrouter();
 
   if (Array.isArray(name)) {
-    name.forEach(function(key) {
-      this.param(key, fn);
-    }, this);
+    for (var i = 0; i < name.length; i++) {
+      this.param(name[i], fn);
+    }
+
     return this;
   }
 
   this._router.param(name, fn);
+
   return this;
 };
 
@@ -333,10 +345,10 @@ app.param = function(name, fn){
  * @param {String} setting
  * @param {*} [val]
  * @return {Server} for chaining
- * @api public
+ * @public
  */
 
-app.set = function(setting, val){
+app.set = function set(setting, val) {
   if (arguments.length === 1) {
     // app.get(setting)
     return this.settings[setting];
@@ -382,10 +394,10 @@ app.set = function(setting, val){
  * return value would be "/blog/admin".
  *
  * @return {String}
- * @api private
+ * @private
  */
 
-app.path = function(){
+app.path = function path() {
   return this.parent
     ? this.parent.path() + this.mountpath
     : '';
@@ -403,11 +415,11 @@ app.path = function(){
  *
  * @param {String} setting
  * @return {Boolean}
- * @api public
+ * @public
  */
 
-app.enabled = function(setting){
-  return !!this.set(setting);
+app.enabled = function enabled(setting) {
+  return Boolean(this.set(setting));
 };
 
 /**
@@ -422,10 +434,10 @@ app.enabled = function(setting){
  *
  * @param {String} setting
  * @return {Boolean}
- * @api public
+ * @public
  */
 
-app.disabled = function(setting){
+app.disabled = function disabled(setting) {
   return !this.set(setting);
 };
 
@@ -434,10 +446,10 @@ app.disabled = function(setting){
  *
  * @param {String} setting
  * @return {app} for chaining
- * @api public
+ * @public
  */
 
-app.enable = function(setting){
+app.enable = function enable(setting) {
   return this.set(setting, true);
 };
 
@@ -446,10 +458,10 @@ app.enable = function(setting){
  *
  * @param {String} setting
  * @return {app} for chaining
- * @api public
+ * @public
  */
 
-app.disable = function(setting){
+app.disable = function disable(setting) {
   return this.set(setting, false);
 };
 
@@ -459,7 +471,10 @@ app.disable = function(setting){
 
 methods.forEach(function(method){
   app[method] = function(path){
-    if ('get' == method && 1 == arguments.length) return this.set(path);
+    if (method === 'get' && arguments.length === 1) {
+      // app.get(setting)
+      return this.set(path);
+    }
 
     this.lazyrouter();
 
@@ -476,17 +491,18 @@ methods.forEach(function(method){
  * @param {String} path
  * @param {Function} ...
  * @return {app} for chaining
- * @api public
+ * @public
  */
 
-app.all = function(path){
+app.all = function all(path) {
   this.lazyrouter();
 
   var route = this._router.route(path);
   var args = slice.call(arguments, 1);
-  methods.forEach(function(method){
-    route[method].apply(route, args);
-  });
+
+  for (var i = 0; i < methods.length; i++) {
+    route[methods[i]].apply(route, args);
+  }
 
   return this;
 };
@@ -508,43 +524,50 @@ app.del = deprecate.function(app.delete, 'app.del: Use app.delete instead');
  *
  * @param {String} name
  * @param {String|Function} options or fn
- * @param {Function} fn
- * @api public
+ * @param {Function} callback
+ * @public
  */
 
-app.render = function(name, options, fn){
-  var opts = {};
+app.render = function render(name, options, callback) {
   var cache = this.cache;
+  var done = callback;
   var engines = this.engines;
+  var opts = options;
+  var renderOptions = {};
   var view;
 
   // support callback function as second arg
-  if ('function' == typeof options) {
-    fn = options, options = {};
+  if (typeof options === 'function') {
+    done = options;
+    opts = {};
   }
 
   // merge app.locals
-  merge(opts, this.locals);
+  merge(renderOptions, this.locals);
 
   // merge options._locals
-  if (options._locals) {
-    merge(opts, options._locals);
+  if (opts._locals) {
+    merge(renderOptions, opts._locals);
   }
 
   // merge options
-  merge(opts, options);
+  merge(renderOptions, opts);
 
   // set .cache unless explicitly provided
-  opts.cache = null == opts.cache
-    ? this.enabled('view cache')
-    : opts.cache;
+  if (renderOptions.cache == null) {
+    renderOptions.cache = this.enabled('view cache');
+  }
 
   // primed cache
-  if (opts.cache) view = cache[name];
+  if (renderOptions.cache) {
+    view = cache[name];
+  }
 
   // view
   if (!view) {
-    view = new (this.get('view'))(name, {
+    var View = this.get('view');
+
+    view = new View(name, {
       defaultEngine: this.get('view engine'),
       root: this.get('views'),
       engines: engines
@@ -556,18 +579,20 @@ app.render = function(name, options, fn){
         : 'directory "' + view.root + '"'
       var err = new Error('Failed to lookup view "' + name + '" in views ' + dirs);
       err.view = view;
-      return fn(err);
+      return done(err);
     }
 
     // prime the cache
-    if (opts.cache) cache[name] = view;
+    if (renderOptions.cache) {
+      cache[name] = view;
+    }
   }
 
   // render
   try {
-    view.render(opts, fn);
+    view.render(renderOptions, done);
   } catch (err) {
-    fn(err);
+    done(err);
   }
 };
 
@@ -589,21 +614,22 @@ app.render = function(name, options, fn){
  *    https.createServer({ ... }, app).listen(443);
  *
  * @return {http.Server}
- * @api public
+ * @public
  */
 
-app.listen = function(){
+app.listen = function listen() {
   var server = http.createServer(this);
   return server.listen.apply(server, arguments);
 };
 
 /**
-* Log error using console.error.
-*
-* @param {Error} err
-* @api private
-*/
+ * Log error using console.error.
+ *
+ * @param {Error} err
+ * @private
+ */
 
-function logerror(err){
+function logerror(err) {
+  /* istanbul ignore next */
   if (this.get('env') !== 'test') console.error(err.stack || err.toString());
 }

From f5a240636d71781c7875191d2048279efce5ad56 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 20 Jun 2015 13:36:40 -0400
Subject: [PATCH 0862/1265] perf: isolate app.render try block

---
 History.md         |  1 +
 lib/application.js | 19 ++++++++++++++-----
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index 84738af0966..a50fb367407 100644
--- a/History.md
+++ b/History.md
@@ -66,6 +66,7 @@ unreleased
     - perf: reduce try block size
     - perf: remove bitwise operations
   * perf: enable strict mode
+  * perf: isolate `app.render` try block
   * perf: remove argument reassignments in application
   * perf: remove argument reassignments in `View`
   * perf: use saved reference to `http.STATUS_CODES`
diff --git a/lib/application.js b/lib/application.js
index 7db0f14d4ac..b230ad8d629 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -589,11 +589,7 @@ app.render = function render(name, options, callback) {
   }
 
   // render
-  try {
-    view.render(renderOptions, done);
-  } catch (err) {
-    done(err);
-  }
+  tryRender(view, renderOptions, done);
 };
 
 /**
@@ -633,3 +629,16 @@ function logerror(err) {
   /* istanbul ignore next */
   if (this.get('env') !== 'test') console.error(err.stack || err.toString());
 }
+
+/**
+ * Try rendering a view.
+ * @private
+ */
+
+function tryRender(view, options, callback) {
+  try {
+    view.render(options, callback);
+  } catch (err) {
+    callback(err);
+  }
+}

From d414a2dc733167114e9a37107cc27f078181d1c2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 20 Jun 2015 13:48:58 -0400
Subject: [PATCH 0863/1265] perf: remove argument reassignments in request
 prototype

---
 History.md     |  1 +
 lib/request.js | 72 +++++++++++++++++++++++++++++---------------------
 2 files changed, 43 insertions(+), 30 deletions(-)

diff --git a/History.md b/History.md
index a50fb367407..68d9f7db2ed 100644
--- a/History.md
+++ b/History.md
@@ -68,6 +68,7 @@ unreleased
   * perf: enable strict mode
   * perf: isolate `app.render` try block
   * perf: remove argument reassignments in application
+  * perf: remove argument reassignments in request prototype
   * perf: remove argument reassignments in `View`
   * perf: use saved reference to `http.STATUS_CODES`
 
diff --git a/lib/request.js b/lib/request.js
index 962f48d094d..33cac180ed7 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -10,6 +10,7 @@
 
 /**
  * Module dependencies.
+ * @private
  */
 
 var accepts = require('accepts');
@@ -51,18 +52,20 @@ var req = exports = module.exports = {
  *
  * @param {String} name
  * @return {String}
- * @api public
+ * @public
  */
 
 req.get =
-req.header = function(name){
-  switch (name = name.toLowerCase()) {
+req.header = function header(name) {
+  var lc = name.toLowerCase();
+
+  switch (lc) {
     case 'referer':
     case 'referrer':
       return this.headers.referrer
         || this.headers.referer;
     default:
-      return this.headers[name];
+      return this.headers[lc];
   }
 };
 
@@ -109,7 +112,7 @@ req.header = function(name){
  *
  * @param {String|Array} type(s)
  * @return {String|Array|Boolean}
- * @api public
+ * @public
  */
 
 req.accepts = function(){
@@ -122,7 +125,7 @@ req.accepts = function(){
  *
  * @param {String} ...encoding
  * @return {String|Array}
- * @api public
+ * @public
  */
 
 req.acceptsEncodings = function(){
@@ -139,7 +142,7 @@ req.acceptsEncoding = deprecate.function(req.acceptsEncodings,
  *
  * @param {String} ...charset
  * @return {String|Array}
- * @api public
+ * @public
  */
 
 req.acceptsCharsets = function(){
@@ -156,7 +159,7 @@ req.acceptsCharset = deprecate.function(req.acceptsCharsets,
  *
  * @param {String} ...lang
  * @return {String|Array}
- * @api public
+ * @public
  */
 
 req.acceptsLanguages = function(){
@@ -184,7 +187,7 @@ req.acceptsLanguage = deprecate.function(req.acceptsLanguages,
  *
  * @param {Number} size
  * @return {Array}
- * @api public
+ * @public
  */
 
 req.range = function(size){
@@ -207,7 +210,7 @@ req.range = function(size){
  * @param {String} name
  * @param {Mixed} [defaultValue]
  * @return {String}
- * @api public
+ * @public
  */
 
 req.param = function param(name, defaultValue) {
@@ -248,14 +251,23 @@ req.param = function param(name, defaultValue) {
  *      req.is('html');
  *      // => false
  *
- * @param {String} type
- * @return {Boolean}
- * @api public
+ * @param {String|Array} types...
+ * @return {String|false|null}
+ * @public
  */
 
-req.is = function(types){
-  if (!Array.isArray(types)) types = [].slice.call(arguments);
-  return typeis(this, types);
+req.is = function is(types) {
+  var arr = types;
+
+  // support flattened arguments
+  if (!Array.isArray(types)) {
+    arr = new Array(arguments.length);
+    for (var i = 0; i < arr.length; i++) {
+      arr[i] = arguments[i];
+    }
+  }
+
+  return typeis(this, arr);
 };
 
 /**
@@ -269,7 +281,7 @@ req.is = function(types){
  * supplies https for you this may be enabled.
  *
  * @return {String}
- * @api public
+ * @public
  */
 
 defineGetter(req, 'protocol', function protocol(){
@@ -294,11 +306,11 @@ defineGetter(req, 'protocol', function protocol(){
  *    req.protocol == 'https'
  *
  * @return {Boolean}
- * @api public
+ * @public
  */
 
 defineGetter(req, 'secure', function secure(){
-  return 'https' == this.protocol;
+  return this.protocol === 'https';
 });
 
 /**
@@ -308,7 +320,7 @@ defineGetter(req, 'secure', function secure(){
  * "trust proxy" is set.
  *
  * @return {String}
- * @api public
+ * @public
  */
 
 defineGetter(req, 'ip', function ip(){
@@ -325,7 +337,7 @@ defineGetter(req, 'ip', function ip(){
  * "proxy2" were trusted.
  *
  * @return {Array}
- * @api public
+ * @public
  */
 
 defineGetter(req, 'ips', function ips() {
@@ -346,7 +358,7 @@ defineGetter(req, 'ips', function ips() {
  * If "subdomain offset" is 3, req.subdomains is `["tobi"]`.
  *
  * @return {Array}
- * @api public
+ * @public
  */
 
 defineGetter(req, 'subdomains', function subdomains() {
@@ -366,7 +378,7 @@ defineGetter(req, 'subdomains', function subdomains() {
  * Short-hand for `url.parse(req.url).pathname`.
  *
  * @return {String}
- * @api public
+ * @public
  */
 
 defineGetter(req, 'path', function path() {
@@ -381,7 +393,7 @@ defineGetter(req, 'path', function path() {
  * be trusted.
  *
  * @return {String}
- * @api public
+ * @public
  */
 
 defineGetter(req, 'hostname', function hostname(){
@@ -400,7 +412,7 @@ defineGetter(req, 'hostname', function hostname(){
     : 0;
   var index = host.indexOf(':', offset);
 
-  return ~index
+  return index !== -1
     ? host.substring(0, index)
     : host;
 });
@@ -417,7 +429,7 @@ defineGetter(req, 'host', deprecate.function(function host(){
  * still match.
  *
  * @return {Boolean}
- * @api public
+ * @public
  */
 
 defineGetter(req, 'fresh', function(){
@@ -441,7 +453,7 @@ defineGetter(req, 'fresh', function(){
  * resource has changed.
  *
  * @return {Boolean}
- * @api public
+ * @public
  */
 
 defineGetter(req, 'stale', function stale(){
@@ -452,12 +464,12 @@ defineGetter(req, 'stale', function stale(){
  * Check if the request was an _XMLHttpRequest_.
  *
  * @return {Boolean}
- * @api public
+ * @public
  */
 
 defineGetter(req, 'xhr', function xhr(){
   var val = this.get('X-Requested-With') || '';
-  return 'xmlhttprequest' == val.toLowerCase();
+  return val.toLowerCase() === 'xmlhttprequest';
 });
 
 /**
@@ -466,7 +478,7 @@ defineGetter(req, 'xhr', function xhr(){
  * @param {Object} obj
  * @param {String} name
  * @param {Function} getter
- * @api private
+ * @private
  */
 function defineGetter(obj, name, getter) {
   Object.defineProperty(obj, name, {

From bb53b20d4c72548b03af97742bbef4ca15a4801c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 20 Jun 2015 14:36:48 -0400
Subject: [PATCH 0864/1265] perf: remove argument reassignments in response
 prototype

---
 History.md      |   1 +
 lib/response.js | 217 +++++++++++++++++++++++++++---------------------
 2 files changed, 124 insertions(+), 94 deletions(-)

diff --git a/History.md b/History.md
index 68d9f7db2ed..bc5a3d95eab 100644
--- a/History.md
+++ b/History.md
@@ -69,6 +69,7 @@ unreleased
   * perf: isolate `app.render` try block
   * perf: remove argument reassignments in application
   * perf: remove argument reassignments in request prototype
+  * perf: remove argument reassignments in response prototype
   * perf: remove argument reassignments in `View`
   * perf: use saved reference to `http.STATUS_CODES`
 
diff --git a/lib/response.js b/lib/response.js
index 5334515eeb4..b9d6cc0e9bc 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -9,7 +9,7 @@
 
 /**
  * Module dependencies.
- * @api private
+ * @private
  */
 
 var contentDisposition = require('content-disposition');
@@ -40,15 +40,22 @@ var res = module.exports = {
   __proto__: http.ServerResponse.prototype
 };
 
+/**
+ * Module variables.
+ * @private
+ */
+
+var charsetRegExp = /;\s*charset\s*=/;
+
 /**
  * Set status `code`.
  *
  * @param {Number} code
  * @return {ServerResponse}
- * @api public
+ * @public
  */
 
-res.status = function(code){
+res.status = function status(code) {
   this.statusCode = code;
   return this;
 };
@@ -65,7 +72,7 @@ res.status = function(code){
  *
  * @param {Object} links
  * @return {ServerResponse}
- * @api public
+ * @public
  */
 
 res.links = function(links){
@@ -86,7 +93,7 @@ res.links = function(links){
  *     res.send('<p>some html</p>');
  *
  * @param {string|number|boolean|object|Buffer} body
- * @api public
+ * @public
  */
 
 res.send = function send(body) {
@@ -209,7 +216,7 @@ res.send = function send(body) {
  *     res.json({ user: 'tj' });
  *
  * @param {string|number|boolean|object} obj
- * @api public
+ * @public
  */
 
 res.json = function json(obj) {
@@ -251,7 +258,7 @@ res.json = function json(obj) {
  *     res.jsonp({ user: 'tj' });
  *
  * @param {string|number|boolean|object} obj
- * @api public
+ * @public
  */
 
 res.jsonp = function jsonp(obj) {
@@ -322,7 +329,7 @@ res.jsonp = function jsonp(obj) {
  *     res.sendStatus(200);
  *
  * @param {number} statusCode
- * @api public
+ * @public
  */
 
 res.sendStatus = function sendStatus(statusCode) {
@@ -338,7 +345,7 @@ res.sendStatus = function sendStatus(statusCode) {
  * Transfer the file at the given `path`.
  *
  * Automatically sets the _Content-Type_ response header field.
- * The callback `fn(err)` is invoked when the transfer is complete
+ * The callback `callback(err)` is invoked when the transfer is complete
  * or when an error occurs. Be sure to check `res.sentHeader`
  * if you wish to attempt responding, as the header and some data
  * may have already been transferred.
@@ -372,13 +379,15 @@ res.sendStatus = function sendStatus(statusCode) {
  *       });
  *     });
  *
- * @api public
+ * @public
  */
 
-res.sendFile = function sendFile(path, options, fn) {
+res.sendFile = function sendFile(path, options, callback) {
+  var done = callback;
   var req = this.req;
   var res = this;
   var next = req.next;
+  var opts = options || {};
 
   if (!path) {
     throw new TypeError('path argument is required to res.sendFile');
@@ -386,23 +395,21 @@ res.sendFile = function sendFile(path, options, fn) {
 
   // support function as second arg
   if (typeof options === 'function') {
-    fn = options;
-    options = {};
+    done = options;
+    opts = {};
   }
 
-  options = options || {};
-
-  if (!options.root && !isAbsolute(path)) {
+  if (!opts.root && !isAbsolute(path)) {
     throw new TypeError('path must be absolute or specify root to res.sendFile');
   }
 
   // create file stream
   var pathname = encodeURI(path);
-  var file = send(req, pathname, options);
+  var file = send(req, pathname, opts);
 
   // transfer
-  sendfile(res, file, options, function (err) {
-    if (fn) return fn(err);
+  sendfile(res, file, opts, function (err) {
+    if (done) return done(err);
     if (err && err.code === 'EISDIR') return next();
 
     // next() all but write errors
@@ -416,7 +423,7 @@ res.sendFile = function sendFile(path, options, fn) {
  * Transfer the file at the given `path`.
  *
  * Automatically sets the _Content-Type_ response header field.
- * The callback `fn(err)` is invoked when the transfer is complete
+ * The callback `callback(err)` is invoked when the transfer is complete
  * or when an error occurs. Be sure to check `res.sentHeader`
  * if you wish to attempt responding, as the header and some data
  * may have already been transferred.
@@ -450,28 +457,28 @@ res.sendFile = function sendFile(path, options, fn) {
  *       });
  *     });
  *
- * @api public
+ * @public
  */
 
-res.sendfile = function(path, options, fn){
+res.sendfile = function (path, options, callback) {
+  var done = callback;
   var req = this.req;
   var res = this;
   var next = req.next;
+  var opts = options || {};
 
   // support function as second arg
   if (typeof options === 'function') {
-    fn = options;
-    options = {};
+    done = options;
+    opts = {};
   }
 
-  options = options || {};
-
   // create file stream
-  var file = send(req, path, options);
+  var file = send(req, path, opts);
 
   // transfer
-  sendfile(res, file, options, function (err) {
-    if (fn) return fn(err);
+  sendfile(res, file, opts, function (err) {
+    if (done) return done(err);
     if (err && err.code === 'EISDIR') return next();
 
     // next() all but write errors
@@ -488,33 +495,34 @@ res.sendfile = deprecate.function(res.sendfile,
  * Transfer the file at the given `path` as an attachment.
  *
  * Optionally providing an alternate attachment `filename`,
- * and optional callback `fn(err)`. The callback is invoked
+ * and optional callback `callback(err)`. The callback is invoked
  * when the data transfer is complete, or when an error has
  * ocurred. Be sure to check `res.headersSent` if you plan to respond.
  *
  * This method uses `res.sendfile()`.
  *
- * @api public
+ * @public
  */
 
-res.download = function download(path, filename, fn) {
+res.download = function download(path, filename, callback) {
+  var done = callback;
+  var name = filename;
+
   // support function as second arg
   if (typeof filename === 'function') {
-    fn = filename;
-    filename = null;
+    done = filename;
+    name = null;
   }
 
-  filename = filename || path;
-
   // set Content-Disposition when file is sent
   var headers = {
-    'Content-Disposition': contentDisposition(filename)
+    'Content-Disposition': contentDisposition(name || path)
   };
 
   // Resolve the full path for sendFile
   var fullPath = resolve(path);
 
-  return this.sendFile(fullPath, { headers: headers }, fn);
+  return this.sendFile(fullPath, { headers: headers }, done);
 };
 
 /**
@@ -531,14 +539,16 @@ res.download = function download(path, filename, fn) {
  *
  * @param {String} type
  * @return {ServerResponse} for chaining
- * @api public
+ * @public
  */
 
 res.contentType =
-res.type = function(type){
-  return this.set('Content-Type', ~type.indexOf('/')
-    ? type
-    : mime.lookup(type));
+res.type = function contentType(type) {
+  var ct = type.indexOf('/') === -1
+    ? mime.lookup(type)
+    : type;
+
+  return this.set('Content-Type', ct);
 };
 
 /**
@@ -595,7 +605,7 @@ res.type = function(type){
  *
  * @param {Object} obj
  * @return {ServerResponse} for chaining
- * @api public
+ * @public
  */
 
 res.format = function(obj){
@@ -632,7 +642,7 @@ res.format = function(obj){
  *
  * @param {String} filename
  * @return {ServerResponse}
- * @api public
+ * @public
  */
 
 res.attachment = function attachment(filename) {
@@ -657,7 +667,7 @@ res.attachment = function attachment(filename) {
  * @param {String} field
  * @param {String|Array} val
  * @return {ServerResponse} for chaining
- * @api public
+ * @public
  */
 
 res.append = function append(field, val) {
@@ -689,19 +699,23 @@ res.append = function append(field, val) {
  * @param {String|Object} field
  * @param {String|Array} val
  * @return {ServerResponse} for chaining
- * @api public
+ * @public
  */
 
 res.set =
 res.header = function header(field, val) {
   if (arguments.length === 2) {
-    if (Array.isArray(val)) val = val.map(String);
-    else val = String(val);
-    if ('content-type' == field.toLowerCase() && !/;\s*charset\s*=/.test(val)) {
-      var charset = mime.charsets.lookup(val.split(';')[0]);
-      if (charset) val += '; charset=' + charset.toLowerCase();
+    var value = Array.isArray(val)
+      ? val.map(String)
+      : String(val);
+
+    // add charset to content-type
+    if (field.toLowerCase() === 'content-type' && !charsetRegExp.test(value)) {
+      var charset = mime.charsets.lookup(value.split(';')[0]);
+      if (charset) value += '; charset=' + charset.toLowerCase();
     }
-    this.setHeader(field, val);
+
+    this.setHeader(field, value);
   } else {
     for (var key in field) {
       this.set(key, field[key]);
@@ -715,7 +729,7 @@ res.header = function header(field, val) {
  *
  * @param {String} field
  * @return {String}
- * @api public
+ * @public
  */
 
 res.get = function(field){
@@ -728,18 +742,17 @@ res.get = function(field){
  * @param {String} name
  * @param {Object} options
  * @return {ServerResponse} for chaining
- * @api public
+ * @public
  */
 
-res.clearCookie = function(name, options){
-  var opts = { expires: new Date(1), path: '/' };
-  return this.cookie(name, '', options
-    ? merge(opts, options)
-    : opts);
+res.clearCookie = function clearCookie(name, options) {
+  var opts = merge({ expires: new Date(1), path: '/' }, options);
+
+  return this.cookie(name, '', opts);
 };
 
 /**
- * Set cookie `name` to `val`, with the given `options`.
+ * Set cookie `name` to `value`, with the given `options`.
  *
  * Options:
  *
@@ -756,26 +769,39 @@ res.clearCookie = function(name, options){
  *    res.cookie('rememberme', '1', { maxAge: 900000, httpOnly: true })
  *
  * @param {String} name
- * @param {String|Object} val
+ * @param {String|Object} value
  * @param {Options} options
  * @return {ServerResponse} for chaining
- * @api public
+ * @public
  */
 
-res.cookie = function(name, val, options){
-  options = merge({}, options);
+res.cookie = function (name, value, options) {
+  var opts = merge({}, options);
   var secret = this.req.secret;
-  var signed = options.signed;
-  if (signed && !secret) throw new Error('cookieParser("secret") required for signed cookies');
-  if ('number' == typeof val) val = val.toString();
-  if ('object' == typeof val) val = 'j:' + JSON.stringify(val);
-  if (signed) val = 's:' + sign(val, secret);
-  if ('maxAge' in options) {
-    options.expires = new Date(Date.now() + options.maxAge);
-    options.maxAge /= 1000;
+  var signed = opts.signed;
+
+  if (signed && !secret) {
+    throw new Error('cookieParser("secret") required for signed cookies');
   }
-  if (null == options.path) options.path = '/';
-  var headerVal = cookie.serialize(name, String(val), options);
+
+  var val = typeof value === 'object'
+    ? 'j:' + JSON.stringify(value)
+    : String(value);
+
+  if (signed) {
+    val = 's:' + sign(val, secret);
+  }
+
+  if ('maxAge' in opts) {
+    opts.expires = new Date(Date.now() + opts.maxAge);
+    opts.maxAge /= 1000;
+  }
+
+  if (opts.path == null) {
+    opts.path = '/';
+  }
+
+  var headerVal = cookie.serialize(name, String(val), opts);
 
   // supports multiple 'res.cookie' calls by getting previous value
   var prev = this.get('Set-Cookie');
@@ -790,7 +816,6 @@ res.cookie = function(name, val, options){
   return this;
 };
 
-
 /**
  * Set the location header to `url`.
  *
@@ -805,17 +830,19 @@ res.cookie = function(name, val, options){
  *
  * @param {String} url
  * @return {ServerResponse} for chaining
- * @api public
+ * @public
  */
 
-res.location = function(url){
-  var req = this.req;
+res.location = function location(url) {
+  var loc = url;
 
   // "back" is an alias for the referrer
-  if ('back' == url) url = req.get('Referrer') || '/';
+  if (url === 'back') {
+    loc = this.req.get('Referrer') || '/';
+  }
 
-  // Respond
-  this.set('Location', url);
+  // set location
+  this.set('Location', loc);
   return this;
 };
 
@@ -834,7 +861,7 @@ res.location = function(url){
  *    res.redirect(301, 'http://example.com');
  *    res.redirect('../login'); // /blog/post/1 -> /blog/login
  *
- * @api public
+ * @public
  */
 
 res.redirect = function redirect(url) {
@@ -890,7 +917,7 @@ res.redirect = function redirect(url) {
  *
  * @param {Array|String} field
  * @return {ServerResponse} for chaining
- * @api public
+ * @public
  */
 
 res.vary = function(field){
@@ -915,31 +942,33 @@ res.vary = function(field){
  *  - `cache`     boolean hinting to the engine it should cache
  *  - `filename`  filename of the view being rendered
  *
- * @api public
+ * @public
  */
 
-res.render = function(view, options, fn){
-  options = options || {};
-  var self = this;
+res.render = function render(view, options, callback) {
+  var app = this.req.app;
+  var done = callback;
+  var opts = options || {};
   var req = this.req;
-  var app = req.app;
+  var self = this;
 
   // support callback function as second arg
-  if ('function' == typeof options) {
-    fn = options, options = {};
+  if (typeof options === 'function') {
+    done = options;
+    opts = {};
   }
 
   // merge res.locals
-  options._locals = self.locals;
+  opts._locals = self.locals;
 
   // default callback to respond
-  fn = fn || function(err, str){
+  done = done || function (err, str) {
     if (err) return req.next(err);
     self.send(str);
   };
 
   // render
-  app.render(view, options, fn);
+  app.render(view, opts, done);
 };
 
 // pipe the send file stream

From 5915894af3f14e75dd3121fdc2d92ae55206e398 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 20 Jun 2015 14:38:30 -0400
Subject: [PATCH 0865/1265] Simplify res.cookie to call res.append

---
 History.md      |  1 +
 lib/response.js | 12 +-----------
 2 files changed, 2 insertions(+), 11 deletions(-)

diff --git a/History.md b/History.md
index bc5a3d95eab..5778a23bba5 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
   * Fix issue where `next('route')` in `app.param` would incorrectly skip values
   * Fix using `*` before params in routes
   * Fix using capture groups before params in routes
+  * Simplify `res.cookie` to call `res.append`
   * Use `array-flatten` module for flattening arrays
   * deps: accepts@~1.2.9
     - deps: mime-types@~2.1.1
diff --git a/lib/response.js b/lib/response.js
index b9d6cc0e9bc..8f74f951df0 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -801,18 +801,8 @@ res.cookie = function (name, value, options) {
     opts.path = '/';
   }
 
-  var headerVal = cookie.serialize(name, String(val), opts);
+  this.append('Set-Cookie', cookie.serialize(name, String(val), opts));
 
-  // supports multiple 'res.cookie' calls by getting previous value
-  var prev = this.get('Set-Cookie');
-  if (prev) {
-    if (Array.isArray(prev)) {
-      headerVal = prev.concat(headerVal);
-    } else {
-      headerVal = [prev, headerVal];
-    }
-  }
-  this.set('Set-Cookie', headerVal);
   return this;
 };
 

From 3b3e1fc38a8e2763679fc11ff07aed1617946867 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 20 Jun 2015 15:20:35 -0400
Subject: [PATCH 0866/1265] Fix hiding platform issues with decodeURIComponent

closes #2652
---
 History.md          |  2 ++
 lib/router/layer.js | 13 ++++++++-----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index 5778a23bba5..b591d9d0d85 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,8 @@ unreleased
 
   * Fix `res.format` error when only `default` provided
   * Fix issue where `next('route')` in `app.param` would incorrectly skip values
+  * Fix hiding platform issues with `decodeURIComponent`
+    - Only `URIError`s are a 400
   * Fix using `*` before params in routes
   * Fix using capture groups before params in routes
   * Simplify `res.cookie` to call `res.append`
diff --git a/lib/router/layer.js b/lib/router/layer.js
index b5c1f58958b..a29cf26bfcf 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -152,19 +152,22 @@ Layer.prototype.match = function match(path) {
  *
  * @param {string} val
  * @return {string}
- * @api private
+ * @private
  */
 
-function decode_param(val){
+function decode_param(val) {
   if (typeof val !== 'string') {
     return val;
   }
 
   try {
     return decodeURIComponent(val);
-  } catch (e) {
-    var err = new TypeError("Failed to decode param '" + val + "'");
-    err.status = 400;
+  } catch (err) {
+    if (err instanceof URIError) {
+      err.message = 'Failed to decode param \'' + val + '\'';
+      err.status = 400;
+    }
+
     throw err;
   }
 }

From 7d6c1e5c5c17b88da21e30ffd2e58999881c0d67 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 20 Jun 2015 15:23:35 -0400
Subject: [PATCH 0867/1265] perf: skip attempting to decode zero length string

---
 History.md          | 1 +
 lib/router/layer.js | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index b591d9d0d85..db5c13d953f 100644
--- a/History.md
+++ b/History.md
@@ -74,6 +74,7 @@ unreleased
   * perf: remove argument reassignments in request prototype
   * perf: remove argument reassignments in response prototype
   * perf: remove argument reassignments in `View`
+  * perf: skip attempting to decode zero length string
   * perf: use saved reference to `http.STATUS_CODES`
 
 4.12.4 / 2015-05-17
diff --git a/lib/router/layer.js b/lib/router/layer.js
index a29cf26bfcf..b1dd04cf23a 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -156,7 +156,7 @@ Layer.prototype.match = function match(path) {
  */
 
 function decode_param(val) {
-  if (typeof val !== 'string') {
+  if (typeof val !== 'string' || val.length === 0) {
     return val;
   }
 

From 5b4d4b4ab1324743534fbcd4709f4e75bb4b4e9d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 20 Jun 2015 15:27:47 -0400
Subject: [PATCH 0868/1265] Add statusCode properties to two errors

---
 lib/response.js     | 2 +-
 lib/router/layer.js | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index 8f74f951df0..641704b04ae 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -629,7 +629,7 @@ res.format = function(obj){
     fn();
   } else {
     var err = new Error('Not Acceptable');
-    err.status = 406;
+    err.status = err.statusCode = 406;
     err.types = normalizeTypes(keys).map(function(o){ return o.value });
     next(err);
   }
diff --git a/lib/router/layer.js b/lib/router/layer.js
index b1dd04cf23a..846bdadba01 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -165,7 +165,7 @@ function decode_param(val) {
   } catch (err) {
     if (err instanceof URIError) {
       err.message = 'Failed to decode param \'' + val + '\'';
-      err.status = 400;
+      err.status = err.statusCode = 400;
     }
 
     throw err;

From 9302acc5e449768b3ca2b03701d5379d86453af5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 20 Jun 2015 16:13:59 -0400
Subject: [PATCH 0869/1265] perf: remove argument reassignments in routing

---
 History.md          |  1 +
 lib/router/index.js | 38 +++++++++++++------------
 lib/router/layer.js | 11 +++++---
 lib/router/route.js | 69 ++++++++++++++++++++++++++++-----------------
 4 files changed, 71 insertions(+), 48 deletions(-)

diff --git a/History.md b/History.md
index db5c13d953f..f69a1335f26 100644
--- a/History.md
+++ b/History.md
@@ -73,6 +73,7 @@ unreleased
   * perf: remove argument reassignments in application
   * perf: remove argument reassignments in request prototype
   * perf: remove argument reassignments in response prototype
+  * perf: remove argument reassignments in routing
   * perf: remove argument reassignments in `View`
   * perf: skip attempting to decode zero length string
   * perf: use saved reference to `http.STATUS_CODES`
diff --git a/lib/router/index.js b/lib/router/index.js
index 8786dc15d3e..1f3ec6d49ce 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -10,6 +10,7 @@
 
 /**
  * Module dependencies.
+ * @private
  */
 
 var Route = require('./route');
@@ -23,6 +24,7 @@ var parseUrl = require('parseurl');
 
 /**
  * Module variables.
+ * @private
  */
 
 var objectRegExp = /^\[object (\S+)\]$/;
@@ -34,11 +36,11 @@ var toString = Object.prototype.toString;
  *
  * @param {Object} options
  * @return {Router} which is an callable function
- * @api public
+ * @public
  */
 
 var proto = module.exports = function(options) {
-  options = options || {};
+  var opts = options || {};
 
   function router(req, res, next) {
     router.handle(req, res, next);
@@ -49,9 +51,9 @@ var proto = module.exports = function(options) {
 
   router.params = {};
   router._params = [];
-  router.caseSensitive = options.caseSensitive;
-  router.mergeParams = options.mergeParams;
-  router.strict = options.strict;
+  router.caseSensitive = opts.caseSensitive;
+  router.mergeParams = opts.mergeParams;
+  router.strict = opts.strict;
   router.stack = [];
 
   return router;
@@ -88,7 +90,7 @@ var proto = module.exports = function(options) {
  * @param {String} name
  * @param {Function} fn
  * @return {app} for chaining
- * @api public
+ * @public
  */
 
 proto.param = function param(name, fn) {
@@ -127,11 +129,10 @@ proto.param = function param(name, fn) {
 
 /**
  * Dispatch a req, res into the router.
- *
- * @api private
+ * @private
  */
 
-proto.handle = function(req, res, done) {
+proto.handle = function handle(req, res, out) {
   var self = this;
 
   debug('dispatching %s %s', req.method, req.url);
@@ -155,7 +156,7 @@ proto.handle = function(req, res, done) {
   // manage inter-router variables
   var parentParams = req.params;
   var parentUrl = req.baseUrl || '';
-  done = restore(done, req, 'baseUrl', 'next', 'params');
+  var done = restore(out, req, 'baseUrl', 'next', 'params');
 
   // setup next layer
   req.next = next;
@@ -315,11 +316,10 @@ proto.handle = function(req, res, done) {
 
 /**
  * Process any parameters for the layer.
- *
- * @api private
+ * @private
  */
 
-proto.process_params = function(layer, called, req, res, done) {
+proto.process_params = function process_params(layer, called, req, res, done) {
   var params = this.params;
 
   // captured parameters from the layer, keys and values
@@ -422,7 +422,7 @@ proto.process_params = function(layer, called, req, res, done) {
  * handlers can operate without any code changes regardless of the "prefix"
  * pathname.
  *
- * @api public
+ * @public
  */
 
 proto.use = function use(fn) {
@@ -451,7 +451,9 @@ proto.use = function use(fn) {
     throw new TypeError('Router.use() requires middleware functions');
   }
 
-  callbacks.forEach(function (fn) {
+  for (var i = 0; i < callbacks.length; i++) {
+    var fn = callbacks[i];
+
     if (typeof fn !== 'function') {
       throw new TypeError('Router.use() requires middleware function but got a ' + gettype(fn));
     }
@@ -468,7 +470,7 @@ proto.use = function use(fn) {
     layer.route = undefined;
 
     this.stack.push(layer);
-  }, this);
+  }
 
   return this;
 };
@@ -483,10 +485,10 @@ proto.use = function use(fn) {
  *
  * @param {String} path
  * @return {Route}
- * @api public
+ * @public
  */
 
-proto.route = function(path){
+proto.route = function route(path) {
   var route = new Route(path);
 
   var layer = new Layer(path, {
diff --git a/lib/router/layer.js b/lib/router/layer.js
index 846bdadba01..fe9210cb9de 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -10,6 +10,7 @@
 
 /**
  * Module dependencies.
+ * @private
  */
 
 var pathRegexp = require('path-to-regexp');
@@ -17,12 +18,14 @@ var debug = require('debug')('express:router:layer');
 
 /**
  * Module variables.
+ * @private
  */
 
 var hasOwnProperty = Object.prototype.hasOwnProperty;
 
 /**
- * Expose `Layer`.
+ * Module exports.
+ * @public
  */
 
 module.exports = Layer;
@@ -33,15 +36,15 @@ function Layer(path, options, fn) {
   }
 
   debug('new %s', path);
-  options = options || {};
+  var opts = options || {};
 
   this.handle = fn;
   this.name = fn.name || '<anonymous>';
   this.params = undefined;
   this.path = undefined;
-  this.regexp = pathRegexp(path, this.keys = [], options);
+  this.regexp = pathRegexp(path, this.keys = [], opts);
 
-  if (path === '/' && options.end === false) {
+  if (path === '/' && opts.end === false) {
     this.regexp.fast_slash = true;
   }
 }
diff --git a/lib/router/route.js b/lib/router/route.js
index dadd2c7b6d4..2788d7b7353 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -10,6 +10,7 @@
 
 /**
  * Module dependencies.
+ * @private
  */
 
 var debug = require('debug')('express:router:route');
@@ -18,7 +19,16 @@ var Layer = require('./layer');
 var methods = require('methods');
 
 /**
- * Expose `Route`.
+ * Module variables.
+ * @private
+ */
+
+var slice = Array.prototype.slice;
+var toString = Object.prototype.toString;
+
+/**
+ * Module exports.
+ * @public
  */
 
 module.exports = Route;
@@ -27,20 +37,22 @@ module.exports = Route;
  * Initialize `Route` with the given `path`,
  *
  * @param {String} path
- * @api private
+ * @public
  */
 
 function Route(path) {
-  debug('new %s', path);
   this.path = path;
   this.stack = [];
 
+  debug('new %s', path);
+
   // route handlers for various http methods
   this.methods = {};
 }
 
 /**
- * @api private
+ * Determine if the route handles a given method.
+ * @private
  */
 
 Route.prototype._handles_method = function _handles_method(method) {
@@ -48,18 +60,18 @@ Route.prototype._handles_method = function _handles_method(method) {
     return true;
   }
 
-  method = method.toLowerCase();
+  var name = method.toLowerCase();
 
-  if (method === 'head' && !this.methods['head']) {
-    method = 'get';
+  if (name === 'head' && !this.methods['head']) {
+    name = 'get';
   }
 
-  return Boolean(this.methods[method]);
+  return Boolean(this.methods[name]);
 };
 
 /**
  * @return {Array} supported HTTP methods
- * @api private
+ * @private
  */
 
 Route.prototype._options = function _options() {
@@ -80,11 +92,10 @@ Route.prototype._options = function _options() {
 
 /**
  * dispatch req, res into this route
- *
- * @api private
+ * @private
  */
 
-Route.prototype.dispatch = function(req, res, done){
+Route.prototype.dispatch = function dispatch(req, res, done) {
   var idx = 0;
   var stack = this.stack;
   if (stack.length === 0) {
@@ -150,44 +161,50 @@ Route.prototype.dispatch = function(req, res, done){
  * @api public
  */
 
-Route.prototype.all = function(){
-  var callbacks = flatten([].slice.call(arguments));
-  callbacks.forEach(function(fn) {
-    if (typeof fn !== 'function') {
-      var type = {}.toString.call(fn);
+Route.prototype.all = function all() {
+  var handles = flatten(slice.call(arguments));
+
+  for (var i = 0; i < handles.length; i++) {
+    var handle = handles[i];
+
+    if (typeof handle !== 'function') {
+      var type = toString.call(handle);
       var msg = 'Route.all() requires callback functions but got a ' + type;
-      throw new Error(msg);
+      throw new TypeError(msg);
     }
 
-    var layer = Layer('/', {}, fn);
+    var layer = Layer('/', {}, handle);
     layer.method = undefined;
 
     this.methods._all = true;
     this.stack.push(layer);
-  }, this);
+  }
 
   return this;
 };
 
 methods.forEach(function(method){
   Route.prototype[method] = function(){
-    var callbacks = flatten([].slice.call(arguments));
+    var handles = flatten(slice.call(arguments));
+
+    for (var i = 0; i < handles.length; i++) {
+      var handle = handles[i];
 
-    callbacks.forEach(function(fn) {
-      if (typeof fn !== 'function') {
-        var type = {}.toString.call(fn);
+      if (typeof handle !== 'function') {
+        var type = toString.call(handle);
         var msg = 'Route.' + method + '() requires callback functions but got a ' + type;
         throw new Error(msg);
       }
 
       debug('%s %s', method, this.path);
 
-      var layer = Layer('/', {}, fn);
+      var layer = Layer('/', {}, handle);
       layer.method = method;
 
       this.methods[method] = true;
       this.stack.push(layer);
-    }, this);
+    }
+
     return this;
   };
 });

From 2a455890b9f68642457698163224f49e31ffff2a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 20 Jun 2015 16:21:12 -0400
Subject: [PATCH 0870/1265] Add settings to debug output

closes #2675
---
 History.md         | 1 +
 lib/application.js | 5 ++---
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index f69a1335f26..d72226591e2 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Add settings to debug output
   * Fix `res.format` error when only `default` provided
   * Fix issue where `next('route')` in `app.param` would incorrectly skip values
   * Fix hiding platform issues with `decodeURIComponent`
diff --git a/lib/application.js b/lib/application.js
index b230ad8d629..a9df9103540 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -354,21 +354,20 @@ app.set = function set(setting, val) {
     return this.settings[setting];
   }
 
+  debug('set "%s" to %o', setting, val);
+
   // set value
   this.settings[setting] = val;
 
   // trigger matched settings
   switch (setting) {
     case 'etag':
-      debug('compile etag %s', val);
       this.set('etag fn', compileETag(val));
       break;
     case 'query parser':
-      debug('compile query parser %s', val);
       this.set('query parser fn', compileQueryParser(val));
       break;
     case 'trust proxy':
-      debug('compile trust proxy %s', val);
       this.set('trust proxy fn', compileTrust(val));
 
       // trust proxy inherit back-compat

From f73ff9243006ea010fffdaa748f06df3a5b986e7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 20 Jun 2015 19:20:52 -0400
Subject: [PATCH 0871/1265] build: support io.js 2.x

---
 .travis.yml  | 1 +
 appveyor.yml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index b163d5dc22d..ebdea3cbf62 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -4,6 +4,7 @@ node_js:
   - "0.12"
   - "1.0"
   - "1.8"
+  - "2.0"
 sudo: false
 before_install: "npm rm --save-dev connect-redis"
 script: "npm run-script test-ci"
diff --git a/appveyor.yml b/appveyor.yml
index 8be4511b02a..aa7554cfd53 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -4,6 +4,7 @@ environment:
     - nodejs_version: "0.12"
     - nodejs_version: "1.0"
     - nodejs_version: "1.8"
+    - nodejs_version: "2.0"
 install:
   - ps: Install-Product node $env:nodejs_version
   - npm rm --save-dev connect-redis

From 6c7a36733891ddd6089ee4f267d731383bf58ea9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 21 Jun 2015 01:46:44 -0400
Subject: [PATCH 0872/1265] 4.13.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index d72226591e2..0f13c459517 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.13.0 / 2015-06-20
+===================
 
   * Add settings to debug output
   * Fix `res.format` error when only `default` provided
diff --git a/package.json b/package.json
index 95a4a472f87..c3fd59ae9f2 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.12.4",
+  "version": "4.13.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 3ec7cca5506d87e2f7e0146514c6180950e46fd9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Jul 2015 00:38:10 -0400
Subject: [PATCH 0873/1265] deps: connect@2.30.1

---
 History.md   | 13 +++++++++++++
 package.json |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index bb06bdb6f42..659356ef01a 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,16 @@
+3.x
+===
+
+  * deps: connect@2.30.1
+    - deps: body-parser@~1.13.2
+    - deps: compression@~1.5.1
+    - deps: errorhandler@~1.4.1
+    - deps: morgan@~1.6.1
+    - deps: pause@0.1.0
+    - deps: qs@4.0.0
+    - deps: serve-index@~1.7.1
+    - deps: type-is@~1.6.4
+
 3.21.0 / 2015-06-18
 ===================
 
diff --git a/package.json b/package.json
index e8d2f00395f..e39c7881f4a 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "basic-auth": "1.0.2",
-    "connect": "2.30.0",
+    "connect": "2.30.1",
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",
     "commander": "2.6.0",

From 71d56db947dcd4da7a75189a8df784da964a1216 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Jul 2015 00:39:06 -0400
Subject: [PATCH 0874/1265] build: ejs@2.3.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e39c7881f4a..f2521113ffc 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
   },
   "devDependencies": {
     "connect-redis": "~1.5.0",
-    "ejs": "2.3.1",
+    "ejs": "2.3.2",
     "istanbul": "0.3.9",
     "marked": "0.3.3",
     "mocha": "2.2.5",

From f247a4182f9e459e1bf1ca8a2261e9f088718ff0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Jul 2015 00:39:42 -0400
Subject: [PATCH 0875/1265] deps: basic-auth@~1.0.3

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 659356ef01a..53aac06e412 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 3.x
 ===
 
+  * deps: basic-auth@~1.0.3
   * deps: connect@2.30.1
     - deps: body-parser@~1.13.2
     - deps: compression@~1.5.1
diff --git a/package.json b/package.json
index f2521113ffc..ab70b40216f 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "api"
   ],
   "dependencies": {
-    "basic-auth": "1.0.2",
+    "basic-auth": "~1.0.3",
     "connect": "2.30.1",
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",

From 3c0ff8133bace4a0dc1356b8d8e6e83b38d2dd95 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Jul 2015 00:53:25 -0400
Subject: [PATCH 0876/1265] 3.21.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 53aac06e412..581960b7111 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.21.1 / 2015-07-05
+===================
 
   * deps: basic-auth@~1.0.3
   * deps: connect@2.30.1
diff --git a/package.json b/package.json
index ab70b40216f..d78a2576efa 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.21.0",
+  "version": "3.21.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 2870add2305038948dd9bb20aed60ab48d486ece Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Jul 2015 00:59:27 -0400
Subject: [PATCH 0877/1265] deps: type-is@~1.6.4

---
 History.md   | 8 ++++++++
 package.json | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 8a2387b8101..200c0ca7c5e 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,11 @@
+unreleased
+==========
+
+  * deps: type-is@~1.6.4
+    - deps: mime-types@~2.1.2
+    - perf: enable strict mode
+    - perf: remove argument reassignment
+
 4.13.0 / 2015-06-20
 ===================
 
diff --git a/package.json b/package.json
index 621a1040fa6..ab82ad51f1c 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "range-parser": "~1.0.2",
     "send": "0.13.0",
     "serve-static": "~1.10.0",
-    "type-is": "~1.6.3",
+    "type-is": "~1.6.4",
     "vary": "~1.0.0",
     "utils-merge": "1.0.0"
   },

From 3314f767e1e9e06731f2d0a19b9be982829e390e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Jul 2015 01:00:12 -0400
Subject: [PATCH 0878/1265] deps: accepts@~1.2.10

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 200c0ca7c5e..0f9e6177708 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,8 @@
 unreleased
 ==========
 
+  * deps: accepts@~1.2.10
+    - deps: mime-types@~2.1.2
   * deps: type-is@~1.6.4
     - deps: mime-types@~2.1.2
     - perf: enable strict mode
diff --git a/package.json b/package.json
index ab82ad51f1c..c1328c7e3e6 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.2.9",
+    "accepts": "~1.2.10",
     "array-flatten": "1.1.0",
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",

From 7bea53b92b52764df2cb1ae32145fb4f4a242c1c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Jul 2015 01:20:09 -0400
Subject: [PATCH 0879/1265] deps: qs@4.0.0

---
 History.md              |  3 +++
 lib/middleware/query.js | 15 +++++++++++++--
 lib/utils.js            | 16 +++++++++++++++-
 package.json            |  2 +-
 test/req.query.js       | 25 +++++++++++++++++++++++++
 5 files changed, 57 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index 0f9e6177708..f410867ad88 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,9 @@ unreleased
 
   * deps: accepts@~1.2.10
     - deps: mime-types@~2.1.2
+  * deps: qs@4.0.0
+    - Fix dropping parameters like `hasOwnProperty`
+    - Fix various parsing edge cases
   * deps: type-is@~1.6.4
     - deps: mime-types@~2.1.2
     - perf: enable strict mode
diff --git a/lib/middleware/query.js b/lib/middleware/query.js
index d86474a05a5..a665f3f1431 100644
--- a/lib/middleware/query.js
+++ b/lib/middleware/query.js
@@ -22,17 +22,28 @@ var qs = require('qs');
  */
 
 module.exports = function query(options) {
+  var opts = Object.create(options || null);
   var queryparse = qs.parse;
 
   if (typeof options === 'function') {
     queryparse = options;
-    options = undefined;
+    opts = undefined;
+  }
+
+  if (opts !== undefined) {
+    if (opts.allowDots === undefined) {
+      opts.allowDots = false;
+    }
+
+    if (opts.allowPrototypes === undefined) {
+      opts.allowPrototypes = true;
+    }
   }
 
   return function query(req, res, next){
     if (!req.query) {
       var val = parseUrl(req).query;
-      req.query = queryparse(val, options);
+      req.query = queryparse(val, opts);
     }
 
     next();
diff --git a/lib/utils.js b/lib/utils.js
index d10391c43d9..3d54247ad28 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -209,7 +209,7 @@ exports.compileQueryParser = function compileQueryParser(val) {
       fn = newObject;
       break;
     case 'extended':
-      fn = qs.parse;
+      fn = parseExtendedQueryString;
       break;
     case 'simple':
       fn = querystring.parse;
@@ -274,6 +274,20 @@ exports.setCharset = function setCharset(type, charset) {
   return contentType.format(parsed);
 };
 
+/**
+ * Parse an extended query string with qs.
+ *
+ * @return {Object}
+ * @private
+ */
+
+function parseExtendedQueryString(str) {
+  return qs.parse(str, {
+    allowDots: false,
+    allowPrototypes: true
+  });
+}
+
 /**
  * Return new empty object.
  *
diff --git a/package.json b/package.json
index c1328c7e3e6..9aecced520e 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.6",
     "proxy-addr": "~1.0.8",
-    "qs": "2.4.2",
+    "qs": "4.0.0",
     "range-parser": "~1.0.2",
     "send": "0.13.0",
     "serve-static": "~1.10.0",
diff --git a/test/req.query.js b/test/req.query.js
index f243293125b..19151411995 100644
--- a/test/req.query.js
+++ b/test/req.query.js
@@ -28,6 +28,14 @@ describe('req', function(){
         .get('/?user[name]=tj')
         .expect(200, '{"user":{"name":"tj"}}', done);
       });
+
+      it('should parse parameters with dots', function (done) {
+        var app = createApp('extended');
+
+        request(app)
+        .get('/?user.name=tj')
+        .expect(200, '{"user.name":"tj"}', done);
+      });
     });
 
     describe('when "query parser" is simple', function () {
@@ -72,6 +80,23 @@ describe('req', function(){
       });
     });
 
+    describe('when "query parser fn" is missing', function () {
+      it('should act like "extended"', function (done) {
+        var app = express();
+
+        delete app.settings['query parser'];
+        delete app.settings['query parser fn'];
+
+        app.use(function (req, res) {
+          res.send(req.query);
+        });
+
+        request(app)
+        .get('/?user[name]=tj&user.name=tj')
+        .expect(200, '{"user":{"name":"tj"},"user.name":"tj"}', done);
+      });
+    });
+
     describe('when "query parser" an unknown value', function () {
       it('should throw', function () {
         createApp.bind(null, 'bogus').should.throw(/unknown value.*query parser/);

From a48c55896b3b4fe34aa7d10baa75e140c67cad66 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Jul 2015 01:21:26 -0400
Subject: [PATCH 0880/1265] deps: update example dependencies

---
 package.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index 9aecced520e..fa902e8e553 100644
--- a/package.json
+++ b/package.json
@@ -61,14 +61,14 @@
     "mocha": "2.2.5",
     "should": "7.0.1",
     "supertest": "1.0.1",
-    "body-parser": "~1.13.1",
+    "body-parser": "~1.13.2",
     "connect-redis": "~2.3.0",
     "cookie-parser": "~1.3.5",
-    "cookie-session": "~1.1.0",
+    "cookie-session": "~1.2.0",
     "express-session": "~1.11.3",
     "jade": "~1.11.0",
     "method-override": "~2.3.3",
-    "morgan": "~1.6.0",
+    "morgan": "~1.6.1",
     "multiparty": "~4.1.2",
     "vhost": "~3.0.0"
   },

From def241f91f73c456b48100c693230b4fda51c139 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Jul 2015 01:36:51 -0400
Subject: [PATCH 0881/1265] build: io.js@2.3

---
 .travis.yml  | 1 +
 appveyor.yml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index ebdea3cbf62..df087b4a0f7 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -5,6 +5,7 @@ node_js:
   - "1.0"
   - "1.8"
   - "2.0"
+  - "2.3"
 sudo: false
 before_install: "npm rm --save-dev connect-redis"
 script: "npm run-script test-ci"
diff --git a/appveyor.yml b/appveyor.yml
index aa7554cfd53..b1f13d167bd 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -5,6 +5,7 @@ environment:
     - nodejs_version: "1.0"
     - nodejs_version: "1.8"
     - nodejs_version: "2.0"
+    - nodejs_version: "2.3"
 install:
   - ps: Install-Product node $env:nodejs_version
   - npm rm --save-dev connect-redis

From 2ac25098548f739c4f2b526b2a00aa60a74c8e75 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Jul 2015 01:38:44 -0400
Subject: [PATCH 0882/1265] 4.13.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index f410867ad88..3362daefb49 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.13.1 / 2015-07-05
+===================
 
   * deps: accepts@~1.2.10
     - deps: mime-types@~2.1.2
diff --git a/package.json b/package.json
index fa902e8e553..4c4a3b7a767 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.13.0",
+  "version": "4.13.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From de7ffca33ff30932bdaa2dbe51862af32e8a30b1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 24 Jul 2015 21:36:56 -0400
Subject: [PATCH 0883/1265] tests: add test for matching route after error

---
 test/app.routes.error.js | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/test/app.routes.error.js b/test/app.routes.error.js
index ac517efdee2..7c49d50ffe2 100644
--- a/test/app.routes.error.js
+++ b/test/app.routes.error.js
@@ -3,6 +3,22 @@ var express = require('../')
 
 describe('app', function(){
   describe('.VERB()', function(){
+    it('should not get invoked without error handler on error', function(done) {
+      var app = express();
+
+      app.use(function(req, res, next){
+        next(new Error('boom!'))
+      });
+
+      app.get('/bar', function(req, res){
+        res.send('hello, world!');
+      });
+
+      request(app)
+      .post('/bar')
+      .expect(500, /Error: boom!/, done);
+    });
+
     it('should only call an error handling routing callback when an error is propagated', function(done){
       var app = express();
 

From fc95112145a122b9e3aaa56f82b00eae9b8fe001 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 27 Jul 2015 22:09:34 -0400
Subject: [PATCH 0884/1265] build: should@7.0.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index d78a2576efa..8cf5203b6f1 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,7 @@
     "istanbul": "0.3.9",
     "marked": "0.3.3",
     "mocha": "2.2.5",
-    "should": "7.0.1",
+    "should": "7.0.2",
     "supertest": "1.0.1"
   },
   "engines": {

From d51d1ea57afea4a2df288e3f541d092fce8721b7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 27 Jul 2015 22:11:54 -0400
Subject: [PATCH 0885/1265] build: ejs@2.3.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 8cf5203b6f1..78f40ce989a 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
   },
   "devDependencies": {
     "connect-redis": "~1.5.0",
-    "ejs": "2.3.2",
+    "ejs": "2.3.3",
     "istanbul": "0.3.9",
     "marked": "0.3.3",
     "mocha": "2.2.5",

From b53feaa1d8b8701b6c0085ff520f59cd1e7dccd8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 27 Jul 2015 22:12:39 -0400
Subject: [PATCH 0886/1265] deps: vary@~1.0.1

---
 History.md   | 8 ++++++++
 package.json | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 581960b7111..27650df168a 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,11 @@
+3.x
+===
+
+  * deps: vary@~1.0.1
+    - Fix setting empty header from empty `field`
+    - perf: enable strict mode
+    - perf: remove argument reassignments
+
 3.21.1 / 2015-07-05
 ===================
 
diff --git a/package.json b/package.json
index 78f40ce989a..24fdca64021 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "range-parser": "~1.0.2",
     "send": "0.13.0",
     "utils-merge": "1.0.0",
-    "vary": "~1.0.0"
+    "vary": "~1.0.1"
   },
   "devDependencies": {
     "connect-redis": "~1.5.0",

From 09c80bf823e16daafafc2ed013b07c62380a6912 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 28 Jul 2015 23:24:00 -0400
Subject: [PATCH 0887/1265] deps: array-flatten@1.1.1

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 3362daefb49..dbcde7e4053 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: array-flatten@1.1.1
+    - perf: enable strict mode
+
 4.13.1 / 2015-07-05
 ===================
 
diff --git a/package.json b/package.json
index 4c4a3b7a767..973067eb653 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
   ],
   "dependencies": {
     "accepts": "~1.2.10",
-    "array-flatten": "1.1.0",
+    "array-flatten": "1.1.1",
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",
     "cookie": "0.1.3",

From 659c0b154c965f4945e061adcc52c2abf6254dbe Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 28 Jul 2015 23:26:31 -0400
Subject: [PATCH 0888/1265] deps: update example dependencies

---
 package.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index 973067eb653..7b2f63143c2 100644
--- a/package.json
+++ b/package.json
@@ -62,15 +62,15 @@
     "should": "7.0.1",
     "supertest": "1.0.1",
     "body-parser": "~1.13.2",
-    "connect-redis": "~2.3.0",
+    "connect-redis": "~2.4.1",
     "cookie-parser": "~1.3.5",
     "cookie-session": "~1.2.0",
     "express-session": "~1.11.3",
     "jade": "~1.11.0",
-    "method-override": "~2.3.3",
+    "method-override": "~2.3.4",
     "morgan": "~1.6.1",
     "multiparty": "~4.1.2",
-    "vhost": "~3.0.0"
+    "vhost": "~3.0.1"
   },
   "engines": {
     "node": ">= 0.10.0"

From 93dd15cd615f29315f68043a453953af37a870dc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 31 Jul 2015 16:13:09 -0400
Subject: [PATCH 0889/1265] deps: connect@2.30.2

---
 History.md   | 8 ++++++++
 package.json | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 27650df168a..3bb407e7d19 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,14 @@
 3.x
 ===
 
+  * deps: connect@2.30.2
+    - deps: body-parser@~1.13.3
+    - deps: compression@~1.5.2
+    - deps: errorhandler@~1.4.2
+    - deps: method-override@~2.3.5
+    - deps: serve-index@~1.7.2
+    - deps: type-is@~1.6.6
+    - deps: vhost@~3.0.1
   * deps: vary@~1.0.1
     - Fix setting empty header from empty `field`
     - perf: enable strict mode
diff --git a/package.json b/package.json
index 24fdca64021..486a7e39467 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "basic-auth": "~1.0.3",
-    "connect": "2.30.1",
+    "connect": "2.30.2",
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",
     "commander": "2.6.0",

From ce087e559ea416a7dc2f5a6e5eb0aa4f6be8ff2c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 31 Jul 2015 16:13:41 -0400
Subject: [PATCH 0890/1265] build: marked@0.3.5

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 486a7e39467..c129cb95312 100644
--- a/package.json
+++ b/package.json
@@ -52,7 +52,7 @@
     "connect-redis": "~1.5.0",
     "ejs": "2.3.3",
     "istanbul": "0.3.9",
-    "marked": "0.3.3",
+    "marked": "0.3.5",
     "mocha": "2.2.5",
     "should": "7.0.2",
     "supertest": "1.0.1"

From cb59086305367d9fcd7d63b53cfca1a3e4ef77d7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 31 Jul 2015 16:15:06 -0400
Subject: [PATCH 0891/1265] 3.21.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 3bb407e7d19..f95055ae6e0 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-3.x
-===
+3.21.2 / 2015-07-31
+===================
 
   * deps: connect@2.30.2
     - deps: body-parser@~1.13.3
diff --git a/package.json b/package.json
index c129cb95312..321a07e7655 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Sinatra inspired web development framework",
-  "version": "3.21.1",
+  "version": "3.21.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From e33c5035bb3e96f465e8a6c5678706fcb1bcb236 Mon Sep 17 00:00:00 2001
From: Blake Embrey <hello@blakeembrey.com>
Date: Tue, 28 Jul 2015 13:15:34 +1000
Subject: [PATCH 0892/1265] deps: path-to-regexp@0.1.7

closes #2717
---
 History.md         |  2 ++
 package.json       |  2 +-
 test/app.router.js | 12 ++++++++++++
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index dd2366d32b2..4e7e76c6f86 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,8 @@ unreleased
 
   * deps: array-flatten@1.1.1
     - perf: enable strict mode
+  * deps: path-to-regexp@0.1.7
+    - Fix regression with escaped round brackets and matching groups
 
 4.13.1 / 2015-07-05
 ===================
diff --git a/package.json b/package.json
index f952bc1df76..d9981e71dd3 100644
--- a/package.json
+++ b/package.json
@@ -43,7 +43,7 @@
     "methods": "~1.1.1",
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.0",
-    "path-to-regexp": "0.1.6",
+    "path-to-regexp": "0.1.7",
     "proxy-addr": "~1.0.8",
     "qs": "4.0.0",
     "range-parser": "~1.0.2",
diff --git a/test/app.router.js b/test/app.router.js
index 491de358f07..f528a4cb21f 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -721,6 +721,18 @@ describe('app.router', function(){
       .expect('editing tj (old)', cb);
     })
 
+    it('should work inside literal paranthesis', function(done){
+      var app = express();
+
+      app.get('/:user\\(:op\\)', function(req, res){
+        res.end(req.params.op + 'ing ' + req.params.user);
+      });
+
+      request(app)
+      .get('/tj(edit)')
+      .expect('editing tj', done);
+    })
+
     it('should work in array of paths', function(done){
       var app = express();
       var cb = after(2, done);

From 1cea9cedec212695b298afcebadc7473a28a98e6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 31 Jul 2015 17:01:35 -0400
Subject: [PATCH 0893/1265] deps: accepts@~1.2.12

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 4e7e76c6f86..1f1b091fdf0 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,8 @@
 unreleased
 ==========
 
+  * deps: accepts@~1.2.12
+    - deps: mime-types@~2.1.4
   * deps: array-flatten@1.1.1
     - perf: enable strict mode
   * deps: path-to-regexp@0.1.7
diff --git a/package.json b/package.json
index d9981e71dd3..3bdb417394d 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.2.10",
+    "accepts": "~1.2.12",
     "array-flatten": "1.1.1",
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",

From c398a9903df7e4ce50699d597914e1bd7c7019de Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 31 Jul 2015 17:02:10 -0400
Subject: [PATCH 0894/1265] deps: type-is@~1.6.6

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 1f1b091fdf0..2284ffcc978 100644
--- a/History.md
+++ b/History.md
@@ -7,6 +7,8 @@ unreleased
     - perf: enable strict mode
   * deps: path-to-regexp@0.1.7
     - Fix regression with escaped round brackets and matching groups
+  * deps: type-is@~1.6.6
+    - deps: mime-types@~2.1.4
 
 4.13.1 / 2015-07-05
 ===================
diff --git a/package.json b/package.json
index 3bdb417394d..8e8bd20da8e 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "range-parser": "~1.0.2",
     "send": "0.13.0",
     "serve-static": "~1.10.0",
-    "type-is": "~1.6.4",
+    "type-is": "~1.6.6",
     "utils-merge": "1.0.0",
     "vary": "~1.0.1"
   },

From a559ca2d58b0fcf9248148baf472460fd08e36ac Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 31 Jul 2015 17:02:57 -0400
Subject: [PATCH 0895/1265] build: istanbul@0.3.17

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 8e8bd20da8e..323f8084b37 100644
--- a/package.json
+++ b/package.json
@@ -56,7 +56,7 @@
   "devDependencies": {
     "after": "0.8.1",
     "ejs": "2.3.3",
-    "istanbul": "0.3.9",
+    "istanbul": "0.3.17",
     "marked": "0.3.5",
     "mocha": "2.2.5",
     "should": "7.0.2",

From a4fcd91084eaedb36b7c150157236d5d563a4b02 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 31 Jul 2015 17:03:30 -0400
Subject: [PATCH 0896/1265] deps: update example dependencies

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 323f8084b37..3bee76bc601 100644
--- a/package.json
+++ b/package.json
@@ -61,13 +61,13 @@
     "mocha": "2.2.5",
     "should": "7.0.2",
     "supertest": "1.0.1",
-    "body-parser": "~1.13.2",
+    "body-parser": "~1.13.3",
     "connect-redis": "~2.4.1",
     "cookie-parser": "~1.3.5",
     "cookie-session": "~1.2.0",
     "express-session": "~1.11.3",
     "jade": "~1.11.0",
-    "method-override": "~2.3.4",
+    "method-override": "~2.3.5",
     "morgan": "~1.6.1",
     "multiparty": "~4.1.2",
     "vhost": "~3.0.1"

From 97b2d70d8adfb4649fd8ca9adc73c47ffcc4bf5b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 31 Jul 2015 17:09:15 -0400
Subject: [PATCH 0897/1265] 4.13.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 2284ffcc978..dc406139c24 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.13.2 / 2015-07-31
+===================
 
   * deps: accepts@~1.2.12
     - deps: mime-types@~2.1.4
diff --git a/package.json b/package.json
index 3bee76bc601..3b4389e8bfe 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.13.1",
+  "version": "4.13.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From ee90042d0c4a32a426842e4c1ad5b24b5c0344ac Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 3 Aug 2015 00:50:48 -0400
Subject: [PATCH 0898/1265] Fix infinite loop condition using mergeParams: true

---
 History.md          |  5 +++++
 lib/router/index.js |  9 ++++++---
 test/app.router.js  | 16 ++++++++++++++++
 3 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index dc406139c24..3cc3e11d21d 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix infinite loop condition using `mergeParams: true`
+
 4.13.2 / 2015-07-31
 ===================
 
diff --git a/lib/router/index.js b/lib/router/index.js
index 1f3ec6d49ce..4b7e4c97eda 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -578,9 +578,12 @@ function mergeParams(params, parent) {
   var o = 0;
 
   // determine numeric gaps
-  while (i === o || o in parent) {
-    if (i in params) i++;
-    if (o in parent) o++;
+  while (i in params) {
+    i++;
+  }
+
+  while (o in parent) {
+    o++;
   }
 
   // offset numeric indices in params before merge
diff --git a/test/app.router.js b/test/app.router.js
index f528a4cb21f..aa753e90e76 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -320,6 +320,22 @@ describe('app.router', function(){
       .expect(200, '[["0","10"],["1","tj"],["2","profile"]]', done);
     })
 
+    it('should merge numeric indices req.params when parent has same number', function(done){
+      var app = express();
+      var router = new express.Router({ mergeParams: true });
+
+      router.get('/name:(\\w+)', function(req, res){
+        var keys = Object.keys(req.params).sort();
+        res.send(keys.map(function(k){ return [k, req.params[k]] }));
+      });
+
+      app.use('/user/id:(\\d+)', router);
+
+      request(app)
+      .get('/user/id:10/name:tj')
+      .expect(200, '[["0","10"],["1","tj"]]', done);
+    })
+
     it('should ignore invalid incoming req.params', function(done){
       var app = express();
       var router = new express.Router({ mergeParams: true });

From 11a77a3fffb0476a460c4e68536ce20f5b3c542f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 3 Aug 2015 01:01:16 -0400
Subject: [PATCH 0899/1265] Fix inner numeric indices incorrectly altering
 parent req.params

---
 History.md          |  1 +
 lib/router/index.js |  2 +-
 test/app.router.js  | 20 ++++++++++++++++++++
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 3cc3e11d21d..d4eff1f7345 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Fix infinite loop condition using `mergeParams: true`
+  * Fix inner numeric indices incorrectly altering parent `req.params`
 
 4.13.2 / 2015-07-31
 ===================
diff --git a/lib/router/index.js b/lib/router/index.js
index 4b7e4c97eda..504ed9ce0ee 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -596,7 +596,7 @@ function mergeParams(params, parent) {
     }
   }
 
-  return mixin(parent, params);
+  return mixin(obj, params);
 }
 
 // restore obj props after function
diff --git a/test/app.router.js b/test/app.router.js
index aa753e90e76..03b43eb081a 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -354,6 +354,26 @@ describe('app.router', function(){
       .get('/user/tj')
       .expect(200, '[["name","tj"]]', done);
     })
+
+    it('should restore req.params', function(done){
+      var app = express();
+      var router = new express.Router({ mergeParams: true });
+
+      router.get('/user:(\\w+)/*', function (req, res, next) {
+        next();
+      });
+
+      app.use('/user/id:(\\d+)', function (req, res, next) {
+        router(req, res, function (err) {
+          var keys = Object.keys(req.params).sort();
+          res.send(keys.map(function(k){ return [k, req.params[k]] }));
+        });
+      });
+
+      request(app)
+      .get('/user/id:42/user:tj/profile')
+      .expect(200, '[["0","42"]]', done);
+    })
   })
 
   describe('trailing slashes', function(){

From ef7ad681b245fba023843ce94f6bcb8e275bbb8e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 3 Aug 2015 01:02:22 -0400
Subject: [PATCH 0900/1265] 4.13.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index d4eff1f7345..be89c8e7230 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.13.3 / 2015-08-02
+===================
 
   * Fix infinite loop condition using `mergeParams: true`
   * Fix inner numeric indices incorrectly altering parent `req.params`
diff --git a/package.json b/package.json
index 3b4389e8bfe..3f299bada86 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.13.2",
+  "version": "4.13.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 2f8ac6726fa20ab5b4a05c112c886752868ac8ce Mon Sep 17 00:00:00 2001
From: Brendan Ashworth <brendan.ashworth@me.com>
Date: Thu, 25 Jun 2015 00:30:19 -0700
Subject: [PATCH 0901/1265] tests: fix redirect tests for change in 302 status
 message

closes #2690
---
 test/res.redirect.js | 36 +++++++++++++++---------------------
 1 file changed, 15 insertions(+), 21 deletions(-)

diff --git a/test/res.redirect.js b/test/res.redirect.js
index 4044ad49ee5..7ebc1ef01dc 100644
--- a/test/res.redirect.js
+++ b/test/res.redirect.js
@@ -1,6 +1,7 @@
 
-var express = require('../')
-  , request = require('supertest');
+var http = require('http');
+var express = require('..');
+var request = require('supertest');
 
 describe('res', function(){
   describe('.redirect(url)', function(){
@@ -83,11 +84,9 @@ describe('res', function(){
       request(app)
       .get('/')
       .set('Accept', 'text/html')
-      .end(function(err, res){
-        res.headers.should.have.property('location', 'http://google.com');
-        res.text.should.equal('<p>Moved Temporarily. Redirecting to <a href="http://google.com">http://google.com</a></p>');
-        done();
-      })
+      .expect('Content-Type', /html/)
+      .expect('Location', 'http://google.com')
+      .expect(302, '<p>' + http.STATUS_CODES[302] + '. Redirecting to <a href="http://google.com">http://google.com</a></p>', done);
     })
 
     it('should escape the url', function(done){
@@ -101,10 +100,9 @@ describe('res', function(){
       .get('/')
       .set('Host', 'http://example.com')
       .set('Accept', 'text/html')
-      .end(function(err, res){
-        res.text.should.equal('<p>Moved Temporarily. Redirecting to <a href="&lt;lame&gt;">&lt;lame&gt;</a></p>');
-        done();
-      })
+      .expect('Content-Type', /html/)
+      .expect('Location', '<lame>')
+      .expect(302, '<p>' + http.STATUS_CODES[302] + '. Redirecting to <a href="&lt;lame&gt;">&lt;lame&gt;</a></p>', done);
     })
 
     it('should include the redirect type', function(done){
@@ -134,12 +132,9 @@ describe('res', function(){
       request(app)
       .get('/')
       .set('Accept', 'text/plain, */*')
-      .end(function(err, res){
-        res.headers.should.have.property('location', 'http://google.com');
-        res.headers.should.have.property('content-length', '51');
-        res.text.should.equal('Moved Temporarily. Redirecting to http://google.com');
-        done();
-      })
+      .expect('Content-Type', /plain/)
+      .expect('Location', 'http://google.com')
+      .expect(302, http.STATUS_CODES[302] + '. Redirecting to http://google.com', done);
     })
 
     it('should encode the url', function(done){
@@ -153,10 +148,9 @@ describe('res', function(){
       .get('/')
       .set('Host', 'http://example.com')
       .set('Accept', 'text/plain, */*')
-      .end(function(err, res){
-        res.text.should.equal('Moved Temporarily. Redirecting to http://example.com/?param=%3Cscript%3Ealert(%22hax%22);%3C/script%3E');
-        done();
-      })
+      .expect('Content-Type', /plain/)
+      .expect('Location', 'http://example.com/?param=<script>alert("hax");</script>')
+      .expect(302, http.STATUS_CODES[302] + '. Redirecting to http://example.com/?param=%3Cscript%3Ealert(%22hax%22);%3C/script%3E', done);
     })
 
     it('should include the redirect type', function(done){

From 5a4310e9da32bd1dc49977247615be253f56b1f7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 6 Nov 2015 22:09:47 -0500
Subject: [PATCH 0902/1265] build: reduce runtime versions to one per major

---
 .travis.yml  | 2 --
 appveyor.yml | 2 --
 2 files changed, 4 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index df087b4a0f7..f1f609b5922 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -2,9 +2,7 @@ language: node_js
 node_js:
   - "0.10"
   - "0.12"
-  - "1.0"
   - "1.8"
-  - "2.0"
   - "2.3"
 sudo: false
 before_install: "npm rm --save-dev connect-redis"
diff --git a/appveyor.yml b/appveyor.yml
index b1f13d167bd..5a8f3080bf1 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -2,9 +2,7 @@ environment:
   matrix:
     - nodejs_version: "0.10"
     - nodejs_version: "0.12"
-    - nodejs_version: "1.0"
     - nodejs_version: "1.8"
-    - nodejs_version: "2.0"
     - nodejs_version: "2.3"
 install:
   - ps: Install-Product node $env:nodejs_version

From 2f96412636ef04c5639e38768de0f2b526f02e32 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 6 Nov 2015 22:16:06 -0500
Subject: [PATCH 0903/1265] build: io.js@2.5

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index f1f609b5922..7c98d22d8eb 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -3,7 +3,7 @@ node_js:
   - "0.10"
   - "0.12"
   - "1.8"
-  - "2.3"
+  - "2.5"
 sudo: false
 before_install: "npm rm --save-dev connect-redis"
 script: "npm run-script test-ci"
diff --git a/appveyor.yml b/appveyor.yml
index 5a8f3080bf1..bce7c64deeb 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -3,7 +3,7 @@ environment:
     - nodejs_version: "0.10"
     - nodejs_version: "0.12"
     - nodejs_version: "1.8"
-    - nodejs_version: "2.3"
+    - nodejs_version: "2.5"
 install:
   - ps: Install-Product node $env:nodejs_version
   - npm rm --save-dev connect-redis

From 963d795d24ee951ce5382ccb0554f8a1960641e2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 6 Nov 2015 22:47:15 -0500
Subject: [PATCH 0904/1265] build: support io.js 3.x

---
 .travis.yml  | 1 +
 appveyor.yml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 7c98d22d8eb..cc679216af1 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -4,6 +4,7 @@ node_js:
   - "0.12"
   - "1.8"
   - "2.5"
+  - "3.3"
 sudo: false
 before_install: "npm rm --save-dev connect-redis"
 script: "npm run-script test-ci"
diff --git a/appveyor.yml b/appveyor.yml
index bce7c64deeb..40ee0765374 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -4,6 +4,7 @@ environment:
     - nodejs_version: "0.12"
     - nodejs_version: "1.8"
     - nodejs_version: "2.5"
+    - nodejs_version: "3.3"
 install:
   - ps: Install-Product node $env:nodejs_version
   - npm rm --save-dev connect-redis

From 1a59246746045ff78d31a0cd997d3679010b7f4e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 6 Nov 2015 22:49:44 -0500
Subject: [PATCH 0905/1265] build: mocha@2.3.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 3f299bada86..99b8f85a949 100644
--- a/package.json
+++ b/package.json
@@ -58,7 +58,7 @@
     "ejs": "2.3.3",
     "istanbul": "0.3.17",
     "marked": "0.3.5",
-    "mocha": "2.2.5",
+    "mocha": "2.3.3",
     "should": "7.0.2",
     "supertest": "1.0.1",
     "body-parser": "~1.13.3",

From 2f37f4b28d52c3ae18e5e1930ccc776647f86531 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 6 Nov 2015 22:51:09 -0500
Subject: [PATCH 0906/1265] build: istanbul@0.4.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 99b8f85a949..2a432203aea 100644
--- a/package.json
+++ b/package.json
@@ -56,7 +56,7 @@
   "devDependencies": {
     "after": "0.8.1",
     "ejs": "2.3.3",
-    "istanbul": "0.3.17",
+    "istanbul": "0.4.0",
     "marked": "0.3.5",
     "mocha": "2.3.3",
     "should": "7.0.2",

From 9665aa2153c5eca8b6ccdc22ce43a0934475fae8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 6 Nov 2015 22:57:04 -0500
Subject: [PATCH 0907/1265] build: supertest@1.1.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 2a432203aea..25186caf064 100644
--- a/package.json
+++ b/package.json
@@ -60,7 +60,7 @@
     "marked": "0.3.5",
     "mocha": "2.3.3",
     "should": "7.0.2",
-    "supertest": "1.0.1",
+    "supertest": "1.1.0",
     "body-parser": "~1.13.3",
     "connect-redis": "~2.4.1",
     "cookie-parser": "~1.3.5",

From 747fccfb44c61f309e1258959c6c3ad61bdc767c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 6 Nov 2015 22:59:46 -0500
Subject: [PATCH 0908/1265] build: should@7.1.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 25186caf064..2b983b810dc 100644
--- a/package.json
+++ b/package.json
@@ -59,7 +59,7 @@
     "istanbul": "0.4.0",
     "marked": "0.3.5",
     "mocha": "2.3.3",
-    "should": "7.0.2",
+    "should": "7.1.1",
     "supertest": "1.1.0",
     "body-parser": "~1.13.3",
     "connect-redis": "~2.4.1",

From 5699d64b99412bb3251d265f272ba25be03fa0d3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 7 Nov 2015 00:15:39 -0500
Subject: [PATCH 0909/1265] build: ejs@2.3.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 2b983b810dc..27c165bb6c6 100644
--- a/package.json
+++ b/package.json
@@ -55,7 +55,7 @@
   },
   "devDependencies": {
     "after": "0.8.1",
-    "ejs": "2.3.3",
+    "ejs": "2.3.4",
     "istanbul": "0.4.0",
     "marked": "0.3.5",
     "mocha": "2.3.3",

From e5ec966b2f068e935ea1b33374fac133dd06cdc8 Mon Sep 17 00:00:00 2001
From: Alexander Shemetovsky <alexkval@gmail.com>
Date: Tue, 25 Aug 2015 21:03:05 +0300
Subject: [PATCH 0910/1265] Fix param definition is jsdoc for app.render

fixes #2741
---
 lib/application.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/application.js b/lib/application.js
index a9df9103540..0ee4def3890 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -522,7 +522,7 @@ app.del = deprecate.function(app.delete, 'app.del: Use app.delete instead');
  *    })
  *
  * @param {String} name
- * @param {String|Function} options or fn
+ * @param {Object|Function} options or fn
  * @param {Function} callback
  * @public
  */

From 7a3b5aea11abbae6ce4be9094c3acd74e4af95c2 Mon Sep 17 00:00:00 2001
From: Ricardo Bin <rsilv94@walmart.com>
Date: Tue, 27 Oct 2015 09:50:42 -0200
Subject: [PATCH 0911/1265] tests: add test for res.send() without arguments

closes #2778
closes #2783
---
 test/res.send.js | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/test/res.send.js b/test/res.send.js
index 23aa5f7911f..6eafb944966 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -5,6 +5,20 @@ var methods = require('methods');
 var request = require('supertest');
 
 describe('res', function(){
+  describe('.send()', function(){
+    it('should set body to ""', function(done){
+      var app = express();
+
+      app.use(function(req, res){
+        res.send();
+      });
+
+      request(app)
+      .get('/')
+      .expect(200, '', done);
+    })
+  })
+
   describe('.send(null)', function(){
     it('should set body to ""', function(done){
       var app = express();

From 42b944295a12e09426bc220aae0cd5c1b2410ae2 Mon Sep 17 00:00:00 2001
From: Rand McKinney <rand@strongloop.com>
Date: Fri, 13 Nov 2015 13:35:09 -0800
Subject: [PATCH 0912/1265] Add Security document

closes #2733
closes #2804
---
 Readme.md   |  4 ++++
 Security.md | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 57 insertions(+)
 create mode 100644 Security.md

diff --git a/Readme.md b/Readme.md
index 8da83a517e1..d0c081ccfed 100644
--- a/Readme.md
+++ b/Readme.md
@@ -47,6 +47,10 @@ $ npm install express
 
 **PROTIP** Be sure to read [Migrating from 3.x to 4.x](https://github.com/strongloop/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/strongloop/express/wiki/New-features-in-4.x).
 
+###Security Issues
+
+If you discover a security vulnerability in Express, please see [Security Policies and Procedures](security.md).
+
 ## Quick Start
 
   The quickest way to get started with express is to utilize the executable [`express(1)`](https://github.com/expressjs/generator) to generate an application as shown below:
diff --git a/Security.md b/Security.md
new file mode 100644
index 00000000000..0c6d82324f1
--- /dev/null
+++ b/Security.md
@@ -0,0 +1,53 @@
+# Security Policies and Procedures
+
+This document outlines security procedures and general policies for the Express
+project.
+
+  * [Reporting a Bug](#reporting-a-bug)
+  * [Disclosure Policy](#disclosure-policy)
+  * [Receiving Security Updates](#receiving-security-updates)
+  * [Comments on this Policy](#comments-on-this-policy)
+
+## Reporting a Bug
+
+The Express team and community take all security bugs in Express seriously.
+Thank you for improving the security of Express. We appreciate your efforts and
+responsible disclosure and will make every effort to acknowledge your
+contributions.
+
+Report security bugs by emailing security@expressjs.com. Email to this address
+is delivered to a subset of the core team who handle security issues.
+
+The security team will acknowledge your email within 24 hours, and will send a
+more detailed response within 48 hours indicating the next steps in handling
+your report. After the initial reply to your report, the security team will
+endeavor to keep you informed of the progress towards a fix and full
+announcement, and may ask for additional information or guidance.
+
+Report security bugs in third-party modules to the person or team maintaining
+the module. You can also report a vulnerability through the
+[Node Security Project](https://nodesecurity.io/report).
+
+## Disclosure Policy
+
+When the security team receives a security bug report, they will assign it to a
+primary handler. This person will coordinate the fix and release process,
+involving the following steps:
+
+  * Confirm the problem and determine the affected versions.
+  * Audit code to find any potential similar problems.
+  * Prepare fixes for all releases still under maintenance. These fixes will be
+    released as fast as possible to npm.
+
+## Receiving Security Updates
+
+Security notifications will be distributed via the following methods.
+
+  * https://groups.google.com/forum/#!forum/express-js
+  * http://blog.strongloop.com
+  * http://expressjs.com/advanced/security-updates.html
+
+## Comments on this Policy
+
+If you have suggestions on how this process could be improved please submit a
+pull request or email security@expressjs.com to discuss.

From 67116cc5e6fa34b64bc7444c65642c188a6ce0db Mon Sep 17 00:00:00 2001
From: Young Jae Sim <hanul@hanul.me>
Date: Thu, 3 Dec 2015 02:27:25 +0900
Subject: [PATCH 0913/1265] docs: remove link to Korean translation

closes #2820
---
 Readme.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index d0c081ccfed..0f3f40ff14e 100644
--- a/Readme.md
+++ b/Readme.md
@@ -43,7 +43,6 @@ $ npm install express
   * Visit the [Wiki](https://github.com/strongloop/express/wiki)
   * [Google Group](https://groups.google.com/group/express-js) for discussion
   * [Русскоязычная документация](http://jsman.ru/express/)
-  * [한국어 문서](http://expressjs.kr) - [[website repo](https://github.com/Hanul/expressjs.kr)]
 
 **PROTIP** Be sure to read [Migrating from 3.x to 4.x](https://github.com/strongloop/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/strongloop/express/wiki/New-features-in-4.x).
 

From 23f021a3e1643d72110de30925228350b4454d2e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 14 Dec 2015 23:10:31 -0500
Subject: [PATCH 0914/1265] build: support Node.js 4.x

closes #2751
closes #2754
closes #2757
---
 .travis.yml  | 1 +
 appveyor.yml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index cc679216af1..90852320663 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -5,6 +5,7 @@ node_js:
   - "1.8"
   - "2.5"
   - "3.3"
+  - "4.2"
 sudo: false
 before_install: "npm rm --save-dev connect-redis"
 script: "npm run-script test-ci"
diff --git a/appveyor.yml b/appveyor.yml
index 40ee0765374..242bb8b0cb5 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -5,6 +5,7 @@ environment:
     - nodejs_version: "1.8"
     - nodejs_version: "2.5"
     - nodejs_version: "3.3"
+    - nodejs_version: "4.2"
 install:
   - ps: Install-Product node $env:nodejs_version
   - npm rm --save-dev connect-redis

From 60f8e77d66563757a85e489fd2966d9bac3a84d8 Mon Sep 17 00:00:00 2001
From: ChALkeR <chalkerx@gmail.com>
Date: Fri, 13 Nov 2015 10:04:40 +0300
Subject: [PATCH 0915/1265] deps: cookie@0.1.5

closes #2799
closes #2800
closes #2801
---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index be89c8e7230..1820824c069 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: cookie@0.1.5
+    - Throw on invalid values provided to `serialize`
+
 4.13.3 / 2015-08-02
 ===================
 
diff --git a/package.json b/package.json
index 27c165bb6c6..90ea2e77790 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,7 @@
     "array-flatten": "1.1.1",
     "content-disposition": "0.5.0",
     "content-type": "~1.0.1",
-    "cookie": "0.1.3",
+    "cookie": "0.1.5",
     "cookie-signature": "1.0.6",
     "debug": "~2.2.0",
     "depd": "~1.0.1",

From 4416fb2746f01a76e4a4fc94100cdff1107130be Mon Sep 17 00:00:00 2001
From: Rand McKinney <rand@strongloop.com>
Date: Tue, 15 Dec 2015 10:19:19 -0800
Subject: [PATCH 0916/1265] docs: fix link to Security.md in Readme.md

closes #2829
---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 0f3f40ff14e..9e2424ce915 100644
--- a/Readme.md
+++ b/Readme.md
@@ -48,7 +48,7 @@ $ npm install express
 
 ###Security Issues
 
-If you discover a security vulnerability in Express, please see [Security Policies and Procedures](security.md).
+If you discover a security vulnerability in Express, please see [Security Policies and Procedures](Security.md).
 
 ## Quick Start
 

From 2b2a1b28f3cf92a27a87f4f8569e9fa3489b783c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 17 Dec 2015 20:51:32 -0500
Subject: [PATCH 0917/1265] deps: escape-html@~1.0.3

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 1820824c069..63b6f72457d 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,10 @@ unreleased
 
   * deps: cookie@0.1.5
     - Throw on invalid values provided to `serialize`
+  * deps: escape-html@~1.0.3
+    - perf: enable strict mode
+    - perf: optimize string replacement
+    - perf: use faster string coercion
 
 4.13.3 / 2015-08-02
 ===================
diff --git a/package.json b/package.json
index 90ea2e77790..3a3007bb53a 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,7 @@
     "cookie-signature": "1.0.6",
     "debug": "~2.2.0",
     "depd": "~1.0.1",
-    "escape-html": "1.0.2",
+    "escape-html": "~1.0.3",
     "etag": "~1.7.0",
     "finalhandler": "0.4.0",
     "fresh": "0.3.0",

From 7d9350391413aa6cbacaad93271316e2c758501c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 17 Dec 2015 20:56:04 -0500
Subject: [PATCH 0918/1265] deps: finalhandler@0.4.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 63b6f72457d..4b16fc8714e 100644
--- a/History.md
+++ b/History.md
@@ -7,6 +7,8 @@ unreleased
     - perf: enable strict mode
     - perf: optimize string replacement
     - perf: use faster string coercion
+  * deps: finalhandler@0.4.1
+    - deps: escape-html@~1.0.3
 
 4.13.3 / 2015-08-02
 ===================
diff --git a/package.json b/package.json
index 3a3007bb53a..8b4f6b93d61 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "depd": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.7.0",
-    "finalhandler": "0.4.0",
+    "finalhandler": "0.4.1",
     "fresh": "0.3.0",
     "merge-descriptors": "1.0.0",
     "methods": "~1.1.1",

From c95a1077d21e2fd58e24b4435cb9c40dd4495376 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 17 Dec 2015 20:58:41 -0500
Subject: [PATCH 0919/1265] deps: proxy-addr@~1.0.10

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 4b16fc8714e..6398655b286 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,9 @@ unreleased
     - perf: use faster string coercion
   * deps: finalhandler@0.4.1
     - deps: escape-html@~1.0.3
+  * deps: proxy-addr@~1.0.10
+    - deps: ipaddr.js@1.0.5
+    - perf: enable strict mode
 
 4.13.3 / 2015-08-02
 ===================
diff --git a/package.json b/package.json
index 8b4f6b93d61..33ac81687be 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~1.0.8",
+    "proxy-addr": "~1.0.10",
     "qs": "4.0.0",
     "range-parser": "~1.0.2",
     "send": "0.13.0",

From 4f8167f23fddc80ecb12cff3a21c610e639fe738 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 17 Dec 2015 20:59:12 -0500
Subject: [PATCH 0920/1265] deps: range-parser@~1.0.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 6398655b286..28c4648bfa5 100644
--- a/History.md
+++ b/History.md
@@ -12,6 +12,8 @@ unreleased
   * deps: proxy-addr@~1.0.10
     - deps: ipaddr.js@1.0.5
     - perf: enable strict mode
+  * deps: range-parser@~1.0.3
+    - perf: enable strict mode
 
 4.13.3 / 2015-08-02
 ===================
diff --git a/package.json b/package.json
index 33ac81687be..1d701344fc9 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~1.0.10",
     "qs": "4.0.0",
-    "range-parser": "~1.0.2",
+    "range-parser": "~1.0.3",
     "send": "0.13.0",
     "serve-static": "~1.10.0",
     "type-is": "~1.6.6",

From c73b1bee51f72fd11ca7afa497f2737399decd57 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 17 Dec 2015 21:02:22 -0500
Subject: [PATCH 0921/1265] build: istanbul@0.4.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 1d701344fc9..06e53ef9aa0 100644
--- a/package.json
+++ b/package.json
@@ -56,7 +56,7 @@
   "devDependencies": {
     "after": "0.8.1",
     "ejs": "2.3.4",
-    "istanbul": "0.4.0",
+    "istanbul": "0.4.1",
     "marked": "0.3.5",
     "mocha": "2.3.3",
     "should": "7.1.1",

From 249323919211fbb83363da09adaaf7060a123534 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 18 Dec 2015 15:09:34 -0500
Subject: [PATCH 0922/1265] build: mocha@2.3.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 06e53ef9aa0..bc8c9733b9a 100644
--- a/package.json
+++ b/package.json
@@ -58,7 +58,7 @@
     "ejs": "2.3.4",
     "istanbul": "0.4.1",
     "marked": "0.3.5",
-    "mocha": "2.3.3",
+    "mocha": "2.3.4",
     "should": "7.1.1",
     "supertest": "1.1.0",
     "body-parser": "~1.13.3",

From e44f024dab675fbfa493136aa6305f093d7d2055 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 18 Dec 2015 15:10:33 -0500
Subject: [PATCH 0923/1265] deps: update example dependencies

---
 package.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index bc8c9733b9a..960a0578730 100644
--- a/package.json
+++ b/package.json
@@ -61,11 +61,11 @@
     "mocha": "2.3.4",
     "should": "7.1.1",
     "supertest": "1.1.0",
-    "body-parser": "~1.13.3",
+    "body-parser": "~1.14.2",
     "connect-redis": "~2.4.1",
-    "cookie-parser": "~1.3.5",
+    "cookie-parser": "~1.4.1",
     "cookie-session": "~1.2.0",
-    "express-session": "~1.11.3",
+    "express-session": "~1.13.0",
     "jade": "~1.11.0",
     "method-override": "~2.3.5",
     "morgan": "~1.6.1",

From f2cf28c2f3c0a3b5d5ab976a148a83f7e763ae18 Mon Sep 17 00:00:00 2001
From: Jordan Larson <jordanlarson@ebureau.com>
Date: Wed, 13 Jan 2016 15:32:08 -0600
Subject: [PATCH 0924/1265] docs: add link to Gitter

---
 Readme.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Readme.md b/Readme.md
index 9e2424ce915..d2407279fa5 100644
--- a/Readme.md
+++ b/Readme.md
@@ -42,6 +42,7 @@ $ npm install express
   * [Github Organization](https://github.com/expressjs) for Official Middleware & Modules
   * Visit the [Wiki](https://github.com/strongloop/express/wiki)
   * [Google Group](https://groups.google.com/group/express-js) for discussion
+  * [Gitter](https://gitter.im/strongloop/express) for support and discussion
   * [Русскоязычная документация](http://jsman.ru/express/)
 
 **PROTIP** Be sure to read [Migrating from 3.x to 4.x](https://github.com/strongloop/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/strongloop/express/wiki/New-features-in-4.x).

From bd118c47dfdbc05a57cc10d4b791cdb91a203a7f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 16 Jan 2016 23:54:41 -0500
Subject: [PATCH 0925/1265] deps: serve-static@~1.10.1

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 28c4648bfa5..ca4f6556c0f 100644
--- a/History.md
+++ b/History.md
@@ -14,6 +14,9 @@ unreleased
     - perf: enable strict mode
   * deps: range-parser@~1.0.3
     - perf: enable strict mode
+  * deps: serve-static@~1.10.1
+    - deps: escape-html@~1.0.3
+    - deps: send@0.13.1
 
 4.13.3 / 2015-08-02
 ===================
diff --git a/package.json b/package.json
index 960a0578730..eaf0fbd242b 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "qs": "4.0.0",
     "range-parser": "~1.0.3",
     "send": "0.13.0",
-    "serve-static": "~1.10.0",
+    "serve-static": "~1.10.1",
     "type-is": "~1.6.6",
     "utils-merge": "1.0.0",
     "vary": "~1.0.1"

From 53ee474c442e268abae9bea5b49f68464bf61f4e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 16 Jan 2016 23:56:09 -0500
Subject: [PATCH 0926/1265] deps: send@0.13.1

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ca4f6556c0f..6f1904567b2 100644
--- a/History.md
+++ b/History.md
@@ -14,6 +14,11 @@ unreleased
     - perf: enable strict mode
   * deps: range-parser@~1.0.3
     - perf: enable strict mode
+  * deps: send@0.13.1
+    - deps: depd@~1.1.0
+    - deps: destroy@~1.0.4
+    - deps: escape-html@~1.0.3
+    - deps: range-parser@~1.0.3
   * deps: serve-static@~1.10.1
     - deps: escape-html@~1.0.3
     - deps: send@0.13.1
diff --git a/package.json b/package.json
index eaf0fbd242b..1e9fc8a14d7 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
     "proxy-addr": "~1.0.10",
     "qs": "4.0.0",
     "range-parser": "~1.0.3",
-    "send": "0.13.0",
+    "send": "0.13.1",
     "serve-static": "~1.10.1",
     "type-is": "~1.6.6",
     "utils-merge": "1.0.0",

From 7c8456fcde6006faceab1fca659b088c7a915207 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 16 Jan 2016 23:57:07 -0500
Subject: [PATCH 0927/1265] deps: depd@~1.1.0

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 6f1904567b2..1e93e7bdb47 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,9 @@ unreleased
 
   * deps: cookie@0.1.5
     - Throw on invalid values provided to `serialize`
+  * deps: depd@~1.1.0
+    - Support web browser loading
+    - perf: enable strict mode
   * deps: escape-html@~1.0.3
     - perf: enable strict mode
     - perf: optimize string replacement
diff --git a/package.json b/package.json
index 1e9fc8a14d7..de8b09324a6 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "cookie": "0.1.5",
     "cookie-signature": "1.0.6",
     "debug": "~2.2.0",
-    "depd": "~1.0.1",
+    "depd": "~1.1.0",
     "escape-html": "~1.0.3",
     "etag": "~1.7.0",
     "finalhandler": "0.4.1",

From 8eee818e0b697f85418d5eee9a86ab3a8e45105f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 16 Jan 2016 23:58:27 -0500
Subject: [PATCH 0928/1265] build: istanbul@0.4.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index de8b09324a6..2299579285b 100644
--- a/package.json
+++ b/package.json
@@ -56,7 +56,7 @@
   "devDependencies": {
     "after": "0.8.1",
     "ejs": "2.3.4",
-    "istanbul": "0.4.1",
+    "istanbul": "0.4.2",
     "marked": "0.3.5",
     "mocha": "2.3.4",
     "should": "7.1.1",

From 547ea368c2e1b915ed3ff1d844978d754b11c0ee Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 17 Jan 2016 18:00:59 -0500
Subject: [PATCH 0929/1265] deps: content-disposition@0.5.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 1e93e7bdb47..f71dac4875b 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,8 @@
 unreleased
 ==========
 
+  * deps: content-disposition@0.5.1
+    - perf: enable strict mode
   * deps: cookie@0.1.5
     - Throw on invalid values provided to `serialize`
   * deps: depd@~1.1.0
diff --git a/package.json b/package.json
index 2299579285b..2f08acd9f37 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
   "dependencies": {
     "accepts": "~1.2.12",
     "array-flatten": "1.1.1",
-    "content-disposition": "0.5.0",
+    "content-disposition": "0.5.1",
     "content-type": "~1.0.1",
     "cookie": "0.1.5",
     "cookie-signature": "1.0.6",

From 1589ce215348197f4c6a19effe7a07feff991c1d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 17 Jan 2016 18:51:24 -0500
Subject: [PATCH 0930/1265] deps: merge-descriptors@1.0.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f71dac4875b..78fb70063a7 100644
--- a/History.md
+++ b/History.md
@@ -14,6 +14,8 @@ unreleased
     - perf: use faster string coercion
   * deps: finalhandler@0.4.1
     - deps: escape-html@~1.0.3
+  * deps: merge-descriptors@1.0.1
+    - perf: enable strict mode
   * deps: proxy-addr@~1.0.10
     - deps: ipaddr.js@1.0.5
     - perf: enable strict mode
diff --git a/package.json b/package.json
index 2f08acd9f37..941c0a041a6 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "etag": "~1.7.0",
     "finalhandler": "0.4.1",
     "fresh": "0.3.0",
-    "merge-descriptors": "1.0.0",
+    "merge-descriptors": "1.0.1",
     "methods": "~1.1.1",
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.0",

From e83eab85e4c97a51088822c1bc4bb8a1faf06f88 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 17 Jan 2016 22:17:13 -0500
Subject: [PATCH 0931/1265] deps: methods@~1.1.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 78fb70063a7..5b7a1fbb87d 100644
--- a/History.md
+++ b/History.md
@@ -16,6 +16,8 @@ unreleased
     - deps: escape-html@~1.0.3
   * deps: merge-descriptors@1.0.1
     - perf: enable strict mode
+  * deps: methods@~1.1.2
+    - perf: enable strict mode
   * deps: proxy-addr@~1.0.10
     - deps: ipaddr.js@1.0.5
     - perf: enable strict mode
diff --git a/package.json b/package.json
index 941c0a041a6..14c6143664d 100644
--- a/package.json
+++ b/package.json
@@ -40,7 +40,7 @@
     "finalhandler": "0.4.1",
     "fresh": "0.3.0",
     "merge-descriptors": "1.0.1",
-    "methods": "~1.1.1",
+    "methods": "~1.1.2",
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.0",
     "path-to-regexp": "0.1.7",

From f627ca8d0b434c8c0b8c66b82a453a49220d8a1f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 20 Jan 2016 00:56:56 -0500
Subject: [PATCH 0932/1265] deps: serve-static@~1.10.2

---
 History.md   | 3 ++-
 package.json | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 5b7a1fbb87d..897ee5c2459 100644
--- a/History.md
+++ b/History.md
@@ -28,8 +28,9 @@ unreleased
     - deps: destroy@~1.0.4
     - deps: escape-html@~1.0.3
     - deps: range-parser@~1.0.3
-  * deps: serve-static@~1.10.1
+  * deps: serve-static@~1.10.2
     - deps: escape-html@~1.0.3
+    - deps: parseurl@~1.3.0
     - deps: send@0.13.1
 
 4.13.3 / 2015-08-02
diff --git a/package.json b/package.json
index 14c6143664d..9081300a16d 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "qs": "4.0.0",
     "range-parser": "~1.0.3",
     "send": "0.13.1",
-    "serve-static": "~1.10.1",
+    "serve-static": "~1.10.2",
     "type-is": "~1.6.6",
     "utils-merge": "1.0.0",
     "vary": "~1.0.1"

From 68474059742afae6bbcf60dafaccfa7a648e1de0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 20 Jan 2016 00:58:09 -0500
Subject: [PATCH 0933/1265] deps: parseurl@~1.3.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 897ee5c2459..45d426aaf6f 100644
--- a/History.md
+++ b/History.md
@@ -18,6 +18,8 @@ unreleased
     - perf: enable strict mode
   * deps: methods@~1.1.2
     - perf: enable strict mode
+  * deps: parseurl@~1.3.1
+    - perf: enable strict mode
   * deps: proxy-addr@~1.0.10
     - deps: ipaddr.js@1.0.5
     - perf: enable strict mode
diff --git a/package.json b/package.json
index 9081300a16d..1920a126e32 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",
     "on-finished": "~2.3.0",
-    "parseurl": "~1.3.0",
+    "parseurl": "~1.3.1",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~1.0.10",
     "qs": "4.0.0",

From e7a02f6a256a06b670fec65bc1460bc858c9e60e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Jan 2016 20:59:53 -0500
Subject: [PATCH 0934/1265] build: move repository to expressjs

---
 Contributing.md                    |  6 +-----
 Readme.md                          | 18 +++++++-----------
 Security.md                        | 15 +++------------
 examples/view-constructor/index.js |  4 ++--
 examples/web-service/index.js      |  2 +-
 package.json                       |  3 +--
 test/acceptance/web-service.js     |  2 +-
 7 files changed, 16 insertions(+), 34 deletions(-)

diff --git a/Contributing.md b/Contributing.md
index 6dab84f125d..ce33ccd41c9 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -1,7 +1,4 @@
-
-## Website Issues
-
-Issues for the expressjs.com website go here https://github.com/strongloop/expressjs.com
+# Contributing
 
 ## PRs and Code contributions
 
@@ -22,4 +19,3 @@ Things that will help get your question issue looked at:
 * Steps you have taken to debug it yourself.
 
 If you post a question and do not outline the above items or make it easy for us to understand and reproduce your issue, it will be closed.
-
diff --git a/Readme.md b/Readme.md
index d2407279fa5..6e08454b263 100644
--- a/Readme.md
+++ b/Readme.md
@@ -37,16 +37,12 @@ $ npm install express
 
 ## Docs & Community
 
-  * [Website and Documentation](http://expressjs.com/) - [[website repo](https://github.com/strongloop/expressjs.com)]
   * [#express](https://webchat.freenode.net/?channels=express) on freenode IRC
   * [Github Organization](https://github.com/expressjs) for Official Middleware & Modules
-  * Visit the [Wiki](https://github.com/strongloop/express/wiki)
   * [Google Group](https://groups.google.com/group/express-js) for discussion
-  * [Gitter](https://gitter.im/strongloop/express) for support and discussion
+  * [Gitter](https://gitter.im/expressjs/express) for support and discussion
   * [Русскоязычная документация](http://jsman.ru/express/)
 
-**PROTIP** Be sure to read [Migrating from 3.x to 4.x](https://github.com/strongloop/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/strongloop/express/wiki/New-features-in-4.x).
-
 ###Security Issues
 
 If you discover a security vulnerability in Express, please see [Security Policies and Procedures](Security.md).
@@ -94,7 +90,7 @@ $ npm start
   To view the examples, clone the Express repo and install the dependencies:
 
 ```bash
-$ git clone git://github.com/strongloop/express.git --depth 1
+$ git clone git://github.com/expressjs/express.git --depth 1
 $ cd express
 $ npm install
 ```
@@ -120,7 +116,7 @@ The original author of Express is [TJ Holowaychuk](https://github.com/tj) [![TJ'
 
 The current lead maintainer is [Douglas Christopher Wilson](https://github.com/dougwilson) [![Doug's Gratipay][gratipay-image-dougwilson]][gratipay-url-dougwilson]
 
-[List of all contributors](https://github.com/strongloop/express/graphs/contributors)
+[List of all contributors](https://github.com/expressjs/express/graphs/contributors)
 
 ## License
 
@@ -130,12 +126,12 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d
 [npm-url]: https://npmjs.org/package/express
 [downloads-image]: https://img.shields.io/npm/dm/express.svg
 [downloads-url]: https://npmjs.org/package/express
-[travis-image]: https://img.shields.io/travis/strongloop/express/master.svg?label=linux
-[travis-url]: https://travis-ci.org/strongloop/express
+[travis-image]: https://img.shields.io/travis/expressjs/express/master.svg?label=linux
+[travis-url]: https://travis-ci.org/expressjs/express
 [appveyor-image]: https://img.shields.io/appveyor/ci/dougwilson/express/master.svg?label=windows
 [appveyor-url]: https://ci.appveyor.com/project/dougwilson/express
-[coveralls-image]: https://img.shields.io/coveralls/strongloop/express/master.svg
-[coveralls-url]: https://coveralls.io/r/strongloop/express?branch=master
+[coveralls-image]: https://img.shields.io/coveralls/expressjs/express/master.svg
+[coveralls-url]: https://coveralls.io/r/expressjs/express?branch=master
 [gratipay-image-visionmedia]: https://img.shields.io/gratipay/visionmedia.svg
 [gratipay-url-visionmedia]: https://gratipay.com/visionmedia/
 [gratipay-image-dougwilson]: https://img.shields.io/gratipay/dougwilson.svg
diff --git a/Security.md b/Security.md
index 0c6d82324f1..d965a87bb0a 100644
--- a/Security.md
+++ b/Security.md
@@ -15,10 +15,9 @@ Thank you for improving the security of Express. We appreciate your efforts and
 responsible disclosure and will make every effort to acknowledge your
 contributions.
 
-Report security bugs by emailing security@expressjs.com. Email to this address
-is delivered to a subset of the core team who handle security issues.
+Report security bugs by emailing the lead maintainer in the Readme.md file.
 
-The security team will acknowledge your email within 24 hours, and will send a
+The lead maintainer will acknowledge your email within 48 hours, and will send a
 more detailed response within 48 hours indicating the next steps in handling
 your report. After the initial reply to your report, the security team will
 endeavor to keep you informed of the progress towards a fix and full
@@ -39,15 +38,7 @@ involving the following steps:
   * Prepare fixes for all releases still under maintenance. These fixes will be
     released as fast as possible to npm.
 
-## Receiving Security Updates
-
-Security notifications will be distributed via the following methods.
-
-  * https://groups.google.com/forum/#!forum/express-js
-  * http://blog.strongloop.com
-  * http://expressjs.com/advanced/security-updates.html
-
 ## Comments on this Policy
 
 If you have suggestions on how this process could be improved please submit a
-pull request or email security@expressjs.com to discuss.
+pull request.
diff --git a/examples/view-constructor/index.js b/examples/view-constructor/index.js
index 173663f8095..195d32db0eb 100644
--- a/examples/view-constructor/index.js
+++ b/examples/view-constructor/index.js
@@ -23,7 +23,7 @@ app.engine('md', function(str, options, fn){
 });
 
 // pointing to a particular github repo to load files from it
-app.set('views', 'strongloop/express');
+app.set('views', 'expressjs/express');
 
 // register a new view constructor
 app.set('view', GithubView);
@@ -36,7 +36,7 @@ app.get('/', function(req, res){
 });
 
 app.get('/Readme.md', function(req, res){
-  // rendering a view from https://github.com/strongloop/express/blob/master/Readme.md
+  // rendering a view from https://github.com/expressjs/express/blob/master/Readme.md
   res.render('Readme.md');
 });
 
diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index 4958c22450c..694e121d91b 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -49,7 +49,7 @@ var apiKeys = ['foo', 'bar', 'baz'];
 // these two objects will serve as our faux database
 
 var repos = [
-    { name: 'express', url: 'http://github.com/strongloop/express' }
+    { name: 'express', url: 'http://github.com/expressjs/express' }
   , { name: 'stylus', url: 'http://github.com/learnboost/stylus' }
   , { name: 'cluster', url: 'http://github.com/learnboost/cluster' }
 ];
diff --git a/package.json b/package.json
index 1920a126e32..798f43c935c 100644
--- a/package.json
+++ b/package.json
@@ -13,8 +13,7 @@
     "Young Jae Sim <hanul@hanul.me>"
   ],
   "license": "MIT",
-  "repository": "strongloop/express",
-  "homepage": "http://expressjs.com/",
+  "repository": "expressjs/express",
   "keywords": [
     "express",
     "framework",
diff --git a/test/acceptance/web-service.js b/test/acceptance/web-service.js
index 5868e92df95..521fa9fa28d 100644
--- a/test/acceptance/web-service.js
+++ b/test/acceptance/web-service.js
@@ -53,7 +53,7 @@ describe('web-service', function(){
         .get('/api/repos?api-key=foo')
         .expect('Content-Type', 'application/json; charset=utf-8')
         .expect(/"name":"express"/)
-        .expect(/"url":"http:\/\/github.com\/strongloop\/express"/)
+        .expect(/"url":"http:\/\/github.com\/expressjs\/express"/)
         .expect(200, done)
       })
     })

From 193bed2649c55c1fd362e46cd4702c773f3e7434 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Jan 2016 21:10:45 -0500
Subject: [PATCH 0935/1265] 4.13.4

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 45d426aaf6f..c72241b98d5 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.13.4 / 2016-01-21
+===================
 
   * deps: content-disposition@0.5.1
     - perf: enable strict mode
diff --git a/package.json b/package.json
index 798f43c935c..3165cc44d3d 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.13.3",
+  "version": "4.13.4",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 05136550c7fa9d7671a03960cc86a717f0964d21 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Feb 2016 18:21:46 -0500
Subject: [PATCH 0936/1265] docs: fix some links messed up from repository move
 commit

closes #2861
closes #2867
---
 Contributing.md | 5 ++++-
 Readme.md       | 4 ++++
 package.json    | 1 +
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/Contributing.md b/Contributing.md
index ce33ccd41c9..45bc153823f 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -1,4 +1,7 @@
-# Contributing
+
+## Website Issues
+
+Issues for the expressjs.com website go here https://github.com/strongloop/expressjs.com
 
 ## PRs and Code contributions
 
diff --git a/Readme.md b/Readme.md
index 6e08454b263..e9bfaeba20d 100644
--- a/Readme.md
+++ b/Readme.md
@@ -37,12 +37,16 @@ $ npm install express
 
 ## Docs & Community
 
+  * [Website and Documentation](http://expressjs.com/) - [[website repo](https://github.com/strongloop/expressjs.com)]
   * [#express](https://webchat.freenode.net/?channels=express) on freenode IRC
   * [Github Organization](https://github.com/expressjs) for Official Middleware & Modules
+  * Visit the [Wiki](https://github.com/expressjs/express/wiki)
   * [Google Group](https://groups.google.com/group/express-js) for discussion
   * [Gitter](https://gitter.im/expressjs/express) for support and discussion
   * [Русскоязычная документация](http://jsman.ru/express/)
 
+**PROTIP** Be sure to read [Migrating from 3.x to 4.x](https://github.com/expressjs/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/expressjs/express/wiki/New-features-in-4.x).
+
 ###Security Issues
 
 If you discover a security vulnerability in Express, please see [Security Policies and Procedures](Security.md).
diff --git a/package.json b/package.json
index 3165cc44d3d..0b0e791d1f5 100644
--- a/package.json
+++ b/package.json
@@ -14,6 +14,7 @@
   ],
   "license": "MIT",
   "repository": "expressjs/express",
+  "homepage": "http://expressjs.com/",
   "keywords": [
     "express",
     "framework",

From b5a280111f94728e70aa1a22687e64aaf31abd81 Mon Sep 17 00:00:00 2001
From: Andy Fleming <andy@andyfleming.com>
Date: Tue, 9 Feb 2016 14:25:32 -0800
Subject: [PATCH 0937/1265] Fix jsdoc comment for res.get

closes #2882
---
 lib/response.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/response.js b/lib/response.js
index 641704b04ae..e813c52ec1e 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -740,7 +740,7 @@ res.get = function(field){
  * Clear cookie `name`.
  *
  * @param {String} name
- * @param {Object} options
+ * @param {Object} [options]
  * @return {ServerResponse} for chaining
  * @public
  */

From 4bcbf67482471ac096fb39bf076ba5d40c0fe4da Mon Sep 17 00:00:00 2001
From: Sian January <sjanuary@uk.ibm.com>
Date: Mon, 8 Feb 2016 13:52:23 +0000
Subject: [PATCH 0938/1265] docs: add branch & fork steps to contributing
 documentation

closes #2881
---
 Contributing.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/Contributing.md b/Contributing.md
index 45bc153823f..84c5b9ccef6 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -9,6 +9,18 @@ Issues for the expressjs.com website go here https://github.com/strongloop/expre
 * Follow existing coding style.
 * If you fix a bug, add a test.
 
+## Branches
+
+* Use the `master` branch for bug fixes or minor work that is intended for the current release stream
+* Use the correspondingly named branch, e.g. `5.0`, for anything intended for a future release of Express 
+
+## Steps for contributing
+
+* [Create an issue](https://github.com/strongloop/express/issues/new) for the bug you want to fix or the feature that you want to add.
+* Create your own [fork](https://github.com/strongloop/express) on github, then checkout your fork.
+* Write your code in your local copy. It's good practice to create a branch for each new issue you work on, although not compulsory.
+* To run the test suite, first install the dependencies by running `npm install`, then run `npm test`.
+* If the tests pass, you can commit your changes to your fork and then create a pull request from there. Make sure to reference your issue from the pull request comments by including the issue number e.g. #123.
 
 ## Issues which are questions
 

From dd2b8977747203343b37318a34b221d481e789e8 Mon Sep 17 00:00:00 2001
From: Muhammad Saqib <segmentationfaulter@gmail.com>
Date: Thu, 25 Feb 2016 07:46:14 +0500
Subject: [PATCH 0939/1265] examples: comment the usage of process.nextTick

closes #2903
closes #2908
---
 examples/error/index.js      | 3 +++
 examples/view-locals/user.js | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/examples/error/index.js b/examples/error/index.js
index d7db5015a13..94b3b4a4da3 100644
--- a/examples/error/index.js
+++ b/examples/error/index.js
@@ -31,6 +31,9 @@ app.get('/', function(req, res){
 
 app.get('/next', function(req, res, next){
   // We can also pass exceptions to next()
+  // The reason for process.nextTick() is to show that
+  // next() can be called inside an async operation,
+  // in real life it can be a DB read or HTTP request.
   process.nextTick(function(){
     next(new Error('oh no!'));
   });
diff --git a/examples/view-locals/user.js b/examples/view-locals/user.js
index 0e3373d548c..90ab1f389df 100644
--- a/examples/view-locals/user.js
+++ b/examples/view-locals/user.js
@@ -9,6 +9,9 @@ function User(name, age, species) {
 }
 
 User.all = function(fn){
+  // process.nextTick makes sure this function API
+  // behaves in an asynchronous manner, like if it
+  // was a real DB query to read all users.
   process.nextTick(function(){
     fn(null, users);
   });

From f3d99a4fdbe1531ea609e92c4d4ae6c269d78c7a Mon Sep 17 00:00:00 2001
From: Mikeal Rogers <mikeal.rogers@gmail.com>
Date: Mon, 29 Feb 2016 11:26:14 -0800
Subject: [PATCH 0940/1265] docs: add base contributing guide

closes #2918
---
 Collaborator-Guide.md |  36 +++++++++++++++
 Contributing.md       | 102 ++++++++++++++++++++++++++++++++----------
 2 files changed, 115 insertions(+), 23 deletions(-)
 create mode 100644 Collaborator-Guide.md

diff --git a/Collaborator-Guide.md b/Collaborator-Guide.md
new file mode 100644
index 00000000000..84c5b9ccef6
--- /dev/null
+++ b/Collaborator-Guide.md
@@ -0,0 +1,36 @@
+
+## Website Issues
+
+Issues for the expressjs.com website go here https://github.com/strongloop/expressjs.com
+
+## PRs and Code contributions
+
+* Tests must pass.
+* Follow existing coding style.
+* If you fix a bug, add a test.
+
+## Branches
+
+* Use the `master` branch for bug fixes or minor work that is intended for the current release stream
+* Use the correspondingly named branch, e.g. `5.0`, for anything intended for a future release of Express 
+
+## Steps for contributing
+
+* [Create an issue](https://github.com/strongloop/express/issues/new) for the bug you want to fix or the feature that you want to add.
+* Create your own [fork](https://github.com/strongloop/express) on github, then checkout your fork.
+* Write your code in your local copy. It's good practice to create a branch for each new issue you work on, although not compulsory.
+* To run the test suite, first install the dependencies by running `npm install`, then run `npm test`.
+* If the tests pass, you can commit your changes to your fork and then create a pull request from there. Make sure to reference your issue from the pull request comments by including the issue number e.g. #123.
+
+## Issues which are questions
+
+We will typically close any vague issues or questions that are specific to some app you are writing. Please double check the docs and other references before being trigger happy with posting a question issue.
+
+Things that will help get your question issue looked at:
+
+* Full and runnable JS code.
+* Clear description of the problem or unexpected behavior.
+* Clear description of the expected result.
+* Steps you have taken to debug it yourself.
+
+If you post a question and do not outline the above items or make it easy for us to understand and reproduce your issue, it will be closed.
diff --git a/Contributing.md b/Contributing.md
index 84c5b9ccef6..3fb2b7c25f1 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -1,36 +1,92 @@
+# Node.js Community Contributing Guide 1.0
 
-## Website Issues
+This document describes a very simple process suitable for most projects
+in the Node.js ecosystem. Projects are encouraged to adopt this whether they
+are hosted in the Node.js Foundation or not.
 
-Issues for the expressjs.com website go here https://github.com/strongloop/expressjs.com
+The goal of this document is to create a contribution process that:
 
-## PRs and Code contributions
+* Encourages new contributions.
+* Encourages contributors to remain involved.
+* Avoids unnecessary processes and bureaucracy whenever possible.
+* Creates a transparent decision making process which makes it clear how
+contributors can be involved in decision making.
 
-* Tests must pass.
-* Follow existing coding style.
-* If you fix a bug, add a test.
+This document is based on much prior art in the Node.js community, io.js,
+and the Node.js project.
 
-## Branches
+## Vocabulary
 
-* Use the `master` branch for bug fixes or minor work that is intended for the current release stream
-* Use the correspondingly named branch, e.g. `5.0`, for anything intended for a future release of Express 
+* A **Contributor** is any individual creating or commenting on an issue or pull request.
+* A **Committer** is a subset of contributors who have been given write access to the repository.
+* A **TC (Technical Committee)** is a group of committers representing the required technical 
+expertise to resolve rare disputes.
 
-## Steps for contributing
+# Logging Issues
 
-* [Create an issue](https://github.com/strongloop/express/issues/new) for the bug you want to fix or the feature that you want to add.
-* Create your own [fork](https://github.com/strongloop/express) on github, then checkout your fork.
-* Write your code in your local copy. It's good practice to create a branch for each new issue you work on, although not compulsory.
-* To run the test suite, first install the dependencies by running `npm install`, then run `npm test`.
-* If the tests pass, you can commit your changes to your fork and then create a pull request from there. Make sure to reference your issue from the pull request comments by including the issue number e.g. #123.
+Log an issue for any question or problem you might have. When in doubt, log an issue, 
+any additional policies about what to include will be provided in the responses. The only
+exception is security dislosures which should be sent privately.
 
-## Issues which are questions
+Committers may direct you to another repository, ask for additional clarifications, and
+add appropriate metadata before the issue is addressed.
 
-We will typically close any vague issues or questions that are specific to some app you are writing. Please double check the docs and other references before being trigger happy with posting a question issue.
+Please be courteous, respectful, and every participant is expected to follow the 
+project's Code of Conduct.
 
-Things that will help get your question issue looked at:
+# Contributions
+
+Any change to resources in this repository must be through pull requests. This applies to all changes
+to documentation, code, binary files, etc. Even long term committers and TC members must use
+pull requests.
+
+No pull request can be merged without being reviewed.
+
+For non-trivial contributions, pull requests should sit for at least 36 hours to ensure that
+contributors in other timezones have time to review. Consideration should also be given to 
+weekends and other holiday periods to ensure active committers all have reasonable time to 
+become involved in the discussion and review process if they wish.
+
+The default for each contribution is that it is accepted once no committer has an objection.
+During review committers may also request that a specific contributor who is most versed in a 
+particular area gives a "LGTM" before the PR can be merged. There is no additional "sign off" 
+process for contributions to land. Once all issues brought by committers are addressed it can 
+be landed by any committer.
+
+In the case of an objection being raised in a pull request by another committer, all involved 
+committers should seek to arrive at a consensus by way of addressing concerns being expressed 
+by discussion, compromise on the proposed change, or withdrawal of the proposed change.
+
+If a contribution is controversial and committers cannot agree about how to get it to land
+or if it should land then it should be escalated to the TC. TC members should regularly
+discuss pending contributions in order to find a resolution. It is expected that only a 
+small minority of issues be brought to the TC for resolution and that discussion and 
+compromise among committers be the default resolution mechanism.
+
+# Becoming a Committer
+
+All contributors who land a non-trivial contribution should be on-boarded in a timely manner,
+and added as a committer, and be given write access to the repository.
+
+Committers are expected to follow this policy and continue to send pull requests, go through
+proper review, and have other committers merge their pull requests.
+
+# TC Process
+
+The TC uses a "consensus seeking" process for issues that are escalated to the TC. 
+The group tries to find a resolution that has no open objections among TC members.
+If a consensus cannot be reached that has no objections then a majority wins vote
+is called. It is also expected that the majority of decisions made by the TC are via 
+a consensus seeking process and that voting is only used as a last-resort.
+
+Resolution may involve returning the issue to committers with suggestions on how to 
+move forward towards a consensus. It is not expected that a meeting of the TC 
+will resolve all issues on its agenda during that meeting and may prefer to continue
+the discussion happening among the committers.
+
+Members can be added to the TC at any time. Any committer can nominate another committer
+to the TC and the TC uses its standard consensus seeking process to evaluate whether or
+not to add this new member. Members who do not participate consistently at the level of 
+a majority of the other members are expected to resign.
 
-* Full and runnable JS code.
-* Clear description of the problem or unexpected behavior.
-* Clear description of the expected result.
-* Steps you have taken to debug it yourself.
 
-If you post a question and do not outline the above items or make it easy for us to understand and reproduce your issue, it will be closed.

From bb84cf955f5f84edc8938c00ec8590599861abca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Linus=20Unneb=C3=A4ck?= <linus@folkdatorn.se>
Date: Thu, 5 May 2016 10:34:40 +0200
Subject: [PATCH 0941/1265] tests: add test for signed cookie without secret

closes #2986
---
 test/res.cookie.js | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/test/res.cookie.js b/test/res.cookie.js
index 8de6c0c6e37..543af99dcdd 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -150,6 +150,22 @@ describe('res', function(){
       })
     })
 
+    describe('signed without secret', function(){
+      it('should throw an error', function(done){
+        var app = express();
+
+        app.use(cookieParser());
+
+        app.use(function(req, res){
+          res.cookie('name', 'tobi', { signed: true }).end();
+        });
+
+        request(app)
+        .get('/')
+        .expect(500, /secret\S+ required for signed cookies/, done);
+      })
+    })
+
     describe('.signedCookie(name, string)', function(){
       it('should set a signed cookie', function(done){
         var app = express();

From 8931b2311a096515a59398702c8898d88d21515c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 10 May 2016 12:42:16 -0400
Subject: [PATCH 0942/1265] build: Node.js@4.4

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 90852320663..53b5041a6b4 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -5,7 +5,7 @@ node_js:
   - "1.8"
   - "2.5"
   - "3.3"
-  - "4.2"
+  - "4.4"
 sudo: false
 before_install: "npm rm --save-dev connect-redis"
 script: "npm run-script test-ci"
diff --git a/appveyor.yml b/appveyor.yml
index 242bb8b0cb5..4484e8224c1 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -5,7 +5,7 @@ environment:
     - nodejs_version: "1.8"
     - nodejs_version: "2.5"
     - nodejs_version: "3.3"
-    - nodejs_version: "4.2"
+    - nodejs_version: "4.4"
 install:
   - ps: Install-Product node $env:nodejs_version
   - npm rm --save-dev connect-redis

From 12bc16e72fe34ce7e3658679b694e47dce56ae7a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 10 May 2016 12:34:26 -0400
Subject: [PATCH 0943/1265] tests: use supertest to check response header
 values

closes #2983
closes #2992
---
 test/acceptance/cookies.js   | 19 +++++-------
 test/acceptance/downloads.js |  7 ++---
 test/middleware.basic.js     |  9 ++----
 test/res.jsonp.js            |  8 ++---
 test/res.location.js         |  6 ++--
 test/res.redirect.js         | 29 ++++++------------
 test/res.send.js             | 59 +++++++++++-------------------------
 test/res.sendFile.js         | 36 +++++++---------------
 test/res.vary.js             | 11 ++-----
 test/support/utils.js        | 24 +++++++++++++++
 10 files changed, 81 insertions(+), 127 deletions(-)
 create mode 100644 test/support/utils.js

diff --git a/test/acceptance/cookies.js b/test/acceptance/cookies.js
index 86add660c73..aa9e1faef44 100644
--- a/test/acceptance/cookies.js
+++ b/test/acceptance/cookies.js
@@ -1,6 +1,7 @@
 
 var app = require('../../examples/cookies')
   , request = require('supertest');
+var utils = require('../support/utils');
 
 describe('cookies', function(){
   describe('GET /', function(){
@@ -13,10 +14,8 @@ describe('cookies', function(){
     it('should respond with no cookies', function(done){
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.headers.should.not.have.property('set-cookie')
-        done()
-      })
+      .expect(utils.shouldNotHaveHeader('Set-Cookie'))
+      .expect(200, done)
     })
 
     it('should respond to cookie', function(done){
@@ -57,20 +56,16 @@ describe('cookies', function(){
       .post('/')
       .type('urlencoded')
       .send({ remember: 1 })
-      .expect(302, function(err, res){
-        res.headers.should.have.property('set-cookie')
-        done()
-      })
+      .expect('Set-Cookie', /remember=1/)
+      .expect(302, done)
     })
 
     it('should no set cookie w/o reminder', function(done){
       request(app)
       .post('/')
       .send({})
-      .expect(302, function(err, res){
-        res.headers.should.not.have.property('set-cookie')
-        done()
-      })
+      .expect(utils.shouldNotHaveHeader('Set-Cookie'))
+      .expect(302, done)
     })
   })
 })
diff --git a/test/acceptance/downloads.js b/test/acceptance/downloads.js
index ed9a02f9ced..a0aa7b75d9f 100644
--- a/test/acceptance/downloads.js
+++ b/test/acceptance/downloads.js
@@ -15,11 +15,8 @@ describe('downloads', function(){
     it('should have a download header', function(done){
       request(app)
       .get('/files/amazing.txt')
-      .end(function(err, res){
-        res.status.should.equal(200);
-        res.headers.should.have.property('content-disposition', 'attachment; filename="amazing.txt"')
-        done()
-      })
+      .expect('Content-Disposition', 'attachment; filename="amazing.txt"')
+      .expect(200, done)
     })
   })
 
diff --git a/test/middleware.basic.js b/test/middleware.basic.js
index 3e1f1813848..28a4dd18f2e 100644
--- a/test/middleware.basic.js
+++ b/test/middleware.basic.js
@@ -32,13 +32,8 @@ describe('middleware', function(){
       .get('/')
       .set('Content-Type', 'application/json')
       .send('{"foo":"bar"}')
-      .end(function(err, res){
-        if (err) return done(err);
-        res.headers.should.have.property('content-type', 'application/json');
-        res.statusCode.should.equal(200);
-        res.text.should.equal('{"foo":"bar"}');
-        done();
-      })
+      .expect('Content-Type', 'application/json')
+      .expect(200, '{"foo":"bar"}', done)
     })
   })
 })
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 4892a56ef6f..64b41fb9a6b 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -2,6 +2,7 @@
 var express = require('../')
   , request = require('supertest')
   , assert = require('assert');
+var utils = require('./support/utils');
 
 describe('res', function(){
   describe('.jsonp(object)', function(){
@@ -136,11 +137,8 @@ describe('res', function(){
       request(app)
       .get('/')
       .expect('Content-Type', 'application/vnd.example+json; charset=utf-8')
-      .expect(200, '{"hello":"world"}', function (err, res) {
-        if (err) return done(err);
-        res.headers.should.not.have.property('x-content-type-options');
-        done();
-      });
+      .expect(utils.shouldNotHaveHeader('X-Content-Type-Options'))
+      .expect(200, '{"hello":"world"}', done);
     })
 
     it('should override previous Content-Types with callback', function(done){
diff --git a/test/res.location.js b/test/res.location.js
index 6481160174a..2b42bf358d4 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -13,10 +13,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.headers.should.have.property('location', 'http://google.com');
-        done();
-      })
+      .expect('Location', 'http://google.com')
+      .expect(200, done)
     })
   })
 })
diff --git a/test/res.redirect.js b/test/res.redirect.js
index 7ebc1ef01dc..8511c40f2ab 100644
--- a/test/res.redirect.js
+++ b/test/res.redirect.js
@@ -2,6 +2,7 @@
 var http = require('http');
 var express = require('..');
 var request = require('supertest');
+var utils = require('./support/utils');
 
 describe('res', function(){
   describe('.redirect(url)', function(){
@@ -29,11 +30,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.statusCode.should.equal(303);
-        res.headers.should.have.property('location', 'http://google.com');
-        done();
-      })
+      .expect('Location', 'http://google.com')
+      .expect(303, done)
     })
   })
 
@@ -47,11 +45,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.statusCode.should.equal(303);
-        res.headers.should.have.property('location', 'http://google.com');
-        done();
-      })
+      .expect('Location', 'http://google.com')
+      .expect(303, done)
     })
   })
 
@@ -65,11 +60,8 @@ describe('res', function(){
 
       request(app)
       .head('/')
-      .end(function(err, res){
-        res.headers.should.have.property('location', 'http://google.com');
-        res.text.should.equal('');
-        done();
-      })
+      .expect('Location', 'http://google.com')
+      .expect(302, '', done)
     })
   })
 
@@ -182,11 +174,8 @@ describe('res', function(){
       .set('Accept', 'application/octet-stream')
       .expect('location', 'http://google.com')
       .expect('content-length', '0')
-      .expect(302, '', function(err, res){
-        if (err) return done(err)
-        res.headers.should.not.have.property('content-type');
-        done();
-      })
+      .expect(utils.shouldNotHaveHeader('Content-Type'))
+      .expect(302, '', done)
     })
   })
 })
diff --git a/test/res.send.js b/test/res.send.js
index 6eafb944966..719424657c4 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -3,6 +3,7 @@ var assert = require('assert');
 var express = require('..');
 var methods = require('methods');
 var request = require('supertest');
+var utils = require('./support/utils');
 
 describe('res', function(){
   describe('.send()', function(){
@@ -118,12 +119,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.headers.should.have.property('content-type', 'text/html; charset=utf-8');
-        res.text.should.equal('<p>hey</p>');
-        res.statusCode.should.equal(200);
-        done();
-      })
+      .expect('Content-Type', 'text/html; charset=utf-8')
+      .expect(200, '<p>hey</p>', done);
     })
 
     it('should set ETag', function (done) {
@@ -190,12 +187,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.headers.should.have.property('content-type', 'application/octet-stream');
-        res.text.should.equal('hello');
-        res.statusCode.should.equal(200);
-        done();
-      })
+      .expect('Content-Type', 'application/octet-stream')
+      .expect(200, 'hello', done);
     })
 
     it('should set ETag', function (done) {
@@ -221,12 +214,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.headers.should.have.property('content-type', 'text/plain; charset=utf-8');
-        res.text.should.equal('hey');
-        res.statusCode.should.equal(200);
-        done();
-      })
+      .expect('Content-Type', 'text/plain; charset=utf-8')
+      .expect(200, 'hey', done);
     })
   })
 
@@ -269,13 +258,10 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.headers.should.not.have.property('content-type');
-        res.headers.should.not.have.property('content-length');
-        res.headers.should.not.have.property('transfer-encoding');
-        res.text.should.equal('');
-        done();
-      })
+      .expect(utils.shouldNotHaveHeader('Content-Type'))
+      .expect(utils.shouldNotHaveHeader('Content-Length'))
+      .expect(utils.shouldNotHaveHeader('Transfer-Encoding'))
+      .expect(204, '', done);
     })
   })
 
@@ -289,13 +275,10 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        res.headers.should.not.have.property('content-type');
-        res.headers.should.not.have.property('content-length');
-        res.headers.should.not.have.property('transfer-encoding');
-        res.text.should.equal('');
-        done();
-      })
+      .expect(utils.shouldNotHaveHeader('Content-Type'))
+      .expect(utils.shouldNotHaveHeader('Content-Length'))
+      .expect(utils.shouldNotHaveHeader('Transfer-Encoding'))
+      .expect(304, '', done);
     })
   })
 
@@ -451,7 +434,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect(shouldNotHaveHeader('ETag'))
+        .expect(utils.shouldNotHaveHeader('ETag'))
         .expect(200, done);
       })
     });
@@ -469,7 +452,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect(shouldNotHaveHeader('ETag'))
+        .expect(utils.shouldNotHaveHeader('ETag'))
         .expect(200, done);
       });
 
@@ -559,15 +542,9 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect(shouldNotHaveHeader('ETag'))
+        .expect(utils.shouldNotHaveHeader('ETag'))
         .expect(200, done);
       })
     })
   })
 })
-
-function shouldNotHaveHeader(header) {
-  return function (res) {
-    assert.ok(!(header.toLowerCase() in res.headers), 'should not have header ' + header)
-  }
-}
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index f4868b39766..78013a50ebd 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -7,6 +7,7 @@ var onFinished = require('on-finished');
 var path = require('path');
 var should = require('should');
 var fixtures = path.join(__dirname, 'fixtures');
+var utils = require('./support/utils');
 
 describe('res', function(){
   describe('.sendFile(path)', function () {
@@ -154,11 +155,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect(404, function (err, res) {
-          if (err) return done(err);
-          res.headers.should.not.have.property('x-success');
-          done();
-        });
+        .expect(utils.shouldNotHaveHeader('X-Success'))
+        .expect(404, done);
       });
     });
 
@@ -509,11 +507,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect(404, function (err, res) {
-        if (err) return done(err);
-        res.headers.should.not.have.property('x-success');
-        done();
-      });
+        .expect(utils.shouldNotHaveHeader('X-Success'))
+        .expect(404, done);
     })
 
     it('should transfer a file', function (done) {
@@ -595,11 +590,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.text.should.equal('<p>{{user.name}}</p>');
-          res.headers.should.have.property('content-type', 'text/html; charset=UTF-8');
-          done();
-        });
+        .expect('Content-Type', 'text/html; charset=UTF-8')
+        .expect(200, '<p>{{user.name}}</p>', done);
       })
     })
 
@@ -613,11 +605,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.text.should.equal('<p>{{user.name}}</p>');
-          res.headers.should.have.property('content-type', 'text/html; charset=UTF-8');
-          done();
-        });
+        .expect('Content-Type', 'text/html; charset=UTF-8')
+        .expect(200, '<p>{{user.name}}</p>', done);
       })
 
       it('should serve relative to "root"', function(done){
@@ -629,11 +618,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          res.text.should.equal('<p>{{user.name}}</p>');
-          res.headers.should.have.property('content-type', 'text/html; charset=UTF-8');
-          done();
-        });
+        .expect('Content-Type', 'text/html; charset=UTF-8')
+        .expect(200, '<p>{{user.name}}</p>', done);
       })
 
       it('should consider ../ malicious when "root" is not set', function(done){
diff --git a/test/res.vary.js b/test/res.vary.js
index 13c3af2bb70..9a2edd24c09 100644
--- a/test/res.vary.js
+++ b/test/res.vary.js
@@ -2,6 +2,7 @@
 var assert = require('assert');
 var express = require('..');
 var request = require('supertest');
+var utils = require('./support/utils');
 
 describe('res.vary()', function(){
   describe('with no arguments', function(){
@@ -15,7 +16,7 @@ describe('res.vary()', function(){
 
       request(app)
       .get('/')
-      .expect(shouldNotHaveHeader('Vary'))
+      .expect(utils.shouldNotHaveHeader('Vary'))
       .expect(200, done);
     })
   })
@@ -31,7 +32,7 @@ describe('res.vary()', function(){
 
       request(app)
       .get('/')
-      .expect(shouldNotHaveHeader('Vary'))
+      .expect(utils.shouldNotHaveHeader('Vary'))
       .expect(200, done);
     })
   })
@@ -88,9 +89,3 @@ describe('res.vary()', function(){
     })
   })
 })
-
-function shouldNotHaveHeader(header) {
-  return function (res) {
-    assert.ok(!(header.toLowerCase() in res.headers), 'should not have header ' + header);
-  };
-}
diff --git a/test/support/utils.js b/test/support/utils.js
new file mode 100644
index 00000000000..ec6b801bc09
--- /dev/null
+++ b/test/support/utils.js
@@ -0,0 +1,24 @@
+
+/**
+ * Module dependencies.
+ * @private
+ */
+var assert = require('assert');
+
+/**
+ * Module exports.
+ * @public
+ */
+exports.shouldNotHaveHeader = shouldNotHaveHeader;
+
+/**
+ * Assert that a supertest response does not have a header.
+ *
+ * @param {string} header Header name to check
+ * @returns {function}
+ */
+function shouldNotHaveHeader(header) {
+  return function (res) {
+    assert.ok(!(header.toLowerCase() in res.headers), 'should not have header ' + header);
+  };
+}

From 3d56e7374d7d1e812c7851eacb7593bd41963a23 Mon Sep 17 00:00:00 2001
From: Rand McKinney <rmckinn@us.ibm.com>
Date: Thu, 12 May 2016 14:18:43 -0700
Subject: [PATCH 0944/1265] docs: update location of expressjs.com repo

closes #2995
---
 Collaborator-Guide.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Collaborator-Guide.md b/Collaborator-Guide.md
index 84c5b9ccef6..abbfc109429 100644
--- a/Collaborator-Guide.md
+++ b/Collaborator-Guide.md
@@ -1,7 +1,7 @@
 
 ## Website Issues
 
-Issues for the expressjs.com website go here https://github.com/strongloop/expressjs.com
+Open issues for the expressjs.com website in https://github.com/expressjs/expressjs.com.
 
 ## PRs and Code contributions
 
@@ -16,8 +16,8 @@ Issues for the expressjs.com website go here https://github.com/strongloop/expre
 
 ## Steps for contributing
 
-* [Create an issue](https://github.com/strongloop/express/issues/new) for the bug you want to fix or the feature that you want to add.
-* Create your own [fork](https://github.com/strongloop/express) on github, then checkout your fork.
+* [Create an issue](https://github.com/expressjs/express/issues/new) for the bug you want to fix or the feature that you want to add.
+* Create your own [fork](https://github.com/expressjs/express) on github, then checkout your fork.
 * Write your code in your local copy. It's good practice to create a branch for each new issue you work on, although not compulsory.
 * To run the test suite, first install the dependencies by running `npm install`, then run `npm test`.
 * If the tests pass, you can commit your changes to your fork and then create a pull request from there. Make sure to reference your issue from the pull request comments by including the issue number e.g. #123.

From 741a5aac9cf287ce4072e3e458c2bbaab0bca355 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 23 May 2016 22:12:31 -0400
Subject: [PATCH 0945/1265] build: cache node_modules on CI

---
 .travis.yml  | 11 ++++++++++-
 appveyor.yml |  4 ++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 53b5041a6b4..38998527547 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,6 +7,15 @@ node_js:
   - "3.3"
   - "4.4"
 sudo: false
-before_install: "npm rm --save-dev connect-redis"
+cache:
+  directories:
+    - node_modules
+before_install:
+  # Remove all non-test dependencies
+  - "npm rm --save-dev connect-redis"
+
+  # Update Node.js modules
+  - "test ! -d node_modules || npm prune"
+  - "test ! -d node_modules || npm rebuild"
 script: "npm run-script test-ci"
 after_script: "npm install coveralls@2.10.0 && cat ./coverage/lcov.info | coveralls"
diff --git a/appveyor.yml b/appveyor.yml
index 4484e8224c1..ce5e52ff1b9 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -6,9 +6,13 @@ environment:
     - nodejs_version: "2.5"
     - nodejs_version: "3.3"
     - nodejs_version: "4.4"
+cache:
+  - node_modules
 install:
   - ps: Install-Product node $env:nodejs_version
   - npm rm --save-dev connect-redis
+  - if exist node_modules npm prune
+  - if exist node_modules npm rebuild
   - npm install
 build: off
 test_script:

From 20a25489de13f3726d68c606411861a73acfa6b5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 23 May 2016 22:39:59 -0400
Subject: [PATCH 0946/1265] build: ejs@2.4.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 0b0e791d1f5..5f90cc4e9f8 100644
--- a/package.json
+++ b/package.json
@@ -55,7 +55,7 @@
   },
   "devDependencies": {
     "after": "0.8.1",
-    "ejs": "2.3.4",
+    "ejs": "2.4.1",
     "istanbul": "0.4.2",
     "marked": "0.3.5",
     "mocha": "2.3.4",

From 992cd085fb4af69ec838d42b3f51d44c9d852968 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 23 May 2016 22:41:26 -0400
Subject: [PATCH 0947/1265] build: istanbul@0.4.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 5f90cc4e9f8..6f950674682 100644
--- a/package.json
+++ b/package.json
@@ -56,7 +56,7 @@
   "devDependencies": {
     "after": "0.8.1",
     "ejs": "2.4.1",
-    "istanbul": "0.4.2",
+    "istanbul": "0.4.3",
     "marked": "0.3.5",
     "mocha": "2.3.4",
     "should": "7.1.1",

From d7ae24228dbce8d8e384aa9f9e054fc24d4309eb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 23 May 2016 22:44:48 -0400
Subject: [PATCH 0948/1265] build: mocha@2.5.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 6f950674682..c9ddea9d261 100644
--- a/package.json
+++ b/package.json
@@ -58,7 +58,7 @@
     "ejs": "2.4.1",
     "istanbul": "0.4.3",
     "marked": "0.3.5",
-    "mocha": "2.3.4",
+    "mocha": "2.5.1",
     "should": "7.1.1",
     "supertest": "1.1.0",
     "body-parser": "~1.14.2",

From fd48bfe8fe0f8d0cfd3c58475bb89deabb9edb36 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 23 May 2016 22:47:25 -0400
Subject: [PATCH 0949/1265] build: should@8.4.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index c9ddea9d261..404a3dea739 100644
--- a/package.json
+++ b/package.json
@@ -59,7 +59,7 @@
     "istanbul": "0.4.3",
     "marked": "0.3.5",
     "mocha": "2.5.1",
-    "should": "7.1.1",
+    "should": "8.4.0",
     "supertest": "1.1.0",
     "body-parser": "~1.14.2",
     "connect-redis": "~2.4.1",

From e3dd191d54a0a4adfb906af4b12e5fdc4627a2d3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 23 May 2016 23:00:43 -0400
Subject: [PATCH 0950/1265] examples: escape HTML in markdown example

---
 examples/markdown/index.js | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/examples/markdown/index.js b/examples/markdown/index.js
index db2f16fb482..430628701fd 100644
--- a/examples/markdown/index.js
+++ b/examples/markdown/index.js
@@ -2,9 +2,10 @@
  * Module dependencies.
  */
 
+var escapeHtml = require('escape-html');
 var express = require('../..');
 var fs = require('fs');
-var md = require('marked').parse;
+var marked = require('marked');
 
 var app = module.exports = express();
 
@@ -13,15 +14,10 @@ var app = module.exports = express();
 app.engine('md', function(path, options, fn){
   fs.readFile(path, 'utf8', function(err, str){
     if (err) return fn(err);
-    try {
-      var html = md(str);
-      html = html.replace(/\{([^}]+)\}/g, function(_, name){
-        return options[name] || '';
-      });
-      fn(null, html);
-    } catch(err) {
-      fn(err);
-    }
+    var html = marked.parse(str).replace(/\{([^}]+)\}/g, function(_, name){
+      return escapeHtml(options[name] || '');
+    });
+    fn(null, html);
   });
 });
 

From 31dd549f350accd7b4e3685c13f745e857557827 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 23 May 2016 23:03:13 -0400
Subject: [PATCH 0951/1265] tests: add test for dispatching to empty route

---
 test/Route.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/test/Route.js b/test/Route.js
index c979fb110c6..ada54086bf0 100644
--- a/test/Route.js
+++ b/test/Route.js
@@ -7,6 +7,11 @@ var express = require('../')
   , assert = require('assert');
 
 describe('Route', function(){
+  it('should work without handlers', function(done) {
+    var req = { method: 'GET', url: '/' }
+    var route = new Route('/foo')
+    route.dispatch(req, {}, done)
+  })
 
   describe('.all', function(){
     it('should add handler', function(done){

From e5502690d2db1b2ca9f78d0025176b29d834c3ba Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 23 May 2016 23:15:52 -0400
Subject: [PATCH 0952/1265] deps: accepts@~1.3.3

---
 History.md   | 11 +++++++++++
 package.json |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c72241b98d5..562e7214a4b 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,14 @@
+unreleased
+==========
+
+  * deps: accepts@~1.3.3
+    - Fix including type extensions in parameters in `Accept` parsing
+    - Fix parsing `Accept` parameters with quoted equals
+    - Fix parsing `Accept` parameters with quoted semicolons
+    - Many performance improvments
+    - deps: mime-types@~2.1.11
+    - deps: negotiator@0.6.1
+
 4.13.4 / 2016-01-21
 ===================
 
diff --git a/package.json b/package.json
index 404a3dea739..dc21ce4f673 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.2.12",
+    "accepts": "~1.3.3",
     "array-flatten": "1.1.1",
     "content-disposition": "0.5.1",
     "content-type": "~1.0.1",

From 2cf830b29e7260afe1e414a80850a014556ba429 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 23 May 2016 23:18:41 -0400
Subject: [PATCH 0953/1265] deps: content-type@~1.0.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 562e7214a4b..a88d5a76e17 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,8 @@ unreleased
     - Many performance improvments
     - deps: mime-types@~2.1.11
     - deps: negotiator@0.6.1
+  * deps: content-type@~1.0.2
+    - perf: enable strict mode
 
 4.13.4 / 2016-01-21
 ===================
diff --git a/package.json b/package.json
index dc21ce4f673..278adfa0f6b 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "accepts": "~1.3.3",
     "array-flatten": "1.1.1",
     "content-disposition": "0.5.1",
-    "content-type": "~1.0.1",
+    "content-type": "~1.0.2",
     "cookie": "0.1.5",
     "cookie-signature": "1.0.6",
     "debug": "~2.2.0",

From 76c56d1ab88dd253e90b39e621dcef20219a7204 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 29 May 2016 14:25:27 -0400
Subject: [PATCH 0954/1265] deps: vary@~1.1.0

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a88d5a76e17..7e4b0571f53 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,8 @@ unreleased
     - deps: negotiator@0.6.1
   * deps: content-type@~1.0.2
     - perf: enable strict mode
+  * deps: vary@~1.1.0
+    - Only accept valid field names in the `field` argument
 
 4.13.4 / 2016-01-21
 ===================
diff --git a/package.json b/package.json
index 278adfa0f6b..4a9101ebc59 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
     "serve-static": "~1.10.2",
     "type-is": "~1.6.6",
     "utils-merge": "1.0.0",
-    "vary": "~1.0.1"
+    "vary": "~1.1.0"
   },
   "devDependencies": {
     "after": "0.8.1",

From bdf604a77e8bab6c7f47e85eca77c21b84d5b33e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 31 May 2016 00:08:16 -0400
Subject: [PATCH 0955/1265] deps: cookie@0.3.1

---
 History.md   | 11 +++++++++++
 package.json |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 7e4b0571f53..347b4d9607c 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,17 @@ unreleased
     - deps: negotiator@0.6.1
   * deps: content-type@~1.0.2
     - perf: enable strict mode
+  * deps: cookie@0.3.1
+    - Add `sameSite` option
+    - Fix cookie `Max-Age` to never be a floating point number
+    - Improve error message when `encode` is not a function
+    - Improve error message when `expires` is not a `Date`
+    - Throw better error for invalid argument to parse
+    - Throw on invalid values provided to `serialize`
+    - perf: enable strict mode
+    - perf: hoist regular expression
+    - perf: use for loop in parse
+    - perf: use string concatination for serialization
   * deps: vary@~1.1.0
     - Only accept valid field names in the `field` argument
 
diff --git a/package.json b/package.json
index 4a9101ebc59..0202c782265 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,7 @@
     "array-flatten": "1.1.1",
     "content-disposition": "0.5.1",
     "content-type": "~1.0.2",
-    "cookie": "0.1.5",
+    "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "debug": "~2.2.0",
     "depd": "~1.1.0",

From c6039af39d6bc50edfbdd7c822c79e97ba86fc4f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 31 May 2016 00:12:54 -0400
Subject: [PATCH 0956/1265] deps: proxy-addr@~1.1.2

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 347b4d9607c..9aa6b0acc03 100644
--- a/History.md
+++ b/History.md
@@ -21,6 +21,12 @@ unreleased
     - perf: hoist regular expression
     - perf: use for loop in parse
     - perf: use string concatination for serialization
+  * deps: proxy-addr@~1.1.2
+    - Fix accepting various invalid netmasks
+    - Fix IPv6-mapped IPv4 validation edge cases
+    - IPv4 netmasks must be contingous
+    - IPv6 addresses cannot be used as a netmask
+    - deps: ipaddr.js@1.1.1
   * deps: vary@~1.1.0
     - Only accept valid field names in the `field` argument
 
diff --git a/package.json b/package.json
index 0202c782265..1206e08e991 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.1",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~1.0.10",
+    "proxy-addr": "~1.1.2",
     "qs": "4.0.0",
     "range-parser": "~1.0.3",
     "send": "0.13.1",

From b69b7605b07b41273acc931d25ab585377bcd107 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=81ngel=20Sanz?= <angelsanzgit@gmail.com>
Date: Mon, 3 Aug 2015 23:21:38 +0200
Subject: [PATCH 0957/1265] perf: use strict equality when possible

closes #2722
---
 History.md          | 1 +
 lib/request.js      | 6 +++---
 lib/response.js     | 2 +-
 lib/router/index.js | 2 +-
 lib/utils.js        | 8 ++++----
 5 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/History.md b/History.md
index 9aa6b0acc03..764974d0788 100644
--- a/History.md
+++ b/History.md
@@ -29,6 +29,7 @@ unreleased
     - deps: ipaddr.js@1.1.1
   * deps: vary@~1.1.0
     - Only accept valid field names in the `field` argument
+  * perf: use strict equality when possible
 
 4.13.4 / 2016-01-21
 ===================
diff --git a/lib/request.js b/lib/request.js
index 33cac180ed7..4fdc279ebcb 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -303,7 +303,7 @@ defineGetter(req, 'protocol', function protocol(){
 /**
  * Short-hand for:
  *
- *    req.protocol == 'https'
+ *    req.protocol === 'https'
  *
  * @return {Boolean}
  * @public
@@ -437,10 +437,10 @@ defineGetter(req, 'fresh', function(){
   var s = this.res.statusCode;
 
   // GET or HEAD for weak freshness validation only
-  if ('GET' != method && 'HEAD' != method) return false;
+  if ('GET' !== method && 'HEAD' !== method) return false;
 
   // 2xx or 304 as per rfc2616 14.26
-  if ((s >= 200 && s < 300) || 304 == s) {
+  if ((s >= 200 && s < 300) || 304 === s) {
     return fresh(this.headers, (this.res._headers || {}));
   }
 
diff --git a/lib/response.js b/lib/response.js
index e813c52ec1e..b93459cff56 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -189,7 +189,7 @@ res.send = function send(body) {
   if (req.fresh) this.statusCode = 304;
 
   // strip irrelevant headers
-  if (204 == this.statusCode || 304 == this.statusCode) {
+  if (204 === this.statusCode || 304 === this.statusCode) {
     this.removeHeader('Content-Type');
     this.removeHeader('Content-Length');
     this.removeHeader('Transfer-Encoding');
diff --git a/lib/router/index.js b/lib/router/index.js
index 504ed9ce0ee..dac2514815b 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -119,7 +119,7 @@ proto.param = function param(name, fn) {
 
   // ensure we end up with a
   // middleware function
-  if ('function' != typeof fn) {
+  if ('function' !== typeof fn) {
     throw new Error('invalid param() call for ' + name + ', got ' + fn);
   }
 
diff --git a/lib/utils.js b/lib/utils.js
index 3d54247ad28..465b31f5367 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -66,9 +66,9 @@ exports.wetag = function wetag(body, encoding){
  */
 
 exports.isAbsolute = function(path){
-  if ('/' == path[0]) return true;
-  if (':' == path[1] && '\\' == path[2]) return true;
-  if ('\\\\' == path.substring(0, 2)) return true; // Microsoft Azure absolute path
+  if ('/' === path[0]) return true;
+  if (':' === path[1] && '\\' === path[2]) return true;
+  if ('\\\\' === path.substring(0, 2)) return true; // Microsoft Azure absolute path
 };
 
 /**
@@ -142,7 +142,7 @@ function acceptParams(str, index) {
 
   for (var i = 1; i < parts.length; ++i) {
     var pms = parts[i].split(/ *= */);
-    if ('q' == pms[0]) {
+    if ('q' === pms[0]) {
       ret.quality = parseFloat(pms[1]);
     } else {
       ret.params[pms[0]] = pms[1];

From f90f9dde3fe02cd9f4b081c16441415817b297b0 Mon Sep 17 00:00:00 2001
From: Benjamin Tan <demoneaux@gmail.com>
Date: Mon, 22 Feb 2016 06:22:35 +0800
Subject: [PATCH 0958/1265] Improve performance for res.json/res.jsonp in most
 cases

closes #2900
---
 History.md      |  1 +
 lib/response.js | 17 +++++++++++++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 764974d0788..6d1eb43643b 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Improve performance for `res.json`/`res.jsonp` in most cases
   * deps: accepts@~1.3.3
     - Fix including type extensions in parameters in `Accept` parsing
     - Fix parsing `Accept` parameters with quoted equals
diff --git a/lib/response.js b/lib/response.js
index b93459cff56..ad502ad8b58 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -239,7 +239,7 @@ res.json = function json(obj) {
   var app = this.app;
   var replacer = app.get('json replacer');
   var spaces = app.get('json spaces');
-  var body = JSON.stringify(val, replacer, spaces);
+  var body = stringify(val, replacer, spaces);
 
   // content-type
   if (!this.get('Content-Type')) {
@@ -281,7 +281,7 @@ res.jsonp = function jsonp(obj) {
   var app = this.app;
   var replacer = app.get('json replacer');
   var spaces = app.get('json spaces');
-  var body = JSON.stringify(val, replacer, spaces);
+  var body = stringify(val, replacer, spaces);
   var callback = this.req.query[app.get('jsonp callback name')];
 
   // content-type
@@ -1051,3 +1051,16 @@ function sendfile(res, file, options, callback) {
   // pipe
   file.pipe(res);
 }
+
+/**
+ * Stringify JSON, like JSON.stringify, but v8 optimized.
+ * @private
+ */
+
+function stringify(value, replacer, spaces) {
+  // v8 checks arguments.length for optimizing simple call
+  // https://bugs.chromium.org/p/v8/issues/detail?id=4730
+  return replacer || spaces
+    ? JSON.stringify(value, replacer, spaces)
+    : JSON.stringify(value);
+}

From cc25a04d10aace04addb1f4a4a53611f364b86c5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 31 May 2016 14:25:41 -0400
Subject: [PATCH 0959/1265] deps: type-is@~1.6.13

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 6d1eb43643b..5fd9623b6c8 100644
--- a/History.md
+++ b/History.md
@@ -28,6 +28,9 @@ unreleased
     - IPv4 netmasks must be contingous
     - IPv6 addresses cannot be used as a netmask
     - deps: ipaddr.js@1.1.1
+  * deps: type-is@~1.6.13
+    - Fix type error when given invalid type to match against
+    - deps: mime-types@~2.1.11
   * deps: vary@~1.1.0
     - Only accept valid field names in the `field` argument
   * perf: use strict equality when possible
diff --git a/package.json b/package.json
index 1206e08e991..8a35cdece25 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "range-parser": "~1.0.3",
     "send": "0.13.1",
     "serve-static": "~1.10.2",
-    "type-is": "~1.6.6",
+    "type-is": "~1.6.13",
     "utils-merge": "1.0.0",
     "vary": "~1.1.0"
   },

From 999546dfdeb874c20b360ad58346ed07917f3ac0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 31 May 2016 14:28:20 -0400
Subject: [PATCH 0960/1265] deps: qs@6.2.0

---
 History.md              |  2 ++
 lib/middleware/query.js | 11 +++--------
 lib/utils.js            |  1 -
 package.json            |  2 +-
 4 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/History.md b/History.md
index 5fd9623b6c8..ddb0c9a7e8a 100644
--- a/History.md
+++ b/History.md
@@ -28,6 +28,8 @@ unreleased
     - IPv4 netmasks must be contingous
     - IPv6 addresses cannot be used as a netmask
     - deps: ipaddr.js@1.1.1
+  * deps: qs@6.2.0
+    - Add `decoder` option in `parse` function
   * deps: type-is@~1.6.13
     - Fix type error when given invalid type to match against
     - deps: mime-types@~2.1.11
diff --git a/lib/middleware/query.js b/lib/middleware/query.js
index a665f3f1431..5f76f8458f0 100644
--- a/lib/middleware/query.js
+++ b/lib/middleware/query.js
@@ -30,14 +30,9 @@ module.exports = function query(options) {
     opts = undefined;
   }
 
-  if (opts !== undefined) {
-    if (opts.allowDots === undefined) {
-      opts.allowDots = false;
-    }
-
-    if (opts.allowPrototypes === undefined) {
-      opts.allowPrototypes = true;
-    }
+  if (opts !== undefined && opts.allowPrototypes === undefined) {
+    // back-compat for qs module
+    opts.allowPrototypes = true;
   }
 
   return function query(req, res, next){
diff --git a/lib/utils.js b/lib/utils.js
index 465b31f5367..c2d3af1d620 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -283,7 +283,6 @@ exports.setCharset = function setCharset(type, charset) {
 
 function parseExtendedQueryString(str) {
   return qs.parse(str, {
-    allowDots: false,
     allowPrototypes: true
   });
 }
diff --git a/package.json b/package.json
index 8a35cdece25..2478c634926 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "parseurl": "~1.3.1",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~1.1.2",
-    "qs": "4.0.0",
+    "qs": "6.2.0",
     "range-parser": "~1.0.3",
     "send": "0.13.1",
     "serve-static": "~1.10.2",

From 2e1284beb6210444932d050b9d31d3908afb7591 Mon Sep 17 00:00:00 2001
From: huaoguo <huaoguo@gmail.com>
Date: Wed, 1 Jun 2016 12:56:27 +0800
Subject: [PATCH 0961/1265] Fix Windows absolute path check using forward
 slashes

closes #3017
---
 History.md    | 1 +
 lib/utils.js  | 2 +-
 test/utils.js | 1 +
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ddb0c9a7e8a..d1a248ec18e 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix Windows absolute path check using forward slashes
   * Improve performance for `res.json`/`res.jsonp` in most cases
   * deps: accepts@~1.3.3
     - Fix including type extensions in parameters in `Accept` parsing
diff --git a/lib/utils.js b/lib/utils.js
index c2d3af1d620..f418c5807c7 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -67,7 +67,7 @@ exports.wetag = function wetag(body, encoding){
 
 exports.isAbsolute = function(path){
   if ('/' === path[0]) return true;
-  if (':' === path[1] && '\\' === path[2]) return true;
+  if (':' === path[1] && ('\\' === path[2] || '/' === path[2])) return true; // Windows device path
   if ('\\\\' === path.substring(0, 2)) return true; // Microsoft Azure absolute path
 };
 
diff --git a/test/utils.js b/test/utils.js
index b7e8b520091..b6731962601 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -73,6 +73,7 @@ describe('utils.wetag(body, encoding)', function(){
 describe('utils.isAbsolute()', function(){
   it('should support windows', function(){
     assert(utils.isAbsolute('c:\\'));
+    assert(utils.isAbsolute('c:/'));
     assert(!utils.isAbsolute(':\\'));
   })
 

From 98224d2c4f60708dcd6cb43bc50654ab804665d2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Jun 2016 17:22:15 -0400
Subject: [PATCH 0962/1265] build: ejs@2.4.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 2478c634926..ba3e9c8cb68 100644
--- a/package.json
+++ b/package.json
@@ -55,7 +55,7 @@
   },
   "devDependencies": {
     "after": "0.8.1",
-    "ejs": "2.4.1",
+    "ejs": "2.4.2",
     "istanbul": "0.4.3",
     "marked": "0.3.5",
     "mocha": "2.5.1",

From c9531ac1f19a2bab4af819bfab6cb6dfab49e101 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Jun 2016 17:24:08 -0400
Subject: [PATCH 0963/1265] build: mocha@2.5.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ba3e9c8cb68..1c6d1ae0d7c 100644
--- a/package.json
+++ b/package.json
@@ -58,7 +58,7 @@
     "ejs": "2.4.2",
     "istanbul": "0.4.3",
     "marked": "0.3.5",
-    "mocha": "2.5.1",
+    "mocha": "2.5.3",
     "should": "8.4.0",
     "supertest": "1.1.0",
     "body-parser": "~1.14.2",

From d03868965858af94a712fbd4ad68827023199462 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Jun 2016 17:27:06 -0400
Subject: [PATCH 0964/1265] build: should@9.0.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 1c6d1ae0d7c..141f12c76f1 100644
--- a/package.json
+++ b/package.json
@@ -59,7 +59,7 @@
     "istanbul": "0.4.3",
     "marked": "0.3.5",
     "mocha": "2.5.3",
-    "should": "8.4.0",
+    "should": "9.0.0",
     "supertest": "1.1.0",
     "body-parser": "~1.14.2",
     "connect-redis": "~2.4.1",

From 8ddab697cc1d7b4c3d6d24b8e265be116ddccc0b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Jun 2016 17:31:10 -0400
Subject: [PATCH 0965/1265] build: supertest@1.2.0

---
 package.json      | 2 +-
 test/req.query.js | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 141f12c76f1..1af28db9801 100644
--- a/package.json
+++ b/package.json
@@ -60,7 +60,7 @@
     "marked": "0.3.5",
     "mocha": "2.5.3",
     "should": "9.0.0",
-    "supertest": "1.1.0",
+    "supertest": "1.2.0",
     "body-parser": "~1.14.2",
     "connect-redis": "~2.4.1",
     "cookie-parser": "~1.4.1",
diff --git a/test/req.query.js b/test/req.query.js
index 19151411995..d3d29abd16d 100644
--- a/test/req.query.js
+++ b/test/req.query.js
@@ -43,7 +43,7 @@ describe('req', function(){
         var app = createApp('simple');
 
         request(app)
-        .get('/?user[name]=tj')
+        .get('/?user%5Bname%5D=tj')
         .expect(200, '{"user[name]":"tj"}', done);
       });
     });
@@ -55,7 +55,7 @@ describe('req', function(){
         });
 
         request(app)
-        .get('/?user[name]=tj')
+        .get('/?user%5Bname%5D=tj')
         .expect(200, '{"length":17}', done);
       });
     });
@@ -65,7 +65,7 @@ describe('req', function(){
         var app = createApp(false);
 
         request(app)
-        .get('/?user[name]=tj')
+        .get('/?user%5Bname%5D=tj')
         .expect(200, '{}', done);
       });
     });
@@ -75,7 +75,7 @@ describe('req', function(){
         var app = createApp(true);
 
         request(app)
-        .get('/?user[name]=tj')
+        .get('/?user%5Bname%5D=tj')
         .expect(200, '{"user[name]":"tj"}', done);
       });
     });

From 7ee41cc23f2f7237ad8e3b1cfbad03900f14314d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Jun 2016 18:54:11 -0400
Subject: [PATCH 0966/1265] deps: range-parser@~1.2.0

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index d1a248ec18e..77552f8411f 100644
--- a/History.md
+++ b/History.md
@@ -31,6 +31,10 @@ unreleased
     - deps: ipaddr.js@1.1.1
   * deps: qs@6.2.0
     - Add `decoder` option in `parse` function
+  * deps: range-parser@~1.2.0
+    - Add `combine` option to combine overlapping ranges
+    - Fix incorrectly returning -1 when there is at least one valid range
+    - perf: remove internal function
   * deps: type-is@~1.6.13
     - Fix type error when given invalid type to match against
     - deps: mime-types@~2.1.11
diff --git a/package.json b/package.json
index 1af28db9801..303524a3e5c 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~1.1.2",
     "qs": "6.2.0",
-    "range-parser": "~1.0.3",
+    "range-parser": "~1.2.0",
     "send": "0.13.1",
     "serve-static": "~1.10.2",
     "type-is": "~1.6.13",

From 7fcf1d7d5b021d4c285f377d99e0d40dbf26a9b1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Jun 2016 19:04:02 -0400
Subject: [PATCH 0967/1265] docs: update the req.range jsdoc comment

---
 lib/request.js | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/lib/request.js b/lib/request.js
index 4fdc279ebcb..17eb47c33c7 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -171,26 +171,26 @@ req.acceptsLanguage = deprecate.function(req.acceptsLanguages,
   'req.acceptsLanguage: Use acceptsLanguages instead');
 
 /**
- * Parse Range header field,
- * capping to the given `size`.
+ * Parse Range header field, capping to the given `size`.
  *
- * Unspecified ranges such as "0-" require
- * knowledge of your resource length. In
- * the case of a byte range this is of course
- * the total number of bytes. If the Range
- * header field is not given `null` is returned,
- * `-1` when unsatisfiable, `-2` when syntactically invalid.
+ * Unspecified ranges such as "0-" require knowledge of your resource length. In
+ * the case of a byte range this is of course the total number of bytes. If the
+ * Range header field is not given `undefined` is returned, `-1` when unsatisfiable,
+ * and `-2` when syntactically invalid.
  *
- * NOTE: remember that ranges are inclusive, so
- * for example "Range: users=0-3" should respond
- * with 4 users when available, not 3.
+ * When ranges are returned, the array has a "type" property which is the type of
+ * range that is required (most commonly, "bytes"). Each array element is an object
+ * with a "start" and "end" property for the portion of the range.
  *
- * @param {Number} size
- * @return {Array}
+ * NOTE: remember that ranges are inclusive, so for example "Range: users=0-3"
+ * should respond with 4 users when available, not 3.
+ *
+ * @param {number} size
+ * @return {number|array}
  * @public
  */
 
-req.range = function(size){
+req.range = function range(size) {
   var range = this.get('Range');
   if (!range) return;
   return parseRange(size, range);

From 5d642af8c34c49b54b1ea2f9a300440ec5656fef Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Jun 2016 19:13:36 -0400
Subject: [PATCH 0968/1265] Add "options" argument to req.range

---
 History.md        |  2 ++
 lib/request.js    |  9 +++++++--
 test/req.range.js | 16 +++++++++++++---
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index 77552f8411f..a184efbf8a9 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,8 @@
 unreleased
 ==========
 
+  * Add `options` argument to `req.range`
+    - Includes the `combine` option
   * Fix Windows absolute path check using forward slashes
   * Improve performance for `res.json`/`res.jsonp` in most cases
   * deps: accepts@~1.3.3
diff --git a/lib/request.js b/lib/request.js
index 17eb47c33c7..ef0e101a001 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -182,18 +182,23 @@ req.acceptsLanguage = deprecate.function(req.acceptsLanguages,
  * range that is required (most commonly, "bytes"). Each array element is an object
  * with a "start" and "end" property for the portion of the range.
  *
+ * The "combine" option can be set to `true` and overlapping & adjacent ranges
+ * will be combined into a single range.
+ *
  * NOTE: remember that ranges are inclusive, so for example "Range: users=0-3"
  * should respond with 4 users when available, not 3.
  *
  * @param {number} size
+ * @param {object} [options]
+ * @param {boolean} [options.combine=false]
  * @return {number|array}
  * @public
  */
 
-req.range = function range(size) {
+req.range = function range(size, options) {
   var range = this.get('Range');
   if (!range) return;
-  return parseRange(size, range);
+  return parseRange(size, range, options);
 };
 
 /**
diff --git a/test/req.range.js b/test/req.range.js
index 08cf8f91e92..d530d85a645 100644
--- a/test/req.range.js
+++ b/test/req.range.js
@@ -12,9 +12,9 @@ function req(ret) {
 describe('req', function(){
   describe('.range(size)', function(){
     it('should return parsed ranges', function(){
-      var ret = [{ start: 0, end: 50 }, { start: 60, end: 100 }];
-      ret.type = 'bytes';
-      req('bytes=0-50,60-100').range(120).should.eql(ret);
+      var ranges = [{ start: 0, end: 50 }, { start: 51, end: 100 }]
+      ranges.type = 'bytes'
+      assert.deepEqual(req('bytes=0-50,51-100').range(120), ranges)
     })
 
     it('should cap to the given size', function(){
@@ -35,4 +35,14 @@ describe('req', function(){
       assert(req('').range(120) === undefined);
     })
   })
+
+  describe('.range(size, options)', function(){
+    describe('with "combine: true" option', function(){
+      it('should return combined ranges', function(){
+        var ranges = [{ start: 0, end: 100 }]
+        ranges.type = 'bytes'
+        assert.deepEqual(req('bytes=0-50,51-100').range(120, { combine: true }), ranges)
+      })
+    })
+  })
 })

From c762b16f62e2c9f5de33481c250ef6f94a99eb7f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 3 Jun 2016 00:07:34 -0400
Subject: [PATCH 0969/1265] Improve error with invalid arguments to req.get()

fixes #2993
---
 History.md      |  1 +
 lib/request.js  |  8 ++++++++
 test/req.get.js | 26 +++++++++++++++++++++++++-
 3 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a184efbf8a9..46e99a265eb 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,7 @@ unreleased
   * Add `options` argument to `req.range`
     - Includes the `combine` option
   * Fix Windows absolute path check using forward slashes
+  * Improve error with invalid arguments to `req.get()`
   * Improve performance for `res.json`/`res.jsonp` in most cases
   * deps: accepts@~1.3.3
     - Fix including type extensions in parameters in `Accept` parsing
diff --git a/lib/request.js b/lib/request.js
index ef0e101a001..557d050ffb5 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -57,6 +57,14 @@ var req = exports = module.exports = {
 
 req.get =
 req.header = function header(name) {
+  if (!name) {
+    throw new TypeError('name argument is required to req.get');
+  }
+
+  if (typeof name !== 'string') {
+    throw new TypeError('name must be a string to req.get');
+  }
+
   var lc = name.toLowerCase();
 
   switch (lc) {
diff --git a/test/req.get.js b/test/req.get.js
index 144a256848d..109a2d90ce7 100644
--- a/test/req.get.js
+++ b/test/req.get.js
@@ -31,5 +31,29 @@ describe('req', function(){
       .set('Referrer', 'http://foobar.com')
       .expect('http://foobar.com', done);
     })
+
+    it('should throw missing header name', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.end(req.get())
+      })
+
+      request(app)
+      .get('/')
+      .expect(500, /TypeError: name argument is required to req.get/, done)
+    })
+
+    it('should throw for non-string header name', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.end(req.get(42))
+      })
+
+      request(app)
+      .get('/')
+      .expect(500, /TypeError: name must be a string to req.get/, done)
+    })
   })
-})
\ No newline at end of file
+})

From fc40702cb70e39565263d64d962d3b8164fb3621 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 12 Jun 2016 22:33:44 -0400
Subject: [PATCH 0970/1265] deps: send@0.14.1

---
 History.md           | 18 ++++++++++++++++++
 package.json         |  2 +-
 test/res.sendFile.js | 22 ++++++++++++++++++++++
 3 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 46e99a265eb..12bafeff42d 100644
--- a/History.md
+++ b/History.md
@@ -1,11 +1,15 @@
 unreleased
 ==========
 
+  * Add `acceptRanges` option to `res.sendFile`/`res.sendfile`
+  * Add `cacheControl` option to `res.sendFile`/`res.sendfile`
   * Add `options` argument to `req.range`
     - Includes the `combine` option
+  * Fix some redirect handling in `res.sendFile`/`res.sendfile`
   * Fix Windows absolute path check using forward slashes
   * Improve error with invalid arguments to `req.get()`
   * Improve performance for `res.json`/`res.jsonp` in most cases
+  * Improve `Range` header handling in `res.sendFile`/`res.sendfile`
   * deps: accepts@~1.3.3
     - Fix including type extensions in parameters in `Accept` parsing
     - Fix parsing `Accept` parameters with quoted equals
@@ -38,6 +42,20 @@ unreleased
     - Add `combine` option to combine overlapping ranges
     - Fix incorrectly returning -1 when there is at least one valid range
     - perf: remove internal function
+  * deps: send@0.14.1
+    - Add `acceptRanges` option
+    - Add `cacheControl` option
+    - Attempt to combine multiple ranges into single range
+    - Correctly inherit from `Stream` class
+    - Fix `Content-Range` header in 416 responses when using `start`/`end` options
+    - Fix `Content-Range` header missing from default 416 responses
+    - Fix redirect error when `path` contains raw non-URL characters
+    - Fix redirect when `path` starts with multiple forward slashes
+    - Ignore non-byte `Range` headers
+    - deps: http-errors@~1.5.0
+    - deps: range-parser@~1.2.0
+    - deps: statuses@~1.3.0
+    - perf: remove argument reassignment
   * deps: type-is@~1.6.13
     - Fix type error when given invalid type to match against
     - deps: mime-types@~2.1.11
diff --git a/package.json b/package.json
index 303524a3e5c..6d9a9f39c37 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
     "proxy-addr": "~1.1.2",
     "qs": "6.2.0",
     "range-parser": "~1.2.0",
-    "send": "0.13.1",
+    "send": "0.14.1",
     "serve-static": "~1.10.2",
     "type-is": "~1.6.13",
     "utils-merge": "1.0.0",
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index 78013a50ebd..705c15a8b7e 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -286,6 +286,14 @@ describe('res', function(){
     })
   })
 
+  describe('.sendFile(path, options)', function () {
+    it('should pass options to send module', function (done) {
+      request(createApp(path.resolve(fixtures, 'name.txt'), { start: 0, end: 1 }))
+      .get('/')
+      .expect(200, 'to', done)
+    })
+  })
+
   describe('.sendfile(path, fn)', function(){
     it('should invoke the callback when complete', function(done){
       var app = express();
@@ -702,6 +710,20 @@ describe('res', function(){
   })
 })
 
+  describe('.sendfile(path, options)', function () {
+    it('should pass options to send module', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.sendfile(path.resolve(fixtures, 'name.txt'), { start: 0, end: 1 })
+      })
+
+      request(app)
+      .get('/')
+      .expect(200, 'to', done)
+    })
+  })
+
 function createApp(path, options, fn) {
   var app = express();
 

From 791cabf9390a029c5ad9b63eae8145c3c73f204e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 12 Jun 2016 22:38:20 -0400
Subject: [PATCH 0971/1265] deps: serve-static@~1.11.1

---
 History.md   | 8 ++++++++
 package.json | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 12bafeff42d..0c2a99873db 100644
--- a/History.md
+++ b/History.md
@@ -56,6 +56,14 @@ unreleased
     - deps: range-parser@~1.2.0
     - deps: statuses@~1.3.0
     - perf: remove argument reassignment
+  * deps: serve-static@~1.11.1
+    - Add `acceptRanges` option
+    - Add `cacheControl` option
+    - Attempt to combine multiple ranges into single range
+    - Fix redirect error when `req.url` contains raw non-URL characters
+    - Ignore non-byte `Range` headers
+    - Use status code 301 for redirects
+    - deps: send@0.14.1
   * deps: type-is@~1.6.13
     - Fix type error when given invalid type to match against
     - deps: mime-types@~2.1.11
diff --git a/package.json b/package.json
index 6d9a9f39c37..ede72a7eb16 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "qs": "6.2.0",
     "range-parser": "~1.2.0",
     "send": "0.14.1",
-    "serve-static": "~1.10.2",
+    "serve-static": "~1.11.1",
     "type-is": "~1.6.13",
     "utils-merge": "1.0.0",
     "vary": "~1.1.0"

From 23c22ce3fe2c298add7c06ac881ce0f17f73a6be Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 Jun 2016 22:50:18 -0400
Subject: [PATCH 0972/1265] build: support Node.js 5.x

---
 .travis.yml  | 1 +
 appveyor.yml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 38998527547..79f4360e9ee 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -6,6 +6,7 @@ node_js:
   - "2.5"
   - "3.3"
   - "4.4"
+  - "5.11"
 sudo: false
 cache:
   directories:
diff --git a/appveyor.yml b/appveyor.yml
index ce5e52ff1b9..8ed246ec5cc 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -6,6 +6,7 @@ environment:
     - nodejs_version: "2.5"
     - nodejs_version: "3.3"
     - nodejs_version: "4.4"
+    - nodejs_version: "5.11"
 cache:
   - node_modules
 install:

From c12cc8839277dcb3956558865f0cd241e8d08883 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 Jun 2016 22:51:07 -0400
Subject: [PATCH 0973/1265] build: support Node.js 6.x

---
 .travis.yml  | 1 +
 appveyor.yml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 79f4360e9ee..95034721e75 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,6 +7,7 @@ node_js:
   - "3.3"
   - "4.4"
   - "5.11"
+  - "6.2"
 sudo: false
 cache:
   directories:
diff --git a/appveyor.yml b/appveyor.yml
index 8ed246ec5cc..f1061373510 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -7,6 +7,7 @@ environment:
     - nodejs_version: "3.3"
     - nodejs_version: "4.4"
     - nodejs_version: "5.11"
+    - nodejs_version: "6.2"
 cache:
   - node_modules
 install:

From 76eaa326ee8c4dda05568c6452286a16adb84c0b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 Jun 2016 23:23:29 -0400
Subject: [PATCH 0974/1265] Encode URL in res.location/res.redirect if not
 already encoded

fixes #2897
fixes #3003
---
 History.md           |  1 +
 lib/response.js      |  9 ++++-----
 package.json         |  1 +
 test/res.location.js | 26 ++++++++++++++++++++++++++
 test/res.redirect.js | 36 +++++++++++++++++++++++++++++++-----
 5 files changed, 63 insertions(+), 10 deletions(-)

diff --git a/History.md b/History.md
index 0c2a99873db..5fc6dd253a6 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
   * Add `cacheControl` option to `res.sendFile`/`res.sendfile`
   * Add `options` argument to `req.range`
     - Includes the `combine` option
+  * Encode URL in `res.location`/`res.redirect` if not already encoded
   * Fix some redirect handling in `res.sendFile`/`res.sendfile`
   * Fix Windows absolute path check using forward slashes
   * Improve error with invalid arguments to `req.get()`
diff --git a/lib/response.js b/lib/response.js
index ad502ad8b58..6128f450a94 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -14,6 +14,7 @@
 
 var contentDisposition = require('content-disposition');
 var deprecate = require('depd')('express');
+var encodeUrl = require('encodeurl');
 var escapeHtml = require('escape-html');
 var http = require('http');
 var isAbsolute = require('./utils').isAbsolute;
@@ -832,8 +833,7 @@ res.location = function location(url) {
   }
 
   // set location
-  this.set('Location', loc);
-  return this;
+  return this.set('Location', encodeUrl(loc));
 };
 
 /**
@@ -871,13 +871,12 @@ res.redirect = function redirect(url) {
   }
 
   // Set location header
-  this.location(address);
-  address = this.get('Location');
+  address = this.location(address).get('Location');
 
   // Support text/{plain,html} by default
   this.format({
     text: function(){
-      body = statusCodes[status] + '. Redirecting to ' + encodeURI(address);
+      body = statusCodes[status] + '. Redirecting to ' + address;
     },
 
     html: function(){
diff --git a/package.json b/package.json
index ede72a7eb16..8ed7783ab0a 100644
--- a/package.json
+++ b/package.json
@@ -35,6 +35,7 @@
     "cookie-signature": "1.0.6",
     "debug": "~2.2.0",
     "depd": "~1.1.0",
+    "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.7.0",
     "finalhandler": "0.4.1",
diff --git a/test/res.location.js b/test/res.location.js
index 2b42bf358d4..bb9eb6f92e3 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -16,5 +16,31 @@ describe('res', function(){
       .expect('Location', 'http://google.com')
       .expect(200, done)
     })
+
+    it('should encode "url"', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.location('https://google.com?q=\u2603 §10').end()
+      })
+
+      request(app)
+      .get('/')
+      .expect('Location', 'https://google.com?q=%E2%98%83%20%C2%A710')
+      .expect(200, done)
+    })
+
+    it('should not touch already-encoded sequences in "url"', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.location('https://google.com?q=%A710').end()
+      })
+
+      request(app)
+      .get('/')
+      .expect('Location', 'https://google.com?q=%A710')
+      .expect(200, done)
+    })
   })
 })
diff --git a/test/res.redirect.js b/test/res.redirect.js
index 8511c40f2ab..9f3bd436763 100644
--- a/test/res.redirect.js
+++ b/test/res.redirect.js
@@ -18,6 +18,32 @@ describe('res', function(){
       .expect('location', 'http://google.com')
       .expect(302, done)
     })
+
+    it('should encode "url"', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.redirect('https://google.com?q=\u2603 §10')
+      })
+
+      request(app)
+      .get('/')
+      .expect('Location', 'https://google.com?q=%E2%98%83%20%C2%A710')
+      .expect(302, done)
+    })
+
+    it('should not touch already-encoded sequences in "url"', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.redirect('https://google.com?q=%A710')
+      })
+
+      request(app)
+      .get('/')
+      .expect('Location', 'https://google.com?q=%A710')
+      .expect(302, done)
+    })
   })
 
   describe('.redirect(status, url)', function(){
@@ -85,7 +111,7 @@ describe('res', function(){
       var app = express();
 
       app.use(function(req, res){
-        res.redirect('<lame>');
+        res.redirect('<la\'me>');
       });
 
       request(app)
@@ -93,8 +119,8 @@ describe('res', function(){
       .set('Host', 'http://example.com')
       .set('Accept', 'text/html')
       .expect('Content-Type', /html/)
-      .expect('Location', '<lame>')
-      .expect(302, '<p>' + http.STATUS_CODES[302] + '. Redirecting to <a href="&lt;lame&gt;">&lt;lame&gt;</a></p>', done);
+      .expect('Location', '%3Cla\'me%3E')
+      .expect(302, '<p>' + http.STATUS_CODES[302] + '. Redirecting to <a href="%3Cla&#39;me%3E">%3Cla&#39;me%3E</a></p>', done)
     })
 
     it('should include the redirect type', function(done){
@@ -141,8 +167,8 @@ describe('res', function(){
       .set('Host', 'http://example.com')
       .set('Accept', 'text/plain, */*')
       .expect('Content-Type', /plain/)
-      .expect('Location', 'http://example.com/?param=<script>alert("hax");</script>')
-      .expect(302, http.STATUS_CODES[302] + '. Redirecting to http://example.com/?param=%3Cscript%3Ealert(%22hax%22);%3C/script%3E', done);
+      .expect('Location', 'http://example.com/?param=%3Cscript%3Ealert(%22hax%22);%3C/script%3E')
+      .expect(302, http.STATUS_CODES[302] + '. Redirecting to http://example.com/?param=%3Cscript%3Ealert(%22hax%22);%3C/script%3E', done)
     })
 
     it('should include the redirect type', function(done){

From e06766c573ba3784798fc9b8775cea1304e34427 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 15 Jun 2016 18:12:19 -0400
Subject: [PATCH 0975/1265] deps: finalhandler@0.5.0

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5fc6dd253a6..6c3811a4577 100644
--- a/History.md
+++ b/History.md
@@ -31,6 +31,12 @@ unreleased
     - perf: hoist regular expression
     - perf: use for loop in parse
     - perf: use string concatination for serialization
+  * deps: finalhandler@0.5.0
+    - Change invalid or non-numeric status code to 500
+    - Overwrite status message to match set status code
+    - Prefer `err.statusCode` if `err.status` is invalid
+    - Set response headers from `err.headers` object
+    - Use `statuses` instead of `http` module for status messages
   * deps: proxy-addr@~1.1.2
     - Fix accepting various invalid netmasks
     - Fix IPv6-mapped IPv4 validation edge cases
diff --git a/package.json b/package.json
index 8ed7783ab0a..2c8e5cb9741 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.7.0",
-    "finalhandler": "0.4.1",
+    "finalhandler": "0.5.0",
     "fresh": "0.3.0",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",

From 605983fd0e838f9ddb9d85f4e1950f0ce5bed83d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 15 Jun 2016 18:13:30 -0400
Subject: [PATCH 0976/1265] build: should@9.0.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 2c8e5cb9741..3e491e78126 100644
--- a/package.json
+++ b/package.json
@@ -60,7 +60,7 @@
     "istanbul": "0.4.3",
     "marked": "0.3.5",
     "mocha": "2.5.3",
-    "should": "9.0.0",
+    "should": "9.0.2",
     "supertest": "1.2.0",
     "body-parser": "~1.14.2",
     "connect-redis": "~2.4.1",

From 14cf9c563679566bef9a396bfa9702776bfc1b48 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 15 Jun 2016 18:16:08 -0400
Subject: [PATCH 0977/1265] deps: update example dependencies

---
 package.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 3e491e78126..6b3b11b1e60 100644
--- a/package.json
+++ b/package.json
@@ -56,22 +56,22 @@
   },
   "devDependencies": {
     "after": "0.8.1",
+    "body-parser": "~1.15.1",
+    "cookie-parser": "~1.4.3",
     "ejs": "2.4.2",
     "istanbul": "0.4.3",
     "marked": "0.3.5",
+    "method-override": "~2.3.6",
     "mocha": "2.5.3",
+    "morgan": "~1.7.0",
     "should": "9.0.2",
     "supertest": "1.2.0",
-    "body-parser": "~1.14.2",
     "connect-redis": "~2.4.1",
-    "cookie-parser": "~1.4.1",
     "cookie-session": "~1.2.0",
     "express-session": "~1.13.0",
     "jade": "~1.11.0",
-    "method-override": "~2.3.5",
-    "morgan": "~1.6.1",
     "multiparty": "~4.1.2",
-    "vhost": "~3.0.1"
+    "vhost": "~3.0.2"
   },
   "engines": {
     "node": ">= 0.10.0"

From 9375a9afa9d7baa814b454c7a6818a7471aaef00 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Jun 2016 11:03:44 -0400
Subject: [PATCH 0978/1265] 4.14.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 6c3811a4577..40a5ed7e4be 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.14.0 / 2016-06-16
+===================
 
   * Add `acceptRanges` option to `res.sendFile`/`res.sendfile`
   * Add `cacheControl` option to `res.sendFile`/`res.sendfile`
diff --git a/package.json b/package.json
index 6b3b11b1e60..57dd1602884 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.13.4",
+  "version": "4.14.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 305f982bd734da5ee74abba9c270905a8f4aa484 Mon Sep 17 00:00:00 2001
From: Hamza <meteoroid2016@gmail.com>
Date: Sun, 31 Jul 2016 13:14:05 +0100
Subject: [PATCH 0979/1265] exapmples: use path.join to concat paths

closes #3046
---
 examples/static-files/index.js | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/examples/static-files/index.js b/examples/static-files/index.js
index c3b1659d861..0e44313d15d 100644
--- a/examples/static-files/index.js
+++ b/examples/static-files/index.js
@@ -4,6 +4,7 @@
 
 var express = require('../..');
 var logger = require('morgan');
+var path = require('path');
 var app = express();
 
 // log requests
@@ -16,7 +17,7 @@ app.use(logger('dev'));
 // that you pass it. In this case "GET /js/app.js"
 // will look for "./public/js/app.js".
 
-app.use(express.static(__dirname + '/public'));
+app.use(express.static(path.join(__dirname, 'public')));
 
 // if you wanted to "prefix" you may use
 // the mounting feature of Connect, for example
@@ -24,13 +25,13 @@ app.use(express.static(__dirname + '/public'));
 // The mount-path "/static" is simply removed before
 // passing control to the express.static() middleware,
 // thus it serves the file correctly by ignoring "/static"
-app.use('/static', express.static(__dirname + '/public'));
+app.use('/static', express.static(path.join(__dirname, 'public')));
 
 // if for some reason you want to serve files from
 // several directories, you can use express.static()
 // multiple times! Here we're passing "./public/css",
 // this will allow "GET /style.css" instead of "GET /css/style.css":
-app.use(express.static(__dirname + '/public/css'));
+app.use(express.static(path.join(__dirname, 'public', 'css')));
 
 app.listen(3000);
 console.log('listening on port 3000');

From bd47aeb88d28c6cff6e2d8e5378ec73c262e039f Mon Sep 17 00:00:00 2001
From: Vishvajit Pathak <vishvajit.pathak@gmail.com>
Date: Thu, 17 Nov 2016 12:43:14 +0530
Subject: [PATCH 0980/1265] tests: fix typos in test descriptions

closes #3129
closes #3130
---
 test/app.options.js          | 2 +-
 test/app.router.js           | 2 +-
 test/req.acceptsEncoding.js  | 4 ++--
 test/req.acceptsEncodings.js | 4 ++--
 test/req.acceptsLanguage.js  | 4 ++--
 test/req.acceptsLanguages.js | 4 ++--
 6 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/test/app.options.js b/test/app.options.js
index 20234723a57..9c88abafe5e 100644
--- a/test/app.options.js
+++ b/test/app.options.js
@@ -72,7 +72,7 @@ describe('OPTIONS', function(){
     .expect(200, 'GET,HEAD', done);
   })
 
-  describe('when error occurs in respone handler', function () {
+  describe('when error occurs in response handler', function () {
     it('should pass error to callback', function (done) {
       var app = express();
       var router = express.Router();
diff --git a/test/app.router.js b/test/app.router.js
index 03b43eb081a..11e492cbfae 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -757,7 +757,7 @@ describe('app.router', function(){
       .expect('editing tj (old)', cb);
     })
 
-    it('should work inside literal paranthesis', function(done){
+    it('should work inside literal parenthesis', function(done){
       var app = express();
 
       app.get('/:user\\(:op\\)', function(req, res){
diff --git a/test/req.acceptsEncoding.js b/test/req.acceptsEncoding.js
index 930b4ea76c1..12708fc0144 100644
--- a/test/req.acceptsEncoding.js
+++ b/test/req.acceptsEncoding.js
@@ -4,7 +4,7 @@ var express = require('../')
 
 describe('req', function(){
   describe('.acceptsEncoding', function(){
-    it('should be true if encoding accpeted', function(done){
+    it('should be true if encoding accepted', function(done){
       var app = express();
 
       app.use(function(req, res){
@@ -19,7 +19,7 @@ describe('req', function(){
       .expect(200, done);
     })
 
-    it('should be false if encoding not accpeted', function(done){
+    it('should be false if encoding not accepted', function(done){
       var app = express();
 
       app.use(function(req, res){
diff --git a/test/req.acceptsEncodings.js b/test/req.acceptsEncodings.js
index c4c68e1e8ed..c036c297691 100644
--- a/test/req.acceptsEncodings.js
+++ b/test/req.acceptsEncodings.js
@@ -4,7 +4,7 @@ var express = require('../')
 
 describe('req', function(){
   describe('.acceptsEncodingss', function(){
-    it('should be true if encoding accpeted', function(done){
+    it('should be true if encoding accepted', function(done){
       var app = express();
 
       app.use(function(req, res){
@@ -19,7 +19,7 @@ describe('req', function(){
       .expect(200, done);
     })
 
-    it('should be false if encoding not accpeted', function(done){
+    it('should be false if encoding not accepted', function(done){
       var app = express();
 
       app.use(function(req, res){
diff --git a/test/req.acceptsLanguage.js b/test/req.acceptsLanguage.js
index 36afc47f929..b14d920bd69 100644
--- a/test/req.acceptsLanguage.js
+++ b/test/req.acceptsLanguage.js
@@ -4,7 +4,7 @@ var express = require('../')
 
 describe('req', function(){
   describe('.acceptsLanguage', function(){
-    it('should be true if language accpeted', function(done){
+    it('should be true if language accepted', function(done){
       var app = express();
 
       app.use(function(req, res){
@@ -19,7 +19,7 @@ describe('req', function(){
       .expect(200, done);
     })
 
-    it('should be false if language not accpeted', function(done){
+    it('should be false if language not accepted', function(done){
       var app = express();
 
       app.use(function(req, res){
diff --git a/test/req.acceptsLanguages.js b/test/req.acceptsLanguages.js
index 8d11eb81e83..6a9cb3366bc 100644
--- a/test/req.acceptsLanguages.js
+++ b/test/req.acceptsLanguages.js
@@ -4,7 +4,7 @@ var express = require('../')
 
 describe('req', function(){
   describe('.acceptsLanguages', function(){
-    it('should be true if language accpeted', function(done){
+    it('should be true if language accepted', function(done){
       var app = express();
 
       app.use(function(req, res){
@@ -19,7 +19,7 @@ describe('req', function(){
       .expect(200, done);
     })
 
-    it('should be false if language not accpeted', function(done){
+    it('should be false if language not accepted', function(done){
       var app = express();
 
       app.use(function(req, res){

From 505f8482f2a2d41be856662db41265a7b190ca65 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 2 Dec 2016 22:09:46 -0500
Subject: [PATCH 0981/1265] build: Node.js@4.6

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 95034721e75..f147c8a6f5d 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -5,7 +5,7 @@ node_js:
   - "1.8"
   - "2.5"
   - "3.3"
-  - "4.4"
+  - "4.6"
   - "5.11"
   - "6.2"
 sudo: false
diff --git a/appveyor.yml b/appveyor.yml
index f1061373510..7f53b61c289 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -5,7 +5,7 @@ environment:
     - nodejs_version: "1.8"
     - nodejs_version: "2.5"
     - nodejs_version: "3.3"
-    - nodejs_version: "4.4"
+    - nodejs_version: "4.6"
     - nodejs_version: "5.11"
     - nodejs_version: "6.2"
 cache:

From 421ad5aaaa46ca5b2654bd75d9ec2bd62eed68b5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 2 Dec 2016 22:12:33 -0500
Subject: [PATCH 0982/1265] build: Node.js@5.12

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index f147c8a6f5d..15fea9926e4 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -6,7 +6,7 @@ node_js:
   - "2.5"
   - "3.3"
   - "4.6"
-  - "5.11"
+  - "5.12"
   - "6.2"
 sudo: false
 cache:
diff --git a/appveyor.yml b/appveyor.yml
index 7f53b61c289..62a82ef709a 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -6,7 +6,7 @@ environment:
     - nodejs_version: "2.5"
     - nodejs_version: "3.3"
     - nodejs_version: "4.6"
-    - nodejs_version: "5.11"
+    - nodejs_version: "5.12"
     - nodejs_version: "6.2"
 cache:
   - node_modules

From 1bcc9b1236197ac78f64e6cc1a7baf2c97d36395 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 2 Dec 2016 22:19:04 -0500
Subject: [PATCH 0983/1265] build: Node.js@6.9

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 15fea9926e4..3bd122f5d81 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,7 +7,7 @@ node_js:
   - "3.3"
   - "4.6"
   - "5.12"
-  - "6.2"
+  - "6.9"
 sudo: false
 cache:
   directories:
diff --git a/appveyor.yml b/appveyor.yml
index 62a82ef709a..18d5c4abe02 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -7,7 +7,7 @@ environment:
     - nodejs_version: "3.3"
     - nodejs_version: "4.6"
     - nodejs_version: "5.12"
-    - nodejs_version: "6.2"
+    - nodejs_version: "6.9"
 cache:
   - node_modules
 install:

From 6210e47cb664714efac017b9e1987f867ae5f804 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 3 Dec 2016 00:04:47 -0500
Subject: [PATCH 0984/1265] build: after@0.8.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 57dd1602884..76e93218b9e 100644
--- a/package.json
+++ b/package.json
@@ -55,7 +55,7 @@
     "vary": "~1.1.0"
   },
   "devDependencies": {
-    "after": "0.8.1",
+    "after": "0.8.2",
     "body-parser": "~1.15.1",
     "cookie-parser": "~1.4.3",
     "ejs": "2.4.2",

From f6dca56e72bc8df794bb98fec14a0875323c0569 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 3 Dec 2016 00:08:46 -0500
Subject: [PATCH 0985/1265] build: istanbul@0.4.5

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 76e93218b9e..bb0a0e67d22 100644
--- a/package.json
+++ b/package.json
@@ -59,7 +59,7 @@
     "body-parser": "~1.15.1",
     "cookie-parser": "~1.4.3",
     "ejs": "2.4.2",
-    "istanbul": "0.4.3",
+    "istanbul": "0.4.5",
     "marked": "0.3.5",
     "method-override": "~2.3.6",
     "mocha": "2.5.3",

From 1a17888073790f5567fdb9f9e270fab6904abf97 Mon Sep 17 00:00:00 2001
From: Deniz Tetik <deniztetik31@gmail.com>
Date: Wed, 18 Jan 2017 01:32:25 -0500
Subject: [PATCH 0986/1265] docs: fix minor grammatical error

closes #3178
---
 Contributing.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Contributing.md b/Contributing.md
index 3fb2b7c25f1..2ddfa7a62a4 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -31,7 +31,7 @@ exception is security dislosures which should be sent privately.
 Committers may direct you to another repository, ask for additional clarifications, and
 add appropriate metadata before the issue is addressed.
 
-Please be courteous, respectful, and every participant is expected to follow the 
+Please be courteous and respectful. Every participant is expected to follow the
 project's Code of Conduct.
 
 # Contributions

From d1d9631b97b64c7f98f4ad2d0ba61014865b1d49 Mon Sep 17 00:00:00 2001
From: SeongHeon Kim <SeongHeon.Kim@sundaytoz.com>
Date: Fri, 20 Jan 2017 23:05:53 +0900
Subject: [PATCH 0987/1265] docs: remove link to missing section

closes #3179
---
 Security.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Security.md b/Security.md
index d965a87bb0a..cbc5f16cde5 100644
--- a/Security.md
+++ b/Security.md
@@ -5,7 +5,6 @@ project.
 
   * [Reporting a Bug](#reporting-a-bug)
   * [Disclosure Policy](#disclosure-policy)
-  * [Receiving Security Updates](#receiving-security-updates)
   * [Comments on this Policy](#comments-on-this-policy)
 
 ## Reporting a Bug

From 6723b4419abacba00b73c466edb338e331e9ffe8 Mon Sep 17 00:00:00 2001
From: Zachary Lester <zachary.greg.lester@gmail.com>
Date: Tue, 23 Aug 2016 13:36:52 -0700
Subject: [PATCH 0988/1265] tests: add test for res.sendFile "cacheContol"
 option

closes #3061
---
 test/res.sendFile.js | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index 705c15a8b7e..ece09ee0731 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -116,6 +116,26 @@ describe('res', function(){
       test.expect(200, cb);
     })
 
+    describe('with "cacheControl" option', function () {
+      it('should enable cacheControl by default', function (done) {
+        var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'))
+
+        request(app)
+        .get('/')
+        .expect('Cache-Control', 'public, max-age=0')
+        .expect(200, done)
+      })
+
+      it('should accept cacheControl option', function (done) {
+        var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'), { cacheControl: false })
+
+        request(app)
+        .get('/')
+        .expect(utils.shouldNotHaveHeader('Cache-Control'))
+        .expect(200, done)
+      })
+    })
+
     describe('with "dotfiles" option', function () {
       it('should not serve dotfiles by default', function (done) {
         var app = createApp(path.resolve(__dirname, 'fixtures/.name'));

From ddc93aa0e20e1a802dccc80dd4a84c5763306531 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 21 Jan 2017 00:39:46 -0500
Subject: [PATCH 0989/1265] deps: content-disposition@0.5.2

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 40a5ed7e4be..ac5203ca815 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * deps: content-disposition@0.5.2
+
 4.14.0 / 2016-06-16
 ===================
 
diff --git a/package.json b/package.json
index bb0a0e67d22..3a56a3de785 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
   "dependencies": {
     "accepts": "~1.3.3",
     "array-flatten": "1.1.1",
-    "content-disposition": "0.5.1",
+    "content-disposition": "0.5.2",
     "content-type": "~1.0.2",
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",

From e73913b5837f615eaedde6a7005ffae5d09a3bff Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 21 Jan 2017 00:46:28 -0500
Subject: [PATCH 0990/1265] build: mocha@3.2.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 3a56a3de785..b4ec8b0d559 100644
--- a/package.json
+++ b/package.json
@@ -62,7 +62,7 @@
     "istanbul": "0.4.5",
     "marked": "0.3.5",
     "method-override": "~2.3.6",
-    "mocha": "2.5.3",
+    "mocha": "3.2.0",
     "morgan": "~1.7.0",
     "should": "9.0.2",
     "supertest": "1.2.0",

From a2e323a012de8415df58bd23ccb235bb0e0094c2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 21 Jan 2017 00:59:29 -0500
Subject: [PATCH 0991/1265] build: should@11.1.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index b4ec8b0d559..9a9b6ce63b1 100644
--- a/package.json
+++ b/package.json
@@ -64,7 +64,7 @@
     "method-override": "~2.3.6",
     "mocha": "3.2.0",
     "morgan": "~1.7.0",
-    "should": "9.0.2",
+    "should": "11.1.2",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
     "cookie-session": "~1.2.0",

From a3d635309cab51fc04730be06efcb31f83d0c444 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 21 Jan 2017 01:00:52 -0500
Subject: [PATCH 0992/1265] deps: proxy-addr@~1.1.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ac5203ca815..63b5a6c2df3 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,8 @@ unreleased
 ==========
 
   * deps: content-disposition@0.5.2
+  * deps: proxy-addr@~1.1.3
+    - deps: ipaddr.js@1.2.0
 
 4.14.0 / 2016-06-16
 ===================
diff --git a/package.json b/package.json
index 9a9b6ce63b1..eaea535b0a7 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.1",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~1.1.2",
+    "proxy-addr": "~1.1.3",
     "qs": "6.2.0",
     "range-parser": "~1.2.0",
     "send": "0.14.1",

From cfae537d3b37c73090634dd1dec7b10d6e9b920d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 21 Jan 2017 01:05:17 -0500
Subject: [PATCH 0993/1265] deps: finalhandler@0.5.1

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 63b5a6c2df3..39e64c441a6 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,11 @@ unreleased
 ==========
 
   * deps: content-disposition@0.5.2
+  * deps: finalhandler@0.5.1
+    - Fix exception when `err.headers` is not an object
+    - deps: statuses@~1.3.1
+    - perf: hoist regular expressions
+    - perf: remove duplicate validation path
   * deps: proxy-addr@~1.1.3
     - deps: ipaddr.js@1.2.0
 
diff --git a/package.json b/package.json
index eaea535b0a7..6b334fd59fd 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.7.0",
-    "finalhandler": "0.5.0",
+    "finalhandler": "0.5.1",
     "fresh": "0.3.0",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",

From 572657ee4a63b95d7522232dcc74a5012eb4239e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 23 Jan 2017 10:43:11 -0500
Subject: [PATCH 0994/1265] deps: send@0.14.2

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 39e64c441a6..922bee8576c 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,10 @@ unreleased
     - perf: remove duplicate validation path
   * deps: proxy-addr@~1.1.3
     - deps: ipaddr.js@1.2.0
+  * deps: send@0.14.2
+    - deps: http-errors@~1.5.1
+    - deps: ms@0.7.2
+    - deps: statuses@~1.3.1
 
 4.14.0 / 2016-06-16
 ===================
diff --git a/package.json b/package.json
index 6b334fd59fd..ebe7757b39a 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "proxy-addr": "~1.1.3",
     "qs": "6.2.0",
     "range-parser": "~1.2.0",
-    "send": "0.14.1",
+    "send": "0.14.2",
     "serve-static": "~1.11.1",
     "type-is": "~1.6.13",
     "utils-merge": "1.0.0",

From 8e14e06ebf45bd88b92ce9e84d4ffed3634c5097 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 24 Jan 2017 07:40:20 -0800
Subject: [PATCH 0995/1265] deps: serve-static@~1.11.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 922bee8576c..ec0568ddf20 100644
--- a/History.md
+++ b/History.md
@@ -13,6 +13,8 @@ unreleased
     - deps: http-errors@~1.5.1
     - deps: ms@0.7.2
     - deps: statuses@~1.3.1
+  * deps: serve-static@~1.11.2
+    - deps: send@0.14.2
 
 4.14.0 / 2016-06-16
 ===================
diff --git a/package.json b/package.json
index ebe7757b39a..550bda78cec 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "qs": "6.2.0",
     "range-parser": "~1.2.0",
     "send": "0.14.2",
-    "serve-static": "~1.11.1",
+    "serve-static": "~1.11.2",
     "type-is": "~1.6.13",
     "utils-merge": "1.0.0",
     "vary": "~1.1.0"

From dc48f27f607f59b187bd21ab3a84a82d2638f1eb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 26 Jan 2017 22:25:39 -0500
Subject: [PATCH 0996/1265] deps: update example dependencies

---
 package.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 550bda78cec..017ef91ac6e 100644
--- a/package.json
+++ b/package.json
@@ -56,21 +56,21 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "body-parser": "~1.15.1",
+    "body-parser": "1.16.0",
     "cookie-parser": "~1.4.3",
-    "ejs": "2.4.2",
+    "ejs": "2.5.5",
+    "express-session": "1.15.0",
     "istanbul": "0.4.5",
-    "marked": "0.3.5",
+    "marked": "0.3.6",
     "method-override": "~2.3.6",
     "mocha": "3.2.0",
     "morgan": "~1.7.0",
+    "multiparty": "4.1.3",
     "should": "11.1.2",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
     "cookie-session": "~1.2.0",
-    "express-session": "~1.13.0",
     "jade": "~1.11.0",
-    "multiparty": "~4.1.2",
     "vhost": "~3.0.2"
   },
   "engines": {

From 6b506d801a731eb079fc0f442d25a7398b5f1a5b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 26 Jan 2017 22:33:52 -0500
Subject: [PATCH 0997/1265] examples: fix mvc example to ignore files in
 controllers dir

fixes #3182
---
 examples/mvc/lib/boot.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/examples/mvc/lib/boot.js b/examples/mvc/lib/boot.js
index 78e82db1bfb..a0ca6ec37b1 100644
--- a/examples/mvc/lib/boot.js
+++ b/examples/mvc/lib/boot.js
@@ -8,6 +8,7 @@ var fs = require('fs');
 module.exports = function(parent, options){
   var verbose = options.verbose;
   fs.readdirSync(__dirname + '/../controllers').forEach(function(name){
+    if (!fs.statSync(__dirname + '/../controllers/' + name).isDirectory()) return;
     verbose && console.log('\n   %s:', name);
     var obj = require('./../controllers/' + name);
     var name = obj.name || name;

From c238aca43875fe804df1e7e076dd3f63211f2e02 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 26 Jan 2017 22:48:08 -0500
Subject: [PATCH 0998/1265] examples: remove big-view example

---
 examples/big-view/index.js  | 31 -------------------------------
 examples/big-view/pets.jade | 12 ------------
 2 files changed, 43 deletions(-)
 delete mode 100644 examples/big-view/index.js
 delete mode 100644 examples/big-view/pets.jade

diff --git a/examples/big-view/index.js b/examples/big-view/index.js
deleted file mode 100644
index 0814cbb6e01..00000000000
--- a/examples/big-view/index.js
+++ /dev/null
@@ -1,31 +0,0 @@
-/**
- * Module dependencies.
- */
-
-var express = require('../..');
-var logger = require('morgan');
-var app = express();
-
-app.set('views', __dirname);
-app.set('view engine', 'jade');
-
-var pets = [];
-
-var n = 1000;
-while (n--) {
-  pets.push({ name: 'Tobi', age: 2, species: 'ferret' });
-  pets.push({ name: 'Loki', age: 1, species: 'ferret' });
-  pets.push({ name: 'Jane', age: 6, species: 'ferret' });
-}
-
-app.use(logger('dev'));
-
-app.get('/', function(req, res){
-  res.render('pets', { pets: pets });
-});
-
-/* istanbul ignore next */
-if (!module.parent) {
-  app.listen(3000);
-  console.log('Express started on port 3000');
-}
diff --git a/examples/big-view/pets.jade b/examples/big-view/pets.jade
deleted file mode 100644
index afb086819c2..00000000000
--- a/examples/big-view/pets.jade
+++ /dev/null
@@ -1,12 +0,0 @@
-style.
-  body {
-    padding: 50px;
-    font: 16px "Helvetica Neue", Helvetica;
-  }
-
-table
-  for pet in pets
-    tr
-      td= pet.name
-      td= pet.age
-      td= pet.species
\ No newline at end of file

From 0d6c64fdfd0bd6031dc23df2c5f9abdf6e4bbb11 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 26 Jan 2017 22:54:05 -0500
Subject: [PATCH 0999/1265] deps: type-is@~1.6.14

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ec0568ddf20..5d69820a80f 100644
--- a/History.md
+++ b/History.md
@@ -15,6 +15,8 @@ unreleased
     - deps: statuses@~1.3.1
   * deps: serve-static@~1.11.2
     - deps: send@0.14.2
+  * deps: type-is@~1.6.14
+    - deps: mime-types@~2.1.13
 
 4.14.0 / 2016-06-16
 ===================
diff --git a/package.json b/package.json
index 017ef91ac6e..c8ff63519e1 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "range-parser": "~1.2.0",
     "send": "0.14.2",
     "serve-static": "~1.11.2",
-    "type-is": "~1.6.13",
+    "type-is": "~1.6.14",
     "utils-merge": "1.0.0",
     "vary": "~1.1.0"
   },

From 0b39fa2f7c5a68c956019eff01c002968e8966db Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 28 Jan 2017 16:40:40 -0500
Subject: [PATCH 1000/1265] build: should@11.2.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index c8ff63519e1..d39ac73503b 100644
--- a/package.json
+++ b/package.json
@@ -66,7 +66,7 @@
     "mocha": "3.2.0",
     "morgan": "~1.7.0",
     "multiparty": "4.1.3",
-    "should": "11.1.2",
+    "should": "11.2.0",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
     "cookie-session": "~1.2.0",

From 1f70b76c453e9550545e9a5a91a97d5d0dba3e32 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 28 Jan 2017 16:56:34 -0500
Subject: [PATCH 1001/1265] build: Node.js@4.7

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 3bd122f5d81..924fd00a2aa 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -5,7 +5,7 @@ node_js:
   - "1.8"
   - "2.5"
   - "3.3"
-  - "4.6"
+  - "4.7"
   - "5.12"
   - "6.9"
 sudo: false
diff --git a/appveyor.yml b/appveyor.yml
index 18d5c4abe02..72f86987907 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -5,7 +5,7 @@ environment:
     - nodejs_version: "1.8"
     - nodejs_version: "2.5"
     - nodejs_version: "3.3"
-    - nodejs_version: "4.6"
+    - nodejs_version: "4.7"
     - nodejs_version: "5.12"
     - nodejs_version: "6.9"
 cache:

From 0437c513f2dbc8d1dfc5a3e35fe35182bd3a671e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 28 Jan 2017 17:21:24 -0500
Subject: [PATCH 1002/1265] 4.14.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 5d69820a80f..4a706a4d104 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.14.1 / 2017-01-28
+===================
 
   * deps: content-disposition@0.5.2
   * deps: finalhandler@0.5.1
diff --git a/package.json b/package.json
index d39ac73503b..d499a6df13e 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.14.0",
+  "version": "4.14.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 94377f681d66efff100aa2a9086398b0df5688f8 Mon Sep 17 00:00:00 2001
From: Takuma Hanatani <mail@potato4d.me>
Date: Wed, 1 Feb 2017 18:26:16 +0900
Subject: [PATCH 1003/1265] lint: remove unnecessary semicolon

closes #3191
---
 lib/request.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/request.js b/lib/request.js
index 557d050ffb5..513c9bf3d46 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -499,4 +499,4 @@ function defineGetter(obj, name, getter) {
     enumerable: true,
     get: getter
   });
-};
+}

From 4f291e7d55d6093ecc4a99d88c785dee22d6d125 Mon Sep 17 00:00:00 2001
From: Tom Hosford <tom.hosford@gmail.com>
Date: Wed, 1 Feb 2017 18:28:26 -0500
Subject: [PATCH 1004/1265] examples: use res.format in error-pages

closes #3195
---
 examples/error-pages/index.js | 25 +++++++++++--------------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/examples/error-pages/index.js b/examples/error-pages/index.js
index aff985bd674..d1219689f2c 100644
--- a/examples/error-pages/index.js
+++ b/examples/error-pages/index.js
@@ -60,20 +60,17 @@ app.get('/500', function(req, res, next){
 app.use(function(req, res, next){
   res.status(404);
 
-  // respond with html page
-  if (req.accepts('html')) {
-    res.render('404', { url: req.url });
-    return;
-  }
-
-  // respond with json
-  if (req.accepts('json')) {
-    res.send({ error: 'Not found' });
-    return;
-  }
-
-  // default to plain-text. send()
-  res.type('txt').send('Not found');
+  res.format({
+    html: function () {
+      res.render('404', { url: req.url })
+    },
+    json: function () {
+      res.json({ error: 'Not found' })
+    },
+    default: function () {
+      res.type('txt').send('Not found')
+    }
+  })
 });
 
 // error-handling middleware, take the same form

From fb3946f4549395b2f0d3a166ef74eb407d11549b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 4 Feb 2017 20:54:47 -0500
Subject: [PATCH 1005/1265] lint: fix broken indentation in tests

---
 test/req.ip.js       |  4 ++--
 test/res.sendFile.js | 24 ++++++++++++------------
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/test/req.ip.js b/test/req.ip.js
index 3ca575e11bd..1cd255216b9 100644
--- a/test/req.ip.js
+++ b/test/req.ip.js
@@ -79,8 +79,8 @@ describe('req', function(){
           res.send(req.ip);
         });
 
-          var test = request(app).get('/')
-          test.expect(200, getExpectedClientAddress(test._server), done);
+        var test = request(app).get('/')
+        test.expect(200, getExpectedClientAddress(test._server), done)
       })
     })
   })
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index ece09ee0731..927d31991f0 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -157,8 +157,8 @@ describe('res', function(){
     describe('with "headers" option', function () {
       it('should accept headers option', function (done) {
         var headers = {
-           'x-success': 'sent',
-           'x-other': 'done'
+          'x-success': 'sent',
+          'x-other': 'done'
         };
         var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'), { headers: headers });
 
@@ -510,8 +510,8 @@ describe('res', function(){
     it('should accept headers option', function(done){
       var app = express();
       var headers = {
-         'x-success': 'sent',
-         'x-other': 'done'
+        'x-success': 'sent',
+        'x-other': 'done'
       };
 
       app.use(function(req, res){
@@ -730,19 +730,19 @@ describe('res', function(){
   })
 })
 
-  describe('.sendfile(path, options)', function () {
-    it('should pass options to send module', function (done) {
-      var app = express()
+describe('.sendfile(path, options)', function () {
+  it('should pass options to send module', function (done) {
+    var app = express()
 
-      app.use(function (req, res) {
-        res.sendfile(path.resolve(fixtures, 'name.txt'), { start: 0, end: 1 })
-      })
+    app.use(function (req, res) {
+      res.sendfile(path.resolve(fixtures, 'name.txt'), { start: 0, end: 1 })
+    })
 
-      request(app)
+    request(app)
       .get('/')
       .expect(200, 'to', done)
-    })
   })
+})
 
 function createApp(path, options, fn) {
   var app = express();

From abd1de73c14985c884d11fb35aff5f4b17381e23 Mon Sep 17 00:00:00 2001
From: Sebastian Van Sande <sebastian@vansande.org>
Date: Mon, 6 Feb 2017 13:09:59 +0100
Subject: [PATCH 1006/1265] tests: fix misnamed app.router test section

fixes #3194
closes #3199
---
 test/app.router.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/app.router.js b/test/app.router.js
index 11e492cbfae..6d41778c038 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -90,7 +90,7 @@ describe('app.router', function(){
     });
   })
 
-  describe('decode querystring', function(){
+  describe('decode params', function () {
     it('should decode correct params', function(done){
       var app = express();
 

From 034f261fea1eed22d79706ef3c29666acc5fce4a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 15 Feb 2017 23:36:17 -0500
Subject: [PATCH 1007/1265] examples: use pbkdf2-password module in auth
 example

closes #3207
---
 examples/auth/index.js |  6 +++---
 examples/auth/pass.js  | 48 ------------------------------------------
 package.json           |  1 +
 3 files changed, 4 insertions(+), 51 deletions(-)
 delete mode 100644 examples/auth/pass.js

diff --git a/examples/auth/index.js b/examples/auth/index.js
index d110fe28d42..1c3ca217512 100644
--- a/examples/auth/index.js
+++ b/examples/auth/index.js
@@ -3,8 +3,8 @@
  */
 
 var express = require('../..');
-var hash = require('./pass').hash;
 var bodyParser = require('body-parser');
+var hash = require('pbkdf2-password')()
 var session = require('express-session');
 
 var app = module.exports = express();
@@ -45,7 +45,7 @@ var users = {
 // when you create a user, generate a salt
 // and hash the password ('foobar' is the pass here)
 
-hash('foobar', function(err, salt, hash){
+hash({ password: 'foobar' }, function (err, pass, salt, hash) {
   if (err) throw err;
   // store the salt & hash in the "db"
   users.tj.salt = salt;
@@ -63,7 +63,7 @@ function authenticate(name, pass, fn) {
   // apply the same algorithm to the POSTed password, applying
   // the hash against the pass / salt, if there is a match we
   // found the user
-  hash(pass, user.salt, function(err, hash){
+  hash({ password: pass, salt: user.salt }, function (err, pass, salt, hash) {
     if (err) return fn(err);
     if (hash == user.hash) return fn(null, user);
     fn(new Error('invalid password'));
diff --git a/examples/auth/pass.js b/examples/auth/pass.js
deleted file mode 100644
index fefb25b66a5..00000000000
--- a/examples/auth/pass.js
+++ /dev/null
@@ -1,48 +0,0 @@
-
-// check out https://github.com/tj/node-pwd
-
-/**
- * Module dependencies.
- */
-
-var crypto = require('crypto');
-
-/**
- * Bytesize.
- */
-
-var len = 128;
-
-/**
- * Iterations. ~300ms
- */
-
-var iterations = 12000;
-
-/**
- * Hashes a password with optional `salt`, otherwise
- * generate a salt for `pass` and invoke `fn(err, salt, hash)`.
- *
- * @param {String} password to hash
- * @param {String} optional salt
- * @param {Function} callback
- * @api public
- */
-
-exports.hash = function (pwd, salt, fn) {
-  if (3 == arguments.length) {
-    crypto.pbkdf2(pwd, salt, iterations, len, function(err, hash){
-      fn(err, hash.toString('base64'));
-    });
-  } else {
-    fn = salt;
-    crypto.randomBytes(len, function(err, salt){
-      if (err) return fn(err);
-      salt = salt.toString('base64');
-      crypto.pbkdf2(pwd, salt, iterations, len, function(err, hash){
-        if (err) return fn(err);
-        fn(null, salt, hash.toString('base64'));
-      });
-    });
-  }
-};
diff --git a/package.json b/package.json
index d499a6df13e..72b266a3afb 100644
--- a/package.json
+++ b/package.json
@@ -66,6 +66,7 @@
     "mocha": "3.2.0",
     "morgan": "~1.7.0",
     "multiparty": "4.1.3",
+    "pbkdf2-password": "1.2.1",
     "should": "11.2.0",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",

From c48014fde8682f59c2fff8f0ae4655daf8de3b0d Mon Sep 17 00:00:00 2001
From: Rand McKinney <crandmck@yahoo.com>
Date: Wed, 15 Feb 2017 17:14:06 -0800
Subject: [PATCH 1008/1265] docs: minor fixes to contributing guide

---
 Contributing.md | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/Contributing.md b/Contributing.md
index 2ddfa7a62a4..214e9070126 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -1,20 +1,13 @@
-# Node.js Community Contributing Guide 1.0
-
-This document describes a very simple process suitable for most projects
-in the Node.js ecosystem. Projects are encouraged to adopt this whether they
-are hosted in the Node.js Foundation or not.
+# Express.js Community Contributing Guide 1.0
 
 The goal of this document is to create a contribution process that:
 
 * Encourages new contributions.
 * Encourages contributors to remain involved.
 * Avoids unnecessary processes and bureaucracy whenever possible.
-* Creates a transparent decision making process which makes it clear how
+* Creates a transparent decision making process that makes it clear how
 contributors can be involved in decision making.
 
-This document is based on much prior art in the Node.js community, io.js,
-and the Node.js project.
-
 ## Vocabulary
 
 * A **Contributor** is any individual creating or commenting on an issue or pull request.
@@ -24,7 +17,7 @@ expertise to resolve rare disputes.
 
 # Logging Issues
 
-Log an issue for any question or problem you might have. When in doubt, log an issue, 
+Log an issue for any question or problem you might have. When in doubt, log an issue, and
 any additional policies about what to include will be provided in the responses. The only
 exception is security dislosures which should be sent privately.
 

From 7ef92f8a171aeb7c90260a0ba92015862da1a0eb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Feb 2017 00:42:57 -0500
Subject: [PATCH 1009/1265] examples: remove semi-broken expose-data-to-client
 example

---
 examples/expose-data-to-client/index.js       | 64 -------------------
 .../expose-data-to-client/views/page.jade     | 14 ----
 2 files changed, 78 deletions(-)
 delete mode 100644 examples/expose-data-to-client/index.js
 delete mode 100644 examples/expose-data-to-client/views/page.jade

diff --git a/examples/expose-data-to-client/index.js b/examples/expose-data-to-client/index.js
deleted file mode 100644
index 5dd99df682a..00000000000
--- a/examples/expose-data-to-client/index.js
+++ /dev/null
@@ -1,64 +0,0 @@
-
-var express = require('../..');
-var logger = require('morgan');
-var app = express();
-
-app.set('view engine', 'jade');
-app.set('views', __dirname + '/views');
-
-function User(name) {
-  this.private = 'heyyyy';
-  this.secret = 'something';
-  this.name = name;
-  this.id = 123;
-}
-
-// You'll probably want to do
-// something like this so you
-// dont expose "secret" data.
-
-User.prototype.toJSON = function(){
-  return {
-    id: this.id,
-    name: this.name
-  };
-};
-
-app.use(logger('dev'));
-
-// earlier on expose an object
-// that we can tack properties on.
-// all res.locals props are exposed
-// to the templates, so "expose" will
-// be present.
-
-app.use(function(req, res, next){
-  res.locals.expose = {};
-  // you could alias this as req or res.expose
-  // to make it shorter and less annoying
-  next();
-});
-
-// pretend we loaded a user
-
-app.use(function(req, res, next){
-  req.user = new User('Tobi');
-  next();
-});
-
-app.get('/', function(req, res){
-  res.redirect('/user');
-});
-
-app.get('/user', function(req, res){
-  // we only want to expose the user
-  // to the client for this route:
-  res.locals.expose.user = req.user;
-  res.render('page');
-});
-
-/* istanbul ignore next */
-if (!module.parent) {
-  app.listen(3000);
-  console.log('Express started on port 3000');
-}
diff --git a/examples/expose-data-to-client/views/page.jade b/examples/expose-data-to-client/views/page.jade
deleted file mode 100644
index 6e58a18afbc..00000000000
--- a/examples/expose-data-to-client/views/page.jade
+++ /dev/null
@@ -1,14 +0,0 @@
-html
-  head
-    title Express
-    script.
-      // call this whatever you like,
-      // or dump them into individual
-      // props like "var user ="
-      var data = !{JSON.stringify(expose)}
-  body
-    h1 Expose client data
-    p The following was exposed to the client:
-    pre
-      script.
-        document.write(JSON.stringify(data, null, 2))
\ No newline at end of file

From eb326d7ecb52a555f08aba4ebf8744512db1240b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 20 Feb 2017 16:55:15 -0500
Subject: [PATCH 1010/1265] tests: update req.is tests to run through express

---
 test/req.is.js | 213 ++++++++++++++++++++++++++++++++-----------------
 1 file changed, 139 insertions(+), 74 deletions(-)

diff --git a/test/req.is.js b/test/req.is.js
index e5adb19de90..a2fce178673 100644
--- a/test/req.is.js
+++ b/test/req.is.js
@@ -1,103 +1,168 @@
 
-var express = require('../')
-  , request = require('supertest');
-
-function req(ct) {
-  var req = {
-    headers: {
-      'content-type': ct,
-      'transfer-encoding': 'chunked'
-    },
-    __proto__: express.request
-  };
-
-  return req;
-}
-
-describe('req.is()', function(){
-  it('should ignore charset', function(){
-    req('application/json')
-    .is('json')
-    .should.equal('json');
+var express = require('..')
+var request = require('supertest')
+
+describe('req.is()', function () {
+  describe('when given a mime type', function () {
+    it('should return the type when matching', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.json(req.is('application/json'))
+      })
+
+      request(app)
+      .post('/')
+      .type('application/json')
+      .send('{}')
+      .expect(200, '"application/json"', done)
+    })
+
+    it('should return false when not matching', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.json(req.is('image/jpeg'))
+      })
+
+      request(app)
+      .post('/')
+      .type('application/json')
+      .send('{}')
+      .expect(200, 'false', done)
+    })
+
+    it('should ignore charset', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.json(req.is('application/json'))
+      })
+
+      request(app)
+      .post('/')
+      .type('application/json; charset=UTF-8')
+      .send('{}')
+      .expect(200, '"application/json"', done)
+    })
   })
 
   describe('when content-type is not present', function(){
-    it('should return false', function(){
-      req('')
-      .is('json')
-      .should.be.false;
+    it('should return false', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.json(req.is('application/json'))
+      })
+
+      request(app)
+      .post('/')
+      .send('{}')
+      .expect(200, 'false', done)
     })
   })
 
   describe('when given an extension', function(){
-    it('should lookup the mime type', function(){
-      req('application/json')
-      .is('json')
-      .should.equal('json');
-
-      req('text/html')
-      .is('json')
-      .should.be.false;
-    })
-  })
+    it('should lookup the mime type', function (done) {
+      var app = express()
 
-  describe('when given a mime type', function(){
-    it('should match', function(){
-      req('application/json')
-      .is('application/json')
-      .should.equal('application/json');
+      app.use(function (req, res) {
+        res.json(req.is('json'))
+      })
 
-      req('image/jpeg')
-      .is('application/json')
-      .should.be.false;
+      request(app)
+      .post('/')
+      .type('application/json')
+      .send('{}')
+      .expect(200, '"json"', done)
     })
   })
 
   describe('when given */subtype', function(){
-    it('should match', function(){
-      req('application/json')
-      .is('*/json')
-      .should.equal('application/json');
-
-      req('image/jpeg')
-      .is('*/json')
-      .should.be.false;
+    it('should return the full type when matching', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.json(req.is('*/json'))
+      })
+
+      request(app)
+      .post('/')
+      .type('application/json')
+      .send('{}')
+      .expect(200, '"application/json"', done)
+    })
+
+    it('should return false when not matching', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.json(req.is('*/html'))
+      })
+
+      request(app)
+      .post('/')
+      .type('application/json')
+      .send('{}')
+      .expect(200, 'false', done)
     })
 
-    describe('with a charset', function(){
-      it('should match', function(){
-        req('text/html; charset=utf-8')
-        .is('*/html')
-        .should.equal('text/html');
+    it('should ignore charset', function (done) {
+      var app = express()
 
-        req('text/plain; charset=utf-8')
-        .is('*/html')
-        .should.be.false;
+      app.use(function (req, res) {
+        res.json(req.is('*/json'))
       })
+
+      request(app)
+      .post('/')
+      .type('application/json; charset=UTF-8')
+      .send('{}')
+      .expect(200, '"application/json"', done)
     })
   })
 
   describe('when given type/*', function(){
-    it('should match', function(){
-      req('image/png')
-      .is('image/*')
-      .should.equal('image/png');
-
-      req('text/html')
-      .is('image/*')
-      .should.be.false;
+    it('should return the full type when matching', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.json(req.is('application/*'))
+      })
+
+      request(app)
+      .post('/')
+      .type('application/json')
+      .send('{}')
+      .expect(200, '"application/json"', done)
     })
 
-    describe('with a charset', function(){
-      it('should match', function(){
-        req('text/html; charset=utf-8')
-        .is('text/*')
-        .should.equal('text/html');
+    it('should return false when not matching', function (done) {
+      var app = express()
 
-        req('something/html; charset=utf-8')
-        .is('text/*')
-        .should.be.false;
+      app.use(function (req, res) {
+        res.json(req.is('text/*'))
       })
+
+      request(app)
+      .post('/')
+      .type('application/json')
+      .send('{}')
+      .expect(200, 'false', done)
+    })
+
+    it('should ignore charset', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.json(req.is('application/*'))
+      })
+
+      request(app)
+      .post('/')
+      .type('application/json; charset=UTF-8')
+      .send('{}')
+      .expect(200, '"application/json"', done)
     })
   })
 })

From 3e3d35777d3e3081b33ce7d50c8a5c855b450534 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 20 Feb 2017 17:09:21 -0500
Subject: [PATCH 1011/1265] tests: update req.range tests to run through
 express

---
 test/req.range.js | 110 ++++++++++++++++++++++++++++++++++------------
 1 file changed, 83 insertions(+), 27 deletions(-)

diff --git a/test/req.range.js b/test/req.range.js
index d530d85a645..09459d1e127 100644
--- a/test/req.range.js
+++ b/test/req.range.js
@@ -1,47 +1,103 @@
 
 var assert = require('assert');
 var express = require('..');
-
-function req(ret) {
-  return {
-      get: function(){ return ret }
-    , __proto__: express.request
-  };
-}
+var request = require('supertest')
 
 describe('req', function(){
   describe('.range(size)', function(){
-    it('should return parsed ranges', function(){
-      var ranges = [{ start: 0, end: 50 }, { start: 51, end: 100 }]
-      ranges.type = 'bytes'
-      assert.deepEqual(req('bytes=0-50,51-100').range(120), ranges)
+    it('should return parsed ranges', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.json(req.range(120))
+      })
+
+      request(app)
+      .get('/')
+      .set('Range', 'bytes=0-50,51-100')
+      .expect(200, '[{"start":0,"end":50},{"start":51,"end":100}]', done)
     })
 
-    it('should cap to the given size', function(){
-      var ret = [{ start: 0, end: 74 }];
-      ret.type = 'bytes';
-      req('bytes=0-100').range(75).should.eql(ret);
+    it('should cap to the given size', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.json(req.range(75))
+      })
+
+      request(app)
+      .get('/')
+      .set('Range', 'bytes=0-100')
+      .expect(200, '[{"start":0,"end":74}]', done)
     })
 
-    it('should have a .type', function(){
-      var ret = [{ start: 0, end: Infinity }];
-      ret.type = 'users';
-      req('users=0-').range(Infinity).should.eql(ret);
+    it('should cap to the given size when open-ended', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.json(req.range(75))
+      })
+
+      request(app)
+      .get('/')
+      .set('Range', 'bytes=0-')
+      .expect(200, '[{"start":0,"end":74}]', done)
     })
 
-    it('should return undefined if no range', function(){
-      var ret = [{ start: 0, end: 50 }, { start: 60, end: 100 }];
-      ret.type = 'bytes';
-      assert(req('').range(120) === undefined);
+    it('should have a .type', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.json(req.range(120).type)
+      })
+
+      request(app)
+      .get('/')
+      .set('Range', 'bytes=0-100')
+      .expect(200, '"bytes"', done)
+    })
+
+    it('should accept any type', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.json(req.range(120).type)
+      })
+
+      request(app)
+      .get('/')
+      .set('Range', 'users=0-2')
+      .expect(200, '"users"', done)
+    })
+
+    it('should return undefined if no range', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.send(String(req.range(120)))
+      })
+
+      request(app)
+      .get('/')
+      .expect(200, 'undefined', done)
     })
   })
 
   describe('.range(size, options)', function(){
     describe('with "combine: true" option', function(){
-      it('should return combined ranges', function(){
-        var ranges = [{ start: 0, end: 100 }]
-        ranges.type = 'bytes'
-        assert.deepEqual(req('bytes=0-50,51-100').range(120, { combine: true }), ranges)
+      it('should return combined ranges', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.json(req.range(120, {
+            combine: true
+          }))
+        })
+
+        request(app)
+        .get('/')
+        .set('Range', 'bytes=0-50,51-100')
+        .expect(200, '[{"start":0,"end":100}]', done)
       })
     })
   })

From f3a47e39a4aeaba36c4881ccafbe12262278e9f4 Mon Sep 17 00:00:00 2001
From: Rand McKinney <crandmck@yahoo.com>
Date: Wed, 15 Feb 2017 17:18:57 -0800
Subject: [PATCH 1012/1265] docs: update collaborator guide

---
 Collaborator-Guide.md | 32 ++++++++++++++++++++++----------
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/Collaborator-Guide.md b/Collaborator-Guide.md
index abbfc109429..7c0d265dd0a 100644
--- a/Collaborator-Guide.md
+++ b/Collaborator-Guide.md
@@ -6,25 +6,36 @@ Open issues for the expressjs.com website in https://github.com/expressjs/expres
 ## PRs and Code contributions
 
 * Tests must pass.
-* Follow existing coding style.
+* Follow the [JavaScript Standard Style](http://standardjs.com/).
 * If you fix a bug, add a test.
 
 ## Branches
 
-* Use the `master` branch for bug fixes or minor work that is intended for the current release stream
-* Use the correspondingly named branch, e.g. `5.0`, for anything intended for a future release of Express 
+Use the `master` branch for bug fixes or minor work that is intended for the
+current release stream.
+
+Use the correspondingly named branch, e.g. `5.0`, for anything intended for
+a future release of Express.
 
 ## Steps for contributing
 
-* [Create an issue](https://github.com/expressjs/express/issues/new) for the bug you want to fix or the feature that you want to add.
-* Create your own [fork](https://github.com/expressjs/express) on github, then checkout your fork.
-* Write your code in your local copy. It's good practice to create a branch for each new issue you work on, although not compulsory.
-* To run the test suite, first install the dependencies by running `npm install`, then run `npm test`.
-* If the tests pass, you can commit your changes to your fork and then create a pull request from there. Make sure to reference your issue from the pull request comments by including the issue number e.g. #123.
+1. [Create an issue](https://github.com/expressjs/express/issues/new) for the
+   bug you want to fix or the feature that you want to add.
+2. Create your own [fork](https://github.com/expressjs/express) on github, then
+   checkout your fork.
+3. Write your code in your local copy. It's good practice to create a branch for
+   each new issue you work on, although not compulsory.
+4. To run the test suite, first install the dependencies by running `npm install`,
+   then run `npm test`.
+5. If the tests pass, you can commit your changes to your fork and then create
+   a pull request from there. Make sure to reference your issue from the pull
+   request comments by including the issue number e.g. `#123`.
 
 ## Issues which are questions
 
-We will typically close any vague issues or questions that are specific to some app you are writing. Please double check the docs and other references before being trigger happy with posting a question issue.
+We will typically close any vague issues or questions that are specific to some
+app you are writing. Please double check the docs and other references before
+being trigger happy with posting a question issue.
 
 Things that will help get your question issue looked at:
 
@@ -33,4 +44,5 @@ Things that will help get your question issue looked at:
 * Clear description of the expected result.
 * Steps you have taken to debug it yourself.
 
-If you post a question and do not outline the above items or make it easy for us to understand and reproduce your issue, it will be closed.
+If you post a question and do not outline the above items or make it easy for
+us to understand and reproduce your issue, it will be closed.

From 1678613db165126306bd79ca6bda310c5cf9bb62 Mon Sep 17 00:00:00 2001
From: Rand McKinney <crandmck@yahoo.com>
Date: Wed, 15 Feb 2017 17:02:13 -0800
Subject: [PATCH 1013/1265] docs: add guide for writing readmes

closes #3209
---
 Readme-Guide.md | 125 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 125 insertions(+)
 create mode 100644 Readme-Guide.md

diff --git a/Readme-Guide.md b/Readme-Guide.md
new file mode 100644
index 00000000000..34d4648b9c2
--- /dev/null
+++ b/Readme-Guide.md
@@ -0,0 +1,125 @@
+# README guidelines
+
+Every module in the expressjs, pillarjs, and jshttp organizations should have
+a README file named `README.md`. The purpose of the README is to:
+
+- Explain the purpose of the module and how to use it.
+- Act as a landing page (both on GitHub and npmjs.com) for the module to help
+  people find it via search. Middleware module READMEs are also incorporated
+  into https://expressjs.com/en/resources/middleware.html.
+- Encourage community contributions and participation.
+
+Use the [README template](https://github.com/expressjs/express/wiki/README-template)
+to quickly create a new README file.
+
+## Top-level items
+
+**Badges** (optional): At the very top (with no subheading), include any
+applicable badges, such as npm version/downloads, build status, test coverage,
+and so on. Badges should resolve properly (not display a broken image).
+
+Possible badges include:
+- npm version: `[![NPM Version][npm-image]][npm-url]`
+- npm downloads: `[![NPM Downloads][downloads-image]][downloads-url]`
+- Build status: `[![Build Status][travis-image]][travis-url]`
+- Test coverage: `[![Test Coverage][coveralls-image]][coveralls-url]`
+- Tips: `[![Gratipay][gratipay-image]][gratipay-url]`
+
+**Summary**: Following badges, provide a one- or two-sentence description of
+what the module does. This should be the same as the npmjs.org blurb (which
+comes from the description property of `package.json`). Since npm doesn't
+handle markdown for the blurb, avoid using markdown in the summary sentence.
+
+**TOC** (Optional): For longer READMEs, provide a table of contents that has
+a relative link to each section. A tool such as
+[doctoc](https://www.npmjs.com/package/doctoc) makes it very easy to generate
+a TOC.
+
+## Overview
+
+Optionally, include a section of one or two paragraphs with more high-level
+information on what the module does, what problems it solves, why one would
+use it and how.  Don't just repeat what's in the summary.
+
+## Installation
+
+Required. This section is typically just:
+
+```sh
+$ npm install module-name
+```
+
+But include any other steps or requirements.
+
+NOTE: Use the `sh` code block to make the shell command display properly on
+the website.
+
+## Basic use
+
+- Provide a general description of how to use the module with code sample.
+  Include any important caveats or restrictions.
+- Explain the most common use cases.
+- Optional: a simple "hello world" type example (where applicable). This
+  example is in addition to the more comprehensive [example section](#examples)
+  later.
+
+## API
+
+Provide complete API documentation.
+
+Formatting conventions: Each function is listed in a 3rd-level heading (`###`),
+like this:
+
+```
+### Function_name(arg, options [, optional_arg]  ... )
+```
+
+**Options objects**
+
+For arguments that are objects (for example, options object), describe the
+properties in a table, as follows. This matches the formatting used in the
+[Express API docs](https://expressjs.com/en/4x/api.html).
+
+|Property | Description | Type | Default|
+|----------|-----------|------------|-------------|
+|Name of the property in `monospace`. | Brief description | String, Number, Boolean, etc. | If applicable.|
+
+If all the properties are required (i.e. there are no defaults), then you
+can omit the default column.
+
+Instead of very lengthy descriptions, link out to subsequent paragraphs for
+more detailed explanation of specific cases (e.g. "When this property is set
+to 'foobar', xyz happens; see &lt;link to following section &gt;.)
+
+If there are options properties that are themselves options, use additional
+tables. See [`trust proxy` and `etag` properties](https://expressjs.com/en/4x/api.html#app.settings.table).
+
+## Examples
+
+Every README should have at least one example; ideally more.  For code samples,
+be sure to use the `js` code block, for proper display in the website, e.g.:
+
+```js
+var csurf = require('csurf')
+...
+```
+
+## Tests
+
+What tests are included.
+
+How to run them.
+
+The convention for running tests is `npm test`. All our projects should follow
+this convention.
+
+## Contributors
+
+Names of module "owners" (lead developers) and other developers who have
+contributed.
+
+## License
+
+Link to the license, with a short description of what it is, e.g. "MIT" or
+whatever. Ideally, avoid putting the license text directly in the README; link
+to it instead.

From 4420a7bd94f811e4e40caa5fcf5b67ecae779d2f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 20 Feb 2017 18:25:42 -0500
Subject: [PATCH 1014/1265] docs: update link to expressjs.com website repo

---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index e9bfaeba20d..0ddc68fdc9a 100644
--- a/Readme.md
+++ b/Readme.md
@@ -37,7 +37,7 @@ $ npm install express
 
 ## Docs & Community
 
-  * [Website and Documentation](http://expressjs.com/) - [[website repo](https://github.com/strongloop/expressjs.com)]
+  * [Website and Documentation](http://expressjs.com/) - [[website repo](https://github.com/expressjs/expressjs.com)]
   * [#express](https://webchat.freenode.net/?channels=express) on freenode IRC
   * [Github Organization](https://github.com/expressjs) for Official Middleware & Modules
   * Visit the [Wiki](https://github.com/expressjs/express/wiki)

From 1a99bb051947fbf06b6b415bba06f8c83247c0d1 Mon Sep 17 00:00:00 2001
From: Mike Tunnicliffe <mike.tunnicliffe@uk.ibm.com>
Date: Mon, 15 Feb 2016 17:25:35 +0000
Subject: [PATCH 1015/1265] docs: add release guide

closes #2857
closes #2890
---
 Release-Process.md | 186 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 186 insertions(+)
 create mode 100644 Release-Process.md

diff --git a/Release-Process.md b/Release-Process.md
new file mode 100644
index 00000000000..ae740972f77
--- /dev/null
+++ b/Release-Process.md
@@ -0,0 +1,186 @@
+# Express Release Process
+
+This document contains the technical aspects of the Express release process. The
+intended audience is those who have been authorized by the Express Technical
+Committee (TC) to create, promote and sign official release builds for Express,
+as npm packages hosted on https://npmjs.com/package/express.
+
+## Who can make releases?
+
+Release authorization is given by the Express TC. Once authorized, an individual
+must have the following access permissions:
+
+### 1. Github release access
+
+The individual making the release will need to be a member of the
+expressjs/express team with Write permission level so they are able to tag the
+release commit and push changes to the expressjs/express repository
+(see Steps 4 and 5).
+
+### 2. npmjs.com release access
+
+The individual making the release will need to be made an owner on the
+`express` package on npmjs.com so they are able to publish the release
+(see Step 6).
+
+## How to publish a release
+
+Before publishing, the following preconditions should be met:
+
+- A release proposal issue or tracking pull request (see "Proposal branch"
+  below) will exist documenting:
+  - the proposed changes
+  - the type of release: patch, minor or major
+  - the version number (according to semantic versioning - http://semver.org)
+- The proposed changes should be complete.
+
+There are two main release flows: patch and non-patch.
+
+The patch flow is for making **patch releases**. As per semantic versioning,
+patch releases are for simple changes, eg: typo fixes, patch dependency updates,
+and simple/low-risk bug fixes. Every other type of change is made via the
+non-patch flow.
+
+### Branch terminology
+
+"Master branch"
+
+- There is a branch in git used for the current major version of Express, named
+  `master`.
+- This branch contains the completed commits for the next patch release of the
+  current major version.
+- Releases for the current major version are published from this branch.
+
+"Version branch"
+
+- For any given major version of Express (current, previous or next) there is
+  a branch in git for that release named `<major-version>.x` (eg: `4.x`).
+- This branch points to the commit of the latest tag for the given major version.
+
+"Release branch"
+
+- For any given major version of Express, there is a branch used for publishing
+  releases.
+- For the current major version of Express, the release branch is the
+  "Master branch" named `master`.
+- For all other major versions of Express, the release branch is the
+  "Version branch" named `<major-version>.x`.
+
+"Proposal branch"
+
+- A branch in git representing a proposed new release of Express. This can be a
+  minor or major release, named `<major-version>.0` for a major release,
+  `<major-version>.<minor-version>` for a minor release.
+- A tracking pull request should exist to document the proposed release,
+  targeted at the appropriate release branch. Prior to opening the tracking
+  pull request the content of the release may have be discussed in an issue.
+- This branch contains the commits accepted so far that implement the proposal
+  in the tracking pull request.
+
+### Patch flow
+
+In the patch flow, simple changes are committed to the release branch which
+acts as an ever-present branch for the next patch release of the associated
+major version of Express.
+
+The release branch is usually kept in a state where it is ready to release.
+Releases are made when sufficient time or change has been made to warrant it.
+This is usually proposed and decided using a github issue.
+
+### Non-patch flow
+
+In the non-patch flow, changes are committed to a temporary proposal branch
+created specifically for that release proposal. The branch is based on the
+most recent release of the major version of Express that the release targets.
+
+Releases are made when all the changes on a proposal branch are complete and
+approved. This is done by merging the proposal branch into the release branch
+(using a fast-forward merge), tagging it with the new version number and
+publishing the release package to npmjs.com.
+
+### Flow
+
+Below is a detailed description of the steps to publish a release.
+
+#### Step 1. Check the release is ready to publish
+
+Check any relevant information to ensure the release is ready, eg: any
+milestone, label, issue or tracking pull request for the release. The release
+is ready when all proposed code, tests and documentation updates are complete
+(either merged, closed or re-targeted to another release).
+
+#### Step 2. (Non-patch flow only) Merge the proposal branch into the release branch
+
+In the patch flow: skip this step.
+
+In the non-patch flow:
+```sh
+$ git checkout <release-branch>
+$ git merge --ff-only <proposal-branch>
+```
+
+<release-branch> - see "Release branch" of "Branches" above.
+<proposal-branch> - see "Proposal branch" of "Non-patch flow" above.
+
+**NOTE:** You may need to rebase the proposal branch to allow a fast-forward
+          merge. Using a fast-forward merge keeps the history clean as it does
+          not introduce merge commits.
+
+### Step 3. Update the History.md and package.json to the new version number
+
+The changes so far for the release should already be documented under the
+"unreleased" section at the top of the History.md file, as per the usual
+development practice. Change "unreleased" to the new release version / date.
+Example diff fragment:
+
+```diff
+-unreleased
+-==========
++4.13.3 / 2015-08-02
++===================
+```
+
+The version property in the package.json should already contain the version of
+the previous release. Change it to the new release version.
+
+Commit these changes together under a single commit with the message set to
+the new release version (eg: `4.13.3`):
+
+```sh
+$ git checkout <release-branch>
+<..edit files..>
+$ git add History.md package.json
+$ git commit -m '<version-number>'
+```
+
+### Step 4. Identify and tag the release commit with the new release version
+
+Create a lightweight tag (rather than an annotated tag) named after the new
+release version (eg: `4.13.3`).
+
+```sh
+$ git tag <version-number>
+```
+
+### Step 5. Push the release branch changes and tag to github
+
+The branch and tag should be pushed directly to the main repository
+(https://github.com/expressjs/express).
+
+```sh
+$ git push origin <release-branch>
+$ git push origin <version-number>
+```
+
+### Step 6. Publish to npmjs.com
+
+Ensure your local working copy is completely clean (no extra or changed files).
+You can use `git status` for this purpose.
+
+```sh
+$ npm login <npm-username>
+$ npm publish
+```
+
+**NOTE:** The version number to publish will be picked up automatically from
+          package.json.

From fefd7290376ca865e348d747592543a119a2ff98 Mon Sep 17 00:00:00 2001
From: Pravdomil <pravdomil.toman@gmail.com>
Date: Sun, 25 Dec 2016 19:28:15 +0100
Subject: [PATCH 1016/1265] Add debug message when loading view engine

closes #3158
---
 History.md  | 5 +++++
 lib/view.js | 4 +++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 4a706a4d104..e78bd75083d 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Add debug message when loading view engine
+
 4.14.1 / 2017-01-28
 ===================
 
diff --git a/lib/view.js b/lib/view.js
index 52415d4c28b..1728725d291 100644
--- a/lib/view.js
+++ b/lib/view.js
@@ -75,7 +75,9 @@ function View(name, options) {
 
   if (!opts.engines[this.ext]) {
     // load engine
-    opts.engines[this.ext] = require(this.ext.substr(1)).__express;
+    var mod = this.ext.substr(1)
+    debug('require "%s"', mod)
+    opts.engines[this.ext] = require(mod).__express
   }
 
   // store loaded engine

From bbed8021c6f634b5eeec52f0f70666f76c78e918 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Feb 2017 00:58:46 -0500
Subject: [PATCH 1017/1265] build: support Node.js 7.x

---
 .travis.yml  | 1 +
 appveyor.yml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 924fd00a2aa..c8220d9b83a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,6 +8,7 @@ node_js:
   - "4.7"
   - "5.12"
   - "6.9"
+  - "7.5"
 sudo: false
 cache:
   directories:
diff --git a/appveyor.yml b/appveyor.yml
index 72f86987907..4717f2735a8 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -8,6 +8,7 @@ environment:
     - nodejs_version: "4.7"
     - nodejs_version: "5.12"
     - nodejs_version: "6.9"
+    - nodejs_version: "7.5"
 cache:
   - node_modules
 install:

From c63424a0a11a29c067dd0e6ae284d6d821917f32 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Feb 2017 01:22:17 -0500
Subject: [PATCH 1018/1265] deps: debug@2.6.1

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e78bd75083d..17a6027733e 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,12 @@ unreleased
 ==========
 
   * Add debug message when loading view engine
+  * deps: debug@2.6.1
+    - Allow colors in workers
+    - Deprecated `DEBUG_FD` environment variable set to `3` or higher
+    - Fix error when running under React Native
+    - Use same color for same namespace
+    - deps: ms@0.7.2
 
 4.14.1 / 2017-01-28
 ===================
diff --git a/package.json b/package.json
index 72b266a3afb..28a07ea618b 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "content-type": "~1.0.2",
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
-    "debug": "~2.2.0",
+    "debug": "2.6.1",
     "depd": "~1.1.0",
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",

From 906164b204efa1e27af16468ad2cd2b1532212b0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Feb 2017 01:23:51 -0500
Subject: [PATCH 1019/1265] deps: qs@6.3.1

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 17a6027733e..c46cda0d152 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,9 @@ unreleased
     - Fix error when running under React Native
     - Use same color for same namespace
     - deps: ms@0.7.2
+  * deps: qs@6.3.1
+    - Fix array parsing from skipping empty values
+    - Fix compacting nested arrays
 
 4.14.1 / 2017-01-28
 ===================
diff --git a/package.json b/package.json
index 28a07ea618b..dfe12046f7f 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "parseurl": "~1.3.1",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~1.1.3",
-    "qs": "6.2.0",
+    "qs": "6.3.1",
     "range-parser": "~1.2.0",
     "send": "0.14.2",
     "serve-static": "~1.11.2",

From 485b6f86ac43814c2b596f14648f8b6e1a373a11 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=81ngel=20Sanz?= <angelsanzgit@gmail.com>
Date: Tue, 4 Aug 2015 00:28:54 +0200
Subject: [PATCH 1020/1265] perf: improve req.ips performance

closes #2723
---
 History.md     | 1 +
 lib/request.js | 7 ++++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c46cda0d152..c7410703e72 100644
--- a/History.md
+++ b/History.md
@@ -11,6 +11,7 @@ unreleased
   * deps: qs@6.3.1
     - Fix array parsing from skipping empty values
     - Fix compacting nested arrays
+  * perf: improve `req.ips` performance
 
 4.14.1 / 2017-01-28
 ===================
diff --git a/lib/request.js b/lib/request.js
index 513c9bf3d46..78945e5da7a 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -356,7 +356,12 @@ defineGetter(req, 'ip', function ip(){
 defineGetter(req, 'ips', function ips() {
   var trust = this.app.get('trust proxy fn');
   var addrs = proxyaddr.all(this, trust);
-  return addrs.slice(1).reverse();
+
+  // reverse the order (to farthest -> closest)
+  // and remove socket address
+  addrs.reverse().pop()
+
+  return addrs
 });
 
 /**

From 92c859dd055646077607619a2df79243bc8a431f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 18 Feb 2017 22:14:58 -0500
Subject: [PATCH 1021/1265] deps: finalhandler@~1.0.0

---
 History.md         | 7 +++++++
 package.json       | 2 +-
 test/app.router.js | 2 +-
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index c7410703e72..acad7d288e0 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,13 @@ unreleased
     - Fix error when running under React Native
     - Use same color for same namespace
     - deps: ms@0.7.2
+  * deps: finalhandler@~1.0.0
+    - Fix exception when `err` cannot be converted to a string
+    - Fully URL-encode the pathname in the 404
+    - Only include the pathname in the 404 message
+    - Send complete HTML document
+    - Set `Content-Security-Policy: default-src 'self'` header
+    - deps: debug@2.6.1
   * deps: qs@6.3.1
     - Fix array parsing from skipping empty values
     - Fix compacting nested arrays
diff --git a/package.json b/package.json
index dfe12046f7f..08aea3e25fb 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.7.0",
-    "finalhandler": "0.5.1",
+    "finalhandler": "~1.0.0",
     "fresh": "0.3.0",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",
diff --git a/test/app.router.js b/test/app.router.js
index 6d41778c038..301f9b86af0 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -77,7 +77,7 @@ describe('app.router', function(){
 
       request(app)
       .get('/')
-      .expect(404, 'Cannot GET /\n', cb);
+      .expect(404, cb)
 
       request(app)
       .delete('/')

From f2bbd10ae7abadae174b3cf9beb5d944dea4a90b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 18 Feb 2017 22:17:52 -0500
Subject: [PATCH 1022/1265] deps: update example dependencies

---
 package.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 08aea3e25fb..10cabda8ceb 100644
--- a/package.json
+++ b/package.json
@@ -56,15 +56,15 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "body-parser": "1.16.0",
+    "body-parser": "1.16.1",
     "cookie-parser": "~1.4.3",
-    "ejs": "2.5.5",
-    "express-session": "1.15.0",
+    "ejs": "2.5.6",
+    "express-session": "1.15.1",
     "istanbul": "0.4.5",
     "marked": "0.3.6",
-    "method-override": "~2.3.6",
+    "method-override": "2.3.7",
     "mocha": "3.2.0",
-    "morgan": "~1.7.0",
+    "morgan": "1.8.1",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",
     "should": "11.2.0",

From 9f4dbae083264898a65ee2d187b1ae0302814148 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 18 Feb 2017 22:49:04 -0500
Subject: [PATCH 1023/1265] deps: etag@~1.8.0

---
 History.md       |  3 +++
 package.json     |  2 +-
 test/res.send.js | 16 ++++++++--------
 test/utils.js    | 16 ++++++++--------
 4 files changed, 20 insertions(+), 17 deletions(-)

diff --git a/History.md b/History.md
index acad7d288e0..c63b9a45b60 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,9 @@ unreleased
     - Fix error when running under React Native
     - Use same color for same namespace
     - deps: ms@0.7.2
+  * deps: etag@~1.8.0
+    - Use SHA1 instead of MD5 for ETag hashing
+    - Works with FIPS 140-2 OpenSSL configuration
   * deps: finalhandler@~1.0.0
     - Fix exception when `err` cannot be converted to a string
     - Fully URL-encode the pathname in the 404
diff --git a/package.json b/package.json
index 10cabda8ceb..b313d14d67d 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "depd": "~1.1.0",
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
-    "etag": "~1.7.0",
+    "etag": "~1.8.0",
     "finalhandler": "~1.0.0",
     "fresh": "0.3.0",
     "merge-descriptors": "1.0.1",
diff --git a/test/res.send.js b/test/res.send.js
index 719424657c4..f2e7d759c15 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -133,7 +133,7 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('ETag', 'W/"3e7-VYgCBglFKiDVAcpzPNt4Sg"')
+      .expect('ETag', 'W/"3e7-qPnkJ3CVdVhFJQvUBfF10TmVA7g"')
       .expect(200, done);
     })
 
@@ -201,7 +201,7 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('ETag', 'W/"3e7-VYgCBglFKiDVAcpzPNt4Sg"')
+      .expect('ETag', 'W/"3e7-qPnkJ3CVdVhFJQvUBfF10TmVA7g"')
       .expect(200, done);
     })
 
@@ -355,7 +355,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('ETag', 'W/"c-ZUfd0NJ26qwjlKF4r8qb2g"')
+        .expect('ETag', 'W/"c-IgR/L5SF7CJQff4wxKGF/vfPuZ0"')
         .expect(200, done);
       });
 
@@ -371,7 +371,7 @@ describe('res', function(){
 
           request(app)
           [method]('/')
-          .expect('ETag', 'W/"c-ZUfd0NJ26qwjlKF4r8qb2g"')
+          .expect('ETag', 'W/"c-IgR/L5SF7CJQff4wxKGF/vfPuZ0"')
           .expect(200, done);
         })
       });
@@ -387,7 +387,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('ETag', 'W/"0-1B2M2Y8AsgTpgAmY7PhCfg"')
+        .expect('ETag', 'W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"')
         .expect(200, done);
       })
 
@@ -403,7 +403,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('ETag', 'W/"3e7-VYgCBglFKiDVAcpzPNt4Sg"')
+        .expect('ETag', 'W/"3e7-qPnkJ3CVdVhFJQvUBfF10TmVA7g"')
         .expect(200, done);
       });
 
@@ -485,7 +485,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('ETag', '"d-Otu60XkfuuPskIiUxJY4cA"')
+        .expect('ETag', '"d-HwnTDHB9U/PRbFMN1z1wps51lqk"')
         .expect(200, done);
       })
     })
@@ -502,7 +502,7 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect('ETag', 'W/"d-Otu60XkfuuPskIiUxJY4cA"')
+        .expect('ETag', 'W/"d-HwnTDHB9U/PRbFMN1z1wps51lqk"')
         .expect(200, done)
       })
     })
diff --git a/test/utils.js b/test/utils.js
index b6731962601..c49019fe126 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -5,23 +5,23 @@ var utils = require('../lib/utils');
 describe('utils.etag(body, encoding)', function(){
   it('should support strings', function(){
     utils.etag('express!')
-    .should.eql('"8-zZdv4imtWD49AHEviejT6A"')
+    .should.eql('"8-O2uVAFaQ1rZvlKLT14RnuvjPIdg"')
   })
 
   it('should support utf8 strings', function(){
     utils.etag('express❤', 'utf8')
-    .should.eql('"a-fsFba4IxwQS6h6Umb+FNxw"')
+    .should.eql('"a-JBiXf7GyzxwcrxY4hVXUwa7tmks"')
   })
 
   it('should support buffer', function(){
     var buf = new Buffer('express!')
     utils.etag(buf)
-    .should.eql('"8-zZdv4imtWD49AHEviejT6A"');
+    .should.eql('"8-O2uVAFaQ1rZvlKLT14RnuvjPIdg"')
   })
 
   it('should support empty string', function(){
     utils.etag('')
-    .should.eql('"0-1B2M2Y8AsgTpgAmY7PhCfg"');
+    .should.eql('"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"')
   })
 })
 
@@ -50,23 +50,23 @@ describe('utils.setCharset(type, charset)', function () {
 describe('utils.wetag(body, encoding)', function(){
   it('should support strings', function(){
     utils.wetag('express!')
-    .should.eql('W/"8-zZdv4imtWD49AHEviejT6A"')
+    .should.eql('W/"8-O2uVAFaQ1rZvlKLT14RnuvjPIdg"')
   })
 
   it('should support utf8 strings', function(){
     utils.wetag('express❤', 'utf8')
-    .should.eql('W/"a-fsFba4IxwQS6h6Umb+FNxw"')
+    .should.eql('W/"a-JBiXf7GyzxwcrxY4hVXUwa7tmks"')
   })
 
   it('should support buffer', function(){
     var buf = new Buffer('express!')
     utils.wetag(buf)
-    .should.eql('W/"8-zZdv4imtWD49AHEviejT6A"');
+    .should.eql('W/"8-O2uVAFaQ1rZvlKLT14RnuvjPIdg"')
   })
 
   it('should support empty string', function(){
     utils.wetag('')
-    .should.eql('W/"0-1B2M2Y8AsgTpgAmY7PhCfg"');
+    .should.eql('W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"')
   })
 })
 

From cd7d241a5d07eb8fa3df025e96759ee15800e661 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 20 Feb 2017 21:29:19 -0500
Subject: [PATCH 1024/1265] build: test against Node.js 8.x nightly

---
 .travis.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index c8220d9b83a..e6139739cc4 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,6 +9,13 @@ node_js:
   - "5.12"
   - "6.9"
   - "7.5"
+matrix:
+  include:
+    - node_js: "8.0"
+      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
+  allow_failures:
+    # Allow the nightly installs to fail
+    - env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
 sudo: false
 cache:
   directories:

From f87abb34934c21926f0315162159e4acf7d7dae8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 20 Feb 2017 21:39:22 -0500
Subject: [PATCH 1025/1265] Remove usage of res._headers private field

closes #3174
---
 History.md        |  2 ++
 lib/request.js    | 10 +++++++---
 test/req.fresh.js |  2 +-
 test/req.stale.js |  2 +-
 4 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index c63b9a45b60..755ba7456c4 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,8 @@ unreleased
 ==========
 
   * Add debug message when loading view engine
+  * Remove usage of `res._headers` private field
+    - Improves compatibility with Node.js 8 nightly
   * deps: debug@2.6.1
     - Allow colors in workers
     - Deprecated `DEBUG_FD` environment variable set to `3` or higher
diff --git a/lib/request.js b/lib/request.js
index 78945e5da7a..fdebbcdbe18 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -452,14 +452,18 @@ defineGetter(req, 'host', deprecate.function(function host(){
 
 defineGetter(req, 'fresh', function(){
   var method = this.method;
-  var s = this.res.statusCode;
+  var res = this.res
+  var status = res.statusCode
 
   // GET or HEAD for weak freshness validation only
   if ('GET' !== method && 'HEAD' !== method) return false;
 
   // 2xx or 304 as per rfc2616 14.26
-  if ((s >= 200 && s < 300) || 304 === s) {
-    return fresh(this.headers, (this.res._headers || {}));
+  if ((status >= 200 && status < 300) || 304 === status) {
+    return fresh(this.headers, {
+      'etag': res.get('ETag'),
+      'last-modified': res.get('Last-Modified')
+    })
   }
 
   return false;
diff --git a/test/req.fresh.js b/test/req.fresh.js
index 0f1aa982ad2..1aa8fa5b217 100644
--- a/test/req.fresh.js
+++ b/test/req.fresh.js
@@ -36,8 +36,8 @@ describe('req', function(){
     it('should return false without response headers', function(done){
       var app = express();
 
+      app.disable('x-powered-by')
       app.use(function(req, res){
-        res._headers = null;
         res.send(req.fresh);
       });
 
diff --git a/test/req.stale.js b/test/req.stale.js
index c92c5a9fb8d..30c9d05d51c 100644
--- a/test/req.stale.js
+++ b/test/req.stale.js
@@ -36,8 +36,8 @@ describe('req', function(){
     it('should return true without response headers', function(done){
       var app = express();
 
+      app.disable('x-powered-by')
       app.use(function(req, res){
-        res._headers = null;
         res.send(req.stale);
       });
 

From a9f15aaefc396b487f18d583b1a3c39ee53e1db6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 22 Feb 2017 02:11:06 -0500
Subject: [PATCH 1026/1265] deps: fresh@0.5.0

---
 History.md   | 12 ++++++++++++
 package.json |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 755ba7456c4..7e90ca96f93 100644
--- a/History.md
+++ b/History.md
@@ -20,6 +20,18 @@ unreleased
     - Send complete HTML document
     - Set `Content-Security-Policy: default-src 'self'` header
     - deps: debug@2.6.1
+  * deps: fresh@0.5.0
+    - Fix false detection of `no-cache` request directive
+    - Fix incorrect result when `If-None-Match` has both `*` and ETags
+    - Fix weak `ETag` matching to match spec
+    - perf: delay reading header values until needed
+    - perf: enable strict mode
+    - perf: hoist regular expressions
+    - perf: remove duplicate conditional
+    - perf: remove unnecessary boolean coercions
+    - perf: skip checking modified time if ETag check failed
+    - perf: skip parsing `If-None-Match` when no `ETag` header
+    - perf: use `Date.parse` instead of `new Date`
   * deps: qs@6.3.1
     - Fix array parsing from skipping empty values
     - Fix compacting nested arrays
diff --git a/package.json b/package.json
index b313d14d67d..417df65d53a 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "escape-html": "~1.0.3",
     "etag": "~1.8.0",
     "finalhandler": "~1.0.0",
-    "fresh": "0.3.0",
+    "fresh": "0.5.0",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",
     "on-finished": "~2.3.0",

From 034165caeb558560c19a0b3105d913c11999cdd0 Mon Sep 17 00:00:00 2001
From: Wes <wes@wesleytodd.com>
Date: Mon, 20 Feb 2017 15:32:33 -0600
Subject: [PATCH 1027/1265] Use statuses instead of http module for status
 messages

closes #3215
---
 History.md           |  1 +
 lib/response.js      | 10 +++++-----
 package.json         |  1 +
 test/res.redirect.js |  9 ++++-----
 4 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/History.md b/History.md
index 7e90ca96f93..a74b4c058b7 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,7 @@ unreleased
   * Add debug message when loading view engine
   * Remove usage of `res._headers` private field
     - Improves compatibility with Node.js 8 nightly
+  * Use `statuses` instead of `http` module for status messages
   * deps: debug@2.6.1
     - Allow colors in workers
     - Deprecated `DEBUG_FD` environment variable set to `3` or higher
diff --git a/lib/response.js b/lib/response.js
index 6128f450a94..42bc196dfae 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -20,12 +20,12 @@ var http = require('http');
 var isAbsolute = require('./utils').isAbsolute;
 var onFinished = require('on-finished');
 var path = require('path');
+var statuses = require('statuses')
 var merge = require('utils-merge');
 var sign = require('cookie-signature').sign;
 var normalizeType = require('./utils').normalizeType;
 var normalizeTypes = require('./utils').normalizeTypes;
 var setCharset = require('./utils').setCharset;
-var statusCodes = http.STATUS_CODES;
 var cookie = require('cookie');
 var send = require('send');
 var extname = path.extname;
@@ -129,7 +129,7 @@ res.send = function send(body) {
 
     deprecate('res.send(status): Use res.sendStatus(status) instead');
     this.statusCode = chunk;
-    chunk = statusCodes[chunk];
+    chunk = statuses[chunk]
   }
 
   switch (typeof chunk) {
@@ -334,7 +334,7 @@ res.jsonp = function jsonp(obj) {
  */
 
 res.sendStatus = function sendStatus(statusCode) {
-  var body = statusCodes[statusCode] || String(statusCode);
+  var body = statuses[statusCode] || String(statusCode)
 
   this.statusCode = statusCode;
   this.type('txt');
@@ -876,12 +876,12 @@ res.redirect = function redirect(url) {
   // Support text/{plain,html} by default
   this.format({
     text: function(){
-      body = statusCodes[status] + '. Redirecting to ' + address;
+      body = statuses[status] + '. Redirecting to ' + address
     },
 
     html: function(){
       var u = escapeHtml(address);
-      body = '<p>' + statusCodes[status] + '. Redirecting to <a href="' + u + '">' + u + '</a></p>';
+      body = '<p>' + statuses[status] + '. Redirecting to <a href="' + u + '">' + u + '</a></p>'
     },
 
     default: function(){
diff --git a/package.json b/package.json
index 417df65d53a..36d83cb9660 100644
--- a/package.json
+++ b/package.json
@@ -50,6 +50,7 @@
     "range-parser": "~1.2.0",
     "send": "0.14.2",
     "serve-static": "~1.11.2",
+    "statuses": "~1.3.1",
     "type-is": "~1.6.14",
     "utils-merge": "1.0.0",
     "vary": "~1.1.0"
diff --git a/test/res.redirect.js b/test/res.redirect.js
index 9f3bd436763..755bb1c1c6c 100644
--- a/test/res.redirect.js
+++ b/test/res.redirect.js
@@ -1,5 +1,4 @@
 
-var http = require('http');
 var express = require('..');
 var request = require('supertest');
 var utils = require('./support/utils');
@@ -104,7 +103,7 @@ describe('res', function(){
       .set('Accept', 'text/html')
       .expect('Content-Type', /html/)
       .expect('Location', 'http://google.com')
-      .expect(302, '<p>' + http.STATUS_CODES[302] + '. Redirecting to <a href="http://google.com">http://google.com</a></p>', done);
+      .expect(302, '<p>Found. Redirecting to <a href="http://google.com">http://google.com</a></p>', done)
     })
 
     it('should escape the url', function(done){
@@ -120,7 +119,7 @@ describe('res', function(){
       .set('Accept', 'text/html')
       .expect('Content-Type', /html/)
       .expect('Location', '%3Cla\'me%3E')
-      .expect(302, '<p>' + http.STATUS_CODES[302] + '. Redirecting to <a href="%3Cla&#39;me%3E">%3Cla&#39;me%3E</a></p>', done)
+      .expect(302, '<p>Found. Redirecting to <a href="%3Cla&#39;me%3E">%3Cla&#39;me%3E</a></p>', done)
     })
 
     it('should include the redirect type', function(done){
@@ -152,7 +151,7 @@ describe('res', function(){
       .set('Accept', 'text/plain, */*')
       .expect('Content-Type', /plain/)
       .expect('Location', 'http://google.com')
-      .expect(302, http.STATUS_CODES[302] + '. Redirecting to http://google.com', done);
+      .expect(302, 'Found. Redirecting to http://google.com', done)
     })
 
     it('should encode the url', function(done){
@@ -168,7 +167,7 @@ describe('res', function(){
       .set('Accept', 'text/plain, */*')
       .expect('Content-Type', /plain/)
       .expect('Location', 'http://example.com/?param=%3Cscript%3Ealert(%22hax%22);%3C/script%3E')
-      .expect(302, http.STATUS_CODES[302] + '. Redirecting to http://example.com/?param=%3Cscript%3Ealert(%22hax%22);%3C/script%3E', done)
+      .expect(302, 'Found. Redirecting to http://example.com/?param=%3Cscript%3Ealert(%22hax%22);%3C/script%3E', done)
     })
 
     it('should include the redirect type', function(done){

From 8de1230d039f4391a8c7227e8ce702f280b72e33 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 22 Feb 2017 23:03:20 -0500
Subject: [PATCH 1028/1265] lint: remove unreachable code

---
 lib/router/index.js | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/lib/router/index.js b/lib/router/index.js
index dac2514815b..29183d561e1 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -351,11 +351,6 @@ proto.process_params = function process_params(layer, called, req, res, done) {
 
     paramIndex = 0;
     key = keys[i++];
-
-    if (!key) {
-      return done();
-    }
-
     name = key.name;
     paramVal = req.params[name];
     paramCallbacks = params[name];

From 7bc5f1af968175ddb492cc436a37fc53a8026175 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 22 Feb 2017 23:09:36 -0500
Subject: [PATCH 1029/1265] lint: consolidate layer match failure path

---
 lib/router/layer.js | 32 +++++++++++++++-----------------
 1 file changed, 15 insertions(+), 17 deletions(-)

diff --git a/lib/router/layer.js b/lib/router/layer.js
index fe9210cb9de..e2afb9723db 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -108,23 +108,21 @@ Layer.prototype.handle_request = function handle(req, res, next) {
  */
 
 Layer.prototype.match = function match(path) {
-  if (path == null) {
-    // no path, nothing matches
-    this.params = undefined;
-    this.path = undefined;
-    return false;
-  }
+  var match
+
+  if (path != null) {
+    if (this.regexp.fast_slash) {
+      // fast path non-ending match for / (everything matches)
+      this.params = {}
+      this.path = ''
+      return true
+    }
 
-  if (this.regexp.fast_slash) {
-    // fast path non-ending match for / (everything matches)
-    this.params = {};
-    this.path = '';
-    return true;
+    // match the path
+    match = this.regexp.exec(path)
   }
 
-  var m = this.regexp.exec(path);
-
-  if (!m) {
+  if (!match) {
     this.params = undefined;
     this.path = undefined;
     return false;
@@ -132,15 +130,15 @@ Layer.prototype.match = function match(path) {
 
   // store values
   this.params = {};
-  this.path = m[0];
+  this.path = match[0]
 
   var keys = this.keys;
   var params = this.params;
 
-  for (var i = 1; i < m.length; i++) {
+  for (var i = 1; i < match.length; i++) {
     var key = keys[i - 1];
     var prop = key.name;
-    var val = decode_param(m[i]);
+    var val = decode_param(match[i])
 
     if (val !== undefined || !(hasOwnProperty.call(params, prop))) {
       params[prop] = val;

From 668f545fd4f69cb27dccc6c2d7a21c1637e84933 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 22 Feb 2017 23:42:57 -0500
Subject: [PATCH 1030/1265] Skip routing when req.url is not set

---
 History.md          |  1 +
 lib/router/index.js | 24 +++++++++++++++++++-----
 test/Router.js      | 10 ++++++++++
 3 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index a74b4c058b7..f218fb578b3 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,7 @@ unreleased
   * Add debug message when loading view engine
   * Remove usage of `res._headers` private field
     - Improves compatibility with Node.js 8 nightly
+  * Skip routing when `req.url` is not set
   * Use `statuses` instead of `http` module for status messages
   * deps: debug@2.6.1
     - Allow colors in workers
diff --git a/lib/router/index.js b/lib/router/index.js
index 29183d561e1..83ad8b500f4 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -137,11 +137,8 @@ proto.handle = function handle(req, res, out) {
 
   debug('dispatching %s %s', req.method, req.url);
 
-  var search = 1 + req.url.indexOf('?');
-  var pathlength = search ? search - 1 : req.url.length;
-  var fqdn = req.url[0] !== '/' && 1 + req.url.substr(0, pathlength).indexOf('://');
-  var protohost = fqdn ? req.url.substr(0, req.url.indexOf('/', 2 + fqdn)) : '';
   var idx = 0;
+  var protohost = getProtohost(req.url) || ''
   var removed = '';
   var slashAdded = false;
   var paramcalled = {};
@@ -293,7 +290,7 @@ proto.handle = function handle(req, res, out) {
       req.url = protohost + req.url.substr(protohost.length + removed.length);
 
       // Ensure leading slash
-      if (!fqdn && req.url[0] !== '/') {
+      if (!protohost && req.url[0] !== '/') {
         req.url = '/' + req.url;
         slashAdded = true;
       }
@@ -526,6 +523,23 @@ function getPathname(req) {
   }
 }
 
+// Get get protocol + host for a URL
+function getProtohost(url) {
+  if (typeof url !== 'string' || url.length === 0 || url[0] === '/') {
+    return undefined
+  }
+
+  var searchIndex = url.indexOf('?')
+  var pathLength = searchIndex !== -1
+    ? searchIndex
+    : url.length
+  var fqdnIndex = url.substr(0, pathLength).indexOf('://')
+
+  return fqdnIndex !== -1
+    ? url.substr(0, url.indexOf('/', 3 + fqdnIndex))
+    : undefined
+}
+
 // get type for error message
 function gettype(obj) {
   var type = typeof obj;
diff --git a/test/Router.js b/test/Router.js
index 21cdff2c6c0..41cd149e8eb 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -53,6 +53,16 @@ describe('Router', function(){
     router.handle({ url: '', method: 'GET' }, {}, done);
   });
 
+  it('should handle missing URL', function (done) {
+    var router = new Router()
+
+    router.use(function (req, res) {
+      throw new Error('should not be called')
+    })
+
+    router.handle({ method: 'GET' }, {}, done)
+  })
+
   it('should not stack overflow with many registered routes', function(done){
     var handler = function(req, res){ res.end(new Error('wrong handler')) };
     var router = new Router();

From 12ff56e1e44eb0126d777205b53c31c247ee9293 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Feb 2017 01:52:49 -0500
Subject: [PATCH 1031/1265] Use Object.create to setup request & response
 prototypes

---
 History.md      |  1 +
 lib/express.js  | 12 ++++++++++--
 lib/request.js  | 12 +++++++++---
 lib/response.js | 12 +++++++++---
 4 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/History.md b/History.md
index f218fb578b3..be606575bef 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
   * Remove usage of `res._headers` private field
     - Improves compatibility with Node.js 8 nightly
   * Skip routing when `req.url` is not set
+  * Use `Object.create` to setup request & response prototypes
   * Use `statuses` instead of `http` module for status messages
   * deps: debug@2.6.1
     - Allow colors in workers
diff --git a/lib/express.js b/lib/express.js
index 540c8be6f41..187e4e2d7ca 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -41,8 +41,16 @@ function createApplication() {
   mixin(app, EventEmitter.prototype, false);
   mixin(app, proto, false);
 
-  app.request = { __proto__: req, app: app };
-  app.response = { __proto__: res, app: app };
+  // expose the prototype that will get set on requests
+  app.request = Object.create(req, {
+    app: { configurable: true, enumerable: true, writable: true, value: app }
+  })
+
+  // expose the prototype that will get set on responses
+  app.response = Object.create(res, {
+    app: { configurable: true, enumerable: true, writable: true, value: app }
+  })
+
   app.init();
   return app;
 }
diff --git a/lib/request.js b/lib/request.js
index fdebbcdbe18..3432e6776fe 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -25,11 +25,17 @@ var proxyaddr = require('proxy-addr');
 
 /**
  * Request prototype.
+ * @public
  */
 
-var req = exports = module.exports = {
-  __proto__: http.IncomingMessage.prototype
-};
+var req = Object.create(http.IncomingMessage.prototype)
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = req
 
 /**
  * Return request header.
diff --git a/lib/response.js b/lib/response.js
index 42bc196dfae..6aefe1b1782 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -35,11 +35,17 @@ var vary = require('vary');
 
 /**
  * Response prototype.
+ * @public
  */
 
-var res = module.exports = {
-  __proto__: http.ServerResponse.prototype
-};
+var res = Object.create(http.ServerResponse.prototype)
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = res
 
 /**
  * Module variables.

From 6022567c754a8f1d0b117168b67324da7200fa3c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Feb 2017 01:56:58 -0500
Subject: [PATCH 1032/1265] Use setprototypeof module to replace __proto__
 setting

closes #1967
closes #2613
closes #3103
closes #3164
---
 History.md             |  1 +
 lib/application.js     | 13 +++++++------
 lib/middleware/init.js | 11 +++++++++--
 lib/router/index.js    |  3 ++-
 package.json           |  1 +
 5 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/History.md b/History.md
index be606575bef..5e12afa9957 100644
--- a/History.md
+++ b/History.md
@@ -6,6 +6,7 @@ unreleased
     - Improves compatibility with Node.js 8 nightly
   * Skip routing when `req.url` is not set
   * Use `Object.create` to setup request & response prototypes
+  * Use `setprototypeof` module to replace `__proto__` setting
   * Use `statuses` instead of `http` module for status messages
   * deps: debug@2.6.1
     - Allow colors in workers
diff --git a/lib/application.js b/lib/application.js
index 0ee4def3890..0fe0eb44023 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -28,6 +28,7 @@ var deprecate = require('depd')('express');
 var flatten = require('array-flatten');
 var merge = require('utils-merge');
 var resolve = require('path').resolve;
+var setPrototyeOf = require('setprototypeof')
 var slice = Array.prototype.slice;
 
 /**
@@ -94,10 +95,10 @@ app.defaultConfiguration = function defaultConfiguration() {
     }
 
     // inherit protos
-    this.request.__proto__ = parent.request;
-    this.response.__proto__ = parent.response;
-    this.engines.__proto__ = parent.engines;
-    this.settings.__proto__ = parent.settings;
+    setPrototyeOf(this.request, parent.request)
+    setPrototyeOf(this.response, parent.response)
+    setPrototyeOf(this.engines, parent.engines)
+    setPrototyeOf(this.settings, parent.settings)
   });
 
   // setup locals
@@ -227,8 +228,8 @@ app.use = function use(fn) {
     router.use(path, function mounted_app(req, res, next) {
       var orig = req.app;
       fn.handle(req, res, function (err) {
-        req.__proto__ = orig.request;
-        res.__proto__ = orig.response;
+        setPrototyeOf(req, orig.request)
+        setPrototyeOf(res, orig.response)
         next(err);
       });
     });
diff --git a/lib/middleware/init.js b/lib/middleware/init.js
index f3119ed3a15..328c4a863d9 100644
--- a/lib/middleware/init.js
+++ b/lib/middleware/init.js
@@ -8,6 +8,13 @@
 
 'use strict';
 
+/**
+ * Module dependencies.
+ * @private
+ */
+
+var setPrototyeOf = require('setprototypeof')
+
 /**
  * Initialization middleware, exposing the
  * request and response to each other, as well
@@ -25,8 +32,8 @@ exports.init = function(app){
     res.req = req;
     req.next = next;
 
-    req.__proto__ = app.request;
-    res.__proto__ = app.response;
+    setPrototyeOf(req, app.request)
+    setPrototyeOf(res, app.response)
 
     res.locals = res.locals || Object.create(null);
 
diff --git a/lib/router/index.js b/lib/router/index.js
index 83ad8b500f4..2c4239eba18 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -21,6 +21,7 @@ var debug = require('debug')('express:router');
 var deprecate = require('depd')('express');
 var flatten = require('array-flatten');
 var parseUrl = require('parseurl');
+var setPrototypeOf = require('setprototypeof')
 
 /**
  * Module variables.
@@ -47,7 +48,7 @@ var proto = module.exports = function(options) {
   }
 
   // mixin Router class functions
-  router.__proto__ = proto;
+  setPrototypeOf(router, proto)
 
   router.params = {};
   router._params = [];
diff --git a/package.json b/package.json
index 36d83cb9660..daa1580b2ff 100644
--- a/package.json
+++ b/package.json
@@ -50,6 +50,7 @@
     "range-parser": "~1.2.0",
     "send": "0.14.2",
     "serve-static": "~1.11.2",
+    "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",
     "type-is": "~1.6.14",
     "utils-merge": "1.0.0",

From 1b43166fcafceedf50d588abf09224d33cc93507 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 25 Feb 2017 17:53:34 -0500
Subject: [PATCH 1033/1265] deps: send@0.15.0

---
 History.md   | 12 ++++++++++++
 package.json |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5e12afa9957..67f353843f2 100644
--- a/History.md
+++ b/History.md
@@ -39,6 +39,18 @@ unreleased
   * deps: qs@6.3.1
     - Fix array parsing from skipping empty values
     - Fix compacting nested arrays
+  * deps: send@0.15.0
+    - Fix false detection of `no-cache` request directive
+    - Fix incorrect result when `If-None-Match` has both `*` and ETags
+    - Fix weak `ETag` matching to match spec
+    - Remove usage of `res._headers` private field
+    - Support `If-Match` and `If-Unmodified-Since` headers
+    - Use `res.getHeaderNames()` when available
+    - Use `res.headersSent` when available
+    - deps: debug@2.6.1
+    - deps: etag@~1.8.0
+    - deps: fresh@0.5.0
+    - deps: http-errors@~1.6.1
   * perf: improve `req.ips` performance
 
 4.14.1 / 2017-01-28
diff --git a/package.json b/package.json
index daa1580b2ff..9bc995e3205 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "proxy-addr": "~1.1.3",
     "qs": "6.3.1",
     "range-parser": "~1.2.0",
-    "send": "0.14.2",
+    "send": "0.15.0",
     "serve-static": "~1.11.2",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",

From acc4a619d93c86b526af9d850407464f8e404b8f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 25 Feb 2017 19:31:39 -0500
Subject: [PATCH 1034/1265] deps: serve-static@1.12.0

---
 History.md   | 11 +++++++++++
 package.json |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 67f353843f2..14103f267f8 100644
--- a/History.md
+++ b/History.md
@@ -51,6 +51,17 @@ unreleased
     - deps: etag@~1.8.0
     - deps: fresh@0.5.0
     - deps: http-errors@~1.6.1
+  * deps: serve-static@1.12.0
+    - Fix false detection of `no-cache` request directive
+    - Fix incorrect result when `If-None-Match` has both `*` and ETags
+    - Fix weak `ETag` matching to match spec
+    - Remove usage of `res._headers` private field
+    - Send complete HTML document in redirect response
+    - Set default CSP header in redirect response
+    - Support `If-Match` and `If-Unmodified-Since` headers
+    - Use `res.getHeaderNames()` when available
+    - Use `res.headersSent` when available
+    - deps: send@0.15.0
   * perf: improve `req.ips` performance
 
 4.14.1 / 2017-01-28
diff --git a/package.json b/package.json
index 9bc995e3205..79b3b0e31c5 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "qs": "6.3.1",
     "range-parser": "~1.2.0",
     "send": "0.15.0",
-    "serve-static": "~1.11.2",
+    "serve-static": "1.12.0",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",
     "type-is": "~1.6.14",

From 1f71fae23be00f44bdfef212cc16868dd8cd5954 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 26 Feb 2017 13:21:18 -0500
Subject: [PATCH 1035/1265] tests: add lone "*" route tests

---
 test/app.router.js | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/test/app.router.js b/test/app.router.js
index 301f9b86af0..1bba62e270f 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -563,6 +563,30 @@ describe('app.router', function(){
   })
 
   describe('*', function(){
+    it('should capture everything', function (done) {
+      var app = express()
+
+      app.get('*', function (req, res) {
+        res.end(req.params[0])
+      })
+
+      request(app)
+      .get('/user/tobi.json')
+      .expect('/user/tobi.json', done)
+    })
+
+    it('should decore the capture', function (done) {
+      var app = express()
+
+      app.get('*', function (req, res) {
+        res.end(req.params[0])
+      })
+
+      request(app)
+      .get('/user/tobi%20and%20loki.json')
+      .expect('/user/tobi and loki.json', done)
+    })
+
     it('should denote a greedy capture group', function(done){
       var app = express();
 

From 081b811b100a54e26e46aec64e0effd12cdd5053 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 26 Feb 2017 13:32:21 -0500
Subject: [PATCH 1036/1265] perf: add fast match path for "*" route

---
 History.md          |  1 +
 lib/router/layer.js | 15 +++++++++++----
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index 14103f267f8..2b20beb7177 100644
--- a/History.md
+++ b/History.md
@@ -62,6 +62,7 @@ unreleased
     - Use `res.getHeaderNames()` when available
     - Use `res.headersSent` when available
     - deps: send@0.15.0
+  * perf: add fast match path for `*` route
   * perf: improve `req.ips` performance
 
 4.14.1 / 2017-01-28
diff --git a/lib/router/layer.js b/lib/router/layer.js
index e2afb9723db..6325df8aff9 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -44,9 +44,9 @@ function Layer(path, options, fn) {
   this.path = undefined;
   this.regexp = pathRegexp(path, this.keys = [], opts);
 
-  if (path === '/' && opts.end === false) {
-    this.regexp.fast_slash = true;
-  }
+  // set fast path flags
+  this.regexp.fast_star = path === '*'
+  this.regexp.fast_slash = path === '/' && opts.end === false
 }
 
 /**
@@ -111,13 +111,20 @@ Layer.prototype.match = function match(path) {
   var match
 
   if (path != null) {
+    // fast path non-ending match for / (any path matches)
     if (this.regexp.fast_slash) {
-      // fast path non-ending match for / (everything matches)
       this.params = {}
       this.path = ''
       return true
     }
 
+    // fast path for * (everything matched in a param)
+    if (this.regexp.fast_star) {
+      this.params = {'0': decode_param(path)}
+      this.path = path
+      return true
+    }
+
     // match the path
     match = this.regexp.exec(path)
   }

From 8b6dc6ceec1b36e74ee9c6d362aa04e46237c227 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 26 Feb 2017 13:45:35 -0500
Subject: [PATCH 1037/1265] Use "%o" in path debug to tell types apart

---
 History.md          | 1 +
 lib/router/index.js | 2 +-
 lib/router/layer.js | 2 +-
 lib/router/route.js | 4 ++--
 4 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index 2b20beb7177..ed51a7e5b0a 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
   * Remove usage of `res._headers` private field
     - Improves compatibility with Node.js 8 nightly
   * Skip routing when `req.url` is not set
+  * Use `%o` in path debug to tell types apart
   * Use `Object.create` to setup request & response prototypes
   * Use `setprototypeof` module to replace `__proto__` setting
   * Use `statuses` instead of `http` module for status messages
diff --git a/lib/router/index.js b/lib/router/index.js
index 2c4239eba18..d2ed86e0bc8 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -452,7 +452,7 @@ proto.use = function use(fn) {
     }
 
     // add the middleware
-    debug('use %s %s', path, fn.name || '<anonymous>');
+    debug('use %o %s', path, fn.name || '<anonymous>')
 
     var layer = new Layer(path, {
       sensitive: this.caseSensitive,
diff --git a/lib/router/layer.js b/lib/router/layer.js
index 6325df8aff9..4dc8e86d4f7 100644
--- a/lib/router/layer.js
+++ b/lib/router/layer.js
@@ -35,7 +35,7 @@ function Layer(path, options, fn) {
     return new Layer(path, options, fn);
   }
 
-  debug('new %s', path);
+  debug('new %o', path)
   var opts = options || {};
 
   this.handle = fn;
diff --git a/lib/router/route.js b/lib/router/route.js
index 2788d7b7353..1ec9d50ea0e 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -44,7 +44,7 @@ function Route(path) {
   this.path = path;
   this.stack = [];
 
-  debug('new %s', path);
+  debug('new %o', path)
 
   // route handlers for various http methods
   this.methods = {};
@@ -196,7 +196,7 @@ methods.forEach(function(method){
         throw new Error(msg);
       }
 
-      debug('%s %s', method, this.path);
+      debug('%s %o', method, this.path)
 
       var layer = Layer('/', {}, handle);
       layer.method = method;

From 51f52901eb1f00571e18d404e10b27310215234c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 26 Feb 2017 13:59:47 -0500
Subject: [PATCH 1038/1265] Fix case where router.use skipped requests routes
 did not

fixes #3037
---
 History.md          |  1 +
 lib/router/index.js | 11 ++++++-----
 test/Router.js      | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 43 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index ed51a7e5b0a..bf7764011ba 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Add debug message when loading view engine
+  * Fix case where `router.use` skipped requests routes did not
   * Remove usage of `res._headers` private field
     - Improves compatibility with Node.js 8 nightly
   * Skip routing when `req.url` is not set
diff --git a/lib/router/index.js b/lib/router/index.js
index d2ed86e0bc8..917c6002c8b 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -280,12 +280,13 @@ proto.handle = function handle(req, res, out) {
   }
 
   function trim_prefix(layer, layerError, layerPath, path) {
-    var c = path[layerPath.length];
-    if (c && '/' !== c && '.' !== c) return next(layerError);
-
-     // Trim off the part of the url that matches the route
-     // middleware (.use stuff) needs to have the path stripped
     if (layerPath.length !== 0) {
+      // Validate path breaks on a path separator
+      var c = path[layerPath.length]
+      if (c && c !== '/' && c !== '.') return next(layerError)
+
+      // Trim off the part of the url that matches the route
+      // middleware (.use stuff) needs to have the path stripped
       debug('trim prefix (%s) from url %s', layerPath, req.url);
       removed = layerPath;
       req.url = protohost + req.url.substr(protohost.length + removed.length);
diff --git a/test/Router.js b/test/Router.js
index 41cd149e8eb..01a6e2c472b 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -347,6 +347,24 @@ describe('Router', function(){
       assert.equal(count, methods.length);
       done();
     })
+
+    it('should be called for any URL when "*"', function (done) {
+      var cb = after(4, done)
+      var router = new Router()
+
+      function no () {
+        throw new Error('should not be called')
+      }
+
+      router.all('*', function (req, res) {
+        res.end()
+      })
+
+      router.handle({ url: '/', method: 'GET' }, { end: cb }, no)
+      router.handle({ url: '/foo', method: 'GET' }, { end: cb }, no)
+      router.handle({ url: 'foo', method: 'GET' }, { end: cb }, no)
+      router.handle({ url: '*', method: 'GET' }, { end: cb }, no)
+    })
   })
 
   describe('.use', function() {
@@ -363,6 +381,24 @@ describe('Router', function(){
       router.use.bind(router, '/', new Date()).should.throw(/requires middleware function.*Date/)
     })
 
+    it('should be called for any URL', function (done) {
+      var cb = after(4, done)
+      var router = new Router()
+
+      function no () {
+        throw new Error('should not be called')
+      }
+
+      router.use(function (req, res) {
+        res.end()
+      })
+
+      router.handle({ url: '/', method: 'GET' }, { end: cb }, no)
+      router.handle({ url: '/foo', method: 'GET' }, { end: cb }, no)
+      router.handle({ url: 'foo', method: 'GET' }, { end: cb }, no)
+      router.handle({ url: '*', method: 'GET' }, { end: cb }, no)
+    })
+
     it('should accept array of middleware', function(done){
       var count = 0;
       var router = new Router();

From 9722202df964bfbfc0f579e4baeb5a4e1b43b344 Mon Sep 17 00:00:00 2001
From: Blake Embrey <hello@blakeembrey.com>
Date: Thu, 12 Nov 2015 16:17:47 -0800
Subject: [PATCH 1039/1265] Add next("router") to exit from router

closes #2241
closes #2371
---
 History.md          |  1 +
 lib/router/index.js |  6 ++++++
 lib/router/route.js |  6 ++++++
 test/app.router.js  | 31 +++++++++++++++++++++++++++++++
 4 files changed, 44 insertions(+)

diff --git a/History.md b/History.md
index bf7764011ba..824f2443d3e 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Add debug message when loading view engine
+  * Add `next("router")` to exit from router
   * Fix case where `router.use` skipped requests routes did not
   * Remove usage of `res._headers` private field
     - Improves compatibility with Node.js 8 nightly
diff --git a/lib/router/index.js b/lib/router/index.js
index 917c6002c8b..1f426068d7e 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -191,6 +191,12 @@ proto.handle = function handle(req, res, out) {
       removed = '';
     }
 
+    // signal to exit router
+    if (layerError === 'router') {
+      setImmediate(done, null)
+      return
+    }
+
     // no more matching layers
     if (idx >= stack.length) {
       setImmediate(done, layerError);
diff --git a/lib/router/route.js b/lib/router/route.js
index 1ec9d50ea0e..ea82ed29df5 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -112,10 +112,16 @@ Route.prototype.dispatch = function dispatch(req, res, done) {
   next();
 
   function next(err) {
+    // signal to exit route
     if (err && err === 'route') {
       return done();
     }
 
+    // signal to exit router
+    if (err && err === 'router') {
+      return done(err)
+    }
+
     var layer = stack[idx++];
     if (!layer) {
       return done(err);
diff --git a/test/app.router.js b/test/app.router.js
index 1bba62e270f..e838b2e33fc 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -932,6 +932,37 @@ describe('app.router', function(){
     })
   })
 
+  describe('when next("router") is called', function () {
+    it('should jump out of router', function (done) {
+      var app = express()
+      var router = express.Router()
+
+      function fn (req, res, next) {
+        res.set('X-Hit', '1')
+        next('router')
+      }
+
+      router.get('/foo', fn, function (req, res, next) {
+        res.end('failure')
+      })
+
+      router.get('/foo', function (req, res, next) {
+        res.end('failure')
+      })
+
+      app.use(router)
+
+      app.get('/foo', function (req, res) {
+        res.end('success')
+      })
+
+      request(app)
+      .get('/foo')
+      .expect('X-Hit', '1')
+      .expect(200, 'success', done)
+    })
+  })
+
   describe('when next(err) is called', function(){
     it('should break out of app.router', function(done){
       var app = express()

From 146a13ede7c81d0131468e99b29d06940727bfea Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Mar 2017 17:15:57 -0500
Subject: [PATCH 1040/1265] build: Node.js@4.8

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index e6139739cc4..bb466557163 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -5,7 +5,7 @@ node_js:
   - "1.8"
   - "2.5"
   - "3.3"
-  - "4.7"
+  - "4.8"
   - "5.12"
   - "6.9"
   - "7.5"
diff --git a/appveyor.yml b/appveyor.yml
index 4717f2735a8..659dbd1d3f7 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -5,7 +5,7 @@ environment:
     - nodejs_version: "1.8"
     - nodejs_version: "2.5"
     - nodejs_version: "3.3"
-    - nodejs_version: "4.7"
+    - nodejs_version: "4.8"
     - nodejs_version: "5.12"
     - nodejs_version: "6.9"
     - nodejs_version: "7.5"

From 72475543bcf61868e32ba2f4053cf42707a4b55d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Mar 2017 17:16:09 -0500
Subject: [PATCH 1041/1265] build: Node.js@6.10

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index bb466557163..0c4df4972da 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,7 +7,7 @@ node_js:
   - "3.3"
   - "4.8"
   - "5.12"
-  - "6.9"
+  - "6.10"
   - "7.5"
 matrix:
   include:
diff --git a/appveyor.yml b/appveyor.yml
index 659dbd1d3f7..4645573fcd7 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -7,7 +7,7 @@ environment:
     - nodejs_version: "3.3"
     - nodejs_version: "4.8"
     - nodejs_version: "5.12"
-    - nodejs_version: "6.9"
+    - nodejs_version: "6.10"
     - nodejs_version: "7.5"
 cache:
   - node_modules

From f59de6ae3d0c142a95e4f47dedf9770efe198ae6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Mar 2017 17:16:21 -0500
Subject: [PATCH 1042/1265] build: Node.js@7.7

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 0c4df4972da..824e6b2a17a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "4.8"
   - "5.12"
   - "6.10"
-  - "7.5"
+  - "7.7"
 matrix:
   include:
     - node_js: "8.0"
diff --git a/appveyor.yml b/appveyor.yml
index 4645573fcd7..1b399ce4ab0 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -8,7 +8,7 @@ environment:
     - nodejs_version: "4.8"
     - nodejs_version: "5.12"
     - nodejs_version: "6.10"
-    - nodejs_version: "7.5"
+    - nodejs_version: "7.7"
 cache:
   - node_modules
 install:

From 7f96896f67ba14e5a2f5be4fc5496584ce682b24 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Mar 2017 17:17:50 -0500
Subject: [PATCH 1043/1265] deps: update example dependencies

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 79b3b0e31c5..cca0f7f4533 100644
--- a/package.json
+++ b/package.json
@@ -58,7 +58,7 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "body-parser": "1.16.1",
+    "body-parser": "1.17.0",
     "cookie-parser": "~1.4.3",
     "ejs": "2.5.6",
     "express-session": "1.15.1",

From 504a51c040f22c80c7e52377c0ef00b1c8b2a76b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Mar 2017 17:22:18 -0500
Subject: [PATCH 1044/1265] 4.15.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 824f2443d3e..24f0c2e41f7 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.15.0 / 2017-03-01
+===================
 
   * Add debug message when loading view engine
   * Add `next("router")` to exit from router
diff --git a/package.json b/package.json
index cca0f7f4533..cc6f36633fe 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.14.1",
+  "version": "4.15.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 6d9b1279899cbc1fbaa2b98a2ab118a2c3081778 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Mar 2017 17:44:13 -0500
Subject: [PATCH 1045/1265] build: Node.js@7.6

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 824e6b2a17a..1230c7e2f95 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "4.8"
   - "5.12"
   - "6.10"
-  - "7.7"
+  - "7.6"
 matrix:
   include:
     - node_js: "8.0"
diff --git a/appveyor.yml b/appveyor.yml
index 1b399ce4ab0..b4bb184dd8f 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -8,7 +8,7 @@ environment:
     - nodejs_version: "4.8"
     - nodejs_version: "5.12"
     - nodejs_version: "6.10"
-    - nodejs_version: "7.7"
+    - nodejs_version: "7.6"
 cache:
   - node_modules
 install:

From 4012846d2534addd8de0b0c237cd63ada104109a Mon Sep 17 00:00:00 2001
From: Jamie Barton <hi_jamie@me.com>
Date: Sun, 26 Feb 2017 13:38:26 +0000
Subject: [PATCH 1046/1265] examples: use static assets in search example

closes #3224
---
 examples/search/index.js               | 11 +----------
 examples/search/{ => public}/client.js |  0
 examples/search/public/index.html      | 20 ++++++++++++++++++++
 examples/search/search.jade            | 15 ---------------
 4 files changed, 21 insertions(+), 25 deletions(-)
 rename examples/search/{ => public}/client.js (100%)
 create mode 100644 examples/search/public/index.html
 delete mode 100644 examples/search/search.jade

diff --git a/examples/search/index.js b/examples/search/index.js
index d614ac24076..8027635f19e 100644
--- a/examples/search/index.js
+++ b/examples/search/index.js
@@ -15,8 +15,7 @@ var db = redis.createClient();
 
 var app = express();
 
-app.set('view engine', 'jade');
-app.set('views', __dirname);
+app.use(express.static(__dirname + '/public'));
 
 // populate search
 
@@ -26,14 +25,6 @@ db.sadd('ferret', 'jane');
 db.sadd('cat', 'manny');
 db.sadd('cat', 'luna');
 
-/**
- * GET the search page.
- */
-
-app.get('/', function(req, res){
-  res.render('search');
-});
-
 /**
  * GET search for :query.
  */
diff --git a/examples/search/client.js b/examples/search/public/client.js
similarity index 100%
rename from examples/search/client.js
rename to examples/search/public/client.js
diff --git a/examples/search/public/index.html b/examples/search/public/index.html
new file mode 100644
index 00000000000..4a5540fdf3a
--- /dev/null
+++ b/examples/search/public/index.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>Search example</title>
+  <style type="text/css">
+    body {
+      font: 14px "Helvetica Neue", Helvetica;
+      padding: 50px;
+    }
+  </style>
+</head>
+<body>
+  <h2>Search</h2>
+  <p>Try searching for "ferret" or "cat".</p>
+  <input type="search" name="search" value="" />
+  <pre />
+  <script src="/client.js" charset="utf-8"></script>
+</body>
+</html>
diff --git a/examples/search/search.jade b/examples/search/search.jade
deleted file mode 100644
index 37d77e434c6..00000000000
--- a/examples/search/search.jade
+++ /dev/null
@@ -1,15 +0,0 @@
-doctype
-html
-  head
-    title Search example
-    style.
-      body {
-        font: 14px "Helvetica Neue", Helvetica;
-        padding: 50px;
-      }
-  body
-    h2 Search
-    p Try searching for "ferret" or "cat".
-    input(type='search')
-    pre
-    script(src='client.js')

From b4550fbe7a154d3fb9e935935e266a9eca9a4d69 Mon Sep 17 00:00:00 2001
From: Jamie Barton <hi_jamie@me.com>
Date: Sun, 26 Feb 2017 13:12:35 +0000
Subject: [PATCH 1047/1265] Use ejs instead of jade within engine jsdoc

closes #3222
---
 lib/application.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/application.js b/lib/application.js
index 0fe0eb44023..21a81ee9efe 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -262,9 +262,9 @@ app.route = function route(path) {
  *
  * By default will `require()` the engine based on the
  * file extension. For example if you try to render
- * a "foo.jade" file Express will invoke the following internally:
+ * a "foo.ejs" file Express will invoke the following internally:
  *
- *     app.engine('jade', require('jade').__express);
+ *     app.engine('ejs', require('ejs').__express);
  *
  * For engines that do not provide `.__express` out of the box,
  * or if you wish to "map" a different extension to the template engine

From 7027b37764050c550366e808ea84fee1c58233ed Mon Sep 17 00:00:00 2001
From: Jianru Lin <jianru.lin@gmail.com>
Date: Wed, 1 Mar 2017 10:38:13 +0800
Subject: [PATCH 1048/1265] lint: remove unused err argument

closes #3228
---
 lib/router/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/router/index.js b/lib/router/index.js
index 1f426068d7e..51db4c28ff9 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -626,7 +626,7 @@ function restore(fn, obj) {
     vals[i] = obj[props[i]];
   }
 
-  return function(err){
+  return function () {
     // restore vals
     for (var i = 0; i < props.length; i++) {
       obj[props[i]] = vals[i];

From dc8acc8676bed4aa4afa391ee312baa497d680e2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 5 Mar 2017 00:04:47 -0500
Subject: [PATCH 1049/1265] tests: use supertest expect for simple assertions

---
 test/app.param.js         |  9 ++++-----
 test/app.router.js        |  4 ++--
 test/req.signedCookies.js |  6 +-----
 test/res.clearCookie.js   | 14 ++++----------
 test/res.cookie.js        | 28 ++++++++--------------------
 5 files changed, 19 insertions(+), 42 deletions(-)

diff --git a/test/app.param.js b/test/app.param.js
index 30885bcdc89..c7a375418cd 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -29,8 +29,8 @@ describe('app', function(){
 
       request(app)
       .get('/user/tj')
-      .end(function(err, res){
-        res.text.should.equal('tj');
+      .expect(200, 'tj', function (err) {
+        if (err) return done(err)
         request(app)
         .get('/user/123')
         .expect(404, done);
@@ -69,9 +69,8 @@ describe('app', function(){
 
       request(app)
       .get('/user/123')
-      .end(function(err, res){
-        res.text.should.equal('123');
-
+      .expect(200, '123', function (err) {
+        if (err) return done(err)
         request(app)
         .get('/post/123')
         .expect('123', done);
diff --git a/test/app.router.js b/test/app.router.js
index e838b2e33fc..95680f9139c 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -539,8 +539,8 @@ describe('app.router', function(){
 
     request(app)
     .get('/user/10')
-    .end(function(err, res){
-      res.statusCode.should.equal(200);
+    .expect(200, function (err) {
+      if (err) return done(err)
       request(app)
       .get('/user/tj')
       .expect(404, done);
diff --git a/test/req.signedCookies.js b/test/req.signedCookies.js
index 111a0f77df8..73880b01b4c 100644
--- a/test/req.signedCookies.js
+++ b/test/req.signedCookies.js
@@ -28,11 +28,7 @@ describe('req', function(){
         request(app)
         .get('/')
         .set('Cookie', cookie)
-        .end(function(err, res){
-          if (err) return done(err);
-          res.body.should.eql({ obj: { foo: 'bar' } });
-          done();
-        });
+        .expect(200, { obj: { foo: 'bar' } }, done)
       });
     })
   })
diff --git a/test/res.clearCookie.js b/test/res.clearCookie.js
index 92c9d049f0d..4822057e926 100644
--- a/test/res.clearCookie.js
+++ b/test/res.clearCookie.js
@@ -13,11 +13,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        var val = 'sid=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT';
-        res.header['set-cookie'].should.eql([val]);
-        done();
-      })
+      .expect('Set-Cookie', 'sid=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT')
+      .expect(200, done)
     })
   })
 
@@ -31,11 +28,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        var val = 'sid=; Path=/admin; Expires=Thu, 01 Jan 1970 00:00:00 GMT';
-        res.header['set-cookie'].should.eql([val]);
-        done();
-      })
+      .expect('Set-Cookie', 'sid=; Path=/admin; Expires=Thu, 01 Jan 1970 00:00:00 GMT')
+      .expect(200, done)
     })
   })
 })
diff --git a/test/res.cookie.js b/test/res.cookie.js
index 543af99dcdd..4eeaaf094ad 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -16,11 +16,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        var val = ['user=' + encodeURIComponent('j:{"name":"tobi"}') + '; Path=/'];
-        res.headers['set-cookie'].should.eql(val);
-        done();
-      })
+      .expect('Set-Cookie', 'user=j%3A%7B%22name%22%3A%22tobi%22%7D; Path=/')
+      .expect(200, done)
     })
   })
 
@@ -34,11 +31,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        var val = ['name=tobi; Path=/'];
-        res.headers['set-cookie'].should.eql(val);
-        done();
-      })
+      .expect('Set-Cookie', 'name=tobi; Path=/')
+      .expect(200, done)
     })
 
     it('should allow multiple calls', function(done){
@@ -72,11 +66,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .end(function(err, res){
-        var val = ['name=tobi; Path=/; HttpOnly; Secure'];
-        res.headers['set-cookie'].should.eql(val);
-        done();
-      })
+      .expect('Set-Cookie', 'name=tobi; Path=/; HttpOnly; Secure')
+      .expect(200, done)
     })
 
     describe('maxAge', function(){
@@ -178,11 +169,8 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          var val = ['name=s%3Atobi.xJjV2iZ6EI7C8E5kzwbfA9PVLl1ZR07UTnuTgQQ4EnQ; Path=/'];
-          res.headers['set-cookie'].should.eql(val);
-          done();
-        })
+        .expect('Set-Cookie', 'name=s%3Atobi.xJjV2iZ6EI7C8E5kzwbfA9PVLl1ZR07UTnuTgQQ4EnQ; Path=/')
+        .expect(200, done)
       })
     })
   })

From c0089d971b9880b17c652bfde95cc4f36fd8aaf8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 5 Mar 2017 00:06:59 -0500
Subject: [PATCH 1050/1265] deps: send@0.15.1

---
 History.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 24f0c2e41f7..aadd7ece046 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,10 @@
+unreleased
+==========
+
+  * deps: send@0.15.1
+    - Fix issue when `Date.parse` does not return `NaN` on invalid date
+    - Fix strict violation in broken environments
+
 4.15.0 / 2017-03-01
 ===================
 
diff --git a/package.json b/package.json
index cc6f36633fe..aea1a83bc10 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "proxy-addr": "~1.1.3",
     "qs": "6.3.1",
     "range-parser": "~1.2.0",
-    "send": "0.15.0",
+    "send": "0.15.1",
     "serve-static": "1.12.0",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",

From 67168fe231445a82dc1e8dde6a93ee9441be28c1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 5 Mar 2017 00:08:16 -0500
Subject: [PATCH 1051/1265] deps: serve-static@1.12.1

fixes #3233
---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index aadd7ece046..e4de69bc488 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,9 @@ unreleased
   * deps: send@0.15.1
     - Fix issue when `Date.parse` does not return `NaN` on invalid date
     - Fix strict violation in broken environments
+  * deps: serve-static@1.12.1
+    - Fix issue when `Date.parse` does not return `NaN` on invalid date
+    - deps: send@0.15.1
 
 4.15.0 / 2017-03-01
 ===================
diff --git a/package.json b/package.json
index aea1a83bc10..1b442295e03 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "qs": "6.3.1",
     "range-parser": "~1.2.0",
     "send": "0.15.1",
-    "serve-static": "1.12.0",
+    "serve-static": "1.12.1",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",
     "type-is": "~1.6.14",

From 8eb95ae57973b2cbe7778bc2e10450a380ca2efe Mon Sep 17 00:00:00 2001
From: chainhelen <chainhelen@gmail.com>
Date: Mon, 6 Mar 2017 02:44:22 +0800
Subject: [PATCH 1052/1265] examples: use path.join instead of concatenation

closes #3236
---
 examples/auth/index.js             |  3 ++-
 examples/downloads/index.js        |  6 ++---
 examples/ejs/index.js              |  3 ++-
 examples/error-pages/index.js      |  3 ++-
 examples/jade/index.js             |  5 +++--
 examples/markdown/index.js         |  3 ++-
 examples/mvc/index.js              |  5 +++--
 examples/mvc/lib/boot.js           | 35 ++++++++++++++++--------------
 examples/route-separation/index.js |  5 +++--
 examples/search/index.js           |  5 +++--
 10 files changed, 42 insertions(+), 31 deletions(-)

diff --git a/examples/auth/index.js b/examples/auth/index.js
index 1c3ca217512..084fba79a97 100644
--- a/examples/auth/index.js
+++ b/examples/auth/index.js
@@ -5,6 +5,7 @@
 var express = require('../..');
 var bodyParser = require('body-parser');
 var hash = require('pbkdf2-password')()
+var path = require('path');
 var session = require('express-session');
 
 var app = module.exports = express();
@@ -12,7 +13,7 @@ var app = module.exports = express();
 // config
 
 app.set('view engine', 'ejs');
-app.set('views', __dirname + '/views');
+app.set('views', path.join(__dirname, 'views'));
 
 // middleware
 
diff --git a/examples/downloads/index.js b/examples/downloads/index.js
index 6ab6ba0213e..e6f3fa9db69 100644
--- a/examples/downloads/index.js
+++ b/examples/downloads/index.js
@@ -3,6 +3,7 @@
  */
 
 var express = require('../../');
+var path = require('path');
 var app = module.exports = express();
 
 app.get('/', function(req, res){
@@ -16,10 +17,9 @@ app.get('/', function(req, res){
 // /files/* is accessed via req.params[0]
 // but here we name it :file
 app.get('/files/:file(*)', function(req, res, next){
-  var file = req.params.file;
-  var path = __dirname + '/files/' + file;
+  var filePath = path.join(__dirname, 'files', req.params.file);
 
-  res.download(path, function(err){
+  res.download(filePath, function (err) {
     if (!err) return; // file sent
     if (err && err.status !== 404) return next(err); // non-404 error
     // file for download not found
diff --git a/examples/ejs/index.js b/examples/ejs/index.js
index bf78a9cc803..13a80efc193 100644
--- a/examples/ejs/index.js
+++ b/examples/ejs/index.js
@@ -3,6 +3,7 @@
  */
 
 var express = require('../../');
+var path = require('path');
 
 var app = module.exports = express();
 
@@ -21,7 +22,7 @@ app.engine('.html', require('ejs').__express);
 
 // Optional since express defaults to CWD/views
 
-app.set('views', __dirname + '/views');
+app.set('views', path.join(__dirname, 'views'));
 
 // Without this you would need to
 // supply the extension to res.render()
diff --git a/examples/error-pages/index.js b/examples/error-pages/index.js
index d1219689f2c..790f6e30dfd 100644
--- a/examples/error-pages/index.js
+++ b/examples/error-pages/index.js
@@ -3,12 +3,13 @@
  */
 
 var express = require('../../');
+var path = require('path');
 var app = module.exports = express();
 var logger = require('morgan');
 var silent = 'test' == process.env.NODE_ENV;
 
 // general config
-app.set('views', __dirname + '/views');
+app.set('views', path.join(__dirname, 'views'));
 app.set('view engine', 'ejs');
 
 // our custom "verbose errors" setting
diff --git a/examples/jade/index.js b/examples/jade/index.js
index 738b382d267..86ca14c426e 100644
--- a/examples/jade/index.js
+++ b/examples/jade/index.js
@@ -3,10 +3,11 @@
  */
 
 var express = require('../../lib/express');
+var path = require('path');
 
 // Path to our public directory
 
-var pub = __dirname + '/public';
+var pub = path.join(__dirname, 'public');
 
 // setup middleware
 
@@ -15,7 +16,7 @@ app.use(express.static(pub));
 
 // Optional since express defaults to CWD/views
 
-app.set('views', __dirname + '/views');
+app.set('views', path.join(__dirname, 'views'));
 
 // Set our default template engine to "jade"
 // which prevents the need for extensions
diff --git a/examples/markdown/index.js b/examples/markdown/index.js
index 430628701fd..df8c195fb4e 100644
--- a/examples/markdown/index.js
+++ b/examples/markdown/index.js
@@ -6,6 +6,7 @@ var escapeHtml = require('escape-html');
 var express = require('../..');
 var fs = require('fs');
 var marked = require('marked');
+var path = require('path');
 
 var app = module.exports = express();
 
@@ -21,7 +22,7 @@ app.engine('md', function(path, options, fn){
   });
 });
 
-app.set('views', __dirname + '/views');
+app.set('views', path.join(__dirname, 'views'));
 
 // make it the default so we dont need .md
 app.set('view engine', 'md');
diff --git a/examples/mvc/index.js b/examples/mvc/index.js
index bf7f726e30f..c5e2678697a 100644
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -4,6 +4,7 @@
 
 var express = require('../..');
 var logger = require('morgan');
+var path = require('path');
 var session = require('express-session');
 var bodyParser = require('body-parser');
 var methodOverride = require('method-override');
@@ -17,7 +18,7 @@ var app = module.exports = express();
 app.set('view engine', 'jade');
 
 // set views for error and 404 pages
-app.set('views', __dirname + '/views');
+app.set('views', path.join(__dirname, 'views'));
 
 // define a custom res.message() method
 // which stores messages in the session
@@ -34,7 +35,7 @@ app.response.message = function(msg){
 if (!module.parent) app.use(logger('dev'));
 
 // serve static files
-app.use(express.static(__dirname + '/public'));
+app.use(express.static(path.join(__dirname, 'public')));
 
 // session support
 app.use(session({
diff --git a/examples/mvc/lib/boot.js b/examples/mvc/lib/boot.js
index a0ca6ec37b1..422330dc066 100644
--- a/examples/mvc/lib/boot.js
+++ b/examples/mvc/lib/boot.js
@@ -4,23 +4,26 @@
 
 var express = require('../../..');
 var fs = require('fs');
+var path = require('path');
 
 module.exports = function(parent, options){
+  var dir = path.join(__dirname, '..', 'controllers');
   var verbose = options.verbose;
-  fs.readdirSync(__dirname + '/../controllers').forEach(function(name){
-    if (!fs.statSync(__dirname + '/../controllers/' + name).isDirectory()) return;
+  fs.readdirSync(dir).forEach(function(name){
+    var file = path.join(dir, name)
+    if (!fs.statSync(file).isDirectory()) return;
     verbose && console.log('\n   %s:', name);
-    var obj = require('./../controllers/' + name);
+    var obj = require(file);
     var name = obj.name || name;
     var prefix = obj.prefix || '';
     var app = express();
     var handler;
     var method;
-    var path;
+    var url;
 
     // allow specifying the view engine
     if (obj.engine) app.set('view engine', obj.engine);
-    app.set('views', __dirname + '/../controllers/' + name + '/views');
+    app.set('views', path.join(__dirname, '..', 'controllers', name, 'views'));
 
     // generate routes based
     // on the exported methods
@@ -31,27 +34,27 @@ module.exports = function(parent, options){
       switch (key) {
         case 'show':
           method = 'get';
-          path = '/' + name + '/:' + name + '_id';
+          url = '/' + name + '/:' + name + '_id';
           break;
         case 'list':
           method = 'get';
-          path = '/' + name + 's';
+          url = '/' + name + 's';
           break;
         case 'edit':
           method = 'get';
-          path = '/' + name + '/:' + name + '_id/edit';
+          url = '/' + name + '/:' + name + '_id/edit';
           break;
         case 'update':
           method = 'put';
-          path = '/' + name + '/:' + name + '_id';
+          url = '/' + name + '/:' + name + '_id';
           break;
         case 'create':
           method = 'post';
-          path = '/' + name;
+          url = '/' + name;
           break;
         case 'index':
           method = 'get';
-          path = '/';
+          url = '/';
           break;
         default:
           /* istanbul ignore next */
@@ -60,15 +63,15 @@ module.exports = function(parent, options){
 
       // setup
       handler = obj[key];
-      path = prefix + path;
+      url = prefix + url;
 
       // before middleware support
       if (obj.before) {
-        app[method](path, obj.before, handler);
-        verbose && console.log('     %s %s -> before -> %s', method.toUpperCase(), path, key);
+        app[method](url, obj.before, handler);
+        verbose && console.log('     %s %s -> before -> %s', method.toUpperCase(), url, key);
       } else {
-        app[method](path, handler);
-        verbose && console.log('     %s %s -> %s', method.toUpperCase(), path, key);
+        app[method](url, handler);
+        verbose && console.log('     %s %s -> %s', method.toUpperCase(), url, key);
       }
     }
 
diff --git a/examples/route-separation/index.js b/examples/route-separation/index.js
index 3d93d5cfd9c..c6605ada6cb 100644
--- a/examples/route-separation/index.js
+++ b/examples/route-separation/index.js
@@ -3,6 +3,7 @@
  */
 
 var express = require('../..');
+var path = require('path');
 var app = express();
 var logger = require('morgan');
 var cookieParser = require('cookie-parser');
@@ -17,7 +18,7 @@ module.exports = app;
 // Config
 
 app.set('view engine', 'jade');
-app.set('views', __dirname + '/views');
+app.set('views', path.join(__dirname, 'views'));
 
 /* istanbul ignore next */
 if (!module.parent) {
@@ -27,7 +28,7 @@ if (!module.parent) {
 app.use(methodOverride('_method'));
 app.use(cookieParser());
 app.use(bodyParser.urlencoded({ extended: true }));
-app.use(express.static(__dirname + '/public'));
+app.use(express.static(path.join(__dirname, 'public')));
 
 // General
 
diff --git a/examples/search/index.js b/examples/search/index.js
index 8027635f19e..79f5d9f4d36 100644
--- a/examples/search/index.js
+++ b/examples/search/index.js
@@ -7,6 +7,7 @@
  */
 
 var express = require('../..');
+var path = require('path');
 var redis = require('redis');
 
 var db = redis.createClient();
@@ -15,7 +16,7 @@ var db = redis.createClient();
 
 var app = express();
 
-app.use(express.static(__dirname + '/public'));
+app.use(express.static(path.join(__dirname, 'public')));
 
 // populate search
 
@@ -45,7 +46,7 @@ app.get('/search/:query?', function(req, res){
  */
 
 app.get('/client.js', function(req, res){
-  res.sendFile(__dirname + '/client.js');
+  res.sendFile(path.join(__dirname, 'client.js'));
 });
 
 /* istanbul ignore next */

From eece3850bc5206c28bfac78c986fbe0c193b34b8 Mon Sep 17 00:00:00 2001
From: chainhelen <chainhelen@gmail.com>
Date: Mon, 6 Mar 2017 02:44:22 +0800
Subject: [PATCH 1053/1265] tests: use path.join instead of concatenation

closes #3236
---
 test/app.engine.js   |  9 +++++----
 test/app.render.js   | 47 ++++++++++++++++++++++++++++----------------
 test/res.render.js   | 47 +++++++++++++++++++++++++-------------------
 test/res.sendFile.js |  4 ++--
 4 files changed, 64 insertions(+), 43 deletions(-)

diff --git a/test/app.engine.js b/test/app.engine.js
index 88311b2f6d5..6d1ee1cacbf 100644
--- a/test/app.engine.js
+++ b/test/app.engine.js
@@ -1,6 +1,7 @@
 
 var express = require('../')
   , fs = require('fs');
+var path = require('path')
 
 function render(path, options, fn) {
   fs.readFile(path, 'utf8', function(err, str){
@@ -15,7 +16,7 @@ describe('app', function(){
     it('should map a template engine', function(done){
       var app = express();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
       app.engine('.html', render);
       app.locals.user = { name: 'tobi' };
 
@@ -36,7 +37,7 @@ describe('app', function(){
     it('should work without leading "."', function(done){
       var app = express();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
       app.engine('html', render);
       app.locals.user = { name: 'tobi' };
 
@@ -50,7 +51,7 @@ describe('app', function(){
     it('should work "view engine" setting', function(done){
       var app = express();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
       app.engine('html', render);
       app.set('view engine', 'html');
       app.locals.user = { name: 'tobi' };
@@ -65,7 +66,7 @@ describe('app', function(){
     it('should work "view engine" with leading "."', function(done){
       var app = express();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
       app.engine('.html', render);
       app.set('view engine', '.html');
       app.locals.user = { name: 'tobi' };
diff --git a/test/app.render.js b/test/app.render.js
index c9737b7a060..729b1c97cc8 100644
--- a/test/app.render.js
+++ b/test/app.render.js
@@ -1,5 +1,7 @@
 
+var assert = require('assert')
 var express = require('..');
+var path = require('path')
 var tmpl = require('./support/tmpl');
 
 describe('app', function(){
@@ -9,7 +11,7 @@ describe('app', function(){
 
       app.locals.user = { name: 'tobi' };
 
-      app.render(__dirname + '/fixtures/user.tmpl', function (err, str) {
+      app.render(path.join(__dirname, 'fixtures', 'user.tmpl'), function (err, str) {
         if (err) return done(err);
         str.should.equal('<p>tobi</p>');
         done();
@@ -22,7 +24,7 @@ describe('app', function(){
       app.set('view engine', 'tmpl');
       app.locals.user = { name: 'tobi' };
 
-      app.render(__dirname + '/fixtures/user', function(err, str){
+      app.render(path.join(__dirname, 'fixtures', 'user'), function (err, str) {
         if (err) return done(err);
         str.should.equal('<p>tobi</p>');
         done();
@@ -32,7 +34,7 @@ describe('app', function(){
     it('should expose app.locals', function(done){
       var app = createApp();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
       app.locals.user = { name: 'tobi' };
 
       app.render('user.tmpl', function (err, str) {
@@ -45,7 +47,7 @@ describe('app', function(){
     it('should support index.<engine>', function(done){
       var app = createApp();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
       app.set('view engine', 'tmpl');
 
       app.render('blog/post', function (err, str) {
@@ -80,9 +82,10 @@ describe('app', function(){
       it('should provide a helpful error', function(done){
         var app = createApp();
 
-        app.set('views', __dirname + '/fixtures');
+        app.set('views', path.join(__dirname, 'fixtures'))
         app.render('rawr.tmpl', function (err) {
-          err.message.should.equal('Failed to lookup view "rawr.tmpl" in views directory "' + __dirname + '/fixtures"');
+          assert.ok(err)
+          assert.equal(err.message, 'Failed to lookup view "rawr.tmpl" in views directory "' + path.join(__dirname, 'fixtures') + '"')
           done();
         });
       })
@@ -92,7 +95,7 @@ describe('app', function(){
       it('should invoke the callback', function(done){
         var app = createApp();
 
-        app.set('views', __dirname + '/fixtures');
+        app.set('views', path.join(__dirname, 'fixtures'))
 
         app.render('user.tmpl', function (err, str) {
           // nextTick to prevent cyclic
@@ -108,7 +111,7 @@ describe('app', function(){
       it('should render the template', function(done){
         var app = createApp();
 
-        app.set('views', __dirname + '/fixtures');
+        app.set('views', path.join(__dirname, 'fixtures'))
 
         app.render('email.tmpl', function (err, str) {
           if (err) return done(err);
@@ -123,7 +126,7 @@ describe('app', function(){
         var app = createApp();
 
         app.set('view engine', 'tmpl');
-        app.set('views', __dirname + '/fixtures');
+        app.set('views', path.join(__dirname, 'fixtures'))
 
         app.render('email', function(err, str){
           if (err) return done(err);
@@ -137,7 +140,7 @@ describe('app', function(){
       it('should lookup the file in the path', function(done){
         var app = createApp();
 
-        app.set('views', __dirname + '/fixtures/default_layout');
+        app.set('views',  path.join(__dirname, 'fixtures', 'default_layout'))
         app.locals.user = { name: 'tobi' };
 
         app.render('user.tmpl', function (err, str) {
@@ -150,7 +153,10 @@ describe('app', function(){
       describe('when array of paths', function(){
         it('should lookup the file in the path', function(done){
           var app = createApp();
-          var views = [__dirname + '/fixtures/local_layout', __dirname + '/fixtures/default_layout'];
+          var views = [
+            path.join(__dirname, 'fixtures', 'local_layout'),
+            path.join(__dirname, 'fixtures', 'default_layout')
+          ]
 
           app.set('views', views);
           app.locals.user = { name: 'tobi' };
@@ -164,7 +170,10 @@ describe('app', function(){
 
         it('should lookup in later paths until found', function(done){
           var app = createApp();
-          var views = [__dirname + '/fixtures/local_layout', __dirname + '/fixtures/default_layout'];
+          var views = [
+            path.join(__dirname, 'fixtures', 'local_layout'),
+            path.join(__dirname, 'fixtures', 'default_layout')
+          ]
 
           app.set('views', views);
           app.locals.name = 'tobi';
@@ -178,13 +187,17 @@ describe('app', function(){
 
         it('should error if file does not exist', function(done){
           var app = createApp();
-          var views = [__dirname + '/fixtures/local_layout', __dirname + '/fixtures/default_layout'];
+          var views = [
+            path.join(__dirname, 'fixtures', 'local_layout'),
+            path.join(__dirname, 'fixtures', 'default_layout')
+          ]
 
           app.set('views', views);
           app.locals.name = 'tobi';
 
           app.render('pet.tmpl', function (err, str) {
-            err.message.should.equal('Failed to lookup view "pet.tmpl" in views directories "' + __dirname + '/fixtures/local_layout" or "' + __dirname + '/fixtures/default_layout"');
+            assert.ok(err)
+            assert.equal(err.message, 'Failed to lookup view "pet.tmpl" in views directories "' + views[0] + '" or "' + views[1] + '"')
             done();
           })
         })
@@ -281,7 +294,7 @@ describe('app', function(){
     it('should render the template', function(done){
       var app = createApp();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
 
       var user = { name: 'tobi' };
 
@@ -295,7 +308,7 @@ describe('app', function(){
     it('should expose app.locals', function(done){
       var app = createApp();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
       app.locals.user = { name: 'tobi' };
 
       app.render('user.tmpl', {}, function (err, str) {
@@ -308,7 +321,7 @@ describe('app', function(){
     it('should give precedence to app.render() locals', function(done){
       var app = createApp();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
       app.locals.user = { name: 'tobi' };
       var jane = { name: 'jane' };
 
diff --git a/test/res.render.js b/test/res.render.js
index d4d2a7616d1..2e3a16f1370 100644
--- a/test/res.render.js
+++ b/test/res.render.js
@@ -1,5 +1,6 @@
 
 var express = require('..');
+var path = require('path')
 var request = require('supertest');
 var tmpl = require('./support/tmpl');
 
@@ -11,7 +12,7 @@ describe('res', function(){
       app.locals.user = { name: 'tobi' };
 
       app.use(function(req, res){
-        res.render(__dirname + '/fixtures/user.tmpl');
+        res.render(path.join(__dirname, 'fixtures', 'user.tmpl'))
       });
 
       request(app)
@@ -26,7 +27,7 @@ describe('res', function(){
       app.set('view engine', 'tmpl');
 
       app.use(function(req, res){
-        res.render(__dirname + '/fixtures/user');
+        res.render(path.join(__dirname, 'fixtures', 'user'))
       });
 
       request(app)
@@ -40,7 +41,7 @@ describe('res', function(){
       app.locals.user = { name: 'tobi' };
 
       app.use(function(req, res){
-        res.render(__dirname + '/fixtures/user');
+        res.render(path.join(__dirname, 'fixtures', 'user'))
       });
 
       request(app)
@@ -51,7 +52,7 @@ describe('res', function(){
     it('should expose app.locals', function(done){
       var app = createApp();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
       app.locals.user = { name: 'tobi' };
 
       app.use(function(req, res){
@@ -66,7 +67,7 @@ describe('res', function(){
     it('should expose app.locals with `name` property', function(done){
       var app = createApp();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
       app.locals.name = 'tobi';
 
       app.use(function(req, res){
@@ -81,7 +82,7 @@ describe('res', function(){
     it('should support index.<engine>', function(done){
       var app = createApp();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
       app.set('view engine', 'tmpl');
 
       app.use(function(req, res){
@@ -97,7 +98,7 @@ describe('res', function(){
       it('should next(err)', function(done){
         var app = createApp();
 
-        app.set('views', __dirname + '/fixtures');
+        app.set('views', path.join(__dirname, 'fixtures'))
 
         app.use(function(req, res){
           res.render('user.tmpl');
@@ -118,7 +119,7 @@ describe('res', function(){
         var app = createApp();
 
         app.set('view engine', 'tmpl');
-        app.set('views', __dirname + '/fixtures');
+        app.set('views', path.join(__dirname, 'fixtures'))
 
         app.use(function(req, res){
           res.render('email');
@@ -134,7 +135,7 @@ describe('res', function(){
       it('should lookup the file in the path', function(done){
         var app = createApp();
 
-        app.set('views', __dirname + '/fixtures/default_layout');
+        app.set('views', path.join(__dirname, 'fixtures', 'default_layout'))
 
         app.use(function(req, res){
           res.render('user.tmpl', { user: { name: 'tobi' } });
@@ -148,7 +149,10 @@ describe('res', function(){
       describe('when array of paths', function(){
         it('should lookup the file in the path', function(done){
           var app = createApp();
-          var views = [__dirname + '/fixtures/local_layout', __dirname + '/fixtures/default_layout'];
+          var views = [
+            path.join(__dirname, 'fixtures', 'local_layout'),
+            path.join(__dirname, 'fixtures', 'default_layout')
+          ]
 
           app.set('views', views);
 
@@ -163,7 +167,10 @@ describe('res', function(){
 
         it('should lookup in later paths until found', function(done){
           var app = createApp();
-          var views = [__dirname + '/fixtures/local_layout', __dirname + '/fixtures/default_layout'];
+          var views = [
+            path.join(__dirname, 'fixtures', 'local_layout'),
+            path.join(__dirname, 'fixtures', 'default_layout')
+          ]
 
           app.set('views', views);
 
@@ -183,7 +190,7 @@ describe('res', function(){
     it('should render the template', function(done){
       var app = createApp();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
 
       var user = { name: 'tobi' };
 
@@ -199,7 +206,7 @@ describe('res', function(){
     it('should expose app.locals', function(done){
       var app = createApp();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
       app.locals.user = { name: 'tobi' };
 
       app.use(function(req, res){
@@ -214,7 +221,7 @@ describe('res', function(){
     it('should expose res.locals', function(done){
       var app = createApp();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
 
       app.use(function(req, res){
         res.locals.user = { name: 'tobi' };
@@ -229,7 +236,7 @@ describe('res', function(){
     it('should give precedence to res.locals over app.locals', function(done){
       var app = createApp();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
       app.locals.user = { name: 'tobi' };
 
       app.use(function(req, res){
@@ -245,7 +252,7 @@ describe('res', function(){
     it('should give precedence to res.render() locals over res.locals', function(done){
       var app = createApp();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
       var jane = { name: 'jane' };
 
       app.use(function(req, res){
@@ -261,7 +268,7 @@ describe('res', function(){
     it('should give precedence to res.render() locals over app.locals', function(done){
       var app = createApp();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
       app.locals.user = { name: 'tobi' };
       var jane = { name: 'jane' };
 
@@ -279,7 +286,7 @@ describe('res', function(){
     it('should pass the resulting string', function(done){
       var app = createApp();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
 
       app.use(function(req, res){
         var tobi = { name: 'tobi' };
@@ -299,7 +306,7 @@ describe('res', function(){
     it('should pass the resulting string', function(done){
       var app = createApp();
 
-      app.set('views', __dirname + '/fixtures');
+      app.set('views', path.join(__dirname, 'fixtures'))
 
       app.use(function(req, res){
         res.locals.user = { name: 'tobi' };
@@ -318,7 +325,7 @@ describe('res', function(){
       it('should pass it to the callback', function(done){
         var app = createApp();
 
-        app.set('views', __dirname + '/fixtures');
+        app.set('views', path.join(__dirname, 'fixtures'))
 
         app.use(function(req, res){
           res.render('user.tmpl', function (err) {
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index 927d31991f0..be3a23ebc2c 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -613,7 +613,7 @@ describe('res', function(){
         var app = express();
 
         app.use(function(req, res){
-          res.sendfile(__dirname + '/fixtures/user.html');
+          res.sendfile(path.join(__dirname, '/fixtures/user.html'))
         });
 
         request(app)
@@ -718,7 +718,7 @@ describe('res', function(){
             , calls = 0;
 
           app.use(function(req, res){
-            res.sendfile(__dirname + '/fixtures/name.txt');
+            res.sendfile(path.join(__dirname, '/fixtures/name.txt'))
           });
 
           request(app)

From 57d3dfd9f828c4529fa90dde4b3d216898181e99 Mon Sep 17 00:00:00 2001
From: Jamie Barton <hi_jamie@me.com>
Date: Sun, 26 Feb 2017 13:26:39 +0000
Subject: [PATCH 1054/1265] examples: merge the jade example into ejs

closes #3223
---
 examples/ejs/index.js                         |  4 ++
 .../public/stylesheets/style.css              |  0
 examples/ejs/views/header.html                |  9 +---
 examples/jade/index.js                        | 52 -------------------
 examples/jade/views/header.jade               |  3 --
 examples/jade/views/layout.jade               |  5 --
 examples/jade/views/users/index.jade          |  8 ---
 examples/jade/views/users/user.jade           |  3 --
 8 files changed, 6 insertions(+), 78 deletions(-)
 rename examples/{jade => ejs}/public/stylesheets/style.css (100%)
 delete mode 100644 examples/jade/index.js
 delete mode 100644 examples/jade/views/header.jade
 delete mode 100644 examples/jade/views/layout.jade
 delete mode 100644 examples/jade/views/users/index.jade
 delete mode 100644 examples/jade/views/users/user.jade

diff --git a/examples/ejs/index.js b/examples/ejs/index.js
index 13a80efc193..b868bdd7cb9 100644
--- a/examples/ejs/index.js
+++ b/examples/ejs/index.js
@@ -24,6 +24,10 @@ app.engine('.html', require('ejs').__express);
 
 app.set('views', path.join(__dirname, 'views'));
 
+// Path to our public directory
+
+app.use(express.static(path.join(__dirname + 'public')));
+
 // Without this you would need to
 // supply the extension to res.render()
 // ex: res.render('users.html').
diff --git a/examples/jade/public/stylesheets/style.css b/examples/ejs/public/stylesheets/style.css
similarity index 100%
rename from examples/jade/public/stylesheets/style.css
rename to examples/ejs/public/stylesheets/style.css
diff --git a/examples/ejs/views/header.html b/examples/ejs/views/header.html
index 8dbeb8d3c01..4396bc444fa 100644
--- a/examples/ejs/views/header.html
+++ b/examples/ejs/views/header.html
@@ -2,12 +2,7 @@
 <html lang="en">
 <head>
   <meta charset="utf-8">
-  <title> <%= title %> </title>
-  <style type="text/css">
-    body {
-      padding: 50px;
-      font: 13px Helvetica, Arial, sans-serif;
-    }
-  </style>
+  <title><%= title %></title>
+  <link rel="stylesheet" href="/stylesheets/style.css">
 </head>
 <body>
diff --git a/examples/jade/index.js b/examples/jade/index.js
deleted file mode 100644
index 86ca14c426e..00000000000
--- a/examples/jade/index.js
+++ /dev/null
@@ -1,52 +0,0 @@
-/**
- * Module dependencies.
- */
-
-var express = require('../../lib/express');
-var path = require('path');
-
-// Path to our public directory
-
-var pub = path.join(__dirname, 'public');
-
-// setup middleware
-
-var app = express();
-app.use(express.static(pub));
-
-// Optional since express defaults to CWD/views
-
-app.set('views', path.join(__dirname, 'views'));
-
-// Set our default template engine to "jade"
-// which prevents the need for extensions
-// (although you can still mix and match)
-app.set('view engine', 'jade');
-
-function User(name, email) {
-  this.name = name;
-  this.email = email;
-}
-
-// Dummy users
-var users = [
-    new User('tj', 'tj@vision-media.ca')
-  , new User('ciaran', 'ciaranj@gmail.com')
-  , new User('aaron', 'aaron.heckmann+github@gmail.com')
-];
-
-app.get('/', function(req, res){
-  res.render('users', { users: users });
-});
-
-// change this to a better error handler in your code
-// sending stacktrace to users in production is not good
-app.use(function(err, req, res, next) {
-  res.send(err.stack);
-});
-
-/* istanbul ignore next */
-if (!module.parent) {
-  app.listen(3000);
-  console.log('Express started on port 3000');
-}
diff --git a/examples/jade/views/header.jade b/examples/jade/views/header.jade
deleted file mode 100644
index 6c42929d837..00000000000
--- a/examples/jade/views/header.jade
+++ /dev/null
@@ -1,3 +0,0 @@
-head
-  title Jade Example
-  link(rel="stylesheet", href="/stylesheets/style.css")
\ No newline at end of file
diff --git a/examples/jade/views/layout.jade b/examples/jade/views/layout.jade
deleted file mode 100644
index 300cdc78473..00000000000
--- a/examples/jade/views/layout.jade
+++ /dev/null
@@ -1,5 +0,0 @@
-doctype html
-html
-  include header
-  body
-    block content
diff --git a/examples/jade/views/users/index.jade b/examples/jade/views/users/index.jade
deleted file mode 100644
index feb7623fa3d..00000000000
--- a/examples/jade/views/users/index.jade
+++ /dev/null
@@ -1,8 +0,0 @@
-
-extends ../layout
-
-block content
-  h1 Users
-  #users
-    for user in users
-      include user
\ No newline at end of file
diff --git a/examples/jade/views/users/user.jade b/examples/jade/views/users/user.jade
deleted file mode 100644
index 9e603298cbf..00000000000
--- a/examples/jade/views/users/user.jade
+++ /dev/null
@@ -1,3 +0,0 @@
-.user
-  h2= user.name
-  .email= user.email
\ No newline at end of file

From d32ed68b2995e0322100ace29d86e7a86b9c6378 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 5 Mar 2017 23:19:32 -0500
Subject: [PATCH 1055/1265] 4.15.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index e4de69bc488..82511c3f400 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.15.1 / 2017-03-05
+===================
 
   * deps: send@0.15.1
     - Fix issue when `Date.parse` does not return `NaN` on invalid date
diff --git a/package.json b/package.json
index 1b442295e03..727064b6652 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.15.0",
+  "version": "4.15.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 85c96fd64edad8ce076bb82c065ef0c9fea6c559 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Mar 2017 08:32:13 -0500
Subject: [PATCH 1056/1265] deps: qs@6.4.0

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 82511c3f400..dd529f16320 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: qs@6.4.0
+    - Fix regression parsing keys starting with `[`
+
 4.15.1 / 2017-03-05
 ===================
 
diff --git a/package.json b/package.json
index 727064b6652..05a9ce56d90 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "parseurl": "~1.3.1",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~1.1.3",
-    "qs": "6.3.1",
+    "qs": "6.4.0",
     "range-parser": "~1.2.0",
     "send": "0.15.1",
     "serve-static": "1.12.1",

From 05fd1e444198954c1e275d485bccabafed052868 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Mar 2017 08:33:37 -0500
Subject: [PATCH 1057/1265] deps: update example dependencies

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 05a9ce56d90..7894722c4db 100644
--- a/package.json
+++ b/package.json
@@ -58,7 +58,7 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "body-parser": "1.17.0",
+    "body-parser": "1.17.1",
     "cookie-parser": "~1.4.3",
     "ejs": "2.5.6",
     "express-session": "1.15.1",

From d43b074f0b3b56a91f240e62798c932ba104b79a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Mar 2017 08:34:38 -0500
Subject: [PATCH 1058/1265] 4.15.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index dd529f16320..5bfd5690a53 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.15.2 / 2017-03-06
+===================
 
   * deps: qs@6.4.0
     - Fix regression parsing keys starting with `[`
diff --git a/package.json b/package.json
index 7894722c4db..ef49b40d425 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.15.1",
+  "version": "4.15.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 64dd446aa85a3fc28bd4662626593f29a45689f6 Mon Sep 17 00:00:00 2001
From: Jamie Barton <hi_jamie@me.com>
Date: Wed, 8 Mar 2017 14:10:39 +0000
Subject: [PATCH 1059/1265] docs: remove dead link to translated readme

closes #3239
---
 Readme.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 0ddc68fdc9a..7b261a3d94d 100644
--- a/Readme.md
+++ b/Readme.md
@@ -43,7 +43,6 @@ $ npm install express
   * Visit the [Wiki](https://github.com/expressjs/express/wiki)
   * [Google Group](https://groups.google.com/group/express-js) for discussion
   * [Gitter](https://gitter.im/expressjs/express) for support and discussion
-  * [Русскоязычная документация](http://jsman.ru/express/)
 
 **PROTIP** Be sure to read [Migrating from 3.x to 4.x](https://github.com/expressjs/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/expressjs/express/wiki/New-features-in-4.x).
 

From f44368f8bede4ffc56929b183d6d5508e222a949 Mon Sep 17 00:00:00 2001
From: Jamie Barton <hi_jamie@me.com>
Date: Wed, 8 Mar 2017 14:32:43 +0000
Subject: [PATCH 1060/1265] examples: replace jade with ejs in view-locals

closes #3240
---
 examples/view-locals/index.js        | 11 ++++++-----
 examples/view-locals/layout.jade     | 12 ------------
 examples/view-locals/user.jade       |  8 --------
 examples/view-locals/views/index.ejs | 19 +++++++++++++++++++
 4 files changed, 25 insertions(+), 25 deletions(-)
 delete mode 100644 examples/view-locals/layout.jade
 delete mode 100644 examples/view-locals/user.jade
 create mode 100644 examples/view-locals/views/index.ejs

diff --git a/examples/view-locals/index.js b/examples/view-locals/index.js
index cf347ed38d6..3814e6e4962 100644
--- a/examples/view-locals/index.js
+++ b/examples/view-locals/index.js
@@ -3,11 +3,12 @@
  */
 
 var express = require('../..');
+var path = require('path');
 var User = require('./user');
 var app = express();
 
-app.set('views', __dirname);
-app.set('view engine', 'jade');
+app.set('views', path.join(__dirname, 'views'));
+app.set('view engine', 'ejs');
 
 // filter ferrets only
 
@@ -25,7 +26,7 @@ app.get('/', function(req, res, next){
     if (err) return next(err);
     User.all(function(err, users){
       if (err) return next(err);
-      res.render('user', {
+      res.render('index', {
         title: 'Users',
         count: count,
         users: users.filter(ferrets)
@@ -59,7 +60,7 @@ function users(req, res, next) {
 }
 
 app.get('/middleware', count, users, function(req, res, next){
-  res.render('user', {
+  res.render('index', {
     title: 'Users',
     count: req.count,
     users: req.users.filter(ferrets)
@@ -101,7 +102,7 @@ app.get('/middleware-locals', count2, users2, function(req, res, next){
   // to pass to res.render(). If we have
   // several routes related to users this
   // can be a great productivity booster
-  res.render('user', { title: 'Users' });
+  res.render('index', { title: 'Users' });
 });
 
 // keep in mind that middleware may be placed anywhere
diff --git a/examples/view-locals/layout.jade b/examples/view-locals/layout.jade
deleted file mode 100644
index 5616cfaf7c2..00000000000
--- a/examples/view-locals/layout.jade
+++ /dev/null
@@ -1,12 +0,0 @@
-doctype html
-html
-  head
-    title= title
-    style.
-      body {
-        padding: 50px;
-        font: 16px Helvetica, Arial;
-      }
-  body
-    h2= title
-    block content
\ No newline at end of file
diff --git a/examples/view-locals/user.jade b/examples/view-locals/user.jade
deleted file mode 100644
index b07d2b17563..00000000000
--- a/examples/view-locals/user.jade
+++ /dev/null
@@ -1,8 +0,0 @@
-
-extends layout
-
-block content
-  for user in users
-    .user
-      h3= user.name
-      p #{user.name} is a #{user.age} year old #{user.species}.
\ No newline at end of file
diff --git a/examples/view-locals/views/index.ejs b/examples/view-locals/views/index.ejs
new file mode 100644
index 00000000000..1cbfc40bc00
--- /dev/null
+++ b/examples/view-locals/views/index.ejs
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title><%= title %></title>
+    <style media="screen">
+      body {
+        padding: 50px;
+        font: 16px Helvetica, Arial;
+      }
+    </style>
+  </head>
+  <body>
+    <h2><%= title %></h2>
+    <% users.forEach(function(user) { %>
+      <li><strong><%= user.name %></strong> is a <% user.age %> year old <%= user.species %></li>
+    <% }); %>
+  </body>
+</html>

From a1fffda3f2c879dac1b2ba7a28c457957768e874 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 14 Mar 2017 23:46:29 -0400
Subject: [PATCH 1061/1265] build: should@11.2.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ef49b40d425..1ec44636566 100644
--- a/package.json
+++ b/package.json
@@ -69,7 +69,7 @@
     "morgan": "1.8.1",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",
-    "should": "11.2.0",
+    "should": "11.2.1",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
     "cookie-session": "~1.2.0",

From 1b6ad080952f026fc7913beb84176519658ee07b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 14 Mar 2017 23:53:19 -0400
Subject: [PATCH 1062/1265] deps: debug@2.6.3

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5bfd5690a53..aa32ea6b893 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: debug@2.6.3
+    - Fix: `DEBUG_MAX_ARRAY_LENGTH`
+
 4.15.2 / 2017-03-06
 ===================
 
diff --git a/package.json b/package.json
index 1ec44636566..dd03d7e9bc5 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "content-type": "~1.0.2",
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
-    "debug": "2.6.1",
+    "debug": "2.6.3",
     "depd": "~1.1.0",
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",

From 245fa8942a4478862b7a620c6ce66f55311c556e Mon Sep 17 00:00:00 2001
From: Jamie Barton <hi_jamie@me.com>
Date: Wed, 8 Mar 2017 14:52:43 +0000
Subject: [PATCH 1063/1265] examples: replace jade with ejs in route-separation

closes #3241
---
 examples/route-separation/index.js            |  2 +-
 examples/route-separation/views/footer.ejs    |  2 ++
 examples/route-separation/views/header.ejs    |  8 +++++++
 examples/route-separation/views/index.ejs     | 10 ++++++++
 examples/route-separation/views/index.jade    |  6 -----
 examples/route-separation/views/layout.jade   |  6 -----
 .../route-separation/views/posts/index.ejs    | 12 ++++++++++
 .../route-separation/views/posts/index.jade   |  8 -------
 .../route-separation/views/users/edit.ejs     | 23 +++++++++++++++++++
 .../route-separation/views/users/edit.jade    | 12 ----------
 .../route-separation/views/users/index.ejs    | 14 +++++++++++
 .../route-separation/views/users/index.jade   |  9 --------
 .../route-separation/views/users/view.ejs     |  9 ++++++++
 .../route-separation/views/users/view.jade    |  6 -----
 14 files changed, 79 insertions(+), 48 deletions(-)
 create mode 100644 examples/route-separation/views/footer.ejs
 create mode 100644 examples/route-separation/views/header.ejs
 create mode 100644 examples/route-separation/views/index.ejs
 delete mode 100644 examples/route-separation/views/index.jade
 delete mode 100644 examples/route-separation/views/layout.jade
 create mode 100644 examples/route-separation/views/posts/index.ejs
 delete mode 100644 examples/route-separation/views/posts/index.jade
 create mode 100644 examples/route-separation/views/users/edit.ejs
 delete mode 100644 examples/route-separation/views/users/edit.jade
 create mode 100644 examples/route-separation/views/users/index.ejs
 delete mode 100644 examples/route-separation/views/users/index.jade
 create mode 100644 examples/route-separation/views/users/view.ejs
 delete mode 100644 examples/route-separation/views/users/view.jade

diff --git a/examples/route-separation/index.js b/examples/route-separation/index.js
index c6605ada6cb..79e26497f45 100644
--- a/examples/route-separation/index.js
+++ b/examples/route-separation/index.js
@@ -17,7 +17,7 @@ module.exports = app;
 
 // Config
 
-app.set('view engine', 'jade');
+app.set('view engine', 'ejs');
 app.set('views', path.join(__dirname, 'views'));
 
 /* istanbul ignore next */
diff --git a/examples/route-separation/views/footer.ejs b/examples/route-separation/views/footer.ejs
new file mode 100644
index 00000000000..308b1d01b6c
--- /dev/null
+++ b/examples/route-separation/views/footer.ejs
@@ -0,0 +1,2 @@
+</body>
+</html>
diff --git a/examples/route-separation/views/header.ejs b/examples/route-separation/views/header.ejs
new file mode 100644
index 00000000000..141f114ddba
--- /dev/null
+++ b/examples/route-separation/views/header.ejs
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title><%= title %></title>
+  <link rel="stylesheet" href="/style.css">
+</head>
+<body>
diff --git a/examples/route-separation/views/index.ejs b/examples/route-separation/views/index.ejs
new file mode 100644
index 00000000000..6d1afb4ac3d
--- /dev/null
+++ b/examples/route-separation/views/index.ejs
@@ -0,0 +1,10 @@
+<% include header %>
+
+<h1><%= title %></h1>
+
+<ul>
+  <li>Visit the <a href="/users">users</a> page.</li>
+  <li>Visit the <a href="/users">posts</a> page.</li>
+</ul>
+
+<% include footer %>
diff --git a/examples/route-separation/views/index.jade b/examples/route-separation/views/index.jade
deleted file mode 100644
index af9d499387a..00000000000
--- a/examples/route-separation/views/index.jade
+++ /dev/null
@@ -1,6 +0,0 @@
-extends layout
-
-block content
-  ul
-    li Visit the <a href="/users">users</a> page
-    li Visit the <a href="/posts">posts</a> page
diff --git a/examples/route-separation/views/layout.jade b/examples/route-separation/views/layout.jade
deleted file mode 100644
index 6535c8cc89d..00000000000
--- a/examples/route-separation/views/layout.jade
+++ /dev/null
@@ -1,6 +0,0 @@
-html
-  head
-    title= title
-    link(href="/style.css", rel="stylesheet")
-  body
-    block content
diff --git a/examples/route-separation/views/posts/index.ejs b/examples/route-separation/views/posts/index.ejs
new file mode 100644
index 00000000000..12303444858
--- /dev/null
+++ b/examples/route-separation/views/posts/index.ejs
@@ -0,0 +1,12 @@
+<% include ../header %>
+
+<h1>Posts</h1>
+
+<dl id="posts">
+  <% posts.forEach(function(post) { %>
+    <dt><%= post.title %></dt>
+    <dd><%= post.body %></dd>
+  <% }) %>
+</dl>
+
+<% include ../footer %>
diff --git a/examples/route-separation/views/posts/index.jade b/examples/route-separation/views/posts/index.jade
deleted file mode 100644
index 46efb2ea222..00000000000
--- a/examples/route-separation/views/posts/index.jade
+++ /dev/null
@@ -1,8 +0,0 @@
-extends ../layout
-
-block content
-  h1 Posts
-  dl#posts
-    for post in posts
-      dt= post.title
-      dd= post.body
diff --git a/examples/route-separation/views/users/edit.ejs b/examples/route-separation/views/users/edit.ejs
new file mode 100644
index 00000000000..c64160e037f
--- /dev/null
+++ b/examples/route-separation/views/users/edit.ejs
@@ -0,0 +1,23 @@
+<% include ../header %>
+
+<h1>Editing <%= user.name %></h1>
+
+<div id="user">
+  <form action="?_method=put", method="post">
+    <p>
+      Name:
+      <input type="text" value="<%= user.name %>" name="user[name]" />
+    </p>
+
+    <p>
+      Email:
+      <input type="email" value="<%= user.email %>" name="user[email]" />
+    </p>
+
+    <p>
+      <input type="submit" value="Save" />
+    </p>
+  </form>
+</div>
+
+<% include ../footer %>
diff --git a/examples/route-separation/views/users/edit.jade b/examples/route-separation/views/users/edit.jade
deleted file mode 100644
index f9ef180d6db..00000000000
--- a/examples/route-separation/views/users/edit.jade
+++ /dev/null
@@ -1,12 +0,0 @@
-extends ../layout
-
-block content
-  h1 Editing #{user.name}
-  #user
-    form(action="?_method=put", method="post")
-      p Name: 
-        input(type="text", value= user.name, name="user[name]")
-      p Email: 
-        input(type="text", value= user.email, name="user[email]")
-      p 
-        input(type="submit", value="Save")
diff --git a/examples/route-separation/views/users/index.ejs b/examples/route-separation/views/users/index.ejs
new file mode 100644
index 00000000000..0f97fc691c0
--- /dev/null
+++ b/examples/route-separation/views/users/index.ejs
@@ -0,0 +1,14 @@
+<% include ../header %>
+
+<h1><%= title %></h1>
+
+<div id="users">
+  <% users.forEach(function(user, index) { %>
+    <li>
+      <a href="/user/<%= index %>"><%= user.name %></a>
+      <a href="/user/<%= index %>/edit">edit</a>
+    </li>
+  <% }) %>
+</div>
+
+<% include ../footer %>
diff --git a/examples/route-separation/views/users/index.jade b/examples/route-separation/views/users/index.jade
deleted file mode 100644
index c4c54d0cf0d..00000000000
--- a/examples/route-separation/views/users/index.jade
+++ /dev/null
@@ -1,9 +0,0 @@
-extends ../layout
-
-block content
-  h1 Users
-  #users
-    for user, i in users
-      li
-        a(href="/user/#{i}")= user.name
-        a.edit(href="/user/#{i}/edit") edit
diff --git a/examples/route-separation/views/users/view.ejs b/examples/route-separation/views/users/view.ejs
new file mode 100644
index 00000000000..696abc04504
--- /dev/null
+++ b/examples/route-separation/views/users/view.ejs
@@ -0,0 +1,9 @@
+<% include ../header %>
+
+<h1><%= user.name %></h1>
+
+<div id="user">
+  <p>Email: <%= user.email %></p>
+</div>
+
+<% include ../footer %>
diff --git a/examples/route-separation/views/users/view.jade b/examples/route-separation/views/users/view.jade
deleted file mode 100644
index f5af1ae8cc0..00000000000
--- a/examples/route-separation/views/users/view.jade
+++ /dev/null
@@ -1,6 +0,0 @@
-extends ../layout
-
-block content
-  h1= user.name
-  #user
-    p Email: #{user.email}

From 2189ff14a9ba5ff2109412edd7009fcf5bc802f3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 19 Mar 2017 16:45:58 -0400
Subject: [PATCH 1064/1265] lint: remove trailing new lines from docs

---
 Contributing.md | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/Contributing.md b/Contributing.md
index 214e9070126..41386568d64 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -12,7 +12,7 @@ contributors can be involved in decision making.
 
 * A **Contributor** is any individual creating or commenting on an issue or pull request.
 * A **Committer** is a subset of contributors who have been given write access to the repository.
-* A **TC (Technical Committee)** is a group of committers representing the required technical 
+* A **TC (Technical Committee)** is a group of committers representing the required technical
 expertise to resolve rare disputes.
 
 # Logging Issues
@@ -36,24 +36,24 @@ pull requests.
 No pull request can be merged without being reviewed.
 
 For non-trivial contributions, pull requests should sit for at least 36 hours to ensure that
-contributors in other timezones have time to review. Consideration should also be given to 
-weekends and other holiday periods to ensure active committers all have reasonable time to 
+contributors in other timezones have time to review. Consideration should also be given to
+weekends and other holiday periods to ensure active committers all have reasonable time to
 become involved in the discussion and review process if they wish.
 
 The default for each contribution is that it is accepted once no committer has an objection.
-During review committers may also request that a specific contributor who is most versed in a 
-particular area gives a "LGTM" before the PR can be merged. There is no additional "sign off" 
-process for contributions to land. Once all issues brought by committers are addressed it can 
+During review committers may also request that a specific contributor who is most versed in a
+particular area gives a "LGTM" before the PR can be merged. There is no additional "sign off"
+process for contributions to land. Once all issues brought by committers are addressed it can
 be landed by any committer.
 
-In the case of an objection being raised in a pull request by another committer, all involved 
-committers should seek to arrive at a consensus by way of addressing concerns being expressed 
+In the case of an objection being raised in a pull request by another committer, all involved
+committers should seek to arrive at a consensus by way of addressing concerns being expressed
 by discussion, compromise on the proposed change, or withdrawal of the proposed change.
 
 If a contribution is controversial and committers cannot agree about how to get it to land
 or if it should land then it should be escalated to the TC. TC members should regularly
-discuss pending contributions in order to find a resolution. It is expected that only a 
-small minority of issues be brought to the TC for resolution and that discussion and 
+discuss pending contributions in order to find a resolution. It is expected that only a
+small minority of issues be brought to the TC for resolution and that discussion and
 compromise among committers be the default resolution mechanism.
 
 # Becoming a Committer
@@ -66,20 +66,20 @@ proper review, and have other committers merge their pull requests.
 
 # TC Process
 
-The TC uses a "consensus seeking" process for issues that are escalated to the TC. 
+The TC uses a "consensus seeking" process for issues that are escalated to the TC.
 The group tries to find a resolution that has no open objections among TC members.
 If a consensus cannot be reached that has no objections then a majority wins vote
-is called. It is also expected that the majority of decisions made by the TC are via 
+is called. It is also expected that the majority of decisions made by the TC are via
 a consensus seeking process and that voting is only used as a last-resort.
 
-Resolution may involve returning the issue to committers with suggestions on how to 
-move forward towards a consensus. It is not expected that a meeting of the TC 
+Resolution may involve returning the issue to committers with suggestions on how to
+move forward towards a consensus. It is not expected that a meeting of the TC
 will resolve all issues on its agenda during that meeting and may prefer to continue
 the discussion happening among the committers.
 
 Members can be added to the TC at any time. Any committer can nominate another committer
 to the TC and the TC uses its standard consensus seeking process to evaluate whether or
-not to add this new member. Members who do not participate consistently at the level of 
+not to add this new member. Members who do not participate consistently at the level of
 a majority of the other members are expected to resign.
 
 

From efd7032f71f3ef18060a100edc4aa11f4c912dde Mon Sep 17 00:00:00 2001
From: Wes Todd <wes@wesleytodd.com>
Date: Fri, 24 Feb 2017 09:05:43 -0600
Subject: [PATCH 1065/1265] build: Add .editorconfig

closes #3221
---
 .editorconfig | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 .editorconfig

diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 00000000000..cdb36c1b466
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,11 @@
+# http://editorconfig.org
+root = true
+
+[*]
+charset = utf-8
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[{*.js,*.json,*.yml}]
+indent_size = 2
+indent_style = space

From dbf092d3ea5aefd65815ca022ab9e89246cd67b9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 22 Mar 2017 02:10:43 -0400
Subject: [PATCH 1066/1265] deps: vary@~1.1.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index aa32ea6b893..8ecd3970c70 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,8 @@ unreleased
 
   * deps: debug@2.6.3
     - Fix: `DEBUG_MAX_ARRAY_LENGTH`
+  * deps: vary@~1.1.1
+    - perf: hoist regular expression
 
 4.15.2 / 2017-03-06
 ===================
diff --git a/package.json b/package.json
index dd03d7e9bc5..1bb93d378c1 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,7 @@
     "statuses": "~1.3.1",
     "type-is": "~1.6.14",
     "utils-merge": "1.0.0",
-    "vary": "~1.1.0"
+    "vary": "~1.1.1"
   },
   "devDependencies": {
     "after": "0.8.2",

From 8acaa9a3ea209be604e73477445c991e842ffe9e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 22 Mar 2017 02:12:06 -0400
Subject: [PATCH 1067/1265] deps: finalhandler@~1.0.1

fixes #3252
---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 8ecd3970c70..a8647e2484a 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,9 @@ unreleased
 
   * deps: debug@2.6.3
     - Fix: `DEBUG_MAX_ARRAY_LENGTH`
+  * deps: finalhandler@~1.0.1
+    - Fix missing `</html>` in HTML document
+    - deps: debug@2.6.3
   * deps: vary@~1.1.1
     - perf: hoist regular expression
 
diff --git a/package.json b/package.json
index 1bb93d378c1..42fd1ca46be 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.8.0",
-    "finalhandler": "~1.0.0",
+    "finalhandler": "~1.0.1",
     "fresh": "0.5.0",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",

From 3763d73a1f6663460b32e600b8fc892075e069c5 Mon Sep 17 00:00:00 2001
From: Jamie Barton <hi_jamie@me.com>
Date: Wed, 8 Mar 2017 16:31:18 +0000
Subject: [PATCH 1068/1265] examples: replace jade with hbs in mvc example

fixes #3181
closes #3185
closes #3243
closes #3245
closes #3249
---
 examples/mvc/controllers/user/index.js        |  2 ++
 examples/mvc/controllers/user/views/edit.hbs  | 25 ++++++++++++++++
 examples/mvc/controllers/user/views/edit.jade | 11 -------
 examples/mvc/controllers/user/views/list.hbs  | 16 ++++++++++
 examples/mvc/controllers/user/views/list.jade |  7 -----
 examples/mvc/controllers/user/views/show.hbs  | 29 +++++++++++++++++++
 examples/mvc/controllers/user/views/show.jade | 17 -----------
 examples/mvc/index.js                         |  8 ++---
 examples/mvc/views/404.ejs                    | 12 ++++++++
 examples/mvc/views/404.jade                   |  3 --
 examples/mvc/views/5xx.ejs                    | 12 ++++++++
 examples/mvc/views/5xx.jade                   |  3 --
 package.json                                  |  2 +-
 13 files changed, 100 insertions(+), 47 deletions(-)
 create mode 100644 examples/mvc/controllers/user/views/edit.hbs
 delete mode 100644 examples/mvc/controllers/user/views/edit.jade
 create mode 100644 examples/mvc/controllers/user/views/list.hbs
 delete mode 100644 examples/mvc/controllers/user/views/list.jade
 create mode 100644 examples/mvc/controllers/user/views/show.hbs
 delete mode 100644 examples/mvc/controllers/user/views/show.jade
 create mode 100644 examples/mvc/views/404.ejs
 delete mode 100644 examples/mvc/views/404.jade
 create mode 100644 examples/mvc/views/5xx.ejs
 delete mode 100644 examples/mvc/views/5xx.jade

diff --git a/examples/mvc/controllers/user/index.js b/examples/mvc/controllers/user/index.js
index 9ccbcccb9ca..a7b0208c8e7 100644
--- a/examples/mvc/controllers/user/index.js
+++ b/examples/mvc/controllers/user/index.js
@@ -4,6 +4,8 @@
 
 var db = require('../../db');
 
+exports.engine = 'hbs';
+
 exports.before = function(req, res, next){
   var id = req.params.user_id;
   if (!id) return next();
diff --git a/examples/mvc/controllers/user/views/edit.hbs b/examples/mvc/controllers/user/views/edit.hbs
new file mode 100644
index 00000000000..d356f5ee7f3
--- /dev/null
+++ b/examples/mvc/controllers/user/views/edit.hbs
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <link rel="stylesheet" href="/style.css">
+  <title>Edit {{user.name}}</title>
+</head>
+<body>
+  <h1>{{user.name}}</h1>
+  <form action="/user/{{user.id}}?_method=put" method="post">
+    <label for="user[name]">Name:
+      <input type="text" name="user[name]" value="{{user.name}}">
+    </label>
+
+    <input type="submit" name="submit" value="Update">
+  </form>
+
+  <form action="/user/{{user.id}}/pet" method="post">
+    <label for="pet[name]">Pet:
+      <input type="text" name="pet[name]" placeholder="Pet Name">
+    </label>
+
+    <input type="submit" name="submit" value="Add">
+  </form>
+</body>
+</html>
diff --git a/examples/mvc/controllers/user/views/edit.jade b/examples/mvc/controllers/user/views/edit.jade
deleted file mode 100644
index a2fde5d477e..00000000000
--- a/examples/mvc/controllers/user/views/edit.jade
+++ /dev/null
@@ -1,11 +0,0 @@
-link(rel='stylesheet', href='/style.css')
-h1= user.name
-form(action='/user/#{user.id}?_method=put', method='post')
-  label= 'Name: '
-    input(type='text', name='user[name]', value='#{user.name}')
-  input(type='submit', value='Update')
-
-form(action='/user/#{user.id}/pet', method='post')
-  label= 'Pet: '
-    input(type='text', name='pet[name]', placeholder='Name')
-  input(type='submit', value='Add')
diff --git a/examples/mvc/controllers/user/views/list.hbs b/examples/mvc/controllers/user/views/list.hbs
new file mode 100644
index 00000000000..191867de3ff
--- /dev/null
+++ b/examples/mvc/controllers/user/views/list.hbs
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <link rel="stylesheet" href="/style.css">
+  <title>Users</title>
+</head>
+<body>
+  <h1>Users</h1>
+  <p>Click a user below to view their pets.</p>
+  <ul>
+    {{#each users}}
+      <li><a href="/user/{{id}}">{{name}}</a></li>
+    {{/each}}
+  </ul>
+</body>
+</html>
diff --git a/examples/mvc/controllers/user/views/list.jade b/examples/mvc/controllers/user/views/list.jade
deleted file mode 100644
index af8933cfe05..00000000000
--- a/examples/mvc/controllers/user/views/list.jade
+++ /dev/null
@@ -1,7 +0,0 @@
-link(rel='stylesheet', href='/style.css')
-h1 Users
-p Click a user below to view their pets.
-ul
-  each user in users
-    li
-      a(href='/user/#{user.id}')= user.name
diff --git a/examples/mvc/controllers/user/views/show.hbs b/examples/mvc/controllers/user/views/show.hbs
new file mode 100644
index 00000000000..f064cf54f1f
--- /dev/null
+++ b/examples/mvc/controllers/user/views/show.hbs
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <link rel="stylesheet" href="/style.css">
+  <title>{{user.name}}</title>
+</head>
+<body>
+<h1>{{user.name}} <a href="/user/{{user.id}}/edit">edit</a></h1>
+
+{{#if hasMessages}}
+  <ul>
+    {{#each messages}}
+      <li>{{this}}</li>
+    {{/each}}
+  </ul>
+{{/if}}
+
+{{#if user.pets.length}}
+  <p>View {{user.name}}'s pets:</p>
+  <ul>
+    {{#each user.pets}}
+      <li><a href="/pet/{{id}}">{{name}}</a></li>
+    {{/each}}
+  </ul>
+{{else}}
+  <p>No pets!</p>
+{{/if}}
+</body>
+</html>
diff --git a/examples/mvc/controllers/user/views/show.jade b/examples/mvc/controllers/user/views/show.jade
deleted file mode 100644
index 267d3ef7e40..00000000000
--- a/examples/mvc/controllers/user/views/show.jade
+++ /dev/null
@@ -1,17 +0,0 @@
-link(rel='stylesheet', href='/style.css')
-h1= user.name + ' '
-  a(href='/user/#{user.id}/edit') edit
-
-if (hasMessages)
-  ul#messages
-    each msg in messages
-      li= msg
-
-if (user.pets.length)
-  p View #{user.name}'s pets:
-  ul
-    each pet in user.pets
-      li
-        a(href='/pet/#{pet.id}')= pet.name
-else
-  p No pets!
diff --git a/examples/mvc/index.js b/examples/mvc/index.js
index c5e2678697a..0d5624b63d3 100644
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -11,11 +11,9 @@ var methodOverride = require('method-override');
 
 var app = module.exports = express();
 
-// settings
-
-// set our default template engine to "jade"
-// which prevents the need for extensions
-app.set('view engine', 'jade');
+// set our default template engine to "ejs"
+// which prevents the need for using file extensions
+app.set('view engine', 'ejs');
 
 // set views for error and 404 pages
 app.set('views', path.join(__dirname, 'views'));
diff --git a/examples/mvc/views/404.ejs b/examples/mvc/views/404.ejs
new file mode 100644
index 00000000000..18d7e4afe3a
--- /dev/null
+++ b/examples/mvc/views/404.ejs
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>Not Found</title>
+    <link rel="stylesheet" href="/style.css">
+  </head>
+  <body>
+    <h1>404: Not Found</h1>
+    <p>Sorry we can't find <%= url %></p>
+  </body>
+</html>
diff --git a/examples/mvc/views/404.jade b/examples/mvc/views/404.jade
deleted file mode 100644
index 110c471f1b9..00000000000
--- a/examples/mvc/views/404.jade
+++ /dev/null
@@ -1,3 +0,0 @@
-link(rel='stylesheet', href='/style.css')
-h1 404: Not Found
-p Sorry we can't find #{url}
diff --git a/examples/mvc/views/5xx.ejs b/examples/mvc/views/5xx.ejs
new file mode 100644
index 00000000000..ea0f246ddfd
--- /dev/null
+++ b/examples/mvc/views/5xx.ejs
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>Internal Server Error</title>
+    <link rel="stylesheet" href="/style.css">
+  </head>
+  <body>
+    <h1>500: Internal Server Error</h1>
+    <p>Looks like something blew up!</p>
+  </body>
+</html>
diff --git a/examples/mvc/views/5xx.jade b/examples/mvc/views/5xx.jade
deleted file mode 100644
index 3508b7c0e2a..00000000000
--- a/examples/mvc/views/5xx.jade
+++ /dev/null
@@ -1,3 +0,0 @@
-link(rel='stylesheet', href='/style.css')
-h1 500: Internal Server Error
-p Looks like something blew up!
diff --git a/package.json b/package.json
index 42fd1ca46be..8c1d415f212 100644
--- a/package.json
+++ b/package.json
@@ -62,6 +62,7 @@
     "cookie-parser": "~1.4.3",
     "ejs": "2.5.6",
     "express-session": "1.15.1",
+    "hbs": "4.0.1",
     "istanbul": "0.4.5",
     "marked": "0.3.6",
     "method-override": "2.3.7",
@@ -73,7 +74,6 @@
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
     "cookie-session": "~1.2.0",
-    "jade": "~1.11.0",
     "vhost": "~3.0.2"
   },
   "engines": {

From aabf7802a979f44cf75ffac2978724935d064fec Mon Sep 17 00:00:00 2001
From: Jamie Barton <hi_jamie@me.com>
Date: Fri, 24 Mar 2017 08:53:03 +0000
Subject: [PATCH 1069/1265] docs: fix the security issues heading format

closes #3256
---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 7b261a3d94d..786756a1cd2 100644
--- a/Readme.md
+++ b/Readme.md
@@ -46,7 +46,7 @@ $ npm install express
 
 **PROTIP** Be sure to read [Migrating from 3.x to 4.x](https://github.com/expressjs/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/expressjs/express/wiki/New-features-in-4.x).
 
-###Security Issues
+### Security Issues
 
 If you discover a security vulnerability in Express, please see [Security Policies and Procedures](Security.md).
 

From 347d4db3cac2979d639cb2be161ba01c9b2336d2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 28 Mar 2017 22:56:32 -0400
Subject: [PATCH 1070/1265] deps: proxy-addr@~1.1.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a8647e2484a..8e80d0e5ee7 100644
--- a/History.md
+++ b/History.md
@@ -6,6 +6,8 @@ unreleased
   * deps: finalhandler@~1.0.1
     - Fix missing `</html>` in HTML document
     - deps: debug@2.6.3
+  * deps: proxy-addr@~1.1.4
+    - deps: ipaddr.js@1.3.0
   * deps: vary@~1.1.1
     - perf: hoist regular expression
 
diff --git a/package.json b/package.json
index 8c1d415f212..940c58d1bef 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.1",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~1.1.3",
+    "proxy-addr": "~1.1.4",
     "qs": "6.4.0",
     "range-parser": "~1.2.0",
     "send": "0.15.1",

From c087a45b9cc3eb69c777e260ee880758b6e03a40 Mon Sep 17 00:00:00 2001
From: asaf david <asafdav2@gmail.com>
Date: Fri, 31 Mar 2017 15:57:28 +0300
Subject: [PATCH 1071/1265] Fix typo in variable name setPrototypeOf

closes #3266
---
 lib/application.js     | 14 +++++++-------
 lib/middleware/init.js |  6 +++---
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/lib/application.js b/lib/application.js
index 21a81ee9efe..1abe8d08f58 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -28,7 +28,7 @@ var deprecate = require('depd')('express');
 var flatten = require('array-flatten');
 var merge = require('utils-merge');
 var resolve = require('path').resolve;
-var setPrototyeOf = require('setprototypeof')
+var setPrototypeOf = require('setprototypeof')
 var slice = Array.prototype.slice;
 
 /**
@@ -95,10 +95,10 @@ app.defaultConfiguration = function defaultConfiguration() {
     }
 
     // inherit protos
-    setPrototyeOf(this.request, parent.request)
-    setPrototyeOf(this.response, parent.response)
-    setPrototyeOf(this.engines, parent.engines)
-    setPrototyeOf(this.settings, parent.settings)
+    setPrototypeOf(this.request, parent.request)
+    setPrototypeOf(this.response, parent.response)
+    setPrototypeOf(this.engines, parent.engines)
+    setPrototypeOf(this.settings, parent.settings)
   });
 
   // setup locals
@@ -228,8 +228,8 @@ app.use = function use(fn) {
     router.use(path, function mounted_app(req, res, next) {
       var orig = req.app;
       fn.handle(req, res, function (err) {
-        setPrototyeOf(req, orig.request)
-        setPrototyeOf(res, orig.response)
+        setPrototypeOf(req, orig.request)
+        setPrototypeOf(res, orig.response)
         next(err);
       });
     });
diff --git a/lib/middleware/init.js b/lib/middleware/init.js
index 328c4a863d9..dfd042747bd 100644
--- a/lib/middleware/init.js
+++ b/lib/middleware/init.js
@@ -13,7 +13,7 @@
  * @private
  */
 
-var setPrototyeOf = require('setprototypeof')
+var setPrototypeOf = require('setprototypeof')
 
 /**
  * Initialization middleware, exposing the
@@ -32,8 +32,8 @@ exports.init = function(app){
     res.req = req;
     req.next = next;
 
-    setPrototyeOf(req, app.request)
-    setPrototyeOf(res, app.response)
+    setPrototypeOf(req, app.request)
+    setPrototypeOf(res, app.response)
 
     res.locals = res.locals || Object.create(null);
 

From df4f2719db909ab333d8173f57a96bc213680c2a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 26 Apr 2017 23:49:41 -0400
Subject: [PATCH 1072/1265] deps: type-is@~1.6.15

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 8e80d0e5ee7..336e7428c91 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,8 @@ unreleased
     - deps: debug@2.6.3
   * deps: proxy-addr@~1.1.4
     - deps: ipaddr.js@1.3.0
+  * deps: type-is@~1.6.15
+    - deps: mime-types@~2.1.15
   * deps: vary@~1.1.1
     - perf: hoist regular expression
 
diff --git a/package.json b/package.json
index 940c58d1bef..3ce5dc3cbc2 100644
--- a/package.json
+++ b/package.json
@@ -52,7 +52,7 @@
     "serve-static": "1.12.1",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",
-    "type-is": "~1.6.14",
+    "type-is": "~1.6.15",
     "utils-merge": "1.0.0",
     "vary": "~1.1.1"
   },

From 2d1dade36a867dcd68a2169270d524d73a3b92eb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 27 Apr 2017 00:00:57 -0400
Subject: [PATCH 1073/1265] deps: serve-static@1.12.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 336e7428c91..f6bd295727a 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,8 @@ unreleased
     - deps: debug@2.6.3
   * deps: proxy-addr@~1.1.4
     - deps: ipaddr.js@1.3.0
+  * deps: serve-static@1.12.2
+    - deps: send@0.15.2
   * deps: type-is@~1.6.15
     - deps: mime-types@~2.1.15
   * deps: vary@~1.1.1
diff --git a/package.json b/package.json
index 3ce5dc3cbc2..9dcc7266c73 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "qs": "6.4.0",
     "range-parser": "~1.2.0",
     "send": "0.15.1",
-    "serve-static": "1.12.1",
+    "serve-static": "1.12.2",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",

From 1b6e7004b7e46a7c9fd3f53cd408debbcb689367 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 27 Apr 2017 01:11:58 -0400
Subject: [PATCH 1074/1265] deps: send@0.15.2

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f6bd295727a..10b15b2b6a0 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,9 @@ unreleased
     - deps: debug@2.6.3
   * deps: proxy-addr@~1.1.4
     - deps: ipaddr.js@1.3.0
+  * deps: send@0.15.2
+    - deps: debug@2.6.4
+    - deps: ms@1.0.0
   * deps: serve-static@1.12.2
     - deps: send@0.15.2
   * deps: type-is@~1.6.15
diff --git a/package.json b/package.json
index 9dcc7266c73..1fbff92544f 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "proxy-addr": "~1.1.4",
     "qs": "6.4.0",
     "range-parser": "~1.2.0",
-    "send": "0.15.1",
+    "send": "0.15.2",
     "serve-static": "1.12.2",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",

From a13938eed7b67ce13b86a45c7b0f2ae766a3166d Mon Sep 17 00:00:00 2001
From: Colin Richardson <wormssmail@gmail.com>
Date: Thu, 27 Apr 2017 19:51:38 +0100
Subject: [PATCH 1075/1265] tests: add tests for res.location('back')

closes #3292
closes #3293
---
 test/res.location.js | 58 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/test/res.location.js b/test/res.location.js
index bb9eb6f92e3..c0bfbe8c8ec 100644
--- a/test/res.location.js
+++ b/test/res.location.js
@@ -42,5 +42,63 @@ describe('res', function(){
       .expect('Location', 'https://google.com?q=%A710')
       .expect(200, done)
     })
+
+    describe('when url is "back"', function () {
+      it('should set location from "Referer" header', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.location('back').end()
+        })
+
+        request(app)
+        .get('/')
+        .set('Referer', '/some/page.html')
+        .expect('Location', '/some/page.html')
+        .expect(200, done)
+      })
+
+      it('should set location from "Referrer" header', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.location('back').end()
+        })
+
+        request(app)
+        .get('/')
+        .set('Referrer', '/some/page.html')
+        .expect('Location', '/some/page.html')
+        .expect(200, done)
+      })
+
+      it('should prefer "Referrer" header', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.location('back').end()
+        })
+
+        request(app)
+        .get('/')
+        .set('Referer', '/some/page1.html')
+        .set('Referrer', '/some/page2.html')
+        .expect('Location', '/some/page2.html')
+        .expect(200, done)
+      })
+
+      it('should set the header to "/" without referrer', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.location('back').end()
+        })
+
+        request(app)
+        .get('/')
+        .expect('Location', '/')
+        .expect(200, done)
+      })
+    })
   })
 })

From de41c0bfa4fc9ff78fb5f0f72daf5e83e53a93ae Mon Sep 17 00:00:00 2001
From: Tony Anisimov <spbtony@gmail.com>
Date: Tue, 9 May 2017 23:35:20 +0300
Subject: [PATCH 1076/1265] Fix res.cookie jsdoc comment

closes #3304
---
 lib/response.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/response.js b/lib/response.js
index 6aefe1b1782..f3f043f5cd6 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -777,7 +777,7 @@ res.clearCookie = function clearCookie(name, options) {
  *
  * @param {String} name
  * @param {String|Object} value
- * @param {Options} options
+ * @param {Object} [options]
  * @return {ServerResponse} for chaining
  * @public
  */

From 5ea2a8ff8e78349484d2887db2f10a94ec79b8d7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 14 May 2017 23:29:13 -0400
Subject: [PATCH 1077/1265] build: Node.js@7.9

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 1230c7e2f95..b4beea77f36 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "4.8"
   - "5.12"
   - "6.10"
-  - "7.6"
+  - "7.9"
 matrix:
   include:
     - node_js: "8.0"
diff --git a/appveyor.yml b/appveyor.yml
index b4bb184dd8f..cd4f9d23e5e 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -8,7 +8,7 @@ environment:
     - nodejs_version: "4.8"
     - nodejs_version: "5.12"
     - nodejs_version: "6.10"
-    - nodejs_version: "7.6"
+    - nodejs_version: "7.9"
 cache:
   - node_modules
 install:

From ae0b630ac7e8f34e4ea37285f30db4b52adf8436 Mon Sep 17 00:00:00 2001
From: Oz Michaeli <oz@appfigures.com>
Date: Wed, 10 May 2017 16:23:55 -0400
Subject: [PATCH 1078/1265] Fix error when res.set cannot add charset to
 Content-Type

fixes #3303
closes #3305
closes #3307
---
 History.md      |  1 +
 lib/response.js | 11 ++++++++---
 test/res.set.js | 13 +++++++++++++
 3 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 10b15b2b6a0..cbf13eb837e 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix error when `res.set` cannot add charset to `Content-Type`
   * deps: debug@2.6.3
     - Fix: `DEBUG_MAX_ARRAY_LENGTH`
   * deps: finalhandler@~1.0.1
diff --git a/lib/response.js b/lib/response.js
index f3f043f5cd6..b852a60e2f5 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -717,9 +717,14 @@ res.header = function header(field, val) {
       : String(val);
 
     // add charset to content-type
-    if (field.toLowerCase() === 'content-type' && !charsetRegExp.test(value)) {
-      var charset = mime.charsets.lookup(value.split(';')[0]);
-      if (charset) value += '; charset=' + charset.toLowerCase();
+    if (field.toLowerCase() === 'content-type') {
+      if (Array.isArray(value)) {
+        throw new TypeError('Content-Type cannot be set to an Array');
+      }
+      if (!charsetRegExp.test(value)) {
+        var charset = mime.charsets.lookup(value.split(';')[0]);
+        if (charset) value += '; charset=' + charset.toLowerCase();
+      }
     }
 
     this.setHeader(field, value);
diff --git a/test/res.set.js b/test/res.set.js
index b15bc5d7e3d..e46d123947a 100644
--- a/test/res.set.js
+++ b/test/res.set.js
@@ -73,6 +73,19 @@ describe('res', function(){
       .expect('Content-Type', 'text/html; charset=lol')
       .expect(200, done);
     })
+
+    it('should throw when Content-Type is an array', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.set('Content-Type', ['text/html'])
+        res.end()
+      });
+
+      request(app)
+      .get('/')
+      .expect(500, /TypeError: Content-Type cannot be set to an Array/, done)
+    })
   })
 
   describe('.set(object)', function(){

From 1ba9a9ac23e48cc7295a53919953e1b3f0b0ea7f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 May 2017 01:28:21 -0400
Subject: [PATCH 1079/1265] deps: update example dependencies

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 1fbff92544f..67a20144c35 100644
--- a/package.json
+++ b/package.json
@@ -61,11 +61,11 @@
     "body-parser": "1.17.1",
     "cookie-parser": "~1.4.3",
     "ejs": "2.5.6",
-    "express-session": "1.15.1",
+    "express-session": "1.15.2",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
     "marked": "0.3.6",
-    "method-override": "2.3.7",
+    "method-override": "2.3.8",
     "mocha": "3.2.0",
     "morgan": "1.8.1",
     "multiparty": "4.1.3",

From ad4456c491fc2ecd8358fd3958da5c0a95c2c3ab Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 May 2017 01:46:34 -0400
Subject: [PATCH 1080/1265] deps: send@0.15.3

---
 History.md   | 6 +++---
 package.json | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index cbf13eb837e..b62e24b6e6b 100644
--- a/History.md
+++ b/History.md
@@ -9,9 +9,9 @@ unreleased
     - deps: debug@2.6.3
   * deps: proxy-addr@~1.1.4
     - deps: ipaddr.js@1.3.0
-  * deps: send@0.15.2
-    - deps: debug@2.6.4
-    - deps: ms@1.0.0
+  * deps: send@0.15.3
+    - deps: debug@2.6.7
+    - deps: ms@2.0.0
   * deps: serve-static@1.12.2
     - deps: send@0.15.2
   * deps: type-is@~1.6.15
diff --git a/package.json b/package.json
index 67a20144c35..6e2c5995c8d 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "proxy-addr": "~1.1.4",
     "qs": "6.4.0",
     "range-parser": "~1.2.0",
-    "send": "0.15.2",
+    "send": "0.15.3",
     "serve-static": "1.12.2",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",

From 58cfc9911b5f1e67397ba481535320a1c3b9e954 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 May 2017 01:47:17 -0400
Subject: [PATCH 1081/1265] deps: serve-static@1.12.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index b62e24b6e6b..0ebb6ea31a2 100644
--- a/History.md
+++ b/History.md
@@ -12,8 +12,8 @@ unreleased
   * deps: send@0.15.3
     - deps: debug@2.6.7
     - deps: ms@2.0.0
-  * deps: serve-static@1.12.2
-    - deps: send@0.15.2
+  * deps: serve-static@1.12.3
+    - deps: send@0.15.3
   * deps: type-is@~1.6.15
     - deps: mime-types@~2.1.15
   * deps: vary@~1.1.1
diff --git a/package.json b/package.json
index 6e2c5995c8d..d9f003e8531 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "qs": "6.4.0",
     "range-parser": "~1.2.0",
     "send": "0.15.3",
-    "serve-static": "1.12.2",
+    "serve-static": "1.12.3",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",

From bc2986fe59c233ac58d981e620fddd4c58b55c9b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 May 2017 01:56:36 -0400
Subject: [PATCH 1082/1265] deps: finalhandler@~1.0.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 0ebb6ea31a2..4ca0255a6cd 100644
--- a/History.md
+++ b/History.md
@@ -4,9 +4,9 @@ unreleased
   * Fix error when `res.set` cannot add charset to `Content-Type`
   * deps: debug@2.6.3
     - Fix: `DEBUG_MAX_ARRAY_LENGTH`
-  * deps: finalhandler@~1.0.1
+  * deps: finalhandler@~1.0.3
     - Fix missing `</html>` in HTML document
-    - deps: debug@2.6.3
+    - deps: debug@2.6.7
   * deps: proxy-addr@~1.1.4
     - deps: ipaddr.js@1.3.0
   * deps: send@0.15.3
diff --git a/package.json b/package.json
index d9f003e8531..f469ca5a713 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.8.0",
-    "finalhandler": "~1.0.1",
+    "finalhandler": "~1.0.3",
     "fresh": "0.5.0",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",

From 65494692c2d83bb99586166afe463ba1177dbbdb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 May 2017 01:57:31 -0400
Subject: [PATCH 1083/1265] build: mocha@3.4.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f469ca5a713..ac2f32d6796 100644
--- a/package.json
+++ b/package.json
@@ -66,7 +66,7 @@
     "istanbul": "0.4.5",
     "marked": "0.3.6",
     "method-override": "2.3.8",
-    "mocha": "3.2.0",
+    "mocha": "3.4.1",
     "morgan": "1.8.1",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",

From 5cf473dc5d51c66a0cd373f4eca469505dfa4f32 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 May 2017 02:08:50 -0400
Subject: [PATCH 1084/1265] deps: debug@2.6.7

---
 History.md   | 5 +++--
 package.json | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 4ca0255a6cd..2222778710b 100644
--- a/History.md
+++ b/History.md
@@ -2,8 +2,9 @@ unreleased
 ==========
 
   * Fix error when `res.set` cannot add charset to `Content-Type`
-  * deps: debug@2.6.3
-    - Fix: `DEBUG_MAX_ARRAY_LENGTH`
+  * deps: debug@2.6.7
+    - Fix `DEBUG_MAX_ARRAY_LENGTH`
+    - deps: ms@2.0.0
   * deps: finalhandler@~1.0.3
     - Fix missing `</html>` in HTML document
     - deps: debug@2.6.7
diff --git a/package.json b/package.json
index ac2f32d6796..4acb1ff2e58 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "content-type": "~1.0.2",
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
-    "debug": "2.6.3",
+    "debug": "2.6.7",
     "depd": "~1.1.0",
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",

From 6da454c7fb37e68ed65ffe0371aa688b89f5bd6e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 May 2017 02:14:11 -0400
Subject: [PATCH 1085/1265] 4.15.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 2222778710b..83b439c63e8 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.15.3 / 2017-05-16
+===================
 
   * Fix error when `res.set` cannot add charset to `Content-Type`
   * deps: debug@2.6.7
diff --git a/package.json b/package.json
index 4acb1ff2e58..98adaea686a 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.15.2",
+  "version": "4.15.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From fde8f647d368df1dc62d55ce4d68370ef3eb0a49 Mon Sep 17 00:00:00 2001
From: Owen Luke <hi.owen.luke@gmail.com>
Date: Wed, 17 May 2017 16:00:49 +0800
Subject: [PATCH 1086/1265] examples: fix route in params example

closes #3310
---
 examples/params/index.js  | 2 +-
 test/acceptance/params.js | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/examples/params/index.js b/examples/params/index.js
index d70f0beeeb1..f918b5fd30d 100644
--- a/examples/params/index.js
+++ b/examples/params/index.js
@@ -68,7 +68,7 @@ app.get('/users/:from-:to', function(req, res, next){
   var from = req.params.from;
   var to = req.params.to;
   var names = users.map(function(user){ return user.name; });
-  res.send('users ' + names.slice(from, to).join(', '));
+  res.send('users ' + names.slice(from, to + 1).join(', '));
 });
 
 /* istanbul ignore next */
diff --git a/test/acceptance/params.js b/test/acceptance/params.js
index 56b7a72ce0f..e7c30cf7732 100644
--- a/test/acceptance/params.js
+++ b/test/acceptance/params.js
@@ -29,8 +29,8 @@ describe('params', function(){
   describe('GET /users/0-2', function(){
     it('should respond with three users', function(done){
       request(app)
-        .get('/users/0-2')
-        .expect(/users tj, tobi/,done)
+      .get('/users/0-2')
+      .expect(/users tj, tobi, loki/, done)
     })
   })
 

From 60f87f8074c28a1727305530058d8c2c9596387c Mon Sep 17 00:00:00 2001
From: Owen Luke <hi.owen.luke@gmail.com>
Date: Wed, 17 May 2017 17:04:10 +0800
Subject: [PATCH 1087/1265] examples: fix posts link in route-separation
 example

closes #3310
---
 examples/route-separation/views/index.ejs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/route-separation/views/index.ejs b/examples/route-separation/views/index.ejs
index 6d1afb4ac3d..2a0b095fa36 100644
--- a/examples/route-separation/views/index.ejs
+++ b/examples/route-separation/views/index.ejs
@@ -4,7 +4,7 @@
 
 <ul>
   <li>Visit the <a href="/users">users</a> page.</li>
-  <li>Visit the <a href="/users">posts</a> page.</li>
+  <li>Visit the <a href="/posts">posts</a> page.</li>
 </ul>
 
 <% include footer %>

From cf37240e7306c5085f3d2a232a4649279d020667 Mon Sep 17 00:00:00 2001
From: Owen Luke <hi.owen.luke@gmail.com>
Date: Wed, 17 May 2017 17:10:38 +0800
Subject: [PATCH 1088/1265] examples: fix reference error in view-constructor

closes #3310
---
 examples/view-constructor/github-view.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/view-constructor/github-view.js b/examples/view-constructor/github-view.js
index 53890291056..0a98a908434 100644
--- a/examples/view-constructor/github-view.js
+++ b/examples/view-constructor/github-view.js
@@ -2,7 +2,7 @@
  * Module dependencies.
  */
 
-var http = require('http');
+var https = require('https');
 var path = require('path');
 var extname = path.extname;
 

From 9f019c8c6966736803a65eb4a96d0e7e87e85ede Mon Sep 17 00:00:00 2001
From: Owen Luke <hi.owen.luke@gmail.com>
Date: Wed, 17 May 2017 23:55:27 +0800
Subject: [PATCH 1089/1265] examples: add comment about Redis install in
 examples

closes #3310
---
 examples/online/index.js  | 6 +++++-
 examples/search/index.js  | 6 +++++-
 examples/session/index.js | 6 +++++-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/examples/online/index.js b/examples/online/index.js
index 5cdaa6ca8d2..f14474c08d3 100644
--- a/examples/online/index.js
+++ b/examples/online/index.js
@@ -1,4 +1,8 @@
-// first:
+
+// install redis first:
+// https://redis.io/
+
+// then:
 // $ npm install redis online
 // $ redis-server
 
diff --git a/examples/search/index.js b/examples/search/index.js
index 79f5d9f4d36..246993caa5a 100644
--- a/examples/search/index.js
+++ b/examples/search/index.js
@@ -1,4 +1,8 @@
-// first:
+
+// install redis first:
+// https://redis.io/
+
+// then:
 // $ npm install redis
 // $ redis-server
 
diff --git a/examples/session/index.js b/examples/session/index.js
index de41a77d2c0..9bae48b8d33 100644
--- a/examples/session/index.js
+++ b/examples/session/index.js
@@ -1,4 +1,8 @@
-// first:
+
+// install redis first:
+// https://redis.io/
+
+// then:
 // $ npm install redis
 // $ redis-server
 

From 9467a392e33ad1575f2d76aad5fc19f9290d6cd6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Jun 2017 19:09:25 -0400
Subject: [PATCH 1090/1265] build: Node.js@7.10

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index b4beea77f36..c9172c302ca 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "4.8"
   - "5.12"
   - "6.10"
-  - "7.9"
+  - "7.10"
 matrix:
   include:
     - node_js: "8.0"
diff --git a/appveyor.yml b/appveyor.yml
index cd4f9d23e5e..9fbc9d39a38 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -8,7 +8,7 @@ environment:
     - nodejs_version: "4.8"
     - nodejs_version: "5.12"
     - nodejs_version: "6.10"
-    - nodejs_version: "7.9"
+    - nodejs_version: "7.10"
 cache:
   - node_modules
 install:

From 48777dc37774eaa2c328a1d9bb9541dfa47ca90f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Jun 2017 19:12:30 -0400
Subject: [PATCH 1091/1265] build: mocha@3.4.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 98adaea686a..1788e9ffd16 100644
--- a/package.json
+++ b/package.json
@@ -66,7 +66,7 @@
     "istanbul": "0.4.5",
     "marked": "0.3.6",
     "method-override": "2.3.8",
-    "mocha": "3.4.1",
+    "mocha": "3.4.2",
     "morgan": "1.8.1",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",

From deffce5704913df9e6b00aca5536345610222417 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 30 Jun 2017 23:47:12 -0400
Subject: [PATCH 1092/1265] deps: qs@6.5.0

---
 History.md              | 5 +++++
 lib/middleware/query.js | 3 ++-
 package.json            | 2 +-
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 83b439c63e8..36fadc4b990 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * deps: qs@6.5.0
+
 4.15.3 / 2017-05-16
 ===================
 
diff --git a/lib/middleware/query.js b/lib/middleware/query.js
index 5f76f8458f0..7e9166947af 100644
--- a/lib/middleware/query.js
+++ b/lib/middleware/query.js
@@ -12,6 +12,7 @@
  * Module dependencies.
  */
 
+var merge = require('utils-merge')
 var parseUrl = require('parseurl');
 var qs = require('qs');
 
@@ -22,7 +23,7 @@ var qs = require('qs');
  */
 
 module.exports = function query(options) {
-  var opts = Object.create(options || null);
+  var opts = merge({}, options)
   var queryparse = qs.parse;
 
   if (typeof options === 'function') {
diff --git a/package.json b/package.json
index 1788e9ffd16..cb37b98a7f5 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "parseurl": "~1.3.1",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~1.1.4",
-    "qs": "6.4.0",
+    "qs": "6.5.0",
     "range-parser": "~1.2.0",
     "send": "0.15.3",
     "serve-static": "1.12.3",

From bd5951e603c16c1db779a76bc5e500c243f96cf8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 30 Jun 2017 23:51:18 -0400
Subject: [PATCH 1093/1265] deps: debug@2.6.8

closes #3286
closes #3337
---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 36fadc4b990..59663eb712d 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * deps: debug@2.6.8
   * deps: qs@6.5.0
 
 4.15.3 / 2017-05-16
diff --git a/package.json b/package.json
index cb37b98a7f5..674c8601ab0 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "content-type": "~1.0.2",
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
-    "debug": "2.6.7",
+    "debug": "2.6.8",
     "depd": "~1.1.0",
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",

From 1adee79e636400c734f2307c1ef4fb0fff5db92b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 30 Jun 2017 23:58:01 -0400
Subject: [PATCH 1094/1265] deps: update example dependencies

---
 package.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 674c8601ab0..7f401132cae 100644
--- a/package.json
+++ b/package.json
@@ -58,16 +58,16 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "body-parser": "1.17.1",
+    "body-parser": "1.17.2",
     "cookie-parser": "~1.4.3",
     "ejs": "2.5.6",
-    "express-session": "1.15.2",
+    "express-session": "1.15.3",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
     "marked": "0.3.6",
-    "method-override": "2.3.8",
+    "method-override": "2.3.9",
     "mocha": "3.4.2",
-    "morgan": "1.8.1",
+    "morgan": "1.8.2",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",
     "should": "11.2.1",

From 04beebb2c087e3b9795d6f1c3d0bd1112bf1f244 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 26 Jul 2017 11:52:42 -0400
Subject: [PATCH 1095/1265] build: Node.js@6.11

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index c9172c302ca..3e899dd2351 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,7 +7,7 @@ node_js:
   - "3.3"
   - "4.8"
   - "5.12"
-  - "6.10"
+  - "6.11"
   - "7.10"
 matrix:
   include:
diff --git a/appveyor.yml b/appveyor.yml
index 9fbc9d39a38..ed8d4aa9f05 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -7,7 +7,7 @@ environment:
     - nodejs_version: "3.3"
     - nodejs_version: "4.8"
     - nodejs_version: "5.12"
-    - nodejs_version: "6.10"
+    - nodejs_version: "6.11"
     - nodejs_version: "7.10"
 cache:
   - node_modules

From 43dff4ceb3446397aa3fe8c48b2de67b9e76a031 Mon Sep 17 00:00:00 2001
From: Piper Chester <piperchester@users.noreply.github.com>
Date: Tue, 27 Jun 2017 11:48:08 +0200
Subject: [PATCH 1096/1265] docs: fix GitHub capitalization

closes #3353
---
 Readme.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Readme.md b/Readme.md
index 786756a1cd2..17326615776 100644
--- a/Readme.md
+++ b/Readme.md
@@ -39,7 +39,7 @@ $ npm install express
 
   * [Website and Documentation](http://expressjs.com/) - [[website repo](https://github.com/expressjs/expressjs.com)]
   * [#express](https://webchat.freenode.net/?channels=express) on freenode IRC
-  * [Github Organization](https://github.com/expressjs) for Official Middleware & Modules
+  * [GitHub Organization](https://github.com/expressjs) for Official Middleware & Modules
   * Visit the [Wiki](https://github.com/expressjs/express/wiki)
   * [Google Group](https://groups.google.com/group/express-js) for discussion
   * [Gitter](https://gitter.im/expressjs/express) for support and discussion

From 5e16f400f17ca4bac48226446b09299e392db3b2 Mon Sep 17 00:00:00 2001
From: Owen Luke <hi.owen.luke@gmail.com>
Date: Fri, 19 May 2017 00:18:28 +0800
Subject: [PATCH 1097/1265] examples: use 1-based visitor count in
 cookie-sessions

closes #3312
---
 examples/cookie-sessions/index.js  | 5 ++---
 test/acceptance/cookie-sessions.js | 6 +++---
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/examples/cookie-sessions/index.js b/examples/cookie-sessions/index.js
index 73653f63af9..1dda15de612 100644
--- a/examples/cookie-sessions/index.js
+++ b/examples/cookie-sessions/index.js
@@ -15,9 +15,8 @@ app.use(count);
 
 // custom middleware
 function count(req, res) {
-  req.session.count = req.session.count || 0;
-  var n = req.session.count++;
-  res.send('viewed ' + n + ' times\n');
+  req.session.count = (req.session.count || 0) + 1
+  res.send('viewed ' + req.session.count + ' times\n')
 }
 
 /* istanbul ignore next */
diff --git a/test/acceptance/cookie-sessions.js b/test/acceptance/cookie-sessions.js
index 611ebe462a2..d438cfe6d5d 100644
--- a/test/acceptance/cookie-sessions.js
+++ b/test/acceptance/cookie-sessions.js
@@ -7,7 +7,7 @@ describe('cookie-sessions', function () {
     it('should display no views', function (done) {
       request(app)
       .get('/')
-      .expect(200, 'viewed 0 times\n', done)
+      .expect(200, 'viewed 1 times\n', done)
     })
 
     it('should set a session cookie', function (done) {
@@ -20,12 +20,12 @@ describe('cookie-sessions', function () {
     it('should display 1 view on revisit', function (done) {
       request(app)
       .get('/')
-      .expect(200, 'viewed 0 times\n', function (err, res) {
+      .expect(200, 'viewed 1 times\n', function (err, res) {
         if (err) return done(err)
         request(app)
         .get('/')
         .set('Cookie', getCookies(res))
-        .expect(200, 'viewed 1 times\n', done)
+        .expect(200, 'viewed 2 times\n', done)
       })
     })
   })

From 582381bcebf2a2344e7e054eed9606cc2221dd97 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 26 Jul 2017 13:09:46 -0400
Subject: [PATCH 1098/1265] deps: proxy-addr@~1.1.5

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 59663eb712d..a724e84231f 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,9 @@ unreleased
 ==========
 
   * deps: debug@2.6.8
+  * deps: proxy-addr@~1.1.5
+    - Fix array argument being altered
+    - deps: ipaddr.js@1.4.0
   * deps: qs@6.5.0
 
 4.15.3 / 2017-05-16
diff --git a/package.json b/package.json
index 7f401132cae..daf1f1feb1f 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.1",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~1.1.4",
+    "proxy-addr": "~1.1.5",
     "qs": "6.5.0",
     "range-parser": "~1.2.0",
     "send": "0.15.3",

From 3eb16c233c5bf76fb12558101565971372693c73 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Aug 2017 23:30:47 -0400
Subject: [PATCH 1099/1265] deps: depd@~1.1.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index a724e84231f..af2bcfb384c 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,8 @@ unreleased
 ==========
 
   * deps: debug@2.6.8
+  * deps: depd@~1.1.1
+    - Remove unnecessary `Buffer` loading
   * deps: proxy-addr@~1.1.5
     - Fix array argument being altered
     - deps: ipaddr.js@1.4.0
diff --git a/package.json b/package.json
index daf1f1feb1f..0a3848134fd 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "debug": "2.6.8",
-    "depd": "~1.1.0",
+    "depd": "~1.1.1",
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.8.0",

From b2af1018215540964390aab0c739c1e688865122 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Aug 2017 23:32:44 -0400
Subject: [PATCH 1100/1265] build: ejs@2.5.7

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 0a3848134fd..c14b8126b11 100644
--- a/package.json
+++ b/package.json
@@ -60,7 +60,7 @@
     "after": "0.8.2",
     "body-parser": "1.17.2",
     "cookie-parser": "~1.4.3",
-    "ejs": "2.5.6",
+    "ejs": "2.5.7",
     "express-session": "1.15.3",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",

From daf66beda49ebac6086b81dd1896a34395306a71 Mon Sep 17 00:00:00 2001
From: Hung HOANG <hung.xuan@kellydeli.com>
Date: Thu, 3 Aug 2017 11:33:29 +0200
Subject: [PATCH 1101/1265] examples: fix path join in ejs example

fixes #3382
closes #3383
closes #3385
---
 examples/ejs/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/ejs/index.js b/examples/ejs/index.js
index b868bdd7cb9..72780912938 100644
--- a/examples/ejs/index.js
+++ b/examples/ejs/index.js
@@ -26,7 +26,7 @@ app.set('views', path.join(__dirname, 'views'));
 
 // Path to our public directory
 
-app.use(express.static(path.join(__dirname + 'public')));
+app.use(express.static(path.join(__dirname, 'public')));
 
 // Without this you would need to
 // supply the extension to res.render()

From 85770a71fc3f3c7f3a1efe3e01d9f0c5fd68f82e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Aug 2017 00:25:59 -0400
Subject: [PATCH 1102/1265] deps: finalhandler@~1.0.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index af2bcfb384c..c67fd941745 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,8 @@ unreleased
   * deps: debug@2.6.8
   * deps: depd@~1.1.1
     - Remove unnecessary `Buffer` loading
+  * deps: finalhandler@~1.0.4
+    - deps: debug@2.6.8
   * deps: proxy-addr@~1.1.5
     - Fix array argument being altered
     - deps: ipaddr.js@1.4.0
diff --git a/package.json b/package.json
index c14b8126b11..839f370cbcb 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.8.0",
-    "finalhandler": "~1.0.3",
+    "finalhandler": "~1.0.4",
     "fresh": "0.5.0",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",

From e0aa8bf74eed76df4e5cf02005233d9de2401348 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 4 Aug 2017 00:26:50 -0400
Subject: [PATCH 1103/1265] build: mocha@3.5.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 839f370cbcb..15e80f1934b 100644
--- a/package.json
+++ b/package.json
@@ -66,7 +66,7 @@
     "istanbul": "0.4.5",
     "marked": "0.3.6",
     "method-override": "2.3.9",
-    "mocha": "3.4.2",
+    "mocha": "3.5.0",
     "morgan": "1.8.2",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",

From 713d2aed93586a7c11fc2c8beeaa0c03c6f565c9 Mon Sep 17 00:00:00 2001
From: Daniel Walasek <lysander6@gmail.com>
Date: Sat, 5 Aug 2017 12:42:45 +0200
Subject: [PATCH 1104/1265] tests: fix incorrect should usage

closes #3387
---
 test/Route.js                | 14 +++++++-------
 test/Router.js               |  2 +-
 test/app.js                  |  4 ++--
 test/app.param.js            |  6 +++---
 test/app.render.js           |  2 +-
 test/app.routes.error.js     |  8 ++++----
 test/exports.js              |  8 ++++----
 test/req.acceptsEncoding.js  |  6 +++---
 test/req.acceptsEncodings.js |  6 +++---
 test/req.acceptsLanguage.js  | 12 ++++++------
 test/req.acceptsLanguages.js | 12 ++++++------
 test/req.xhr.js              |  8 ++++----
 test/res.sendFile.js         | 14 +++++++-------
 13 files changed, 51 insertions(+), 51 deletions(-)

diff --git a/test/Route.js b/test/Route.js
index ada54086bf0..d7a80bdbc01 100644
--- a/test/Route.js
+++ b/test/Route.js
@@ -25,7 +25,7 @@ describe('Route', function(){
 
       route.dispatch(req, {}, function (err) {
         if (err) return done(err);
-        should(req.called).be.ok;
+        should(req.called).be.ok()
         done();
       });
     })
@@ -84,7 +84,7 @@ describe('Route', function(){
 
       route.dispatch(req, {}, function (err) {
         if (err) return done(err);
-        should(req.called).be.ok;
+        should(req.called).be.ok()
         done();
       });
     })
@@ -104,7 +104,7 @@ describe('Route', function(){
 
       route.dispatch(req, {}, function (err) {
         if (err) return done(err);
-        should(req.called).be.true;
+        should(req.called).be.true()
         done();
       });
     })
@@ -156,7 +156,7 @@ describe('Route', function(){
       });
 
       route.dispatch(req, {}, function (err) {
-        should(err).be.ok;
+        should(err).be.ok()
         should(err.message).equal('foobar');
         req.order.should.equal('a');
         done();
@@ -182,7 +182,7 @@ describe('Route', function(){
       });
 
       route.dispatch(req, {}, function (err) {
-        should(err).be.ok;
+        should(err).be.ok()
         should(err.message).equal('foobar');
         req.order.should.equal('a');
         done();
@@ -222,7 +222,7 @@ describe('Route', function(){
       });
 
       route.dispatch(req, {}, function(err){
-        should(err).be.ok;
+        should(err).be.ok()
         err.message.should.equal('boom!');
         done();
       });
@@ -234,7 +234,7 @@ describe('Route', function(){
 
       route.all(function(err, req, res, next){
         // this should not execute
-        true.should.be.false;
+        true.should.be.false()
       });
 
       route.dispatch(req, {}, done);
diff --git a/test/Router.js b/test/Router.js
index 01a6e2c472b..18153d29267 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -47,7 +47,7 @@ describe('Router', function(){
     var router = new Router();
 
     router.use(function (req, res) {
-      false.should.be.true;
+      false.should.be.true()
     });
 
     router.handle({ url: '', method: 'GET' }, {}, done);
diff --git a/test/app.js b/test/app.js
index 941d35ff1cc..e52365c36bb 100644
--- a/test/app.js
+++ b/test/app.js
@@ -86,7 +86,7 @@ describe('in development', function(){
   it('should disable "view cache"', function(){
     process.env.NODE_ENV = 'development';
     var app = express();
-    app.enabled('view cache').should.be.false;
+    app.enabled('view cache').should.be.false()
     process.env.NODE_ENV = 'test';
   })
 })
@@ -95,7 +95,7 @@ describe('in production', function(){
   it('should enable "view cache"', function(){
     process.env.NODE_ENV = 'production';
     var app = express();
-    app.enabled('view cache').should.be.true;
+    app.enabled('view cache').should.be.true()
     process.env.NODE_ENV = 'test';
   })
 })
diff --git a/test/app.param.js b/test/app.param.js
index c7a375418cd..ba43e46f8e3 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -57,13 +57,13 @@ describe('app', function(){
 
       app.get('/post/:id', function(req, res){
         var id = req.params.id;
-        id.should.be.a.Number;
+        id.should.be.a.Number()
         res.send('' + id);
       });
 
       app.get('/user/:uid', function(req, res){
         var id = req.params.id;
-        id.should.be.a.Number;
+        id.should.be.a.Number()
         res.send('' + id);
       });
 
@@ -91,7 +91,7 @@ describe('app', function(){
 
       app.get('/user/:id', function(req, res){
         var id = req.params.id;
-        id.should.be.a.Number;
+        id.should.be.a.Number()
         res.send('' + id);
       });
 
diff --git a/test/app.render.js b/test/app.render.js
index 729b1c97cc8..1485098f582 100644
--- a/test/app.render.js
+++ b/test/app.render.js
@@ -72,7 +72,7 @@ describe('app', function(){
       app.set('view', View);
 
       app.render('something', function(err, str){
-        err.should.be.ok;
+        err.should.be.ok()
         err.message.should.equal('err!');
         done();
       })
diff --git a/test/app.routes.error.js b/test/app.routes.error.js
index 7c49d50ffe2..cbbc23ef574 100644
--- a/test/app.routes.error.js
+++ b/test/app.routes.error.js
@@ -44,10 +44,10 @@ describe('app', function(){
         d = true;
         next();
       }, function(req, res){
-        a.should.be.false;
-        b.should.be.true;
-        c.should.be.true;
-        d.should.be.false;
+        a.should.be.false()
+        b.should.be.true()
+        c.should.be.true()
+        d.should.be.false()
         res.send(204);
       });
 
diff --git a/test/exports.js b/test/exports.js
index d34a7b1cf3e..2a80eedbbe8 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -5,19 +5,19 @@ var should = require('should');
 
 describe('exports', function(){
   it('should expose Router', function(){
-    express.Router.should.be.a.Function;
+    express.Router.should.be.a.Function()
   })
 
   it('should expose the application prototype', function(){
-    express.application.set.should.be.a.Function;
+    express.application.set.should.be.a.Function()
   })
 
   it('should expose the request prototype', function(){
-    express.request.accepts.should.be.a.Function;
+    express.request.accepts.should.be.a.Function()
   })
 
   it('should expose the response prototype', function(){
-    express.response.send.should.be.a.Function;
+    express.response.send.should.be.a.Function()
   })
 
   it('should permit modifying the .application prototype', function(){
diff --git a/test/req.acceptsEncoding.js b/test/req.acceptsEncoding.js
index 12708fc0144..9ed9197829f 100644
--- a/test/req.acceptsEncoding.js
+++ b/test/req.acceptsEncoding.js
@@ -8,8 +8,8 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.acceptsEncoding('gzip').should.be.ok;
-        req.acceptsEncoding('deflate').should.be.ok;
+        req.acceptsEncoding('gzip').should.be.ok()
+        req.acceptsEncoding('deflate').should.be.ok()
         res.end();
       });
 
@@ -23,7 +23,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.acceptsEncoding('bogus').should.not.be.ok;
+        req.acceptsEncoding('bogus').should.not.be.ok()
         res.end();
       });
 
diff --git a/test/req.acceptsEncodings.js b/test/req.acceptsEncodings.js
index c036c297691..aba8ea5fbeb 100644
--- a/test/req.acceptsEncodings.js
+++ b/test/req.acceptsEncodings.js
@@ -8,8 +8,8 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.acceptsEncodings('gzip').should.be.ok;
-        req.acceptsEncodings('deflate').should.be.ok;
+        req.acceptsEncodings('gzip').should.be.ok()
+        req.acceptsEncodings('deflate').should.be.ok()
         res.end();
       });
 
@@ -23,7 +23,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.acceptsEncodings('bogus').should.not.be.ok;
+        req.acceptsEncodings('bogus').should.not.be.ok()
         res.end();
       });
 
diff --git a/test/req.acceptsLanguage.js b/test/req.acceptsLanguage.js
index b14d920bd69..1c7c5fd86f6 100644
--- a/test/req.acceptsLanguage.js
+++ b/test/req.acceptsLanguage.js
@@ -8,8 +8,8 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.acceptsLanguage('en-us').should.be.ok;
-        req.acceptsLanguage('en').should.be.ok;
+        req.acceptsLanguage('en-us').should.be.ok()
+        req.acceptsLanguage('en').should.be.ok()
         res.end();
       });
 
@@ -23,7 +23,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.acceptsLanguage('es').should.not.be.ok;
+        req.acceptsLanguage('es').should.not.be.ok()
         res.end();
       });
 
@@ -38,9 +38,9 @@ describe('req', function(){
         var app = express();
 
         app.use(function(req, res){
-          req.acceptsLanguage('en').should.be.ok;
-          req.acceptsLanguage('es').should.be.ok;
-          req.acceptsLanguage('jp').should.be.ok;
+          req.acceptsLanguage('en').should.be.ok()
+          req.acceptsLanguage('es').should.be.ok()
+          req.acceptsLanguage('jp').should.be.ok()
           res.end();
         });
 
diff --git a/test/req.acceptsLanguages.js b/test/req.acceptsLanguages.js
index 6a9cb3366bc..1d92f44b2b3 100644
--- a/test/req.acceptsLanguages.js
+++ b/test/req.acceptsLanguages.js
@@ -8,8 +8,8 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.acceptsLanguages('en-us').should.be.ok;
-        req.acceptsLanguages('en').should.be.ok;
+        req.acceptsLanguages('en-us').should.be.ok()
+        req.acceptsLanguages('en').should.be.ok()
         res.end();
       });
 
@@ -23,7 +23,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.acceptsLanguages('es').should.not.be.ok;
+        req.acceptsLanguages('es').should.not.be.ok()
         res.end();
       });
 
@@ -38,9 +38,9 @@ describe('req', function(){
         var app = express();
 
         app.use(function(req, res){
-          req.acceptsLanguages('en').should.be.ok;
-          req.acceptsLanguages('es').should.be.ok;
-          req.acceptsLanguages('jp').should.be.ok;
+          req.acceptsLanguages('en').should.be.ok()
+          req.acceptsLanguages('es').should.be.ok()
+          req.acceptsLanguages('jp').should.be.ok()
           res.end();
         });
 
diff --git a/test/req.xhr.js b/test/req.xhr.js
index cc8754ce4cf..1bbc247104d 100644
--- a/test/req.xhr.js
+++ b/test/req.xhr.js
@@ -8,7 +8,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.xhr.should.be.true;
+        req.xhr.should.be.true()
         res.end();
       });
 
@@ -25,7 +25,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.xhr.should.be.true;
+        req.xhr.should.be.true()
         res.end();
       });
 
@@ -42,7 +42,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.xhr.should.be.false;
+        req.xhr.should.be.false()
         res.end();
       });
 
@@ -59,7 +59,7 @@ describe('req', function(){
       var app = express();
 
       app.use(function(req, res){
-        req.xhr.should.be.false;
+        req.xhr.should.be.false()
         res.end();
       });
 
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index be3a23ebc2c..a3576d02196 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -108,7 +108,7 @@ describe('res', function(){
       });
 
       app.use(function (err, req, res, next) {
-        err.code.should.be.empty;
+        err.code.should.be.empty()
         cb();
       });
 
@@ -224,7 +224,7 @@ describe('res', function(){
       app.use(function (req, res) {
         setImmediate(function () {
           res.sendFile(path.resolve(fixtures, 'name.txt'), function (err) {
-            should(err).be.ok;
+            should(err).be.ok()
             err.code.should.equal('ECONNABORTED');
             cb();
           });
@@ -243,7 +243,7 @@ describe('res', function(){
       app.use(function (req, res) {
         onFinished(res, function () {
           res.sendFile(path.resolve(fixtures, 'name.txt'), function (err) {
-            should(err).be.ok;
+            should(err).be.ok()
             err.code.should.equal('ECONNABORTED');
             cb();
           });
@@ -294,7 +294,7 @@ describe('res', function(){
 
       app.use(function (req, res) {
         res.sendFile(path.resolve(fixtures, 'does-not-exist'), function (err) {
-          should(err).be.ok;
+          should(err).be.ok()
           err.status.should.equal(404);
           res.send('got it');
         });
@@ -348,7 +348,7 @@ describe('res', function(){
       app.use(function (req, res) {
         setImmediate(function () {
           res.sendfile('test/fixtures/name.txt', function (err) {
-            should(err).be.ok;
+            should(err).be.ok()
             err.code.should.equal('ECONNABORTED');
             cb();
           });
@@ -367,7 +367,7 @@ describe('res', function(){
       app.use(function (req, res) {
         onFinished(res, function () {
           res.sendfile('test/fixtures/name.txt', function (err) {
-            should(err).be.ok;
+            should(err).be.ok()
             err.code.should.equal('ECONNABORTED');
             cb();
           });
@@ -600,7 +600,7 @@ describe('res', function(){
       });
 
       app.use(function (err, req, res, next) {
-        err.code.should.be.empty;
+        err.code.should.be.empty()
         cb();
       });
 

From 56e90e3c7267782febe35754806ce3f63b527485 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 5 Aug 2017 23:37:39 -0400
Subject: [PATCH 1105/1265] lint: add eslint rules that cover editorconfig

---
 .eslintignore                          |  2 ++
 .eslintrc                              |  7 +++++++
 .travis.yml                            |  4 +++-
 appveyor.yml                           |  1 +
 examples/content-negotiation/db.js     |  2 +-
 examples/mvc/controllers/main/index.js |  2 +-
 examples/mvc/db.js                     |  2 +-
 examples/resource/index.js             |  2 +-
 examples/route-separation/site.js      |  2 +-
 examples/search/public/client.js       |  2 +-
 examples/static-files/public/js/app.js |  2 +-
 examples/web-service/index.js          |  2 +-
 package.json                           |  2 ++
 test/acceptance/error-pages.js         |  2 +-
 test/acceptance/error.js               |  2 +-
 test/acceptance/route-map.js           |  2 +-
 test/app.engine.js                     |  4 ++--
 test/config.js                         | 12 ++++++------
 18 files changed, 34 insertions(+), 20 deletions(-)
 create mode 100644 .eslintignore
 create mode 100644 .eslintrc

diff --git a/.eslintignore b/.eslintignore
new file mode 100644
index 00000000000..62562b74a3b
--- /dev/null
+++ b/.eslintignore
@@ -0,0 +1,2 @@
+coverage
+node_modules
diff --git a/.eslintrc b/.eslintrc
new file mode 100644
index 00000000000..8f51db362e8
--- /dev/null
+++ b/.eslintrc
@@ -0,0 +1,7 @@
+{
+  "rules": {
+    "eol-last": "error",
+    "indent": ["error", 2, { "SwitchCase": 1 }],
+    "no-trailing-spaces": "error"
+  }
+}
diff --git a/.travis.yml b/.travis.yml
index 3e899dd2351..5926ca5650a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -27,5 +27,7 @@ before_install:
   # Update Node.js modules
   - "test ! -d node_modules || npm prune"
   - "test ! -d node_modules || npm rebuild"
-script: "npm run-script test-ci"
+script:
+  - "npm run test-ci"
+  - "npm run lint"
 after_script: "npm install coveralls@2.10.0 && cat ./coverage/lcov.info | coveralls"
diff --git a/appveyor.yml b/appveyor.yml
index ed8d4aa9f05..9863c08e272 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -22,4 +22,5 @@ test_script:
   - node --version
   - npm --version
   - npm run test-ci
+  - npm run lint
 version: "{build}"
diff --git a/examples/content-negotiation/db.js b/examples/content-negotiation/db.js
index 8def2f5ad21..43fb04baa18 100644
--- a/examples/content-negotiation/db.js
+++ b/examples/content-negotiation/db.js
@@ -4,4 +4,4 @@ users.push({ name: 'Tobi' });
 users.push({ name: 'Loki' });
 users.push({ name: 'Jane' });
 
-module.exports = users;
\ No newline at end of file
+module.exports = users;
diff --git a/examples/mvc/controllers/main/index.js b/examples/mvc/controllers/main/index.js
index 83db90f6f20..031862d345e 100644
--- a/examples/mvc/controllers/main/index.js
+++ b/examples/mvc/controllers/main/index.js
@@ -1,3 +1,3 @@
 exports.index = function(req, res){
   res.redirect('/users');
-};
\ No newline at end of file
+};
diff --git a/examples/mvc/db.js b/examples/mvc/db.js
index 565fdfaa507..c992afcfd74 100644
--- a/examples/mvc/db.js
+++ b/examples/mvc/db.js
@@ -11,4 +11,4 @@ var users = exports.users = [];
 
 users.push({ name: 'TJ', pets: [pets[0], pets[1], pets[2]], id: 0  });
 users.push({ name: 'Guillermo', pets: [pets[3]], id: 1 });
-users.push({ name: 'Nathan', pets: [], id: 2 });
\ No newline at end of file
+users.push({ name: 'Nathan', pets: [], id: 2 });
diff --git a/examples/resource/index.js b/examples/resource/index.js
index 9137167cdf9..0c2a7a32079 100644
--- a/examples/resource/index.js
+++ b/examples/resource/index.js
@@ -75,7 +75,7 @@ app.resource('/users', User);
 
 app.get('/', function(req, res){
   res.send([
-      '<h1>Examples:</h1> <ul>'
+    '<h1>Examples:</h1> <ul>'
     , '<li>GET /users</li>'
     , '<li>GET /users/1</li>'
     , '<li>GET /users/3</li>'
diff --git a/examples/route-separation/site.js b/examples/route-separation/site.js
index 698892cc89c..a3d20bc8a1f 100644
--- a/examples/route-separation/site.js
+++ b/examples/route-separation/site.js
@@ -1,3 +1,3 @@
 exports.index = function(req, res){
   res.render('index', { title: 'Route Separation Example' });
-};
\ No newline at end of file
+};
diff --git a/examples/search/public/client.js b/examples/search/public/client.js
index 0c198cc39fa..a7eeb6a75af 100644
--- a/examples/search/public/client.js
+++ b/examples/search/public/client.js
@@ -10,4 +10,4 @@ search.addEventListener('keyup', function(){
     }
   };
   xhr.send();
-}, false);
\ No newline at end of file
+}, false);
diff --git a/examples/static-files/public/js/app.js b/examples/static-files/public/js/app.js
index 19102815663..257cc5642cb 100644
--- a/examples/static-files/public/js/app.js
+++ b/examples/static-files/public/js/app.js
@@ -1 +1 @@
-foo
\ No newline at end of file
+foo
diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index 694e121d91b..41747cfdc7f 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -61,7 +61,7 @@ var users = [
 ];
 
 var userRepos = {
-    tobi: [repos[0], repos[1]]
+  tobi: [repos[0], repos[1]]
   , loki: [repos[1]]
   , jane: [repos[2]]
 };
diff --git a/package.json b/package.json
index 15e80f1934b..9f38f52bc1a 100644
--- a/package.json
+++ b/package.json
@@ -61,6 +61,7 @@
     "body-parser": "1.17.2",
     "cookie-parser": "~1.4.3",
     "ejs": "2.5.7",
+    "eslint": "2.13.1",
     "express-session": "1.15.3",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
@@ -87,6 +88,7 @@
     "lib/"
   ],
   "scripts": {
+    "lint": "eslint .",
     "test": "mocha --require test/support/env --reporter spec --bail --check-leaks test/ test/acceptance/",
     "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
diff --git a/test/acceptance/error-pages.js b/test/acceptance/error-pages.js
index 886cedcabe3..9af950178da 100644
--- a/test/acceptance/error-pages.js
+++ b/test/acceptance/error-pages.js
@@ -99,4 +99,4 @@ describe('error-pages', function(){
       })
     })
   })
-})
\ No newline at end of file
+})
diff --git a/test/acceptance/error.js b/test/acceptance/error.js
index 6010f2e2ae4..6bdf099feed 100644
--- a/test/acceptance/error.js
+++ b/test/acceptance/error.js
@@ -26,4 +26,4 @@ describe('error', function(){
         .expect(404,done)
     })
   })
-})
\ No newline at end of file
+})
diff --git a/test/acceptance/route-map.js b/test/acceptance/route-map.js
index ae3eeea6507..0bd2a6d32e1 100644
--- a/test/acceptance/route-map.js
+++ b/test/acceptance/route-map.js
@@ -42,4 +42,4 @@ describe('route-map', function(){
       .expect('delete 12\'s pet 2', done);
     })
   })
-})
\ No newline at end of file
+})
diff --git a/test/app.engine.js b/test/app.engine.js
index 6d1ee1cacbf..b198292fa03 100644
--- a/test/app.engine.js
+++ b/test/app.engine.js
@@ -47,7 +47,7 @@ describe('app', function(){
         done();
       })
     })
-    
+
     it('should work "view engine" setting', function(done){
       var app = express();
 
@@ -62,7 +62,7 @@ describe('app', function(){
         done();
       })
     })
-    
+
     it('should work "view engine" with leading "."', function(done){
       var app = express();
 
diff --git a/test/config.js b/test/config.js
index e298e76a5c5..17a02b7ebab 100644
--- a/test/config.js
+++ b/test/config.js
@@ -49,7 +49,7 @@ describe('config', function () {
       var app = express();
       assert.strictEqual(app.get('foo'), undefined);
     })
-    
+
     it('should otherwise return the value', function(){
       var app = express();
       app.set('foo', 'bar');
@@ -125,7 +125,7 @@ describe('config', function () {
       assert.strictEqual(app.get('tobi'), true);
     })
   })
-  
+
   describe('.disable()', function(){
     it('should set the value to false', function(){
       var app = express();
@@ -133,26 +133,26 @@ describe('config', function () {
       assert.strictEqual(app.get('tobi'), false);
     })
   })
-  
+
   describe('.enabled()', function(){
     it('should default to false', function(){
       var app = express();
       assert.strictEqual(app.enabled('foo'), false);
     })
-    
+
     it('should return true when set', function(){
       var app = express();
       app.set('foo', 'bar');
       assert.strictEqual(app.enabled('foo'), true);
     })
   })
-  
+
   describe('.disabled()', function(){
     it('should default to true', function(){
       var app = express();
       assert.strictEqual(app.disabled('foo'), true);
     })
-    
+
     it('should return false when set', function(){
       var app = express();
       app.set('foo', 'bar');

From 1dbaae51ddb64c7397d19546bacb0792dbb7d59b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 5 Aug 2017 23:54:31 -0400
Subject: [PATCH 1106/1265] deps: update example dependencies

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 9f38f52bc1a..ab6db290342 100644
--- a/package.json
+++ b/package.json
@@ -60,9 +60,10 @@
     "after": "0.8.2",
     "body-parser": "1.17.2",
     "cookie-parser": "~1.4.3",
+    "cookie-session": "1.3.0",
     "ejs": "2.5.7",
     "eslint": "2.13.1",
-    "express-session": "1.15.3",
+    "express-session": "1.15.5",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
     "marked": "0.3.6",
@@ -74,7 +75,6 @@
     "should": "11.2.1",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
-    "cookie-session": "~1.2.0",
     "vhost": "~3.0.2"
   },
   "engines": {

From 44881fabe3680722368df75c66125fbd5f8ed569 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 6 Aug 2017 00:18:57 -0400
Subject: [PATCH 1107/1265] docs: update collaborator guide for lint script

---
 Collaborator-Guide.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/Collaborator-Guide.md b/Collaborator-Guide.md
index 7c0d265dd0a..75d4e7c8f28 100644
--- a/Collaborator-Guide.md
+++ b/Collaborator-Guide.md
@@ -6,7 +6,7 @@ Open issues for the expressjs.com website in https://github.com/expressjs/expres
 ## PRs and Code contributions
 
 * Tests must pass.
-* Follow the [JavaScript Standard Style](http://standardjs.com/).
+* Follow the [JavaScript Standard Style](http://standardjs.com/) and `npm run lint`.
 * If you fix a bug, add a test.
 
 ## Branches
@@ -27,7 +27,9 @@ a future release of Express.
    each new issue you work on, although not compulsory.
 4. To run the test suite, first install the dependencies by running `npm install`,
    then run `npm test`.
-5. If the tests pass, you can commit your changes to your fork and then create
+5. Ensure your code is linted by running `npm run lint` -- fix any issue you
+   see listed.
+6. If the tests pass, you can commit your changes to your fork and then create
    a pull request from there. Make sure to reference your issue from the pull
    request comments by including the issue number e.g. `#123`.
 

From e0066227f787931bb0db09e76e007450d0f365b7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 6 Aug 2017 00:19:32 -0400
Subject: [PATCH 1108/1265] lint: remove all unused varaibles

---
 .eslintrc                          | 3 ++-
 benchmarks/middleware.js           | 1 -
 examples/view-constructor/index.js | 1 -
 lib/utils.js                       | 1 -
 lib/view.js                        | 1 -
 test/Route.js                      | 1 -
 test/app.listen.js                 | 1 -
 test/app.locals.js                 | 1 -
 test/app.router.js                 | 1 -
 test/req.host.js                   | 1 -
 test/req.hostname.js               | 1 -
 test/req.range.js                  | 1 -
 test/res.download.js               | 1 -
 test/res.format.js                 | 1 -
 test/res.send.js                   | 1 -
 test/res.sendFile.js               | 4 ----
 test/res.sendStatus.js             | 1 -
 test/res.vary.js                   | 1 -
 18 files changed, 2 insertions(+), 21 deletions(-)

diff --git a/.eslintrc b/.eslintrc
index 8f51db362e8..ad9c0ce9eb7 100644
--- a/.eslintrc
+++ b/.eslintrc
@@ -2,6 +2,7 @@
   "rules": {
     "eol-last": "error",
     "indent": ["error", 2, { "SwitchCase": 1 }],
-    "no-trailing-spaces": "error"
+    "no-trailing-spaces": "error",
+    "no-unused-vars": ["error", { "vars": "all", "args": "none", "ignoreRestSiblings": true }]
   }
 }
diff --git a/benchmarks/middleware.js b/benchmarks/middleware.js
index 3aa7a8b4ac7..efbac12983a 100644
--- a/benchmarks/middleware.js
+++ b/benchmarks/middleware.js
@@ -1,5 +1,4 @@
 
-var http = require('http');
 var express = require('..');
 var app = express();
 
diff --git a/examples/view-constructor/index.js b/examples/view-constructor/index.js
index 195d32db0eb..175a254e4ee 100644
--- a/examples/view-constructor/index.js
+++ b/examples/view-constructor/index.js
@@ -3,7 +3,6 @@
  */
 
 var express = require('../../');
-var http = require('http');
 var GithubView = require('./github-view');
 var md = require('marked').parse;
 
diff --git a/lib/utils.js b/lib/utils.js
index f418c5807c7..ae2a7f862d2 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -17,7 +17,6 @@ var contentType = require('content-type');
 var deprecate = require('depd')('express');
 var flatten = require('array-flatten');
 var mime = require('send').mime;
-var basename = require('path').basename;
 var etag = require('etag');
 var proxyaddr = require('proxy-addr');
 var qs = require('qs');
diff --git a/lib/view.js b/lib/view.js
index 1728725d291..99d5aed7a07 100644
--- a/lib/view.js
+++ b/lib/view.js
@@ -16,7 +16,6 @@
 var debug = require('debug')('express:view');
 var path = require('path');
 var fs = require('fs');
-var utils = require('./utils');
 
 /**
  * Module variables.
diff --git a/test/Route.js b/test/Route.js
index d7a80bdbc01..8f90152d8c8 100644
--- a/test/Route.js
+++ b/test/Route.js
@@ -4,7 +4,6 @@ var should = require('should');
 var express = require('../')
   , Route = express.Route
   , methods = require('methods')
-  , assert = require('assert');
 
 describe('Route', function(){
   it('should work without handlers', function(done) {
diff --git a/test/app.listen.js b/test/app.listen.js
index b6f68578934..a78d16e4e1a 100644
--- a/test/app.listen.js
+++ b/test/app.listen.js
@@ -1,6 +1,5 @@
 
 var express = require('../')
-  , request = require('supertest');
 
 describe('app.listen()', function(){
   it('should wrap with an HTTP server', function(done){
diff --git a/test/app.locals.js b/test/app.locals.js
index a8b022957a2..d8bfb5a9874 100644
--- a/test/app.locals.js
+++ b/test/app.locals.js
@@ -1,6 +1,5 @@
 
 var express = require('../')
-  , request = require('supertest');
 
 describe('app', function(){
   describe('.locals(obj)', function(){
diff --git a/test/app.router.js b/test/app.router.js
index 95680f9139c..28561c2fbcd 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -39,7 +39,6 @@ describe('app.router', function(){
 
       it('should include ' + method.toUpperCase(), function(done){
         var app = express();
-        var calls = [];
 
         app[method]('/foo', function(req, res){
           if ('head' == method) {
diff --git a/test/req.host.js b/test/req.host.js
index 8fa3409054f..7bb0b27acf8 100644
--- a/test/req.host.js
+++ b/test/req.host.js
@@ -1,7 +1,6 @@
 
 var express = require('../')
   , request = require('supertest')
-  , assert = require('assert');
 
 describe('req', function(){
   describe('.host', function(){
diff --git a/test/req.hostname.js b/test/req.hostname.js
index 65c2be81a1f..816cd597990 100644
--- a/test/req.hostname.js
+++ b/test/req.hostname.js
@@ -1,7 +1,6 @@
 
 var express = require('../')
   , request = require('supertest')
-  , assert = require('assert');
 
 describe('req', function(){
   describe('.hostname', function(){
diff --git a/test/req.range.js b/test/req.range.js
index 09459d1e127..5443c0658d2 100644
--- a/test/req.range.js
+++ b/test/req.range.js
@@ -1,5 +1,4 @@
 
-var assert = require('assert');
 var express = require('..');
 var request = require('supertest')
 
diff --git a/test/res.download.js b/test/res.download.js
index 0671d8318c4..fad56ee256a 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -89,7 +89,6 @@ describe('res', function(){
 
     it('should remove Content-Disposition', function(done){
       var app = express()
-        , calls = 0;
 
       app.use(function (req, res, next) {
         res.download('test/fixtures/foobar.html', function(err){
diff --git a/test/res.format.js b/test/res.format.js
index 2b0dfd517e7..3c1d095b426 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -1,7 +1,6 @@
 
 var express = require('../')
   , request = require('supertest')
-  , utils = require('../lib/utils')
   , assert = require('assert');
 
 var app1 = express();
diff --git a/test/res.send.js b/test/res.send.js
index f2e7d759c15..88d231eab55 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -1,5 +1,4 @@
 
-var assert = require('assert');
 var express = require('..');
 var methods = require('methods');
 var request = require('supertest');
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index a3576d02196..ff4b1cb2dd1 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -446,12 +446,10 @@ describe('res', function(){
 
     it('should invoke the callback on 403', function(done){
       var app = express()
-        , calls = 0;
 
       app.use(function(req, res){
         res.sendfile('test/fixtures/foo/../user.html', function(err){
           assert(!res.headersSent);
-          ++calls;
           res.send(err.message);
         });
       });
@@ -464,7 +462,6 @@ describe('res', function(){
 
     it('should invoke the callback on socket error', function(done){
       var app = express()
-        , calls = 0;
 
       app.use(function(req, res){
         res.sendfile('test/fixtures/user.html', function(err){
@@ -715,7 +712,6 @@ describe('res', function(){
       describe('with non-GET', function(){
         it('should still serve', function(done){
           var app = express()
-            , calls = 0;
 
           app.use(function(req, res){
             res.sendfile(path.join(__dirname, '/fixtures/name.txt'))
diff --git a/test/res.sendStatus.js b/test/res.sendStatus.js
index a97e1bf8d81..c355bc408f3 100644
--- a/test/res.sendStatus.js
+++ b/test/res.sendStatus.js
@@ -1,5 +1,4 @@
 
-var assert = require('assert')
 var express = require('..')
 var request = require('supertest')
 
diff --git a/test/res.vary.js b/test/res.vary.js
index 9a2edd24c09..9d39a341c0b 100644
--- a/test/res.vary.js
+++ b/test/res.vary.js
@@ -1,5 +1,4 @@
 
-var assert = require('assert');
 var express = require('..');
 var request = require('supertest');
 var utils = require('./support/utils');

From e2d725e01620fc3c8b3720e5521a124836e32cb2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 6 Aug 2017 02:37:10 -0400
Subject: [PATCH 1109/1265] deps: send@0.15.4

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c67fd941745..422d52dede3 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,10 @@ unreleased
     - Fix array argument being altered
     - deps: ipaddr.js@1.4.0
   * deps: qs@6.5.0
+  * deps: send@0.15.4
+    - deps: debug@2.6.8
+    - deps: depd@~1.1.1
+    - deps: http-errors@~1.6.2
 
 4.15.3 / 2017-05-16
 ===================
diff --git a/package.json b/package.json
index ab6db290342..5c9e94f4898 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "proxy-addr": "~1.1.5",
     "qs": "6.5.0",
     "range-parser": "~1.2.0",
-    "send": "0.15.3",
+    "send": "0.15.4",
     "serve-static": "1.12.3",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",

From a50f1098d014e2393e2d5f4beae37a85830c203d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 6 Aug 2017 02:38:02 -0400
Subject: [PATCH 1110/1265] deps: serve-static@1.12.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 422d52dede3..91707e6c03d 100644
--- a/History.md
+++ b/History.md
@@ -14,6 +14,8 @@ unreleased
     - deps: debug@2.6.8
     - deps: depd@~1.1.1
     - deps: http-errors@~1.6.2
+  * deps: serve-static@1.12.4
+    - deps: send@0.15.4
 
 4.15.3 / 2017-05-16
 ===================
diff --git a/package.json b/package.json
index 5c9e94f4898..d5b9ae405df 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "qs": "6.5.0",
     "range-parser": "~1.2.0",
     "send": "0.15.4",
-    "serve-static": "1.12.3",
+    "serve-static": "1.12.4",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",

From a4bd4373b2c3b2521ee4c499cb8e90e98f78bfa5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 6 Aug 2017 22:03:53 -0400
Subject: [PATCH 1111/1265] 4.15.4

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 91707e6c03d..f297e3b075c 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.15.4 / 2017-08-06
+===================
 
   * deps: debug@2.6.8
   * deps: depd@~1.1.1
diff --git a/package.json b/package.json
index d5b9ae405df..d8ec444d539 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.15.3",
+  "version": "4.15.4",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 48817a798f3820bbe252d30d33bd701779511dc5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 17 Aug 2017 22:03:40 -0400
Subject: [PATCH 1112/1265] build: remove minor pin for nightly

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 5926ca5650a..3dbeb41fcda 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,7 @@ node_js:
   - "7.10"
 matrix:
   include:
-    - node_js: "8.0"
+    - node_js: "8"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
     # Allow the nightly installs to fail

From 78e55108e40ce8ce751baa10324f48a6bb21b47e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 13 Sep 2017 20:03:42 -0400
Subject: [PATCH 1113/1265] build: mocha@3.5.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index d8ec444d539..2eec2887a7b 100644
--- a/package.json
+++ b/package.json
@@ -68,7 +68,7 @@
     "istanbul": "0.4.5",
     "marked": "0.3.6",
     "method-override": "2.3.9",
-    "mocha": "3.5.0",
+    "mocha": "3.5.3",
     "morgan": "1.8.2",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",

From b208b24f8323930419d9b5bbe0f442b36852dc36 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 13 Sep 2017 20:09:33 -0400
Subject: [PATCH 1114/1265] build: should@13.0.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 2eec2887a7b..5068a5d6144 100644
--- a/package.json
+++ b/package.json
@@ -72,7 +72,7 @@
     "morgan": "1.8.2",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",
-    "should": "11.2.1",
+    "should": "13.0.1",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
     "vhost": "~3.0.2"

From de5fb62b1ac8d02efcb7931ef12936cb0a954307 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 17 Sep 2017 20:13:05 -0400
Subject: [PATCH 1115/1265] deps: update example dependencies

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 5068a5d6144..a02a6943d37 100644
--- a/package.json
+++ b/package.json
@@ -58,9 +58,9 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "body-parser": "1.17.2",
+    "body-parser": "1.18.1",
     "cookie-parser": "~1.4.3",
-    "cookie-session": "1.3.0",
+    "cookie-session": "1.3.1",
     "ejs": "2.5.7",
     "eslint": "2.13.1",
     "express-session": "1.15.5",

From 9e067ad2cb96f23f7997758a7f5a3c69ada03c12 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Sep 2017 20:45:32 -0400
Subject: [PATCH 1116/1265] deps: fresh@0.5.2

---
 History.md   | 8 ++++++++
 package.json | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f297e3b075c..e7e37e92e24 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,11 @@
+unreleased
+==========
+
+  * deps: fresh@0.5.2
+    - Fix handling of modified headers with invalid dates
+    - perf: improve ETag match loop
+    - perf: improve `If-None-Match` token parsing
+
 4.15.4 / 2017-08-06
 ===================
 
diff --git a/package.json b/package.json
index a02a6943d37..87e4ee8eae4 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "escape-html": "~1.0.3",
     "etag": "~1.8.0",
     "finalhandler": "~1.0.4",
-    "fresh": "0.5.0",
+    "fresh": "0.5.2",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",
     "on-finished": "~2.3.0",

From 9e0fa7f1ca2efe768e91ee84534f837d2cff243a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Sep 2017 20:46:42 -0400
Subject: [PATCH 1117/1265] deps: send@0.15.5

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e7e37e92e24..83cd43185e5 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,10 @@ unreleased
     - Fix handling of modified headers with invalid dates
     - perf: improve ETag match loop
     - perf: improve `If-None-Match` token parsing
+  * deps: send@0.15.5
+    - Fix handling of modified headers with invalid dates
+    - deps: etag@~1.8.1
+    - deps: fresh@0.5.2
 
 4.15.4 / 2017-08-06
 ===================
diff --git a/package.json b/package.json
index 87e4ee8eae4..2ad3c5e2a99 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "proxy-addr": "~1.1.5",
     "qs": "6.5.0",
     "range-parser": "~1.2.0",
-    "send": "0.15.4",
+    "send": "0.15.5",
     "serve-static": "1.12.4",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",

From 961dbff904d3e6b1b10cfe6741506ae851d272ff Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Sep 2017 20:48:23 -0400
Subject: [PATCH 1118/1265] deps: serve-static@1.12.5

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 83cd43185e5..95fad3d3d97 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,9 @@ unreleased
     - Fix handling of modified headers with invalid dates
     - deps: etag@~1.8.1
     - deps: fresh@0.5.2
+  * deps: serve-static@1.12.5
+    - deps: parseurl@~1.3.2
+    - deps: send@0.15.5
 
 4.15.4 / 2017-08-06
 ===================
diff --git a/package.json b/package.json
index 2ad3c5e2a99..4bb68915b8e 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "qs": "6.5.0",
     "range-parser": "~1.2.0",
     "send": "0.15.5",
-    "serve-static": "1.12.4",
+    "serve-static": "1.12.5",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",

From d7da22550da484ddcdf77623272b64c36030b216 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Sep 2017 20:49:14 -0400
Subject: [PATCH 1119/1265] build: should@13.1.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 4bb68915b8e..97f94459b83 100644
--- a/package.json
+++ b/package.json
@@ -72,7 +72,7 @@
     "morgan": "1.8.2",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",
-    "should": "13.0.1",
+    "should": "13.1.0",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
     "vhost": "~3.0.2"

From 19a2eeb47697feecae5960a726fb5b7ae2c7644b Mon Sep 17 00:00:00 2001
From: Kunal Pathak <Kunal.Pathak@microsoft.com>
Date: Tue, 21 Mar 2017 14:53:42 -0700
Subject: [PATCH 1120/1265] tests: check render error without engine-specific
 message

closes #3251
---
 test/app.render.js   | 10 ++++------
 test/res.render.js   | 10 ++++++----
 test/support/tmpl.js |  1 +
 3 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/test/app.render.js b/test/app.render.js
index 1485098f582..54f6c2ca82d 100644
--- a/test/app.render.js
+++ b/test/app.render.js
@@ -97,12 +97,10 @@ describe('app', function(){
 
         app.set('views', path.join(__dirname, 'fixtures'))
 
-        app.render('user.tmpl', function (err, str) {
-          // nextTick to prevent cyclic
-          process.nextTick(function(){
-            err.message.should.match(/Cannot read property '[^']+' of undefined/);
-            done();
-          });
+        app.render('user.tmpl', function (err) {
+          assert.ok(err)
+          assert.equal(err.name, 'RenderError')
+          done()
         })
       })
     })
diff --git a/test/res.render.js b/test/res.render.js
index 2e3a16f1370..e19e8cc542b 100644
--- a/test/res.render.js
+++ b/test/res.render.js
@@ -105,12 +105,12 @@ describe('res', function(){
         });
 
         app.use(function(err, req, res, next){
-          res.end(err.message);
+          res.status(500).send('got error: ' + err.name)
         });
 
         request(app)
         .get('/')
-        .expect(/Cannot read property '[^']+' of undefined/, done);
+        .expect(500, 'got error: RenderError', done)
       })
     })
 
@@ -329,13 +329,15 @@ describe('res', function(){
 
         app.use(function(req, res){
           res.render('user.tmpl', function (err) {
-            res.end(err.message);
+            if (err) {
+              res.status(500).send('got error: ' + err.name)
+            }
           });
         });
 
         request(app)
         .get('/')
-        .expect(/Cannot read property '[^']+' of undefined/, done);
+        .expect(500, 'got error: RenderError', done)
       })
     })
   })
diff --git a/test/support/tmpl.js b/test/support/tmpl.js
index 2e8bec86388..bab65669d33 100644
--- a/test/support/tmpl.js
+++ b/test/support/tmpl.js
@@ -13,6 +13,7 @@ module.exports = function renderFile(fileName, options, callback) {
       str = str.replace(variableRegExp, generateVariableLookup(options));
     } catch (e) {
       err = e;
+      err.name = 'RenderError'
     }
 
     callback(err, str);

From 9395db4c22567d09f19ac7cd629e23908784ec6d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 22 Sep 2017 20:25:18 -0400
Subject: [PATCH 1121/1265] deps: debug@2.6.9

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 95fad3d3d97..5bf412451be 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * deps: debug@2.6.9
   * deps: fresh@0.5.2
     - Fix handling of modified headers with invalid dates
     - perf: improve ETag match loop
diff --git a/package.json b/package.json
index 97f94459b83..7f465d0e642 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "content-type": "~1.0.2",
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
-    "debug": "2.6.8",
+    "debug": "2.6.9",
     "depd": "~1.1.1",
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",

From bd1672f0a45e2722126a05723aca68cbd65e3f74 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 22 Sep 2017 20:26:30 -0400
Subject: [PATCH 1122/1265] deps: finalhandler@~1.0.6

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5bf412451be..e4770be6885 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,9 @@ unreleased
 ==========
 
   * deps: debug@2.6.9
+  * deps: finalhandler@~1.0.6
+    - deps: debug@2.6.9
+    - deps: parseurl@~1.3.2
   * deps: fresh@0.5.2
     - Fix handling of modified headers with invalid dates
     - perf: improve ETag match loop
diff --git a/package.json b/package.json
index 7f465d0e642..3afcec06718 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.8.0",
-    "finalhandler": "~1.0.4",
+    "finalhandler": "~1.0.6",
     "fresh": "0.5.2",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",

From 7137bf567db674fa5a93b71fffda09e7ac4ec73c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 22 Sep 2017 20:27:37 -0400
Subject: [PATCH 1123/1265] deps: send@0.15.6

---
 History.md   | 4 +++-
 package.json | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index e4770be6885..3d2bb66505c 100644
--- a/History.md
+++ b/History.md
@@ -9,10 +9,12 @@ unreleased
     - Fix handling of modified headers with invalid dates
     - perf: improve ETag match loop
     - perf: improve `If-None-Match` token parsing
-  * deps: send@0.15.5
+  * deps: send@0.15.6
     - Fix handling of modified headers with invalid dates
+    - deps: debug@2.6.9
     - deps: etag@~1.8.1
     - deps: fresh@0.5.2
+    - perf: improve `If-Match` token parsing
   * deps: serve-static@1.12.5
     - deps: parseurl@~1.3.2
     - deps: send@0.15.5
diff --git a/package.json b/package.json
index 3afcec06718..16b11d6fdb1 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "proxy-addr": "~1.1.5",
     "qs": "6.5.0",
     "range-parser": "~1.2.0",
-    "send": "0.15.5",
+    "send": "0.15.6",
     "serve-static": "1.12.5",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",

From 40435ec99779b08202f9f139c9a0a7d64e941b40 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 22 Sep 2017 20:28:52 -0400
Subject: [PATCH 1124/1265] deps: serve-static@1.12.6

---
 History.md   | 5 +++--
 package.json | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 3d2bb66505c..fa520920d7c 100644
--- a/History.md
+++ b/History.md
@@ -15,9 +15,10 @@ unreleased
     - deps: etag@~1.8.1
     - deps: fresh@0.5.2
     - perf: improve `If-Match` token parsing
-  * deps: serve-static@1.12.5
+  * deps: serve-static@1.12.6
     - deps: parseurl@~1.3.2
-    - deps: send@0.15.5
+    - deps: send@0.15.6
+    - perf: improve slash collapsing
 
 4.15.4 / 2017-08-06
 ===================
diff --git a/package.json b/package.json
index 16b11d6fdb1..bf48b83c7cc 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "qs": "6.5.0",
     "range-parser": "~1.2.0",
     "send": "0.15.6",
-    "serve-static": "1.12.5",
+    "serve-static": "1.12.6",
     "setprototypeof": "1.0.3",
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",

From ea3d60565242c47be97088ead2708d7b88390858 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 25 Sep 2017 01:04:38 -0400
Subject: [PATCH 1125/1265] 4.15.5

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index fa520920d7c..707677eb17a 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.15.5 / 2017-09-24
+===================
 
   * deps: debug@2.6.9
   * deps: finalhandler@~1.0.6
diff --git a/package.json b/package.json
index bf48b83c7cc..954c20b3c30 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.15.4",
+  "version": "4.15.5",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 94fdb674b1df2e36d389fce51f5e07071f807adb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 25 Sep 2017 20:57:54 -0400
Subject: [PATCH 1126/1265] build: support Node.js 8.x

---
 .gitignore   | 1 +
 .travis.yml  | 4 ++++
 appveyor.yml | 2 ++
 3 files changed, 7 insertions(+)

diff --git a/.gitignore b/.gitignore
index 9723e60591d..5fee6a2dc97 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,6 +15,7 @@ Desktop.ini
 
 # npm
 node_modules
+package-lock.json
 *.log
 *.gz
 
diff --git a/.travis.yml b/.travis.yml
index 3dbeb41fcda..3e487a6f186 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,6 +9,7 @@ node_js:
   - "5.12"
   - "6.11"
   - "7.10"
+  - "8.4"
 matrix:
   include:
     - node_js: "8"
@@ -21,6 +22,9 @@ cache:
   directories:
     - node_modules
 before_install:
+  # Skip updating shrinkwrap / lock
+  - "npm config set shrinkwrap false"
+
   # Remove all non-test dependencies
   - "npm rm --save-dev connect-redis"
 
diff --git a/appveyor.yml b/appveyor.yml
index 9863c08e272..193660af715 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -9,10 +9,12 @@ environment:
     - nodejs_version: "5.12"
     - nodejs_version: "6.11"
     - nodejs_version: "7.10"
+    - nodejs_version: "8.4"
 cache:
   - node_modules
 install:
   - ps: Install-Product node $env:nodejs_version
+  - npm config set shrinkwrap false
   - npm rm --save-dev connect-redis
   - if exist node_modules npm prune
   - if exist node_modules npm rebuild

From c3fb7e5adc1fd40e301ed1e25f0d5b5a393d0295 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 25 Sep 2017 21:06:00 -0400
Subject: [PATCH 1127/1265] build: test against Node.js 9.x nightly

---
 .travis.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 3e487a6f186..855168ff540 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,6 +14,8 @@ matrix:
   include:
     - node_js: "8"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
+    - node_js: "9"
+      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
     # Allow the nightly installs to fail
     - env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"

From 80f1ea9bec3c5aedb08a6917ecc24fb8d22b707d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 25 Sep 2017 21:11:33 -0400
Subject: [PATCH 1128/1265] Improve error message when autoloading invalid view
 engine

fixes #3403
---
 History.md                |  5 +++++
 lib/view.js               | 10 +++++++++-
 test/fixtures/broken.send |  0
 test/res.render.js        | 14 ++++++++++++++
 4 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 test/fixtures/broken.send

diff --git a/History.md b/History.md
index 707677eb17a..765f050318a 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Improve error message when autoloading invalid view engine
+
 4.15.5 / 2017-09-24
 ===================
 
diff --git a/lib/view.js b/lib/view.js
index 99d5aed7a07..cf101caeab9 100644
--- a/lib/view.js
+++ b/lib/view.js
@@ -76,7 +76,15 @@ function View(name, options) {
     // load engine
     var mod = this.ext.substr(1)
     debug('require "%s"', mod)
-    opts.engines[this.ext] = require(mod).__express
+
+    // default engine export
+    var fn = require(mod).__express
+
+    if (typeof fn !== 'function') {
+      throw new Error('Module "' + mod + '" does not provide a view engine.')
+    }
+
+    opts.engines[this.ext] = fn
   }
 
   // store loaded engine
diff --git a/test/fixtures/broken.send b/test/fixtures/broken.send
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/test/res.render.js b/test/res.render.js
index e19e8cc542b..643a57002a0 100644
--- a/test/res.render.js
+++ b/test/res.render.js
@@ -35,6 +35,20 @@ describe('res', function(){
       .expect('<p>tobi</p>', done);
     })
 
+    it('should error without "view engine" set and file extension to a non-engine module', function (done) {
+      var app = createApp()
+
+      app.locals.user = { name: 'tobi' }
+
+      app.use(function (req, res) {
+        res.render(path.join(__dirname, 'fixtures', 'broken.send'))
+      })
+
+      request(app)
+      .get('/')
+      .expect(500, /does not provide a view engine/, done)
+    })
+
     it('should error without "view engine" set and no file extension', function (done) {
       var app = createApp();
 

From 48940e61202be07677659b3b9d87c967fc4e8bdc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 25 Sep 2017 21:12:47 -0400
Subject: [PATCH 1129/1265] Skip Buffer encoding when not generating ETag for
 small response

---
 History.md      |  1 +
 lib/response.js | 23 ++++++++++++++++-------
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/History.md b/History.md
index 765f050318a..83ba2cc5d76 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Improve error message when autoloading invalid view engine
+  * Skip `Buffer` encoding when not generating ETag for small response
 
 4.15.5 / 2017-09-24
 ===================
diff --git a/lib/response.js b/lib/response.js
index b852a60e2f5..e34af49d693 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -106,7 +106,6 @@ res.links = function(links){
 res.send = function send(body) {
   var chunk = body;
   var encoding;
-  var len;
   var req = this.req;
   var type;
 
@@ -171,23 +170,33 @@ res.send = function send(body) {
     }
   }
 
+  // determine if ETag should be generated
+  var etagFn = app.get('etag fn')
+  var generateETag = !this.get('ETag') && typeof etagFn === 'function'
+
   // populate Content-Length
+  var len
   if (chunk !== undefined) {
-    if (!Buffer.isBuffer(chunk)) {
-      // convert chunk to Buffer; saves later double conversions
+    if (!generateETag && chunk.length < 1000) {
+      // just calculate length when no ETag + small chunk
+      len = Buffer.byteLength(chunk, encoding)
+    } else if (!Buffer.isBuffer(chunk)) {
+      // convert chunk to Buffer and calculate
       chunk = new Buffer(chunk, encoding);
       encoding = undefined;
+      len = chunk.length
+    } else {
+      // get length of Buffer
+      len = chunk.length
     }
 
-    len = chunk.length;
     this.set('Content-Length', len);
   }
 
   // populate ETag
   var etag;
-  var generateETag = len !== undefined && app.get('etag fn');
-  if (typeof generateETag === 'function' && !this.get('ETag')) {
-    if ((etag = generateETag(chunk, encoding))) {
+  if (generateETag && len !== undefined) {
+    if ((etag = etagFn(chunk, encoding))) {
       this.set('ETag', etag);
     }
   }

From 550043c21727674a9d00c30504beb95cfbd7bbba Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 25 Sep 2017 21:14:00 -0400
Subject: [PATCH 1130/1265] deps: setprototypeof@1.1.0

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 83ba2cc5d76..e8fcafa4149 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,7 @@ unreleased
 
   * Improve error message when autoloading invalid view engine
   * Skip `Buffer` encoding when not generating ETag for small response
+  * deps: setprototypeof@1.1.0
 
 4.15.5 / 2017-09-24
 ===================
diff --git a/package.json b/package.json
index 954c20b3c30..cd94d1cf94a 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "range-parser": "~1.2.0",
     "send": "0.15.6",
     "serve-static": "1.12.6",
-    "setprototypeof": "1.0.3",
+    "setprototypeof": "1.1.0",
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",
     "utils-merge": "1.0.0",

From 9a99c152703048591c031bd10d2a2e3ca55ebcac Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 27 Sep 2017 21:28:25 -0400
Subject: [PATCH 1131/1265] deps: accepts@~1.3.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e8fcafa4149..0c206496496 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,8 @@ unreleased
 
   * Improve error message when autoloading invalid view engine
   * Skip `Buffer` encoding when not generating ETag for small response
+  * deps: accepts@~1.3.4
+    - deps: mime-types@~2.1.16
   * deps: setprototypeof@1.1.0
 
 4.15.5 / 2017-09-24
diff --git a/package.json b/package.json
index cd94d1cf94a..9351cf2e05b 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.3.3",
+    "accepts": "~1.3.4",
     "array-flatten": "1.1.1",
     "content-disposition": "0.5.2",
     "content-type": "~1.0.2",

From 70589c3aef6fb64ce396848e78ca7ea0768d2d5d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 27 Sep 2017 21:30:08 -0400
Subject: [PATCH 1132/1265] deps: content-type@~1.0.4

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 0c206496496..0f6f82bffef 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,9 @@ unreleased
   * Skip `Buffer` encoding when not generating ETag for small response
   * deps: accepts@~1.3.4
     - deps: mime-types@~2.1.16
+  * deps: content-type@~1.0.4
+    - perf: remove argument reassignment
+    - perf: skip parameter parsing when no parameters
   * deps: setprototypeof@1.1.0
 
 4.15.5 / 2017-09-24
diff --git a/package.json b/package.json
index 9351cf2e05b..5febf1048e5 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "accepts": "~1.3.4",
     "array-flatten": "1.1.1",
     "content-disposition": "0.5.2",
-    "content-type": "~1.0.2",
+    "content-type": "~1.0.4",
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",

From e62bb8bf9f68382414cdd7997fe661de4647c987 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 27 Sep 2017 21:30:43 -0400
Subject: [PATCH 1133/1265] deps: etag@~1.8.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 0f6f82bffef..077eec931b5 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,8 @@ unreleased
   * deps: content-type@~1.0.4
     - perf: remove argument reassignment
     - perf: skip parameter parsing when no parameters
+  * deps: etag@~1.8.1
+    - perf: replace regular expression with substring
   * deps: setprototypeof@1.1.0
 
 4.15.5 / 2017-09-24
diff --git a/package.json b/package.json
index 5febf1048e5..78834c50721 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
     "depd": "~1.1.1",
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
-    "etag": "~1.8.0",
+    "etag": "~1.8.1",
     "finalhandler": "~1.0.6",
     "fresh": "0.5.2",
     "merge-descriptors": "1.0.1",

From ad7d96db479e6e9d93ab4848d5fe163905e123ed Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 27 Sep 2017 21:31:39 -0400
Subject: [PATCH 1134/1265] deps: qs@6.5.1

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 077eec931b5..012d8a2ffed 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,8 @@ unreleased
     - perf: skip parameter parsing when no parameters
   * deps: etag@~1.8.1
     - perf: replace regular expression with substring
+  * deps: qs@6.5.1
+    - Fix parsing & compacting very deep objects
   * deps: setprototypeof@1.1.0
 
 4.15.5 / 2017-09-24
diff --git a/package.json b/package.json
index 78834c50721..0bbfeb8e6ea 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "parseurl": "~1.3.1",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~1.1.5",
-    "qs": "6.5.0",
+    "qs": "6.5.1",
     "range-parser": "~1.2.0",
     "send": "0.15.6",
     "serve-static": "1.12.6",

From 5cc761c86593f2e87c7a9dac02135548096bb952 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 00:04:47 -0400
Subject: [PATCH 1135/1265] deps: parseurl@~1.3.2

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 012d8a2ffed..2c9866dbb5d 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,9 @@ unreleased
     - perf: skip parameter parsing when no parameters
   * deps: etag@~1.8.1
     - perf: replace regular expression with substring
+  * deps: parseurl@~1.3.2
+    - perf: reduce overhead for full URLs
+    - perf: unroll the "fast-path" `RegExp`
   * deps: qs@6.5.1
     - Fix parsing & compacting very deep objects
   * deps: setprototypeof@1.1.0
diff --git a/package.json b/package.json
index 0bbfeb8e6ea..4330b141f08 100644
--- a/package.json
+++ b/package.json
@@ -43,7 +43,7 @@
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",
     "on-finished": "~2.3.0",
-    "parseurl": "~1.3.1",
+    "parseurl": "~1.3.2",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~1.1.5",
     "qs": "6.5.1",

From 673d51f4f0fa83f6b663ed6f9f0426940d07664b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 00:19:30 -0400
Subject: [PATCH 1136/1265] deps: utils-merge@1.0.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 2c9866dbb5d..eb01929864f 100644
--- a/History.md
+++ b/History.md
@@ -16,6 +16,7 @@ unreleased
   * deps: qs@6.5.1
     - Fix parsing & compacting very deep objects
   * deps: setprototypeof@1.1.0
+  * deps: utils-merge@1.0.1
 
 4.15.5 / 2017-09-24
 ===================
diff --git a/package.json b/package.json
index 4330b141f08..1298b943275 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "setprototypeof": "1.1.0",
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",
-    "utils-merge": "1.0.0",
+    "utils-merge": "1.0.1",
     "vary": "~1.1.1"
   },
   "devDependencies": {

From c2f4fb535688eaec14c713190a4ab881e195a41a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 00:42:05 -0400
Subject: [PATCH 1137/1265] deps: finalhandler@1.1.0

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index eb01929864f..c4b34a76439 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,8 @@ unreleased
     - perf: skip parameter parsing when no parameters
   * deps: etag@~1.8.1
     - perf: replace regular expression with substring
+  * deps: finalhandler@1.1.0
+    - Use `res.headersSent` when available
   * deps: parseurl@~1.3.2
     - perf: reduce overhead for full URLs
     - perf: unroll the "fast-path" `RegExp`
diff --git a/package.json b/package.json
index 1298b943275..ea49823cbbf 100644
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",
-    "finalhandler": "~1.0.6",
+    "finalhandler": "1.1.0",
     "fresh": "0.5.2",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",

From 02a9d5fb28e313fd94ee5ec24fe5da02fbc0d6eb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 01:18:04 -0400
Subject: [PATCH 1138/1265] deps: proxy-addr@~2.0.2

closes #3432
---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c4b34a76439..4352f26acdf 100644
--- a/History.md
+++ b/History.md
@@ -15,6 +15,11 @@ unreleased
   * deps: parseurl@~1.3.2
     - perf: reduce overhead for full URLs
     - perf: unroll the "fast-path" `RegExp`
+  * deps: proxy-addr@~2.0.2
+    - Fix trimming leading / trailing OWS in `X-Forwarded-For`
+    - deps: forwarded@~0.1.2
+    - deps: ipaddr.js@1.5.2
+    - perf: reduce overhead when no `X-Forwarded-For` header
   * deps: qs@6.5.1
     - Fix parsing & compacting very deep objects
   * deps: setprototypeof@1.1.0
diff --git a/package.json b/package.json
index ea49823cbbf..219e21fe23b 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.2",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~1.1.5",
+    "proxy-addr": "~2.0.2",
     "qs": "6.5.1",
     "range-parser": "~1.2.0",
     "send": "0.15.6",

From d9d09b8b9041504b645f3173ca70ef173c7e1563 Mon Sep 17 00:00:00 2001
From: Lawrence Page <lpage2008@gmail.com>
Date: Thu, 18 May 2017 11:04:27 -0700
Subject: [PATCH 1139/1265] perf: re-use options object when generating ETags

closes #3313
closes #3314
---
 History.md   |  1 +
 lib/utils.js | 35 +++++++++++++++++++++--------------
 2 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/History.md b/History.md
index 4352f26acdf..4b4f0dd5cbf 100644
--- a/History.md
+++ b/History.md
@@ -24,6 +24,7 @@ unreleased
     - Fix parsing & compacting very deep objects
   * deps: setprototypeof@1.1.0
   * deps: utils-merge@1.0.1
+  * perf: re-use options object when generating ETags
 
 4.15.5 / 2017-09-24
 ===================
diff --git a/lib/utils.js b/lib/utils.js
index ae2a7f862d2..80f4edae3a3 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -31,13 +31,7 @@ var querystring = require('querystring');
  * @api private
  */
 
-exports.etag = function (body, encoding) {
-  var buf = !Buffer.isBuffer(body)
-    ? new Buffer(body, encoding)
-    : body;
-
-  return etag(buf, {weak: false});
-};
+exports.etag = createETagGenerator({ weak: false })
 
 /**
  * Return weak ETag for `body`.
@@ -48,13 +42,7 @@ exports.etag = function (body, encoding) {
  * @api private
  */
 
-exports.wetag = function wetag(body, encoding){
-  var buf = !Buffer.isBuffer(body)
-    ? new Buffer(body, encoding)
-    : body;
-
-  return etag(buf, {weak: true});
-};
+exports.wetag = createETagGenerator({ weak: true })
 
 /**
  * Check if `path` looks absolute.
@@ -273,6 +261,25 @@ exports.setCharset = function setCharset(type, charset) {
   return contentType.format(parsed);
 };
 
+/**
+ * Create an ETag generator function, generating ETags with
+ * the given options.
+ *
+ * @param {object} options
+ * @return {function}
+ * @private
+ */
+
+function createETagGenerator (options) {
+  return function generateETag (body, encoding) {
+    var buf = !Buffer.isBuffer(body)
+      ? new Buffer(body, encoding)
+      : body
+
+    return etag(buf, options)
+  }
+}
+
 /**
  * Parse an extended query string with qs.
  *

From fa272edf843a31aa242390d46935437451707d54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hrvoje=20=C5=A0imi=C4=87?= <shime@twobucks.co>
Date: Wed, 27 Sep 2017 15:17:03 +0200
Subject: [PATCH 1140/1265] docs: fix typo in jsdoc comment

closes #3430
---
 lib/application.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/application.js b/lib/application.js
index 1abe8d08f58..8097d81a3b9 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -338,7 +338,7 @@ app.param = function param(name, fn) {
  * Assign `setting` to `val`, or return `setting`'s value.
  *
  *    app.set('foo', 'bar');
- *    app.get('foo');
+ *    app.set('foo');
  *    // => "bar"
  *
  * Mounted servers inherit their parent server's settings.

From 12c37124689380837b24a7ed962432596237b440 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 08:26:39 -0400
Subject: [PATCH 1141/1265] Use safe-buffer for improved Buffer API

---
 History.md               |  1 +
 benchmarks/middleware.js |  4 +---
 lib/response.js          |  5 +++--
 lib/utils.js             |  3 ++-
 package.json             |  1 +
 test/res.attachment.js   |  3 ++-
 test/res.send.js         | 12 ++++++------
 test/utils.js            |  7 +++----
 8 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/History.md b/History.md
index 4b4f0dd5cbf..18f5e5da371 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,7 @@ unreleased
 
   * Improve error message when autoloading invalid view engine
   * Skip `Buffer` encoding when not generating ETag for small response
+  * Use `safe-buffer` for improved Buffer API
   * deps: accepts@~1.3.4
     - deps: mime-types@~2.1.16
   * deps: content-type@~1.0.4
diff --git a/benchmarks/middleware.js b/benchmarks/middleware.js
index efbac12983a..df4df2c5ac5 100644
--- a/benchmarks/middleware.js
+++ b/benchmarks/middleware.js
@@ -13,10 +13,8 @@ while (n--) {
   });
 }
 
-var body = new Buffer('Hello World');
-
 app.use(function(req, res, next){
-  res.send(body);
+  res.send('Hello World')
 });
 
 app.listen(3333);
diff --git a/lib/response.js b/lib/response.js
index e34af49d693..285daf4fb4b 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -12,6 +12,7 @@
  * @private
  */
 
+var Buffer = require('safe-buffer').Buffer
 var contentDisposition = require('content-disposition');
 var deprecate = require('depd')('express');
 var encodeUrl = require('encodeurl');
@@ -95,7 +96,7 @@ res.links = function(links){
  *
  * Examples:
  *
- *     res.send(new Buffer('wahoo'));
+ *     res.send(Buffer.from('wahoo'));
  *     res.send({ some: 'json' });
  *     res.send('<p>some html</p>');
  *
@@ -182,7 +183,7 @@ res.send = function send(body) {
       len = Buffer.byteLength(chunk, encoding)
     } else if (!Buffer.isBuffer(chunk)) {
       // convert chunk to Buffer and calculate
-      chunk = new Buffer(chunk, encoding);
+      chunk = Buffer.from(chunk, encoding)
       encoding = undefined;
       len = chunk.length
     } else {
diff --git a/lib/utils.js b/lib/utils.js
index 80f4edae3a3..bd81ac7f6d9 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -12,6 +12,7 @@
  * @api private
  */
 
+var Buffer = require('safe-buffer').Buffer
 var contentDisposition = require('content-disposition');
 var contentType = require('content-type');
 var deprecate = require('depd')('express');
@@ -273,7 +274,7 @@ exports.setCharset = function setCharset(type, charset) {
 function createETagGenerator (options) {
   return function generateETag (body, encoding) {
     var buf = !Buffer.isBuffer(body)
-      ? new Buffer(body, encoding)
+      ? Buffer.from(body, encoding)
       : body
 
     return etag(buf, options)
diff --git a/package.json b/package.json
index 219e21fe23b..dbbd7810042 100644
--- a/package.json
+++ b/package.json
@@ -48,6 +48,7 @@
     "proxy-addr": "~2.0.2",
     "qs": "6.5.1",
     "range-parser": "~1.2.0",
+    "safe-buffer": "5.1.1",
     "send": "0.15.6",
     "serve-static": "1.12.6",
     "setprototypeof": "1.1.0",
diff --git a/test/res.attachment.js b/test/res.attachment.js
index 662b1dd4e01..4c3d4aa2f1b 100644
--- a/test/res.attachment.js
+++ b/test/res.attachment.js
@@ -1,4 +1,5 @@
 
+var Buffer = require('safe-buffer').Buffer
 var express = require('../')
   , request = require('supertest');
 
@@ -36,7 +37,7 @@ describe('res', function(){
 
       app.use(function(req, res){
         res.attachment('/path/to/image.png');
-        res.send(new Buffer(4));
+        res.send(Buffer.alloc(4, '.'))
       });
 
       request(app)
diff --git a/test/res.send.js b/test/res.send.js
index 88d231eab55..7aa8d7d90e2 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -1,4 +1,5 @@
 
+var Buffer = require('safe-buffer').Buffer
 var express = require('..');
 var methods = require('methods');
 var request = require('supertest');
@@ -166,7 +167,7 @@ describe('res', function(){
       var app = express();
 
       app.use(function(req, res){
-        res.set('Content-Type', 'text/plain; charset=iso-8859-1').send(new Buffer('hi'));
+        res.set('Content-Type', 'text/plain; charset=iso-8859-1').send(Buffer.from('hi'))
       });
 
       request(app)
@@ -181,7 +182,7 @@ describe('res', function(){
       var app = express();
 
       app.use(function(req, res){
-        res.send(new Buffer('hello'));
+        res.send(Buffer.from('hello'))
       });
 
       request(app)
@@ -194,8 +195,7 @@ describe('res', function(){
       var app = express();
 
       app.use(function (req, res) {
-        var str = Array(1000).join('-');
-        res.send(new Buffer(str));
+        res.send(Buffer.alloc(999, '-'))
       });
 
       request(app)
@@ -208,7 +208,7 @@ describe('res', function(){
       var app = express();
 
       app.use(function(req, res){
-        res.set('Content-Type', 'text/plain').send(new Buffer('hey'));
+        res.set('Content-Type', 'text/plain').send(Buffer.from('hey'))
       });
 
       request(app)
@@ -512,7 +512,7 @@ describe('res', function(){
 
         app.set('etag', function (body, encoding) {
           var chunk = !Buffer.isBuffer(body)
-            ? new Buffer(body, encoding)
+            ? Buffer.from(body, encoding)
             : body;
           chunk.toString().should.equal('hello, world!');
           return '"custom"';
diff --git a/test/utils.js b/test/utils.js
index c49019fe126..b51d223af97 100644
--- a/test/utils.js
+++ b/test/utils.js
@@ -1,5 +1,6 @@
 
 var assert = require('assert');
+var Buffer = require('safe-buffer').Buffer
 var utils = require('../lib/utils');
 
 describe('utils.etag(body, encoding)', function(){
@@ -14,8 +15,7 @@ describe('utils.etag(body, encoding)', function(){
   })
 
   it('should support buffer', function(){
-    var buf = new Buffer('express!')
-    utils.etag(buf)
+    utils.etag(Buffer.from('express!'))
     .should.eql('"8-O2uVAFaQ1rZvlKLT14RnuvjPIdg"')
   })
 
@@ -59,8 +59,7 @@ describe('utils.wetag(body, encoding)', function(){
   })
 
   it('should support buffer', function(){
-    var buf = new Buffer('express!')
-    utils.wetag(buf)
+    utils.wetag(Buffer.from('express!'))
     .should.eql('W/"8-O2uVAFaQ1rZvlKLT14RnuvjPIdg"')
   })
 

From 2df1ad26a58bf51228d7600df0d62ed17a90ff71 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hrvoje=20=C5=A0imi=C4=87?= <shime@twobucks.co>
Date: Tue, 26 Sep 2017 16:00:53 +0200
Subject: [PATCH 1142/1265] Improve error messages when non-function provided
 as middleware

closes #3426
---
 History.md          |  1 +
 lib/application.js  |  2 +-
 lib/router/index.js |  4 ++--
 lib/router/route.js |  4 ++--
 test/Router.js      | 30 +++++++++++++++++++++---------
 test/app.use.js     | 31 ++++++++++++++++++++++---------
 6 files changed, 49 insertions(+), 23 deletions(-)

diff --git a/History.md b/History.md
index 18f5e5da371..63a1bdf60b7 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Improve error message when autoloading invalid view engine
+  * Improve error messages when non-function provided as middleware
   * Skip `Buffer` encoding when not generating ETag for small response
   * Use `safe-buffer` for improved Buffer API
   * deps: accepts@~1.3.4
diff --git a/lib/application.js b/lib/application.js
index 8097d81a3b9..91f77d241e4 100644
--- a/lib/application.js
+++ b/lib/application.js
@@ -207,7 +207,7 @@ app.use = function use(fn) {
   var fns = flatten(slice.call(arguments, offset));
 
   if (fns.length === 0) {
-    throw new TypeError('app.use() requires middleware functions');
+    throw new TypeError('app.use() requires a middleware function')
   }
 
   // setup router
diff --git a/lib/router/index.js b/lib/router/index.js
index 51db4c28ff9..60727ed6d64 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -448,14 +448,14 @@ proto.use = function use(fn) {
   var callbacks = flatten(slice.call(arguments, offset));
 
   if (callbacks.length === 0) {
-    throw new TypeError('Router.use() requires middleware functions');
+    throw new TypeError('Router.use() requires a middleware function')
   }
 
   for (var i = 0; i < callbacks.length; i++) {
     var fn = callbacks[i];
 
     if (typeof fn !== 'function') {
-      throw new TypeError('Router.use() requires middleware function but got a ' + gettype(fn));
+      throw new TypeError('Router.use() requires a middleware function but got a ' + gettype(fn))
     }
 
     // add the middleware
diff --git a/lib/router/route.js b/lib/router/route.js
index ea82ed29df5..178df0d5160 100644
--- a/lib/router/route.js
+++ b/lib/router/route.js
@@ -175,7 +175,7 @@ Route.prototype.all = function all() {
 
     if (typeof handle !== 'function') {
       var type = toString.call(handle);
-      var msg = 'Route.all() requires callback functions but got a ' + type;
+      var msg = 'Route.all() requires a callback function but got a ' + type
       throw new TypeError(msg);
     }
 
@@ -198,7 +198,7 @@ methods.forEach(function(method){
 
       if (typeof handle !== 'function') {
         var type = toString.call(handle);
-        var msg = 'Route.' + method + '() requires callback functions but got a ' + type;
+        var msg = 'Route.' + method + '() requires a callback function but got a ' + type
         throw new Error(msg);
       }
 
diff --git a/test/Router.js b/test/Router.js
index 18153d29267..057ce443df4 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -368,17 +368,29 @@ describe('Router', function(){
   })
 
   describe('.use', function() {
-    it('should require arguments', function(){
-      var router = new Router();
-      router.use.bind(router).should.throw(/requires middleware function/)
+    it('should require middleware', function () {
+      var router = new Router()
+      assert.throws(function () { router.use('/') }, /requires a middleware function/)
     })
 
-    it('should not accept non-functions', function(){
-      var router = new Router();
-      router.use.bind(router, '/', 'hello').should.throw(/requires middleware function.*string/)
-      router.use.bind(router, '/', 5).should.throw(/requires middleware function.*number/)
-      router.use.bind(router, '/', null).should.throw(/requires middleware function.*Null/)
-      router.use.bind(router, '/', new Date()).should.throw(/requires middleware function.*Date/)
+    it('should reject string as middleware', function () {
+      var router = new Router()
+      assert.throws(function () { router.use('/', 'foo') }, /requires a middleware function but got a string/)
+    })
+
+    it('should reject number as middleware', function () {
+      var router = new Router()
+      assert.throws(function () { router.use('/', 42) }, /requires a middleware function but got a number/)
+    })
+
+    it('should reject null as middleware', function () {
+      var router = new Router()
+      assert.throws(function () { router.use('/', null) }, /requires a middleware function but got a Null/)
+    })
+
+    it('should reject Date as middleware', function () {
+      var router = new Router()
+      assert.throws(function () { router.use('/', new Date()) }, /requires a middleware function but got a Date/)
     })
 
     it('should be called for any URL', function (done) {
diff --git a/test/app.use.js b/test/app.use.js
index b2031e4c56c..347937fbb3b 100644
--- a/test/app.use.js
+++ b/test/app.use.js
@@ -1,5 +1,6 @@
 
 var after = require('after');
+var assert = require('assert')
 var express = require('..');
 var request = require('supertest');
 
@@ -253,17 +254,29 @@ describe('app', function(){
   })
 
   describe('.use(path, middleware)', function(){
-    it('should reject missing functions', function () {
-      var app = express();
-      app.use.bind(app, '/').should.throw(/requires middleware function/);
+    it('should require middleware', function () {
+      var app = express()
+      assert.throws(function () { app.use('/') }, /requires a middleware function/)
     })
 
-    it('should reject non-functions as middleware', function () {
-      var app = express();
-      app.use.bind(app, '/', 'hi').should.throw(/requires middleware function.*string/);
-      app.use.bind(app, '/', 5).should.throw(/requires middleware function.*number/);
-      app.use.bind(app, '/', null).should.throw(/requires middleware function.*Null/);
-      app.use.bind(app, '/', new Date()).should.throw(/requires middleware function.*Date/);
+    it('should reject string as middleware', function () {
+      var app = express()
+      assert.throws(function () { app.use('/', 'foo') }, /requires a middleware function but got a string/)
+    })
+
+    it('should reject number as middleware', function () {
+      var app = express()
+      assert.throws(function () { app.use('/', 42) }, /requires a middleware function but got a number/)
+    })
+
+    it('should reject null as middleware', function () {
+      var app = express()
+      assert.throws(function () { app.use('/', null) }, /requires a middleware function but got a Null/)
+    })
+
+    it('should reject Date as middleware', function () {
+      var app = express()
+      assert.throws(function () { app.use('/', new Date()) }, /requires a middleware function but got a Date/)
     })
 
     it('should strip path from req.url', function (done) {

From 44591fee234dd83e05894c5b055703db1f68184c Mon Sep 17 00:00:00 2001
From: chainhelen <chainhelen@gmail.com>
Date: Thu, 28 Sep 2017 12:25:27 +0800
Subject: [PATCH 1143/1265] deps: vary@~1.1.2

closes #3434
---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 63a1bdf60b7..04b68978330 100644
--- a/History.md
+++ b/History.md
@@ -26,6 +26,8 @@ unreleased
     - Fix parsing & compacting very deep objects
   * deps: setprototypeof@1.1.0
   * deps: utils-merge@1.0.1
+  * deps: vary@~1.1.2
+    - perf: improve header token parsing speed
   * perf: re-use options object when generating ETags
 
 4.15.5 / 2017-09-24
diff --git a/package.json b/package.json
index dbbd7810042..0a476d67d90 100644
--- a/package.json
+++ b/package.json
@@ -55,7 +55,7 @@
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",
     "utils-merge": "1.0.1",
-    "vary": "~1.1.1"
+    "vary": "~1.1.2"
   },
   "devDependencies": {
     "after": "0.8.2",

From 95fb5cc26848d4c2c57b0a7a74f088538d47d312 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 10:30:10 -0400
Subject: [PATCH 1144/1265] perf: remove dead .charset set in res.jsonp

---
 History.md      | 1 +
 lib/response.js | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 04b68978330..c2d2595731a 100644
--- a/History.md
+++ b/History.md
@@ -29,6 +29,7 @@ unreleased
   * deps: vary@~1.1.2
     - perf: improve header token parsing speed
   * perf: re-use options object when generating ETags
+  * perf: remove dead `.charset` set in `res.jsonp`
 
 4.15.5 / 2017-09-24
 ===================
diff --git a/lib/response.js b/lib/response.js
index 285daf4fb4b..9f61648c17b 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -314,7 +314,6 @@ res.jsonp = function jsonp(obj) {
 
   // jsonp
   if (typeof callback === 'string' && callback.length !== 0) {
-    this.charset = 'utf-8';
     this.set('X-Content-Type-Options', 'nosniff');
     this.set('Content-Type', 'text/javascript');
 

From a24fd0ca6cfd29329444fddf678bcdd1c08e56ae Mon Sep 17 00:00:00 2001
From: Aaron Clover <aaron.j.clover@gmail.com>
Date: Thu, 20 Jul 2017 21:24:04 +1000
Subject: [PATCH 1145/1265] Add options to res.download

closes #3327
closes #3370
---
 lib/response.js      | 34 ++++++++++++++++---
 test/res.download.js | 80 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 110 insertions(+), 4 deletions(-)

diff --git a/lib/response.js b/lib/response.js
index 9f61648c17b..ae028ae81b6 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -515,19 +515,29 @@ res.sendfile = deprecate.function(res.sendfile,
  * when the data transfer is complete, or when an error has
  * ocurred. Be sure to check `res.headersSent` if you plan to respond.
  *
- * This method uses `res.sendfile()`.
+ * Optionally providing an `options` object to use with `res.sendFile()`.
+ * This function will set the `Content-Disposition` header, overriding
+ * any `Content-Disposition` header passed as header options in order
+ * to set the attachment and filename.
+ *
+ * This method uses `res.sendFile()`.
  *
  * @public
  */
 
-res.download = function download(path, filename, callback) {
+res.download = function download (path, filename, options, callback) {
   var done = callback;
   var name = filename;
+  var opts = options || null
 
-  // support function as second arg
+  // support function as second or third arg
   if (typeof filename === 'function') {
     done = filename;
     name = null;
+    opts = null
+  } else if (typeof options === 'function') {
+    done = options
+    opts = null
   }
 
   // set Content-Disposition when file is sent
@@ -535,10 +545,26 @@ res.download = function download(path, filename, callback) {
     'Content-Disposition': contentDisposition(name || path)
   };
 
+  // merge user-provided headers
+  if (opts && opts.headers) {
+    var keys = Object.keys(opts.headers)
+    for (var i = 0; i < keys.length; i++) {
+      var key = keys[i]
+      if (key.toLowerCase() !== 'content-disposition') {
+        headers[key] = opts.headers[key]
+      }
+    }
+  }
+
+  // merge user-provided options
+  opts = Object.create(opts)
+  opts.headers = headers
+
   // Resolve the full path for sendFile
   var fullPath = resolve(path);
 
-  return this.sendFile(fullPath, { headers: headers }, done);
+  // send file
+  return this.sendFile(fullPath, opts, done)
 };
 
 /**
diff --git a/test/res.download.js b/test/res.download.js
index fad56ee256a..30215bf6764 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -71,6 +71,86 @@ describe('res', function(){
     })
   })
 
+  describe('.download(path, filename, options, fn)', function () {
+    it('should invoke the callback', function (done) {
+      var app = express()
+      var cb = after(2, done)
+      var options = {}
+
+      app.use(function (req, res) {
+        res.download('test/fixtures/user.html', 'document', options, done)
+      })
+
+      request(app)
+      .get('/')
+      .expect(200)
+      .expect('Content-Type', 'text/html; charset=UTF-8')
+      .expect('Content-Disposition', 'attachment; filename="document"')
+      .end(cb)
+    })
+
+    it('should allow options to res.sendFile()', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.download('test/fixtures/.name', 'document', {
+          dotfiles: 'allow',
+          maxAge: '4h'
+        })
+      })
+
+      request(app)
+      .get('/')
+      .expect(200)
+      .expect('Content-Disposition', 'attachment; filename="document"')
+      .expect('Cache-Control', 'public, max-age=14400')
+      .expect('tobi')
+      .end(done)
+    })
+
+    describe('when options.headers contains Content-Disposition', function () {
+      it('should should be ignored', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.download('test/fixtures/user.html', 'document', {
+            headers: {
+              'Content-Type': 'text/x-custom',
+              'Content-Disposition': 'inline'
+            }
+          })
+        })
+
+        request(app)
+        .get('/')
+        .expect(200)
+        .expect('Content-Type', 'text/x-custom')
+        .expect('Content-Disposition', 'attachment; filename="document"')
+        .end(done)
+      })
+
+      it('should should be ignored case-insensitively', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.download('test/fixtures/user.html', 'document', {
+            headers: {
+              'content-type': 'text/x-custom',
+              'content-disposition': 'inline'
+            }
+          })
+        })
+
+        request(app)
+        .get('/')
+        .expect(200)
+        .expect('Content-Type', 'text/x-custom')
+        .expect('Content-Disposition', 'attachment; filename="document"')
+        .end(done)
+      })
+    })
+  })
+
   describe('on failure', function(){
     it('should invoke the callback', function(done){
       var app = express();

From 628438d8d890f3707b8eecf57aeff7d0da348e8e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 11:36:20 -0400
Subject: [PATCH 1146/1265] deps: update example dependencies

---
 package.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 0a476d67d90..addbdcb7f30 100644
--- a/package.json
+++ b/package.json
@@ -59,18 +59,18 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "body-parser": "1.18.1",
+    "body-parser": "1.18.2",
     "cookie-parser": "~1.4.3",
-    "cookie-session": "1.3.1",
+    "cookie-session": "1.3.2",
     "ejs": "2.5.7",
     "eslint": "2.13.1",
-    "express-session": "1.15.5",
+    "express-session": "1.15.6",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
     "marked": "0.3.6",
-    "method-override": "2.3.9",
+    "method-override": "2.3.10",
     "mocha": "3.5.3",
-    "morgan": "1.8.2",
+    "morgan": "1.9.0",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",
     "should": "13.1.0",

From 715401478516c39ea9b2f855d4109d7d6e1131e0 Mon Sep 17 00:00:00 2001
From: Greg Guthe <gguthe@mozilla.com>
Date: Wed, 5 Apr 2017 17:42:09 -0400
Subject: [PATCH 1147/1265] Add "escape json" setting for res.json and
 res.jsonp

closes #3268
closes #3269
---
 History.md        |  1 +
 lib/response.js   | 36 +++++++++++++++++++++++++++++++-----
 test/res.json.js  | 22 ++++++++++++++++++++++
 test/res.jsonp.js | 22 ++++++++++++++++++++++
 4 files changed, 76 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index c2d2595731a..248b1c7a678 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Add `"json escape"` setting for `res.json` and `res.jsonp`
   * Improve error message when autoloading invalid view engine
   * Improve error messages when non-function provided as middleware
   * Skip `Buffer` encoding when not generating ETag for small response
diff --git a/lib/response.js b/lib/response.js
index ae028ae81b6..832044be9ae 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -254,9 +254,10 @@ res.json = function json(obj) {
 
   // settings
   var app = this.app;
+  var escape = app.get('json escape')
   var replacer = app.get('json replacer');
   var spaces = app.get('json spaces');
-  var body = stringify(val, replacer, spaces);
+  var body = stringify(val, replacer, spaces, escape)
 
   // content-type
   if (!this.get('Content-Type')) {
@@ -296,9 +297,10 @@ res.jsonp = function jsonp(obj) {
 
   // settings
   var app = this.app;
+  var escape = app.get('json escape')
   var replacer = app.get('json replacer');
   var spaces = app.get('json spaces');
-  var body = stringify(val, replacer, spaces);
+  var body = stringify(val, replacer, spaces, escape)
   var callback = this.req.query[app.get('jsonp callback name')];
 
   // content-type
@@ -1098,14 +1100,38 @@ function sendfile(res, file, options, callback) {
 }
 
 /**
- * Stringify JSON, like JSON.stringify, but v8 optimized.
+ * Stringify JSON, like JSON.stringify, but v8 optimized, with the
+ * ability to escape characters that can trigger HTML sniffing.
+ *
+ * @param {*} value
+ * @param {function} replaces
+ * @param {number} spaces
+ * @param {boolean} escape
+ * @returns {string}
  * @private
  */
 
-function stringify(value, replacer, spaces) {
+function stringify (value, replacer, spaces, escape) {
   // v8 checks arguments.length for optimizing simple call
   // https://bugs.chromium.org/p/v8/issues/detail?id=4730
-  return replacer || spaces
+  var json = replacer || spaces
     ? JSON.stringify(value, replacer, spaces)
     : JSON.stringify(value);
+
+  if (escape) {
+    json = json.replace(/[<>&]/g, function (c) {
+      switch (c.charCodeAt(0)) {
+        case 0x3c:
+          return '\\u003c'
+        case 0x3e:
+          return '\\u003e'
+        case 0x26:
+          return '\\u0026'
+        default:
+          return c
+      }
+    })
+  }
+
+  return json
 }
diff --git a/test/res.json.js b/test/res.json.js
index 69f6723af54..1041376235c 100644
--- a/test/res.json.js
+++ b/test/res.json.js
@@ -102,6 +102,28 @@ describe('res', function(){
       })
     })
 
+    describe('"json escape" setting', function () {
+      it('should be undefined by default', function () {
+        var app = express()
+        assert.strictEqual(app.get('json escape'), undefined)
+      })
+
+      it('should unicode escape HTML-sniffing characters', function (done) {
+        var app = express()
+
+        app.enable('json escape')
+
+        app.use(function (req, res) {
+          res.json({ '&': '<script>' })
+        })
+
+        request(app)
+        .get('/')
+        .expect('Content-Type', 'application/json; charset=utf-8')
+        .expect(200, '{"\\u0026":"\\u003cscript\\u003e"}', done)
+      })
+    })
+
     describe('"json replacer" setting', function(){
       it('should be passed to JSON.stringify()', function(done){
         var app = express();
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 64b41fb9a6b..9b536b541f2 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -242,6 +242,28 @@ describe('res', function(){
       })
     })
 
+    describe('"json escape" setting', function () {
+      it('should be undefined by default', function () {
+        var app = express()
+        assert.strictEqual(app.get('json escape'), undefined)
+      })
+
+      it('should unicode escape HTML-sniffing characters', function (done) {
+        var app = express()
+
+        app.enable('json escape')
+
+        app.use(function (req, res) {
+          res.jsonp({ '&': '\u2028<script>\u2029' })
+        })
+
+        request(app)
+        .get('/?callback=foo')
+        .expect('Content-Type', 'text/javascript; charset=utf-8')
+        .expect(200, /foo\({"\\u0026":"\\u2028\\u003cscript\\u003e\\u2029"}\)/, done)
+      })
+    })
+
     describe('"json replacer" setting', function(){
       it('should be passed to JSON.stringify()', function(done){
         var app = express();

From ddeb71301c98421e0c3cc9fd43e68fdc9b63a45a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 12:32:27 -0400
Subject: [PATCH 1148/1265] tests: add maxAge option tests for res.sendFile

---
 test/res.sendFile.js | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index ff4b1cb2dd1..9b866471bc7 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -180,6 +180,30 @@ describe('res', function(){
       });
     });
 
+    describe('with "maxAge" option', function () {
+      it('should set cache-control max-age from number', function (done) {
+        var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'), {
+          maxAge: 14400000
+        })
+
+        request(app)
+        .get('/')
+        .expect('Cache-Control', 'public, max-age=14400')
+        .expect(200, done)
+      })
+
+      it('should set cache-control max-age from string', function (done) {
+        var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'), {
+          maxAge: '4h'
+        })
+
+        request(app)
+        .get('/')
+        .expect('Cache-Control', 'public, max-age=14400')
+        .expect(200, done)
+      })
+    })
+
     describe('with "root" option', function () {
       it('should not transfer relative with without', function (done) {
         var app = createApp('test/fixtures/name.txt');

From 41964580a8869d5f094e7379d5672dd75f8491f9 Mon Sep 17 00:00:00 2001
From: Daniel Tschinder <daniel@tschinder.de>
Date: Thu, 28 Sep 2017 11:25:52 +0200
Subject: [PATCH 1149/1265] deps: send@0.16.0

closes #3431
closes #3435
---
 History.md           |  8 ++++++++
 package.json         |  2 +-
 test/res.sendFile.js | 14 ++++++++++++++
 test/res.type.js     |  3 ++-
 4 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 248b1c7a678..32b9eb19cb6 100644
--- a/History.md
+++ b/History.md
@@ -25,6 +25,14 @@ unreleased
     - perf: reduce overhead when no `X-Forwarded-For` header
   * deps: qs@6.5.1
     - Fix parsing & compacting very deep objects
+  * deps: send@0.16.0
+    - Add 70 new types for file extensions
+    - Add `immutable` option
+    - Fix missing `</html>` in default error & redirects
+    - Set charset as "UTF-8" for .js and .json
+    - Use instance methods on steam to check for listeners
+    - deps: mime@1.4.1
+    - perf: improve path validation speed
   * deps: setprototypeof@1.1.0
   * deps: utils-merge@1.0.1
   * deps: vary@~1.1.2
diff --git a/package.json b/package.json
index addbdcb7f30..2aac075732e 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "qs": "6.5.1",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",
-    "send": "0.15.6",
+    "send": "0.16.0",
     "serve-static": "1.12.6",
     "setprototypeof": "1.1.0",
     "statuses": "~1.3.1",
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index 9b866471bc7..4b1f3852f35 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -180,6 +180,20 @@ describe('res', function(){
       });
     });
 
+    describe('with "immutable" option', function () {
+      it('should add immutable cache-control directive', function (done) {
+        var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'), {
+          immutable: true,
+          maxAge: '4h'
+        })
+
+        request(app)
+        .get('/')
+        .expect('Cache-Control', 'public, max-age=14400, immutable')
+        .expect(200, done)
+      })
+    })
+
     describe('with "maxAge" option', function () {
       it('should set cache-control max-age from number', function (done) {
         var app = createApp(path.resolve(__dirname, 'fixtures/name.txt'), {
diff --git a/test/res.type.js b/test/res.type.js
index 7c03ef4c64d..cc1dd08d410 100644
--- a/test/res.type.js
+++ b/test/res.type.js
@@ -13,7 +13,8 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect('Content-Type', 'application/javascript', done);
+      .expect('Content-Type', 'application/javascript; charset=utf-8')
+      .end(done)
     })
 
     it('should default to application/octet-stream', function(done){

From 86f5df00ed921a9e3effdc2e08c038e592a3209b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 13:08:38 -0400
Subject: [PATCH 1150/1265] deps: serve-static@1.13.0

closes #3197
---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 32b9eb19cb6..fcde7ab82ba 100644
--- a/History.md
+++ b/History.md
@@ -33,6 +33,11 @@ unreleased
     - Use instance methods on steam to check for listeners
     - deps: mime@1.4.1
     - perf: improve path validation speed
+  * deps: serve-static@1.13.0
+    - Add 70 new types for file extensions
+    - Add `immutable` option
+    - Set charset as "UTF-8" for .js and .json
+    - deps: send@0.16.0
   * deps: setprototypeof@1.1.0
   * deps: utils-merge@1.0.1
   * deps: vary@~1.1.2
diff --git a/package.json b/package.json
index 2aac075732e..d30842b2aee 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",
     "send": "0.16.0",
-    "serve-static": "1.12.6",
+    "serve-static": "1.13.0",
     "setprototypeof": "1.1.0",
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",

From c0136d8b48dd3526c58b2ad8666fb4b12b55116c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 13:22:36 -0400
Subject: [PATCH 1151/1265] Add express.json and express.urlencoded to parse
 bodies

closes #2211
---
 History.md                         | 1 +
 examples/auth/index.js             | 3 +--
 examples/cookies/index.js          | 3 +--
 examples/mvc/index.js              | 3 +--
 examples/route-separation/index.js | 3 +--
 lib/express.js                     | 7 ++++---
 package.json                       | 2 +-
 test/req.param.js                  | 3 +--
 8 files changed, 11 insertions(+), 14 deletions(-)

diff --git a/History.md b/History.md
index fcde7ab82ba..eae41a82b17 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Add `"json escape"` setting for `res.json` and `res.jsonp`
+  * Add `express.json` and `express.urlencoded` to parse bodies
   * Improve error message when autoloading invalid view engine
   * Improve error messages when non-function provided as middleware
   * Skip `Buffer` encoding when not generating ETag for small response
diff --git a/examples/auth/index.js b/examples/auth/index.js
index 084fba79a97..8df77815e3b 100644
--- a/examples/auth/index.js
+++ b/examples/auth/index.js
@@ -3,7 +3,6 @@
  */
 
 var express = require('../..');
-var bodyParser = require('body-parser');
 var hash = require('pbkdf2-password')()
 var path = require('path');
 var session = require('express-session');
@@ -17,7 +16,7 @@ app.set('views', path.join(__dirname, 'views'));
 
 // middleware
 
-app.use(bodyParser.urlencoded({ extended: false }));
+app.use(express.urlencoded({ extended: false }))
 app.use(session({
   resave: false, // don't save session if unmodified
   saveUninitialized: false, // don't create session until something stored
diff --git a/examples/cookies/index.js b/examples/cookies/index.js
index 5d1ba3461c7..34ead527669 100644
--- a/examples/cookies/index.js
+++ b/examples/cookies/index.js
@@ -6,7 +6,6 @@ var express = require('../../');
 var app = module.exports = express();
 var logger = require('morgan');
 var cookieParser = require('cookie-parser');
-var bodyParser = require('body-parser');
 
 // custom log format
 if ('test' != process.env.NODE_ENV) app.use(logger(':method :url'));
@@ -18,7 +17,7 @@ if ('test' != process.env.NODE_ENV) app.use(logger(':method :url'));
 app.use(cookieParser('my secret here'));
 
 // parses x-www-form-urlencoded
-app.use(bodyParser.urlencoded({ extended: false }));
+app.use(express.urlencoded({ extended: false }))
 
 app.get('/', function(req, res){
   if (req.cookies.remember) {
diff --git a/examples/mvc/index.js b/examples/mvc/index.js
index 0d5624b63d3..77885a60ca0 100644
--- a/examples/mvc/index.js
+++ b/examples/mvc/index.js
@@ -6,7 +6,6 @@ var express = require('../..');
 var logger = require('morgan');
 var path = require('path');
 var session = require('express-session');
-var bodyParser = require('body-parser');
 var methodOverride = require('method-override');
 
 var app = module.exports = express();
@@ -43,7 +42,7 @@ app.use(session({
 }));
 
 // parse request bodies (req.body)
-app.use(bodyParser.urlencoded({ extended: true }));
+app.use(express.urlencoded({ extended: true }))
 
 // allow overriding methods in query (?_method=put)
 app.use(methodOverride('_method'));
diff --git a/examples/route-separation/index.js b/examples/route-separation/index.js
index 79e26497f45..65121091348 100644
--- a/examples/route-separation/index.js
+++ b/examples/route-separation/index.js
@@ -7,7 +7,6 @@ var path = require('path');
 var app = express();
 var logger = require('morgan');
 var cookieParser = require('cookie-parser');
-var bodyParser = require('body-parser');
 var methodOverride = require('method-override');
 var site = require('./site');
 var post = require('./post');
@@ -27,7 +26,7 @@ if (!module.parent) {
 
 app.use(methodOverride('_method'));
 app.use(cookieParser());
-app.use(bodyParser.urlencoded({ extended: true }));
+app.use(express.urlencoded({ extended: true }))
 app.use(express.static(path.join(__dirname, 'public')));
 
 // General
diff --git a/lib/express.js b/lib/express.js
index 187e4e2d7ca..485a8fc08de 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -12,6 +12,7 @@
  * Module dependencies.
  */
 
+var bodyParser = require('body-parser')
 var EventEmitter = require('events').EventEmitter;
 var mixin = require('merge-descriptors');
 var proto = require('./application');
@@ -74,16 +75,16 @@ exports.Router = Router;
  * Expose middleware
  */
 
+exports.json = bodyParser.json
 exports.query = require('./middleware/query');
 exports.static = require('serve-static');
+exports.urlencoded = bodyParser.urlencoded
 
 /**
  * Replace removed middleware with an appropriate error message.
  */
 
-[
-  'json',
-  'urlencoded',
+;[
   'bodyParser',
   'compress',
   'cookieSession',
diff --git a/package.json b/package.json
index d30842b2aee..f20c3b9dca8 100644
--- a/package.json
+++ b/package.json
@@ -29,6 +29,7 @@
   "dependencies": {
     "accepts": "~1.3.4",
     "array-flatten": "1.1.1",
+    "body-parser": "1.18.2",
     "content-disposition": "0.5.2",
     "content-type": "~1.0.4",
     "cookie": "0.3.1",
@@ -59,7 +60,6 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "body-parser": "1.18.2",
     "cookie-parser": "~1.4.3",
     "cookie-session": "1.3.2",
     "ejs": "2.5.7",
diff --git a/test/req.param.js b/test/req.param.js
index 1e827f03058..89f0295cd9d 100644
--- a/test/req.param.js
+++ b/test/req.param.js
@@ -1,7 +1,6 @@
 
 var express = require('../')
   , request = require('supertest')
-  , bodyParser = require('body-parser')
 
 describe('req', function(){
   describe('.param(name, default)', function(){
@@ -34,7 +33,7 @@ describe('req', function(){
     it('should check req.body', function(done){
       var app = express();
 
-      app.use(bodyParser.json());
+      app.use(express.json())
 
       app.use(function(req, res){
         res.end(req.param('name'));

From 8d4ceb623d8130e9a4ea784bdbe80ecf2d9d51c9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 13:55:15 -0400
Subject: [PATCH 1152/1265] docs: add more information to installation

---
 Readme.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/Readme.md b/Readme.md
index 17326615776..3cd2203250c 100644
--- a/Readme.md
+++ b/Readme.md
@@ -21,10 +21,22 @@ app.listen(3000)
 
 ## Installation
 
+This is a [Node.js](https://nodejs.org/en/) module available through the
+[npm registry](https://www.npmjs.com/).
+
+Before installing, [download and install Node.js](https://nodejs.org/en/download/).
+Node.js 0.10 or higher is required.
+
+Installation is done using the
+[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
+
 ```bash
 $ npm install express
 ```
 
+Follow [our installing guide](http://expressjs.com/en/starter/installing.html)
+for more information.
+
 ## Features
 
   * Robust routing

From f974d22c66d3cd91634ddaba1ef8bcaa8e49daf4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Sep 2017 13:57:23 -0400
Subject: [PATCH 1153/1265] 4.16.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index eae41a82b17..c4be93f728c 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.16.0 / 2017-09-28
+===================
 
   * Add `"json escape"` setting for `res.json` and `res.jsonp`
   * Add `express.json` and `express.urlencoded` to parse bodies
diff --git a/package.json b/package.json
index f20c3b9dca8..33a667bd4a6 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.15.5",
+  "version": "4.16.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 6d9b13cceda6ee24a53dab01d9db9d7588ac66b4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 29 Sep 2017 15:56:55 -0400
Subject: [PATCH 1154/1265] deps: send@0.16.1

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c4be93f728c..3fd05fb0df5 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * deps: send@0.16.1
+
 4.16.0 / 2017-09-28
 ===================
 
diff --git a/package.json b/package.json
index 33a667bd4a6..29103da521b 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "qs": "6.5.1",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",
-    "send": "0.16.0",
+    "send": "0.16.1",
     "serve-static": "1.13.0",
     "setprototypeof": "1.1.0",
     "statuses": "~1.3.1",

From 6f823e409c1dcaa338df9592df98a2ec396b2143 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 29 Sep 2017 16:12:06 -0400
Subject: [PATCH 1155/1265] deps: serve-static@1.13.1

closes #3436
---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 3fd05fb0df5..b49bdbcfed7 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,9 @@ unreleased
 ==========
 
   * deps: send@0.16.1
+  * deps: serve-static@1.13.1
+    - Fix regression when `root` is incorrectly set to a file
+    - deps: send@0.16.1
 
 4.16.0 / 2017-09-28
 ===================
diff --git a/package.json b/package.json
index 29103da521b..ca0d649f4e5 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",
     "send": "0.16.1",
-    "serve-static": "1.13.0",
+    "serve-static": "1.13.1",
     "setprototypeof": "1.1.0",
     "statuses": "~1.3.1",
     "type-is": "~1.6.15",

From e3f7f51f5f5475ca1ad091b1f8b7293f79467d29 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 29 Sep 2017 16:23:23 -0400
Subject: [PATCH 1156/1265] 4.16.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index b49bdbcfed7..df3280cb7bf 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.16.1 / 2017-09-29
+===================
 
   * deps: send@0.16.1
   * deps: serve-static@1.13.1
diff --git a/package.json b/package.json
index ca0d649f4e5..3b03f12d922 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.16.0",
+  "version": "4.16.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From de129c289dc17d3039c2655c050716b0eff9b0f5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 1 Oct 2017 00:48:29 -0400
Subject: [PATCH 1157/1265] tests: run mocha with --no-exit to detect hangs

closes #3439
---
 package.json             |  8 ++++----
 test/middleware.basic.js |  2 +-
 test/res.format.js       | 11 +++++++----
 test/res.sendFile.js     | 30 ++++++++++++++++++------------
 4 files changed, 30 insertions(+), 21 deletions(-)

diff --git a/package.json b/package.json
index 3b03f12d922..6bfc610ccfc 100644
--- a/package.json
+++ b/package.json
@@ -90,9 +90,9 @@
   ],
   "scripts": {
     "lint": "eslint .",
-    "test": "mocha --require test/support/env --reporter spec --bail --check-leaks test/ test/acceptance/",
-    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
-    "test-tap": "mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/"
+    "test": "mocha --require test/support/env --reporter spec --bail --check-leaks --no-exit test/ test/acceptance/",
+    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks --no-exit test/ test/acceptance/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks --no-exit test/ test/acceptance/",
+    "test-tap": "mocha --require test/support/env --reporter tap --check-leaks --no-exit test/ test/acceptance/"
   }
 }
diff --git a/test/middleware.basic.js b/test/middleware.basic.js
index 28a4dd18f2e..ce59589230b 100644
--- a/test/middleware.basic.js
+++ b/test/middleware.basic.js
@@ -28,7 +28,7 @@ describe('middleware', function(){
         });
       });
 
-      request(app.listen())
+      request(app)
       .get('/')
       .set('Content-Type', 'application/json')
       .send('{"foo":"bar"}')
diff --git a/test/res.format.js b/test/res.format.js
index 3c1d095b426..1c1d077e587 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -1,4 +1,5 @@
 
+var after = require('after')
 var express = require('../')
   , request = require('supertest')
   , assert = require('assert');
@@ -168,21 +169,23 @@ function test(app) {
     .expect('hey', done);
   })
 
-  it('should set the correct  charset for the Content-Type', function() {
+  it('should set the correct charset for the Content-Type', function (done) {
+    var cb = after(3, done)
+
     request(app)
     .get('/')
     .set('Accept', 'text/html')
-    .expect('Content-Type', 'text/html; charset=utf-8');
+    .expect('Content-Type', 'text/html; charset=utf-8', cb)
 
     request(app)
     .get('/')
     .set('Accept', 'text/plain')
-    .expect('Content-Type', 'text/plain; charset=utf-8');
+    .expect('Content-Type', 'text/plain; charset=utf-8', cb)
 
     request(app)
     .get('/')
     .set('Accept', 'application/json')
-    .expect('Content-Type', 'application/json');
+    .expect('Content-Type', 'application/json; charset=utf-8', cb)
   })
 
   it('should Vary: Accept', function(done){
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index 4b1f3852f35..ccec3f40cfe 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -102,7 +102,7 @@ describe('res', function(){
       app.use(function (req, res) {
         setImmediate(function () {
           res.sendFile(path.resolve(fixtures, 'name.txt'));
-          cb();
+          server.close(cb)
         });
         test.abort();
       });
@@ -112,7 +112,8 @@ describe('res', function(){
         cb();
       });
 
-      var test = request(app).get('/');
+      var server = app.listen()
+      var test = request(server).get('/')
       test.expect(200, cb);
     })
 
@@ -264,13 +265,14 @@ describe('res', function(){
           res.sendFile(path.resolve(fixtures, 'name.txt'), function (err) {
             should(err).be.ok()
             err.code.should.equal('ECONNABORTED');
-            cb();
+            server.close(cb)
           });
         });
         test.abort();
       });
 
-      var test = request(app).get('/');
+      var server = app.listen()
+      var test = request(server).get('/')
       test.expect(200, cb);
     })
 
@@ -283,13 +285,14 @@ describe('res', function(){
           res.sendFile(path.resolve(fixtures, 'name.txt'), function (err) {
             should(err).be.ok()
             err.code.should.equal('ECONNABORTED');
-            cb();
+            server.close(cb)
           });
         });
         test.abort();
       });
 
-      var test = request(app).get('/');
+      var server = app.listen()
+      var test = request(server).get('/')
       test.expect(200, cb);
     })
 
@@ -388,13 +391,14 @@ describe('res', function(){
           res.sendfile('test/fixtures/name.txt', function (err) {
             should(err).be.ok()
             err.code.should.equal('ECONNABORTED');
-            cb();
+            server.close(cb)
           });
         });
         test.abort();
       });
 
-      var test = request(app).get('/');
+      var server = app.listen()
+      var test = request(server).get('/')
       test.expect(200, cb);
     })
 
@@ -407,13 +411,14 @@ describe('res', function(){
           res.sendfile('test/fixtures/name.txt', function (err) {
             should(err).be.ok()
             err.code.should.equal('ECONNABORTED');
-            cb();
+            server.close(cb)
           });
         });
         test.abort();
       });
 
-      var test = request(app).get('/');
+      var server = app.listen()
+      var test = request(server).get('/')
       test.expect(200, cb);
     })
 
@@ -629,7 +634,7 @@ describe('res', function(){
       app.use(function (req, res) {
         setImmediate(function () {
           res.sendfile(path.resolve(fixtures, 'name.txt'));
-          cb();
+          server.close(cb)
         });
         test.abort();
       });
@@ -639,7 +644,8 @@ describe('res', function(){
         cb();
       });
 
-      var test = request(app).get('/');
+      var server = app.listen()
+      var test = request(server).get('/')
       test.expect(200, cb);
     })
 

From 48aba21ea4bcf0dec962514553f6e6326f942dc6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 4 Oct 2017 23:09:22 -0400
Subject: [PATCH 1158/1265] docs: add missing history for res.download change

---
 History.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/History.md b/History.md
index df3280cb7bf..2859c77c74a 100644
--- a/History.md
+++ b/History.md
@@ -11,6 +11,7 @@
 
   * Add `"json escape"` setting for `res.json` and `res.jsonp`
   * Add `express.json` and `express.urlencoded` to parse bodies
+  * Add `options` argument to `res.download`
   * Improve error message when autoloading invalid view engine
   * Improve error messages when non-function provided as middleware
   * Skip `Buffer` encoding when not generating ETag for small response

From b7817ab1b0bbadabe79fc88819c8338838ead707 Mon Sep 17 00:00:00 2001
From: David Wood <bitprobe@gmail.com>
Date: Mon, 9 Oct 2017 14:41:06 -0500
Subject: [PATCH 1159/1265] Fix TypeError in res.send when given Buffer and
 ETag header set

fixes #3445
---
 History.md       |  5 +++++
 lib/response.js  | 10 +++++-----
 test/res.send.js | 13 +++++++++++++
 3 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/History.md b/History.md
index 2859c77c74a..f51da8dfb36 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix `TypeError` in `res.send` when given `Buffer` and `ETag` header set
+
 4.16.1 / 2017-09-29
 ===================
 
diff --git a/lib/response.js b/lib/response.js
index 832044be9ae..9c1796d37b3 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -178,17 +178,17 @@ res.send = function send(body) {
   // populate Content-Length
   var len
   if (chunk !== undefined) {
-    if (!generateETag && chunk.length < 1000) {
+    if (Buffer.isBuffer(chunk)) {
+      // get length of Buffer
+      len = chunk.length
+    } else if (!generateETag && chunk.length < 1000) {
       // just calculate length when no ETag + small chunk
       len = Buffer.byteLength(chunk, encoding)
-    } else if (!Buffer.isBuffer(chunk)) {
+    } else {
       // convert chunk to Buffer and calculate
       chunk = Buffer.from(chunk, encoding)
       encoding = undefined;
       len = chunk.length
-    } else {
-      // get length of Buffer
-      len = chunk.length
     }
 
     this.set('Content-Length', len);
diff --git a/test/res.send.js b/test/res.send.js
index 7aa8d7d90e2..24105542481 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -216,6 +216,19 @@ describe('res', function(){
       .expect('Content-Type', 'text/plain; charset=utf-8')
       .expect(200, 'hey', done);
     })
+
+    it('should not override ETag', function (done) {
+      var app = express()
+
+      app.use(function (req, res) {
+        res.type('text/plain').set('ETag', '"foo"').send(Buffer.from('hey'))
+      })
+
+      request(app)
+      .get('/')
+      .expect('ETag', '"foo"')
+      .expect(200, 'hey', done)
+    })
   })
 
   describe('.send(Object)', function(){

From b97faff6e2aa4d34d79485fe4331cb0eec13ad57 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 9 Oct 2017 22:43:23 -0400
Subject: [PATCH 1160/1265] perf: skip parsing of entire "X-Forwarded-Proto"
 header

---
 History.md     | 1 +
 lib/request.js | 8 ++++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index f51da8dfb36..f7313199d43 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Fix `TypeError` in `res.send` when given `Buffer` and `ETag` header set
+  * perf: skip parsing of entire `X-Forwarded-Proto` header
 
 4.16.1 / 2017-09-29
 ===================
diff --git a/lib/request.js b/lib/request.js
index 3432e6776fe..8bb86a9acc4 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -315,8 +315,12 @@ defineGetter(req, 'protocol', function protocol(){
 
   // Note: X-Forwarded-Proto is normally only ever a
   //       single value, but this is to be safe.
-  proto = this.get('X-Forwarded-Proto') || proto;
-  return proto.split(/\s*,\s*/)[0];
+  var header = this.get('X-Forwarded-Proto') || proto
+  var index = header.indexOf(',')
+
+  return index !== -1
+    ? header.substring(0, index).trim()
+    : header.trim()
 });
 
 /**

From 351396f971280ab79faddcf9782ea50f4e88358d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 9 Oct 2017 22:55:18 -0400
Subject: [PATCH 1161/1265] 4.16.2

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index f7313199d43..fbf59a23413 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.16.2 / 2017-10-09
+===================
 
   * Fix `TypeError` in `res.send` when given `Buffer` and `ETag` header set
   * perf: skip parsing of entire `X-Forwarded-Proto` header
diff --git a/package.json b/package.json
index 6bfc610ccfc..134ca2a0c1b 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.16.1",
+  "version": "4.16.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 53bee2506debf01d9f6e884d1fc09b86d001f0e2 Mon Sep 17 00:00:00 2001
From: Yaman Jain <yamanjain007@gmail.com>
Date: Wed, 1 Nov 2017 14:49:59 +0530
Subject: [PATCH 1162/1265] examples: use https github url

closes #3465
---
 examples/web-service/index.js  | 6 +++---
 test/acceptance/web-service.js | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index 41747cfdc7f..5a603a1023f 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -49,9 +49,9 @@ var apiKeys = ['foo', 'bar', 'baz'];
 // these two objects will serve as our faux database
 
 var repos = [
-    { name: 'express', url: 'http://github.com/expressjs/express' }
-  , { name: 'stylus', url: 'http://github.com/learnboost/stylus' }
-  , { name: 'cluster', url: 'http://github.com/learnboost/cluster' }
+  { name: 'express', url: 'https://github.com/expressjs/express' },
+  { name: 'stylus', url: 'https://github.com/learnboost/stylus' },
+  { name: 'cluster', url: 'https://github.com/learnboost/cluster' }
 ];
 
 var users = [
diff --git a/test/acceptance/web-service.js b/test/acceptance/web-service.js
index 521fa9fa28d..fa2c10bfdb4 100644
--- a/test/acceptance/web-service.js
+++ b/test/acceptance/web-service.js
@@ -53,7 +53,7 @@ describe('web-service', function(){
         .get('/api/repos?api-key=foo')
         .expect('Content-Type', 'application/json; charset=utf-8')
         .expect(/"name":"express"/)
-        .expect(/"url":"http:\/\/github.com\/expressjs\/express"/)
+        .expect(/"url":"https:\/\/github.com\/expressjs\/express"/)
         .expect(200, done)
       })
     })
@@ -82,7 +82,7 @@ describe('web-service', function(){
         .get('/api/user/loki/repos?api-key=foo')
         .expect('Content-Type', 'application/json; charset=utf-8')
         .expect(/"name":"stylus"/)
-        .expect(/"url":"http:\/\/github.com\/learnboost\/stylus"/)
+        .expect(/"url":"https:\/\/github.com\/learnboost\/stylus"/)
         .expect(200, done)
       })
 

From 950f4423f0f881e40b1f68339054c209aec6d0e3 Mon Sep 17 00:00:00 2001
From: chainhelen <chainhelen@gmail.com>
Date: Wed, 11 Oct 2017 10:42:11 +0800
Subject: [PATCH 1163/1265] tests: separate res.send() chain test

closes #3448
---
 test/res.send.js | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/test/res.send.js b/test/res.send.js
index 24105542481..13658fe6b01 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -1,4 +1,5 @@
 
+var assert = require('assert')
 var Buffer = require('safe-buffer').Buffer
 var express = require('..');
 var methods = require('methods');
@@ -54,7 +55,7 @@ describe('res', function(){
       var app = express();
 
       app.use(function(req, res){
-        res.send(201).should.equal(res);
+        res.send(201)
       });
 
       request(app)
@@ -354,6 +355,18 @@ describe('res', function(){
     .expect('{"foo":"bar"}', done);
   })
 
+  it('should be chainable', function (done) {
+    var app = express()
+
+    app.use(function (req, res) {
+      assert.equal(res.send('hey'), res)
+    })
+
+    request(app)
+    .get('/')
+    .expect(200, 'hey', done)
+  })
+
   describe('"etag" setting', function () {
     describe('when enabled', function () {
       it('should send ETag', function (done) {

From 187d1f57c973e93310066e29a493e150e57c6ae5 Mon Sep 17 00:00:00 2001
From: David Wu <david10608@gmail.com>
Date: Wed, 3 Jan 2018 00:47:52 +0100
Subject: [PATCH 1164/1265] docs: remove gratipay badges

closes #3524
---
 Readme.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Readme.md b/Readme.md
index 3cd2203250c..582e8958c59 100644
--- a/Readme.md
+++ b/Readme.md
@@ -127,9 +127,9 @@ $ npm test
 
 ## People
 
-The original author of Express is [TJ Holowaychuk](https://github.com/tj) [![TJ's Gratipay][gratipay-image-visionmedia]][gratipay-url-visionmedia]
+The original author of Express is [TJ Holowaychuk](https://github.com/tj)
 
-The current lead maintainer is [Douglas Christopher Wilson](https://github.com/dougwilson) [![Doug's Gratipay][gratipay-image-dougwilson]][gratipay-url-dougwilson]
+The current lead maintainer is [Douglas Christopher Wilson](https://github.com/dougwilson)
 
 [List of all contributors](https://github.com/expressjs/express/graphs/contributors)
 

From a743d5be4d91cf2b430479c6b481f00c19f2ba73 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 2 Jan 2018 19:45:25 -0500
Subject: [PATCH 1165/1265] build: marked@0.3.9

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 134ca2a0c1b..27e1a89cc39 100644
--- a/package.json
+++ b/package.json
@@ -67,7 +67,7 @@
     "express-session": "1.15.6",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
-    "marked": "0.3.6",
+    "marked": "0.3.9",
     "method-override": "2.3.10",
     "mocha": "3.5.3",
     "morgan": "1.9.0",

From b49af6a6743acc7cc875b67f090f553b63a184e8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 2 Jan 2018 19:46:31 -0500
Subject: [PATCH 1166/1265] build: should@13.2.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 27e1a89cc39..666f141d31c 100644
--- a/package.json
+++ b/package.json
@@ -73,7 +73,7 @@
     "morgan": "1.9.0",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",
-    "should": "13.1.0",
+    "should": "13.2.0",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
     "vhost": "~3.0.2"

From 1780ed10918021c54dd36e75476ca52b1f931116 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 2 Jan 2018 21:47:13 -0500
Subject: [PATCH 1167/1265] build: Node.js@6.12

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 855168ff540..5e18eb6f846 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,7 +7,7 @@ node_js:
   - "3.3"
   - "4.8"
   - "5.12"
-  - "6.11"
+  - "6.12"
   - "7.10"
   - "8.4"
 matrix:
diff --git a/appveyor.yml b/appveyor.yml
index 193660af715..cd943573ac6 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -7,7 +7,7 @@ environment:
     - nodejs_version: "3.3"
     - nodejs_version: "4.8"
     - nodejs_version: "5.12"
-    - nodejs_version: "6.11"
+    - nodejs_version: "6.12"
     - nodejs_version: "7.10"
     - nodejs_version: "8.4"
 cache:

From fe0bc4082d799ff95d6010e42828af30e65a9666 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 2 Jan 2018 22:38:09 -0500
Subject: [PATCH 1168/1265] build: Node.js@8.9

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 5e18eb6f846..17b7c7cea0f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "5.12"
   - "6.12"
   - "7.10"
-  - "8.4"
+  - "8.9"
 matrix:
   include:
     - node_js: "8"
diff --git a/appveyor.yml b/appveyor.yml
index cd943573ac6..ab65453be3b 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -9,7 +9,7 @@ environment:
     - nodejs_version: "5.12"
     - nodejs_version: "6.12"
     - nodejs_version: "7.10"
-    - nodejs_version: "8.4"
+    - nodejs_version: "8.9"
 cache:
   - node_modules
 install:

From b4020ec92bfa39c6e279b94cfb183472f06fdf83 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Jan 2018 19:09:25 -0500
Subject: [PATCH 1169/1265] build: should@13.2.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 666f141d31c..f1306e578a9 100644
--- a/package.json
+++ b/package.json
@@ -73,7 +73,7 @@
     "morgan": "1.9.0",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",
-    "should": "13.2.0",
+    "should": "13.2.1",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
     "vhost": "~3.0.2"

From 086e56f1c4d9973fdb5eb1e21e79e10d4e002393 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Jan 2018 19:12:34 -0500
Subject: [PATCH 1170/1265] build: marked@0.3.12

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f1306e578a9..8ab44ef3dc8 100644
--- a/package.json
+++ b/package.json
@@ -67,7 +67,7 @@
     "express-session": "1.15.6",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
-    "marked": "0.3.9",
+    "marked": "0.3.12",
     "method-override": "2.3.10",
     "mocha": "3.5.3",
     "morgan": "1.9.0",

From 68e824cbff0cc58643a3f40e99299f600667072d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Jan 2018 19:19:03 -0500
Subject: [PATCH 1171/1265] build: remove Node.js 8 nightly build

---
 .travis.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 17b7c7cea0f..a83b962abe2 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,8 +12,6 @@ node_js:
   - "8.9"
 matrix:
   include:
-    - node_js: "8"
-      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
     - node_js: "9"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:

From f448a9668515077937437d86e9e44421bcf2a093 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Jan 2018 23:46:11 -0500
Subject: [PATCH 1172/1265] deps: depd@~1.1.2

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index fbf59a23413..02ffc65d44b 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: depd@~1.1.2
+    - perf: remove argument reassignment
+
 4.16.2 / 2017-10-09
 ===================
 
diff --git a/package.json b/package.json
index 8ab44ef3dc8..414280f8d92 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,7 @@
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
-    "depd": "~1.1.1",
+    "depd": "~1.1.2",
     "encodeurl": "~1.0.1",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",

From 323572610b292d2351ad4c60c2b7b9ce4d7ad3ac Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 16 Jan 2018 23:50:41 -0500
Subject: [PATCH 1173/1265] deps: encodeurl@~1.0.2

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 02ffc65d44b..fd49c6b359c 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,8 @@ unreleased
 
   * deps: depd@~1.1.2
     - perf: remove argument reassignment
+  * deps: encodeurl@~1.0.2
+    - Fix encoding `%` as last character
 
 4.16.2 / 2017-10-09
 ===================
diff --git a/package.json b/package.json
index 414280f8d92..f9b9a827e26 100644
--- a/package.json
+++ b/package.json
@@ -36,7 +36,7 @@
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "~1.1.2",
-    "encodeurl": "~1.0.1",
+    "encodeurl": "~1.0.2",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",
     "finalhandler": "1.1.0",

From c6f12a897184e614171121dfdb31bdc03859db0b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Jan 2018 00:00:22 -0500
Subject: [PATCH 1174/1265] deps: statuses@~1.4.0

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index fd49c6b359c..cce0fad97ea 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
     - perf: remove argument reassignment
   * deps: encodeurl@~1.0.2
     - Fix encoding `%` as last character
+  * deps: statuses@~1.4.0
 
 4.16.2 / 2017-10-09
 ===================
diff --git a/package.json b/package.json
index f9b9a827e26..4f341832d2f 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "send": "0.16.1",
     "serve-static": "1.13.1",
     "setprototypeof": "1.1.0",
-    "statuses": "~1.3.1",
+    "statuses": "~1.4.0",
     "type-is": "~1.6.15",
     "utils-merge": "1.0.1",
     "vary": "~1.1.2"

From f8fba68ec0e6e986eea4dc3bfe39dbe09dccf5d7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Jan 2018 00:20:15 -0500
Subject: [PATCH 1175/1265] tests: use supertest expect to test body

---
 test/acceptance/error-pages.js | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/test/acceptance/error-pages.js b/test/acceptance/error-pages.js
index 9af950178da..48feb3fb466 100644
--- a/test/acceptance/error-pages.js
+++ b/test/acceptance/error-pages.js
@@ -52,10 +52,7 @@ describe('error-pages', function(){
         request(app)
         .get('/404')
         .set('Accept','application/json')
-        .end(function(err, res){
-          res.body.should.eql({ error: 'Not found' });
-          done()
-        })
+        .expect(404, { error: 'Not found' }, done)
       })
     })
 

From 94a6cbfbfe672e4abb95bebcf266ed5dc65f336d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Jan 2018 00:28:25 -0500
Subject: [PATCH 1176/1265] tests: remove unnecessary functions for supertest

---
 test/req.xhr.js | 20 ++++----------------
 1 file changed, 4 insertions(+), 16 deletions(-)

diff --git a/test/req.xhr.js b/test/req.xhr.js
index 1bbc247104d..94af9170cb3 100644
--- a/test/req.xhr.js
+++ b/test/req.xhr.js
@@ -15,10 +15,7 @@ describe('req', function(){
       request(app)
       .get('/')
       .set('X-Requested-With', 'xmlhttprequest')
-      .expect(200)
-      .end(function(err, res){
-        done(err);
-      })
+      .expect(200, done)
     })
 
     it('should case-insensitive', function(done){
@@ -32,10 +29,7 @@ describe('req', function(){
       request(app)
       .get('/')
       .set('X-Requested-With', 'XMLHttpRequest')
-      .expect(200)
-      .end(function(err, res){
-        done(err);
-      })
+      .expect(200, done)
     })
 
     it('should return false otherwise', function(done){
@@ -49,10 +43,7 @@ describe('req', function(){
       request(app)
       .get('/')
       .set('X-Requested-With', 'blahblah')
-      .expect(200)
-      .end(function(err, res){
-        done(err);
-      })
+      .expect(200, done)
     })
 
     it('should return false when not present', function(done){
@@ -65,10 +56,7 @@ describe('req', function(){
 
       request(app)
       .get('/')
-      .expect(200)
-      .end(function(err, res){
-        done(err);
-      })
+      .expect(200, done)
     })
   })
 })

From 276a80895c6bef11b0819c46525376ad16c68517 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 9 Feb 2018 13:09:25 -0500
Subject: [PATCH 1177/1265] deps: send@0.16.2

---
 History.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index cce0fad97ea..5161e8554c2 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,11 @@ unreleased
     - perf: remove argument reassignment
   * deps: encodeurl@~1.0.2
     - Fix encoding `%` as last character
+  * deps: send@0.16.2
+    - Fix incorrect end tag in default error & redirects
+    - deps: depd@~1.1.2
+    - deps: encodeurl@~1.0.2
+    - deps: statuses@~1.4.0
   * deps: statuses@~1.4.0
 
 4.16.2 / 2017-10-09
diff --git a/package.json b/package.json
index 4f341832d2f..6b2e0b9d861 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "qs": "6.5.1",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",
-    "send": "0.16.1",
+    "send": "0.16.2",
     "serve-static": "1.13.1",
     "setprototypeof": "1.1.0",
     "statuses": "~1.4.0",

From cbaa04629a90aff76774b59cd055ff8c6e642030 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 9 Feb 2018 13:20:09 -0500
Subject: [PATCH 1178/1265] deps: serve-static@1.13.2

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5161e8554c2..756198b4398 100644
--- a/History.md
+++ b/History.md
@@ -10,6 +10,10 @@ unreleased
     - deps: depd@~1.1.2
     - deps: encodeurl@~1.0.2
     - deps: statuses@~1.4.0
+  * deps: serve-static@1.13.2
+    - Fix incorrect end tag in redirects
+    - deps: encodeurl@~1.0.2
+    - deps: send@0.16.2
   * deps: statuses@~1.4.0
 
 4.16.2 / 2017-10-09
diff --git a/package.json b/package.json
index 6b2e0b9d861..b86eb6f1a6f 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",
     "send": "0.16.2",
-    "serve-static": "1.13.1",
+    "serve-static": "1.13.2",
     "setprototypeof": "1.1.0",
     "statuses": "~1.4.0",
     "type-is": "~1.6.15",

From 98b0b66b6c46882c3fa54f04185254ab53b38570 Mon Sep 17 00:00:00 2001
From: Yuta Hiroto <git@about-hiroppy.com>
Date: Tue, 13 Feb 2018 17:26:27 +0900
Subject: [PATCH 1179/1265] build: use yaml eslint configuration

closes #3561
---
 .eslintrc     | 8 --------
 .eslintrc.yml | 7 +++++++
 2 files changed, 7 insertions(+), 8 deletions(-)
 delete mode 100644 .eslintrc
 create mode 100644 .eslintrc.yml

diff --git a/.eslintrc b/.eslintrc
deleted file mode 100644
index ad9c0ce9eb7..00000000000
--- a/.eslintrc
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "rules": {
-    "eol-last": "error",
-    "indent": ["error", 2, { "SwitchCase": 1 }],
-    "no-trailing-spaces": "error",
-    "no-unused-vars": ["error", { "vars": "all", "args": "none", "ignoreRestSiblings": true }]
-  }
-}
diff --git a/.eslintrc.yml b/.eslintrc.yml
new file mode 100644
index 00000000000..1d9b154a6a7
--- /dev/null
+++ b/.eslintrc.yml
@@ -0,0 +1,7 @@
+root: true
+
+rules:
+  eol-last: error
+  indent: [error, 2, { SwitchCase: 1 }]
+  no-trailing-spaces: error
+  no-unused-vars: [error, { vars: all, args: none, ignoreRestSiblings: true }]

From 80e64691e1972dccc79def005190da33c641d51e Mon Sep 17 00:00:00 2001
From: Steven Anthony <stevenanthonyrevo@live.com>
Date: Thu, 28 Dec 2017 23:29:38 -0500
Subject: [PATCH 1180/1265] examples: add full urls to web-service example

closes #3519
---
 examples/web-service/index.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/examples/web-service/index.js b/examples/web-service/index.js
index 5a603a1023f..0e2cbb7cde0 100644
--- a/examples/web-service/index.js
+++ b/examples/web-service/index.js
@@ -69,14 +69,17 @@ var userRepos = {
 // we now can assume the api key is valid,
 // and simply expose the data
 
+// example: http://localhost:3000/api/users/?api-key=foo
 app.get('/api/users', function(req, res, next){
   res.send(users);
 });
 
+// example: http://localhost:3000/api/repos/?api-key=foo
 app.get('/api/repos', function(req, res, next){
   res.send(repos);
 });
 
+// example: http://localhost:3000/api/user/tobi/repos/?api-key=foo
 app.get('/api/user/:name/repos', function(req, res, next){
   var name = req.params.name;
   var user = userRepos[name];

From 972ada9079b715f9e806ef04ec73311fb46bded0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 Feb 2018 17:14:48 -0500
Subject: [PATCH 1181/1265] tests: remove duplicate block in router test

---
 test/Router.js | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/test/Router.js b/test/Router.js
index 057ce443df4..e7b8e713fee 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -7,9 +7,6 @@ var express = require('../')
 
 describe('Router', function(){
   it('should return a function with router methods', function() {
-    var router = Router();
-    assert(typeof router == 'function');
-
     var router = new Router();
     assert(typeof router == 'function');
 

From 40e04ec7a6d365a7e083b0fdf7f9d2c7afc036a0 Mon Sep 17 00:00:00 2001
From: Alejandro Estrada <estrada9166@hotmail.com>
Date: Sun, 21 Jan 2018 20:14:47 -0500
Subject: [PATCH 1182/1265] lint: remove usages of "=="

closes #3540
---
 .eslintrc.yml                      | 1 +
 examples/auth/index.js             | 2 +-
 examples/cookies/index.js          | 2 +-
 examples/error-pages/index.js      | 4 ++--
 examples/error/index.js            | 2 +-
 examples/route-map/index.js        | 2 +-
 examples/route-middleware/index.js | 4 ++--
 examples/search/public/client.js   | 2 +-
 examples/view-locals/index.js      | 2 +-
 test/Router.js                     | 8 ++++----
 test/app.param.js                  | 2 +-
 test/app.router.js                 | 4 ++--
 test/req.signedCookies.js          | 2 +-
 test/res.format.js                 | 6 +++---
 test/res.json.js                   | 2 +-
 test/res.jsonp.js                  | 2 +-
 16 files changed, 24 insertions(+), 23 deletions(-)

diff --git a/.eslintrc.yml b/.eslintrc.yml
index 1d9b154a6a7..5b11e9fd844 100644
--- a/.eslintrc.yml
+++ b/.eslintrc.yml
@@ -2,6 +2,7 @@ root: true
 
 rules:
   eol-last: error
+  eqeqeq: [error, allow-null]
   indent: [error, 2, { SwitchCase: 1 }]
   no-trailing-spaces: error
   no-unused-vars: [error, { vars: all, args: none, ignoreRestSiblings: true }]
diff --git a/examples/auth/index.js b/examples/auth/index.js
index 8df77815e3b..b8e854300cb 100644
--- a/examples/auth/index.js
+++ b/examples/auth/index.js
@@ -65,7 +65,7 @@ function authenticate(name, pass, fn) {
   // found the user
   hash({ password: pass, salt: user.salt }, function (err, pass, salt, hash) {
     if (err) return fn(err);
-    if (hash == user.hash) return fn(null, user);
+    if (hash === user.hash) return fn(null, user)
     fn(new Error('invalid password'));
   });
 }
diff --git a/examples/cookies/index.js b/examples/cookies/index.js
index 34ead527669..93515e59612 100644
--- a/examples/cookies/index.js
+++ b/examples/cookies/index.js
@@ -8,7 +8,7 @@ var logger = require('morgan');
 var cookieParser = require('cookie-parser');
 
 // custom log format
-if ('test' != process.env.NODE_ENV) app.use(logger(':method :url'));
+if (process.env.NODE_ENV !== 'test') app.use(logger(':method :url'))
 
 // parses request cookies, populating
 // req.cookies and req.signedCookies
diff --git a/examples/error-pages/index.js b/examples/error-pages/index.js
index 790f6e30dfd..44333cb08fc 100644
--- a/examples/error-pages/index.js
+++ b/examples/error-pages/index.js
@@ -6,7 +6,7 @@ var express = require('../../');
 var path = require('path');
 var app = module.exports = express();
 var logger = require('morgan');
-var silent = 'test' == process.env.NODE_ENV;
+var silent = process.env.NODE_ENV === 'test'
 
 // general config
 app.set('views', path.join(__dirname, 'views'));
@@ -19,7 +19,7 @@ app.enable('verbose errors');
 
 // disable them in production
 // use $ NODE_ENV=production node examples/error-pages
-if ('production' == app.settings.env) app.disable('verbose errors');
+if (app.settings.env === 'production') app.disable('verbose errors')
 
 silent || app.use(logger('dev'));
 
diff --git a/examples/error/index.js b/examples/error/index.js
index 94b3b4a4da3..07814d85201 100644
--- a/examples/error/index.js
+++ b/examples/error/index.js
@@ -5,7 +5,7 @@
 var express = require('../../');
 var logger = require('morgan');
 var app = module.exports = express();
-var test = app.get('env') == 'test';
+var test = app.get('env') === 'test'
 
 if (!test) app.use(logger('dev'));
 
diff --git a/examples/route-map/index.js b/examples/route-map/index.js
index 9468dd36678..f2b192ac1d9 100644
--- a/examples/route-map/index.js
+++ b/examples/route-map/index.js
@@ -4,7 +4,7 @@
 
 var express = require('../../lib/express');
 
-var verbose = process.env.NODE_ENV != 'test';
+var verbose = process.env.NODE_ENV !== 'test'
 
 var app = module.exports = express();
 
diff --git a/examples/route-middleware/index.js b/examples/route-middleware/index.js
index 2d26a33a0f1..84407318870 100644
--- a/examples/route-middleware/index.js
+++ b/examples/route-middleware/index.js
@@ -34,7 +34,7 @@ function loadUser(req, res, next) {
 function andRestrictToSelf(req, res, next) {
   // If our authenticated user is the user we are viewing
   // then everything is fine :)
-  if (req.authenticatedUser.id == req.user.id) {
+  if (req.authenticatedUser.id === req.user.id) {
     next();
   } else {
     // You may want to implement specific exceptions
@@ -47,7 +47,7 @@ function andRestrictToSelf(req, res, next) {
 
 function andRestrictTo(role) {
   return function(req, res, next) {
-    if (req.authenticatedUser.role == role) {
+    if (req.authenticatedUser.role === role) {
       next();
     } else {
       next(new Error('Unauthorized'));
diff --git a/examples/search/public/client.js b/examples/search/public/client.js
index a7eeb6a75af..75c37d8e00e 100644
--- a/examples/search/public/client.js
+++ b/examples/search/public/client.js
@@ -5,7 +5,7 @@ search.addEventListener('keyup', function(){
   var xhr = new XMLHttpRequest;
   xhr.open('GET', '/search/' + search.value, true);
   xhr.onreadystatechange = function(){
-    if (4 == xhr.readyState) {
+    if (xhr.readyState === 4) {
       code.textContent = xhr.responseText;
     }
   };
diff --git a/examples/view-locals/index.js b/examples/view-locals/index.js
index 3814e6e4962..cb41509606b 100644
--- a/examples/view-locals/index.js
+++ b/examples/view-locals/index.js
@@ -13,7 +13,7 @@ app.set('view engine', 'ejs');
 // filter ferrets only
 
 function ferrets(user) {
-  return user.species == 'ferret';
+  return user.species === 'ferret'
 }
 
 // naive nesting approach,
diff --git a/test/Router.js b/test/Router.js
index e7b8e713fee..47c5e65481a 100644
--- a/test/Router.js
+++ b/test/Router.js
@@ -8,11 +8,11 @@ var express = require('../')
 describe('Router', function(){
   it('should return a function with router methods', function() {
     var router = new Router();
-    assert(typeof router == 'function');
+    assert(typeof router === 'function')
 
-    assert(typeof router.get == 'function');
-    assert(typeof router.handle == 'function');
-    assert(typeof router.use == 'function');
+    assert(typeof router.get === 'function')
+    assert(typeof router.handle === 'function')
+    assert(typeof router.use === 'function')
   });
 
   it('should support .use of other routers', function(done){
diff --git a/test/app.param.js b/test/app.param.js
index ba43e46f8e3..8785567751f 100644
--- a/test/app.param.js
+++ b/test/app.param.js
@@ -8,7 +8,7 @@ describe('app', function(){
       var app = express();
 
       app.param(function(name, regexp){
-        if (Object.prototype.toString.call(regexp) == '[object RegExp]') { // See #1557
+        if (Object.prototype.toString.call(regexp) === '[object RegExp]') { // See #1557
           return function(req, res, next, val){
             var captures;
             if (captures = regexp.exec(String(val))) {
diff --git a/test/app.router.js b/test/app.router.js
index 28561c2fbcd..c4bfc9b952a 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -41,7 +41,7 @@ describe('app.router', function(){
         var app = express();
 
         app[method]('/foo', function(req, res){
-          if ('head' == method) {
+          if (method === 'head') {
             res.end();
           } else {
             res.end(method);
@@ -50,7 +50,7 @@ describe('app.router', function(){
 
         request(app)
         [method]('/foo')
-        .expect('head' == method ? '' : method, done);
+        .expect(method === 'head' ? '' : method, done)
       })
 
       it('should reject numbers for app.' + method, function(){
diff --git a/test/req.signedCookies.js b/test/req.signedCookies.js
index 73880b01b4c..a55f81b22c5 100644
--- a/test/req.signedCookies.js
+++ b/test/req.signedCookies.js
@@ -11,7 +11,7 @@ describe('req', function(){
       app.use(cookieParser('secret'));
 
       app.use(function(req, res){
-        if ('/set' == req.path) {
+        if (req.path === '/set') {
           res.cookie('obj', { foo: 'bar' }, { signed: true });
           res.end();
         } else {
diff --git a/test/res.format.js b/test/res.format.js
index 1c1d077e587..076b78d7386 100644
--- a/test/res.format.js
+++ b/test/res.format.js
@@ -17,9 +17,9 @@ app1.use(function(req, res, next){
     },
 
     'application/json': function(a, b, c){
-      assert(req == a);
-      assert(res == b);
-      assert(next == c);
+      assert(req === a)
+      assert(res === b)
+      assert(next === c)
       res.send({ message: 'hey' });
     }
   });
diff --git a/test/res.json.js b/test/res.json.js
index 1041376235c..a82a127546e 100644
--- a/test/res.json.js
+++ b/test/res.json.js
@@ -129,7 +129,7 @@ describe('res', function(){
         var app = express();
 
         app.set('json replacer', function(key, val){
-          return '_' == key[0]
+          return key[0] === '_'
             ? undefined
             : val;
         });
diff --git a/test/res.jsonp.js b/test/res.jsonp.js
index 9b536b541f2..40dba100f92 100644
--- a/test/res.jsonp.js
+++ b/test/res.jsonp.js
@@ -269,7 +269,7 @@ describe('res', function(){
         var app = express();
 
         app.set('json replacer', function(key, val){
-          return '_' == key[0]
+          return key[0] === '_'
             ? undefined
             : val;
         });

From f3c5f7ee29e9b935e95e628e002ee9eaebda176a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 13 Feb 2018 21:21:26 -0500
Subject: [PATCH 1183/1265] build: test against Node.js 10.x nightly

---
 .travis.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index a83b962abe2..edde93bcf0f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,6 +14,8 @@ matrix:
   include:
     - node_js: "9"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
+    - node_js: "10"
+      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
     # Allow the nightly installs to fail
     - env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"

From 0083372bed2df35abf56ac882bd42f01bd6cff39 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 26 Feb 2018 23:18:07 -0500
Subject: [PATCH 1184/1265] deps: proxy-addr@~2.0.3

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 756198b4398..21e9d7e7276 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,8 @@ unreleased
     - perf: remove argument reassignment
   * deps: encodeurl@~1.0.2
     - Fix encoding `%` as last character
+  * deps: proxy-addr@~2.0.3
+    - deps: ipaddr.js@1.6.0
   * deps: send@0.16.2
     - Fix incorrect end tag in default error & redirects
     - deps: depd@~1.1.2
diff --git a/package.json b/package.json
index b86eb6f1a6f..0c4277e33c8 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.2",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~2.0.2",
+    "proxy-addr": "~2.0.3",
     "qs": "6.5.1",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",

From e69a29d9c2a425ad10be08833c099a1cfede010a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 28 Feb 2018 19:55:34 -0500
Subject: [PATCH 1185/1265] deps: type-is@~1.6.16

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 21e9d7e7276..9048f7caa49 100644
--- a/History.md
+++ b/History.md
@@ -17,6 +17,8 @@ unreleased
     - deps: encodeurl@~1.0.2
     - deps: send@0.16.2
   * deps: statuses@~1.4.0
+  * deps: type-is@~1.6.16
+    - deps: mime-types@~2.1.18
 
 4.16.2 / 2017-10-09
 ===================
diff --git a/package.json b/package.json
index 0c4277e33c8..f8067410db6 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,7 @@
     "serve-static": "1.13.2",
     "setprototypeof": "1.1.0",
     "statuses": "~1.4.0",
-    "type-is": "~1.6.15",
+    "type-is": "~1.6.16",
     "utils-merge": "1.0.1",
     "vary": "~1.1.2"
   },

From 0e88dceac2b86fbc066cd0f042d093e838604d0d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 28 Feb 2018 23:44:00 -0500
Subject: [PATCH 1186/1265] deps: accepts@~1.3.5

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 9048f7caa49..b2d3af1cbdd 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,8 @@
 unreleased
 ==========
 
+  * deps: accepts@~1.3.5
+    - deps: mime-types@~2.1.18
   * deps: depd@~1.1.2
     - perf: remove argument reassignment
   * deps: encodeurl@~1.0.2
diff --git a/package.json b/package.json
index f8067410db6..f6d45ffbab3 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.3.4",
+    "accepts": "~1.3.5",
     "array-flatten": "1.1.1",
     "body-parser": "1.18.2",
     "content-disposition": "0.5.2",

From d3bdc3b66399424f8b315d0808b5fbb3834144c2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Mar 2018 11:17:26 -0400
Subject: [PATCH 1187/1265] build: marked@0.3.17

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f6d45ffbab3..5a377805510 100644
--- a/package.json
+++ b/package.json
@@ -67,7 +67,7 @@
     "express-session": "1.15.6",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
-    "marked": "0.3.12",
+    "marked": "0.3.17",
     "method-override": "2.3.10",
     "mocha": "3.5.3",
     "morgan": "1.9.0",

From 76bf96e9ce3369d2f9329adefb9ac75407f93493 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Mar 2018 11:20:19 -0400
Subject: [PATCH 1188/1265] deps: finalhandler@1.1.1

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index b2d3af1cbdd..956fc8571fe 100644
--- a/History.md
+++ b/History.md
@@ -7,6 +7,10 @@ unreleased
     - perf: remove argument reassignment
   * deps: encodeurl@~1.0.2
     - Fix encoding `%` as last character
+  * deps: finalhandler@1.1.1
+    - Fix 404 output for bad / missing pathnames
+    - deps: encodeurl@~1.0.2
+    - deps: statuses@~1.4.0
   * deps: proxy-addr@~2.0.3
     - deps: ipaddr.js@1.6.0
   * deps: send@0.16.2
diff --git a/package.json b/package.json
index 5a377805510..a203b81b236 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "encodeurl": "~1.0.2",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",
-    "finalhandler": "1.1.0",
+    "finalhandler": "1.1.1",
     "fresh": "0.5.2",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",

From 3ed5090ca91f6a387e66370d57ead94d886275e1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Mar 2018 13:38:44 -0400
Subject: [PATCH 1189/1265] 4.16.3

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 956fc8571fe..e02fcd5bf9e 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.16.3 / 2018-03-12
+===================
 
   * deps: accepts@~1.3.5
     - deps: mime-types@~2.1.18
diff --git a/package.json b/package.json
index a203b81b236..7aa0f95b3ac 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.16.2",
+  "version": "4.16.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From 02c753583eddabae2691b09a7babd747d449ca5f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Jun 2018 23:50:03 -0400
Subject: [PATCH 1190/1265] build: Node.js@4.9

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index edde93bcf0f..af0c01ad535 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -5,7 +5,7 @@ node_js:
   - "1.8"
   - "2.5"
   - "3.3"
-  - "4.8"
+  - "4.9"
   - "5.12"
   - "6.12"
   - "7.10"
diff --git a/appveyor.yml b/appveyor.yml
index ab65453be3b..5deb61cea33 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -5,7 +5,7 @@ environment:
     - nodejs_version: "1.8"
     - nodejs_version: "2.5"
     - nodejs_version: "3.3"
-    - nodejs_version: "4.8"
+    - nodejs_version: "4.9"
     - nodejs_version: "5.12"
     - nodejs_version: "6.12"
     - nodejs_version: "7.10"

From 3d8ca8ad4aa0ad03ce2e4b27f6773d47e4fea201 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 7 Jun 2018 00:04:28 -0400
Subject: [PATCH 1191/1265] build: Node.js@6.14

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index af0c01ad535..5c85496d1da 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,7 +7,7 @@ node_js:
   - "3.3"
   - "4.9"
   - "5.12"
-  - "6.12"
+  - "6.14"
   - "7.10"
   - "8.9"
 matrix:
diff --git a/appveyor.yml b/appveyor.yml
index 5deb61cea33..5c8161fa75a 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -7,7 +7,7 @@ environment:
     - nodejs_version: "3.3"
     - nodejs_version: "4.9"
     - nodejs_version: "5.12"
-    - nodejs_version: "6.12"
+    - nodejs_version: "6.14"
     - nodejs_version: "7.10"
     - nodejs_version: "8.9"
 cache:

From ac89f6f121cbd17c957e8e493615c33e7f0f2687 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 7 Jun 2018 00:12:07 -0400
Subject: [PATCH 1192/1265] build: Node.js@8.11

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 5c85496d1da..acfb87c2065 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "5.12"
   - "6.14"
   - "7.10"
-  - "8.9"
+  - "8.11"
 matrix:
   include:
     - node_js: "9"
diff --git a/appveyor.yml b/appveyor.yml
index 5c8161fa75a..e5e653abe67 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -9,7 +9,7 @@ environment:
     - nodejs_version: "5.12"
     - nodejs_version: "6.14"
     - nodejs_version: "7.10"
-    - nodejs_version: "8.9"
+    - nodejs_version: "8.11"
 cache:
   - node_modules
 install:

From f95dbc28fdb483dbd45b436386cf0db77322eb43 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 31 Jul 2018 17:09:27 -0400
Subject: [PATCH 1193/1265] build: should@13.2.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 7aa0f95b3ac..cf38858b5c1 100644
--- a/package.json
+++ b/package.json
@@ -73,7 +73,7 @@
     "morgan": "1.9.0",
     "multiparty": "4.1.3",
     "pbkdf2-password": "1.2.1",
-    "should": "13.2.1",
+    "should": "13.2.3",
     "supertest": "1.2.0",
     "connect-redis": "~2.4.1",
     "vhost": "~3.0.2"

From c39d7d933968b3cc03c6bf473920b8d5f24f7f43 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 13 Sep 2018 12:23:38 -0400
Subject: [PATCH 1194/1265] build: Node.js@8.12

---
 .travis.yml  | 2 +-
 appveyor.yml | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index acfb87c2065..239e8071d12 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "5.12"
   - "6.14"
   - "7.10"
-  - "8.11"
+  - "8.12"
 matrix:
   include:
     - node_js: "9"
diff --git a/appveyor.yml b/appveyor.yml
index e5e653abe67..6e77e88bcdd 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -9,11 +9,13 @@ environment:
     - nodejs_version: "5.12"
     - nodejs_version: "6.14"
     - nodejs_version: "7.10"
-    - nodejs_version: "8.11"
+    - nodejs_version: "8.12"
 cache:
   - node_modules
 install:
-  - ps: Install-Product node $env:nodejs_version
+  - ps: >-
+      try { Install-Product node $env:nodejs_version -ErrorAction Stop }
+      catch { Update-NodeJsInstallation (Get-NodeJsLatestBuild $env:nodejs_version) }
   - npm config set shrinkwrap false
   - npm rm --save-dev connect-redis
   - if exist node_modules npm prune

From d5b33cfad8efedc42ec36cab2ced75c2cfd99dce Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 13 Sep 2018 12:26:36 -0400
Subject: [PATCH 1195/1265] build: update example dependencies

---
 package.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index cf38858b5c1..0b87ae7657d 100644
--- a/package.json
+++ b/package.json
@@ -62,16 +62,16 @@
     "after": "0.8.2",
     "cookie-parser": "~1.4.3",
     "cookie-session": "1.3.2",
-    "ejs": "2.5.7",
+    "ejs": "2.6.1",
     "eslint": "2.13.1",
     "express-session": "1.15.6",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
-    "marked": "0.3.17",
-    "method-override": "2.3.10",
+    "marked": "0.5.0",
+    "method-override": "3.0.0",
     "mocha": "3.5.3",
-    "morgan": "1.9.0",
-    "multiparty": "4.1.3",
+    "morgan": "1.9.1",
+    "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",
     "should": "13.2.3",
     "supertest": "1.2.0",

From ede24da9645ed771ddeb9cf327d042d35a31d42d Mon Sep 17 00:00:00 2001
From: Logan Ripplinger <logan.ripplinger@gmail.com>
Date: Tue, 14 Aug 2018 18:41:14 -0700
Subject: [PATCH 1196/1265] examples: fix typo in multi-router example

closes #3718
---
 examples/multi-router/index.js  | 2 +-
 test/acceptance/multi-router.js | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/multi-router/index.js b/examples/multi-router/index.js
index ff31e514a56..78bae9d6e36 100644
--- a/examples/multi-router/index.js
+++ b/examples/multi-router/index.js
@@ -6,7 +6,7 @@ app.use('/api/v1', require('./controllers/api_v1'));
 app.use('/api/v2', require('./controllers/api_v2'));
 
 app.get('/', function(req, res) {
-  res.send('Hello form root route.');
+  res.send('Hello from root route.')
 });
 
 /* istanbul ignore next */
diff --git a/test/acceptance/multi-router.js b/test/acceptance/multi-router.js
index 9590ee94d41..4362a8300be 100644
--- a/test/acceptance/multi-router.js
+++ b/test/acceptance/multi-router.js
@@ -6,7 +6,7 @@ describe('multi-router', function(){
     it('should respond with root handler', function(done){
       request(app)
       .get('/')
-      .expect(200, 'Hello form root route.', done)
+      .expect(200, 'Hello from root route.', done)
     })
   })
 

From f3fa758af9664526ee18c58764590e48f559e6ae Mon Sep 17 00:00:00 2001
From: Andreas Kohn <andreas.kohn@gmail.com>
Date: Sat, 26 May 2018 21:58:15 +0200
Subject: [PATCH 1197/1265] Fix JSDoc for Router constructor

fixes #3598
fixes #3599
fixes #3698
---
 History.md          | 5 +++++
 lib/router/index.js | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e02fcd5bf9e..9295b05feb6 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix JSDoc for `Router` constructor
+
 4.16.3 / 2018-03-12
 ===================
 
diff --git a/lib/router/index.js b/lib/router/index.js
index 60727ed6d64..69e6d3800af 100644
--- a/lib/router/index.js
+++ b/lib/router/index.js
@@ -35,7 +35,7 @@ var toString = Object.prototype.toString;
 /**
  * Initialize a new `Router` with the given `options`.
  *
- * @param {Object} options
+ * @param {Object} [options]
  * @return {Router} which is an callable function
  * @public
  */

From 431f65305eb78eba337356ec7637e4ee13d84195 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Linus=20Unneb=C3=A4ck?= <linus@folkdatorn.se>
Date: Wed, 27 Jun 2018 10:40:56 +0200
Subject: [PATCH 1198/1265] lint: move removed middlewares list to a variable

closes #3558
closes #3677
closes #3678
---
 lib/express.js | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/lib/express.js b/lib/express.js
index 485a8fc08de..594007b5b43 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -84,7 +84,7 @@ exports.urlencoded = bodyParser.urlencoded
  * Replace removed middleware with an appropriate error message.
  */
 
-;[
+var removedMiddlewares = [
   'bodyParser',
   'compress',
   'cookieSession',
@@ -101,8 +101,10 @@ exports.urlencoded = bodyParser.urlencoded
   'directory',
   'limit',
   'multipart',
-  'staticCache',
-].forEach(function (name) {
+  'staticCache'
+]
+
+removedMiddlewares.forEach(function (name) {
   Object.defineProperty(exports, name, {
     get: function () {
       throw new Error('Most middleware (like ' + name + ') is no longer bundled with Express and must be installed separately. Please see https://github.com/senchalabs/connect#middleware.');

From b4eb1f59d39d801d7365c86b04500f16faeb0b1c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 18 Sep 2018 21:56:31 -0400
Subject: [PATCH 1199/1265] deps: qs@6.5.2

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 9295b05feb6..eda6c4d76f3 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Fix JSDoc for `Router` constructor
+  * deps: qs@6.5.2
 
 4.16.3 / 2018-03-12
 ===================
diff --git a/package.json b/package.json
index 0b87ae7657d..1e10d5534ec 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
     "parseurl": "~1.3.2",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~2.0.3",
-    "qs": "6.5.1",
+    "qs": "6.5.2",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",
     "send": "0.16.2",

From b8fb6a7fb1af155b1259d25418dc807112e02138 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felix=20Bu=CC=88nemann?= <buenemann@louis.info>
Date: Tue, 15 May 2018 23:45:17 +0200
Subject: [PATCH 1200/1265] deps: body-parser@1.18.3

closes #3655
closes #3706
---
 History.md   | 9 +++++++++
 package.json | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index eda6c4d76f3..bc77d81ed9e 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,15 @@ unreleased
 ==========
 
   * Fix JSDoc for `Router` constructor
+  * deps: body-parser@1.18.3
+    - Fix deprecation warnings on Node.js 10+
+    - Fix stack trace for strict json parse error
+    - deps: depd@~1.1.2
+    - deps: http-errors@~1.6.3
+    - deps: iconv-lite@0.4.23
+    - deps: qs@6.5.2
+    - deps: raw-body@2.3.3
+    - deps: type-is@~1.6.16
   * deps: qs@6.5.2
 
 4.16.3 / 2018-03-12
diff --git a/package.json b/package.json
index 1e10d5534ec..3b6eac1187b 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
   "dependencies": {
     "accepts": "~1.3.5",
     "array-flatten": "1.1.1",
-    "body-parser": "1.18.2",
+    "body-parser": "1.18.3",
     "content-disposition": "0.5.2",
     "content-type": "~1.0.4",
     "cookie": "0.3.1",

From 4480fb997e9132a8b1e8b23d1a2766d27a918909 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 Sep 2018 12:40:40 -0400
Subject: [PATCH 1201/1265] deps: proxy-addr@~2.0.4

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index bc77d81ed9e..d7b08c54484 100644
--- a/History.md
+++ b/History.md
@@ -11,6 +11,8 @@ unreleased
     - deps: qs@6.5.2
     - deps: raw-body@2.3.3
     - deps: type-is@~1.6.16
+  * deps: proxy-addr@~2.0.4
+    - deps: ipaddr.js@1.8.0
   * deps: qs@6.5.2
 
 4.16.3 / 2018-03-12
diff --git a/package.json b/package.json
index 3b6eac1187b..a0da2a7320a 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.2",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~2.0.3",
+    "proxy-addr": "~2.0.4",
     "qs": "6.5.2",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.1",

From 5de1a08ebff4c33d0c452510217193905f34cbe9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 Sep 2018 14:06:22 -0400
Subject: [PATCH 1202/1265] build: supertest@2.0.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index a0da2a7320a..8bc9069a8fc 100644
--- a/package.json
+++ b/package.json
@@ -74,7 +74,7 @@
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",
     "should": "13.2.3",
-    "supertest": "1.2.0",
+    "supertest": "2.0.0",
     "connect-redis": "~2.4.1",
     "vhost": "~3.0.2"
   },

From 5e9de5dcb6f1ff396038ded11951aa53c62a07a4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 Sep 2018 14:47:48 -0400
Subject: [PATCH 1203/1265] deps: safe-buffer@5.1.2

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index d7b08c54484..ef1733fc26e 100644
--- a/History.md
+++ b/History.md
@@ -14,6 +14,7 @@ unreleased
   * deps: proxy-addr@~2.0.4
     - deps: ipaddr.js@1.8.0
   * deps: qs@6.5.2
+  * deps: safe-buffer@5.1.2
 
 4.16.3 / 2018-03-12
 ===================
diff --git a/package.json b/package.json
index 8bc9069a8fc..45faac1c6ba 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "proxy-addr": "~2.0.4",
     "qs": "6.5.2",
     "range-parser": "~1.2.0",
-    "safe-buffer": "5.1.1",
+    "safe-buffer": "5.1.2",
     "send": "0.16.2",
     "serve-static": "1.13.2",
     "setprototypeof": "1.1.0",

From 3d10279826f59bf68e28995ce423f7bc4d2f11cf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 Sep 2018 23:25:16 -0400
Subject: [PATCH 1204/1265] Fix issue where "Request aborted" may be logged in
 res.sendfile

---
 History.md           |  1 +
 lib/response.js      |  2 +-
 test/res.sendFile.js | 26 +++++++++++++++++---------
 3 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/History.md b/History.md
index ef1733fc26e..2d902e94d61 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix issue where `"Request aborted"` may be logged in `res.sendfile`
   * Fix JSDoc for `Router` constructor
   * deps: body-parser@1.18.3
     - Fix deprecation warnings on Node.js 10+
diff --git a/lib/response.js b/lib/response.js
index 9c1796d37b3..2e445ac02c5 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -500,7 +500,7 @@ res.sendfile = function (path, options, callback) {
     if (err && err.code === 'EISDIR') return next();
 
     // next() all but write errors
-    if (err && err.code !== 'ECONNABORT' && err.syscall !== 'write') {
+    if (err && err.code !== 'ECONNABORTED' && err.syscall !== 'write') {
       next(err);
     }
   });
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index ccec3f40cfe..46cf98bd3b9 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -96,25 +96,29 @@ describe('res', function(){
     })
 
     it('should not error if the client aborts', function (done) {
-      var cb = after(1, done);
       var app = express();
+      var cb = after(2, done)
+      var error = null
 
       app.use(function (req, res) {
         setImmediate(function () {
           res.sendFile(path.resolve(fixtures, 'name.txt'));
           server.close(cb)
-        });
+          setTimeout(function () {
+            cb(error)
+          }, 10)
+        })
         test.abort();
       });
 
       app.use(function (err, req, res, next) {
-        err.code.should.be.empty()
-        cb();
+        error = err
+        next(err)
       });
 
       var server = app.listen()
       var test = request(server).get('/')
-      test.expect(200, cb);
+      test.end()
     })
 
     describe('with "cacheControl" option', function () {
@@ -628,25 +632,29 @@ describe('res', function(){
     });
 
     it('should not error if the client aborts', function (done) {
-      var cb = after(1, done);
       var app = express();
+      var cb = after(2, done)
+      var error = null
 
       app.use(function (req, res) {
         setImmediate(function () {
           res.sendfile(path.resolve(fixtures, 'name.txt'));
           server.close(cb)
+          setTimeout(function () {
+            cb(error)
+          }, 10)
         });
         test.abort();
       });
 
       app.use(function (err, req, res, next) {
-        err.code.should.be.empty()
-        cb();
+        error = err
+        next(err)
       });
 
       var server = app.listen()
       var test = request(server).get('/')
-      test.expect(200, cb);
+      test.end()
     })
 
     describe('with an absolute path', function(){

From 09d5654488f707db2ee05e0358bb74caa44fed91 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 21 Sep 2018 23:01:22 -0400
Subject: [PATCH 1205/1265] build: restructure CI build steps

---
 .travis.yml  | 32 ++++++++++++++++++++++----------
 appveyor.yml | 29 +++++++++++++++++++++++------
 2 files changed, 45 insertions(+), 16 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 239e8071d12..cd312691a22 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -24,16 +24,28 @@ cache:
   directories:
     - node_modules
 before_install:
-  # Skip updating shrinkwrap / lock
-  - "npm config set shrinkwrap false"
-
+  # Configure npm
+  - |
+    # Skip updating shrinkwrap / lock
+    npm config set shrinkwrap false
   # Remove all non-test dependencies
-  - "npm rm --save-dev connect-redis"
-
+  - |
+    # Remove example dependencies
+    npm rm --silent --save-dev connect-redis
   # Update Node.js modules
-  - "test ! -d node_modules || npm prune"
-  - "test ! -d node_modules || npm rebuild"
+  - |
+    # Prune and rebuild node_modules
+    if [[ -d node_modules ]]; then
+      npm prune
+      npm rebuild
+    fi
 script:
-  - "npm run test-ci"
-  - "npm run lint"
-after_script: "npm install coveralls@2.10.0 && cat ./coverage/lcov.info | coveralls"
+  # Run test script
+  - npm run test-ci
+  # Run linting
+  - npm run lint
+after_script:
+  - |
+    # Upload coverage to coveralls
+    npm install --save-dev coveralls@2.10.0
+    coveralls < ./coverage/lcov.info
diff --git a/appveyor.yml b/appveyor.yml
index 6e77e88bcdd..fd5dcea0a6d 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -13,18 +13,35 @@ environment:
 cache:
   - node_modules
 install:
+  # Install Node.js
   - ps: >-
       try { Install-Product node $env:nodejs_version -ErrorAction Stop }
       catch { Update-NodeJsInstallation (Get-NodeJsLatestBuild $env:nodejs_version) }
-  - npm config set shrinkwrap false
-  - npm rm --save-dev connect-redis
-  - if exist node_modules npm prune
-  - if exist node_modules npm rebuild
+  # Configure npm
+  - ps: |
+      # Skip updating shrinkwrap / lock
+      npm config set shrinkwrap false
+  # Remove all non-test dependencies
+  - ps: |
+      # Remove example dependencies
+      npm rm --silent --save-dev connect-redis
+  # Update Node.js modules
+  - ps: |
+      # Prune & rebuild node_modules
+      if (Test-Path -Path node_modules) {
+        npm prune
+        npm rebuild
+      }
+  # Install Node.js modules
   - npm install
 build: off
 test_script:
-  - node --version
-  - npm --version
+  # Output version data
+  - ps: |
+      node --version
+      npm --version
+  # Run test script
   - npm run test-ci
+  # Run linting
   - npm run lint
 version: "{build}"

From f07f368fba5d91a5a80bff80c360bd5d66ed8116 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 21 Sep 2018 23:16:17 -0400
Subject: [PATCH 1206/1265] build: mocha@5.2.0

---
 .travis.yml     |  7 +++++++
 appveyor.yml    |  7 +++++++
 package.json    | 10 +++++-----
 test/mocha.opts |  1 -
 4 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index cd312691a22..a4f644190a5 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -32,6 +32,13 @@ before_install:
   - |
     # Remove example dependencies
     npm rm --silent --save-dev connect-redis
+  # Setup Node.js version-specific dependencies
+  - |
+    # mocha for testing
+    # - use 3.x for Node.js < 6
+    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 6 ]]; then
+      npm install --silent --save-dev mocha@3.5.3
+    fi
   # Update Node.js modules
   - |
     # Prune and rebuild node_modules
diff --git a/appveyor.yml b/appveyor.yml
index fd5dcea0a6d..bb954116f16 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -25,6 +25,13 @@ install:
   - ps: |
       # Remove example dependencies
       npm rm --silent --save-dev connect-redis
+  # Setup Node.js version-specific dependencies
+  - ps: |
+      # mocha for testing
+      # - use 3.x for Node.js < 6
+      if ($env:nodejs_version.split(".")[0] -lt 6) {
+        npm install --silent --save-dev mocha@3.5.3
+      }
   # Update Node.js modules
   - ps: |
       # Prune & rebuild node_modules
diff --git a/package.json b/package.json
index 45faac1c6ba..bbd79fbf887 100644
--- a/package.json
+++ b/package.json
@@ -69,7 +69,7 @@
     "istanbul": "0.4.5",
     "marked": "0.5.0",
     "method-override": "3.0.0",
-    "mocha": "3.5.3",
+    "mocha": "5.2.0",
     "morgan": "1.9.1",
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",
@@ -90,9 +90,9 @@
   ],
   "scripts": {
     "lint": "eslint .",
-    "test": "mocha --require test/support/env --reporter spec --bail --check-leaks --no-exit test/ test/acceptance/",
-    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks --no-exit test/ test/acceptance/",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks --no-exit test/ test/acceptance/",
-    "test-tap": "mocha --require test/support/env --reporter tap --check-leaks --no-exit test/ test/acceptance/"
+    "test": "mocha --require test/support/env --reporter spec --bail --check-leaks test/ test/acceptance/",
+    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
+    "test-tap": "mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/"
   }
 }
diff --git a/test/mocha.opts b/test/mocha.opts
index 24d45f5902f..1e065ec52d9 100644
--- a/test/mocha.opts
+++ b/test/mocha.opts
@@ -1,3 +1,2 @@
 --require should
 --slow 20
---growl

From 451ee5d9c17b8abd6859b939a5edfa083a61127d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 24 Sep 2018 23:40:21 -0400
Subject: [PATCH 1207/1265] build: supertest@3.3.0

---
 .travis.yml          |  6 ++++++
 appveyor.yml         |  6 ++++++
 package.json         |  2 +-
 test/app.router.js   |  8 ++------
 test/res.download.js | 13 ++++++++++++-
 test/res.redirect.js | 15 +++++++++++++--
 test/res.send.js     | 24 ++++++++++++++++++++++--
 test/res.sendFile.js | 19 +++++++++++++++++--
 8 files changed, 79 insertions(+), 14 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index a4f644190a5..ebeed7008dd 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -39,6 +39,12 @@ before_install:
     if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 6 ]]; then
       npm install --silent --save-dev mocha@3.5.3
     fi
+  - |
+    # supertest for http calls
+    # - use 2.0.0 for Node.js < 4
+    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 4 ]]; then
+      npm install --silent --save-dev supertest@2.0.0
+    fi
   # Update Node.js modules
   - |
     # Prune and rebuild node_modules
diff --git a/appveyor.yml b/appveyor.yml
index bb954116f16..fc3582e4a5a 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -32,6 +32,12 @@ install:
       if ($env:nodejs_version.split(".")[0] -lt 6) {
         npm install --silent --save-dev mocha@3.5.3
       }
+  - ps: |
+      # supertest for http calls
+      # - use 2.0.0 for Node.js < 4
+      if ($env:nodejs_version.split(".")[0] -lt 4) {
+        npm install --silent --save-dev supertest@2.0.0
+      }
   # Update Node.js modules
   - ps: |
       # Prune & rebuild node_modules
diff --git a/package.json b/package.json
index bbd79fbf887..2ffd015a6a0 100644
--- a/package.json
+++ b/package.json
@@ -74,7 +74,7 @@
     "multiparty": "4.2.1",
     "pbkdf2-password": "1.2.1",
     "should": "13.2.3",
-    "supertest": "2.0.0",
+    "supertest": "3.3.0",
     "connect-redis": "~2.4.1",
     "vhost": "~3.0.2"
   },
diff --git a/test/app.router.js b/test/app.router.js
index c4bfc9b952a..a6c8cef202a 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -41,16 +41,12 @@ describe('app.router', function(){
         var app = express();
 
         app[method]('/foo', function(req, res){
-          if (method === 'head') {
-            res.end();
-          } else {
-            res.end(method);
-          }
+          res.send(method)
         });
 
         request(app)
         [method]('/foo')
-        .expect(method === 'head' ? '' : method, done)
+        .expect(200, done)
       })
 
       it('should reject numbers for app.' + method, function(){
diff --git a/test/res.download.js b/test/res.download.js
index 30215bf6764..084b3c7164d 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -1,6 +1,7 @@
 
 var after = require('after');
 var assert = require('assert');
+var Buffer = require('safe-buffer').Buffer
 var express = require('..');
 var request = require('supertest');
 
@@ -104,7 +105,7 @@ describe('res', function(){
       .expect(200)
       .expect('Content-Disposition', 'attachment; filename="document"')
       .expect('Cache-Control', 'public, max-age=14400')
-      .expect('tobi')
+      .expect(shouldHaveBody(Buffer.from('tobi')))
       .end(done)
     })
 
@@ -185,6 +186,16 @@ describe('res', function(){
   })
 })
 
+function shouldHaveBody (buf) {
+  return function (res) {
+    var body = !Buffer.isBuffer(res.body)
+      ? Buffer.from(res.text)
+      : res.body
+    assert.ok(body, 'response has body')
+    assert.strictEqual(body.toString('hex'), buf.toString('hex'))
+  }
+}
+
 function shouldNotHaveHeader(header) {
   return function (res) {
     assert.ok(!(header.toLowerCase() in res.headers), 'should not have header ' + header);
diff --git a/test/res.redirect.js b/test/res.redirect.js
index 755bb1c1c6c..c07df5dd2c4 100644
--- a/test/res.redirect.js
+++ b/test/res.redirect.js
@@ -1,4 +1,5 @@
 
+var assert = require('assert')
 var express = require('..');
 var request = require('supertest');
 var utils = require('./support/utils');
@@ -85,8 +86,10 @@ describe('res', function(){
 
       request(app)
       .head('/')
+      .expect(302)
       .expect('Location', 'http://google.com')
-      .expect(302, '', done)
+      .expect(shouldNotHaveBody())
+      .end(done)
     })
   })
 
@@ -197,10 +200,18 @@ describe('res', function(){
       request(app)
       .get('/')
       .set('Accept', 'application/octet-stream')
+      .expect(302)
       .expect('location', 'http://google.com')
       .expect('content-length', '0')
       .expect(utils.shouldNotHaveHeader('Content-Type'))
-      .expect(302, '', done)
+      .expect(shouldNotHaveBody())
+      .end(done)
     })
   })
 })
+
+function shouldNotHaveBody () {
+  return function (res) {
+    assert.ok(res.text === '' || res.text === undefined)
+  }
+}
diff --git a/test/res.send.js b/test/res.send.js
index 13658fe6b01..b836b5e4dcb 100644
--- a/test/res.send.js
+++ b/test/res.send.js
@@ -188,8 +188,10 @@ describe('res', function(){
 
       request(app)
       .get('/')
+      .expect(200)
       .expect('Content-Type', 'application/octet-stream')
-      .expect(200, 'hello', done);
+      .expect(shouldHaveBody(Buffer.from('hello')))
+      .end(done)
     })
 
     it('should set ETag', function (done) {
@@ -257,7 +259,9 @@ describe('res', function(){
 
       request(app)
       .head('/')
-      .expect('', done);
+      .expect(200)
+      .expect(shouldNotHaveBody())
+      .end(done)
     })
   })
 
@@ -573,3 +577,19 @@ describe('res', function(){
     })
   })
 })
+
+function shouldHaveBody (buf) {
+  return function (res) {
+    var body = !Buffer.isBuffer(res.body)
+      ? Buffer.from(res.text)
+      : res.body
+    assert.ok(body, 'response has body')
+    assert.strictEqual(body.toString('hex'), buf.toString('hex'))
+  }
+}
+
+function shouldNotHaveBody () {
+  return function (res) {
+    assert.ok(res.text === '' || res.text === undefined)
+  }
+}
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index 46cf98bd3b9..d7585b7704c 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -1,5 +1,6 @@
 
 var after = require('after');
+var Buffer = require('safe-buffer').Buffer
 var express = require('../')
   , request = require('supertest')
   , assert = require('assert');
@@ -155,7 +156,9 @@ describe('res', function(){
 
         request(app)
         .get('/')
-        .expect(200, 'tobi', done);
+        .expect(200)
+        .expect(shouldHaveBody(Buffer.from('tobi')))
+        .end(done)
       });
     });
 
@@ -548,7 +551,9 @@ describe('res', function(){
 
       request(app)
       .get('/')
-      .expect(200, 'tobi', done);
+      .expect(200)
+      .expect(shouldHaveBody(Buffer.from('tobi')))
+      .end(done)
     })
 
     it('should accept headers option', function(done){
@@ -801,3 +806,13 @@ function createApp(path, options, fn) {
 
   return app;
 }
+
+function shouldHaveBody (buf) {
+  return function (res) {
+    var body = !Buffer.isBuffer(res.body)
+      ? Buffer.from(res.text)
+      : res.body
+    assert.ok(body, 'response has body')
+    assert.strictEqual(body.toString('hex'), buf.toString('hex'))
+  }
+}

From 62a59b6ace6c1cb34f9adf2d433ac57d3c826ce4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 27 Sep 2018 18:09:27 -0400
Subject: [PATCH 1208/1265] build: update example dependencies

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 2ffd015a6a0..6118573572f 100644
--- a/package.json
+++ b/package.json
@@ -60,6 +60,7 @@
   },
   "devDependencies": {
     "after": "0.8.2",
+    "connect-redis": "3.4.0",
     "cookie-parser": "~1.4.3",
     "cookie-session": "1.3.2",
     "ejs": "2.6.1",
@@ -67,7 +68,7 @@
     "express-session": "1.15.6",
     "hbs": "4.0.1",
     "istanbul": "0.4.5",
-    "marked": "0.5.0",
+    "marked": "0.5.1",
     "method-override": "3.0.0",
     "mocha": "5.2.0",
     "morgan": "1.9.1",
@@ -75,7 +76,6 @@
     "pbkdf2-password": "1.2.1",
     "should": "13.2.3",
     "supertest": "3.3.0",
-    "connect-redis": "~2.4.1",
     "vhost": "~3.0.2"
   },
   "engines": {

From dc538f6e810bd462c98ee7e6aae24c64d4b1da93 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Oct 2018 23:50:45 -0400
Subject: [PATCH 1209/1265] 4.16.4

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 2d902e94d61..2f6eab101ae 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.16.4 / 2018-10-10
+===================
 
   * Fix issue where `"Request aborted"` may be logged in `res.sendfile`
   * Fix JSDoc for `Router` constructor
diff --git a/package.json b/package.json
index 6118573572f..74196ad68e2 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.16.3",
+  "version": "4.16.4",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From d0421ac7e1f897e15a2f7a9328e9bfd938b95a9f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 26 Oct 2018 23:34:00 -0400
Subject: [PATCH 1210/1265] tests: use supertest to perform assertions

---
 test/app.router.js | 24 +++++++++---------------
 test/res.cookie.js |  7 ++-----
 test/res.locals.js | 10 ++++------
 3 files changed, 15 insertions(+), 26 deletions(-)

diff --git a/test/app.router.js b/test/app.router.js
index a6c8cef202a..d716ea4b046 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -152,15 +152,12 @@ describe('app.router', function(){
 
     app.use(function(req, res, next){
       calls.push('after');
-      res.end();
+      res.json(calls)
     });
 
     request(app)
     .get('/')
-    .end(function(res){
-      calls.should.eql(['before', 'GET /', 'after'])
-      done();
-    })
+    .expect(200, ['before', 'GET /', 'after'], done)
   })
 
   describe('when given a regexp', function(){
@@ -891,15 +888,12 @@ describe('app.router', function(){
 
       app.get('/foo', function(req, res, next){
         calls.push('/foo 2');
-        res.end('done');
+        res.json(calls)
       });
 
       request(app)
       .get('/foo')
-      .expect('done', function(){
-        calls.should.eql(['/foo/:bar?', '/foo', '/foo 2']);
-        done();
-      })
+      .expect(200, ['/foo/:bar?', '/foo', '/foo 2'], done)
     })
   })
 
@@ -982,15 +976,15 @@ describe('app.router', function(){
       });
 
       app.use(function(err, req, res, next){
-        res.end(err.message);
+        res.json({
+          calls: calls,
+          error: err.message
+        })
       })
 
       request(app)
       .get('/foo')
-      .expect('fail', function(){
-        calls.should.eql(['/foo/:bar?', '/foo']);
-        done();
-      })
+      .expect(200, { calls: ['/foo/:bar?', '/foo'], error: 'fail' }, done)
     })
 
     it('should call handler in same route, if exists', function(done){
diff --git a/test/res.cookie.js b/test/res.cookie.js
index 4eeaaf094ad..271a0969e62 100644
--- a/test/res.cookie.js
+++ b/test/res.cookie.js
@@ -108,15 +108,12 @@ describe('res', function(){
 
         app.use(function(req, res){
           res.cookie('name', 'tobi', options)
-          res.end();
+          res.json(options)
         });
 
         request(app)
         .get('/')
-        .end(function(err, res){
-          options.should.eql(optionsCopy);
-          done();
-        })
+        .expect(200, optionsCopy, done)
       })
     })
 
diff --git a/test/res.locals.js b/test/res.locals.js
index 3c83e66c54f..a1c819667a3 100644
--- a/test/res.locals.js
+++ b/test/res.locals.js
@@ -8,13 +8,12 @@ describe('res', function(){
       var app = express();
 
       app.use(function(req, res){
-        Object.keys(res.locals).should.eql([]);
-        res.end();
+        res.json(res.locals)
       });
 
       request(app)
       .get('/')
-      .expect(200, done);
+      .expect(200, {}, done)
     })
   })
 
@@ -30,12 +29,11 @@ describe('res', function(){
     });
 
     app.use(function(req, res){
-      res.locals.foo.should.equal('bar');
-      res.end();
+      res.json(res.locals)
     });
 
     request(app)
     .get('/')
-    .expect(200, done);
+    .expect(200, { foo: 'bar' }, done)
   })
 })

From a6b119d27a2f1703d51d1938e6fe98b0ee2d5651 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 27 Oct 2018 00:05:00 -0400
Subject: [PATCH 1211/1265] build: coveralls@2.12.0

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index ebeed7008dd..a36ad43c97b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -60,5 +60,5 @@ script:
 after_script:
   - |
     # Upload coverage to coveralls
-    npm install --save-dev coveralls@2.10.0
+    npm install --save-dev coveralls@2.12.0
     coveralls < ./coverage/lcov.info

From 6295b4592014515e137c17e854f83d1c0274198a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 27 Oct 2018 00:50:58 -0400
Subject: [PATCH 1212/1265] build: test against Node.js 11.x nightly

---
 .travis.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index a36ad43c97b..a49b22edcf3 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,6 +16,8 @@ matrix:
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
     - node_js: "10"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
+    - node_js: "11"
+      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
     # Allow the nightly installs to fail
     - env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"

From 003459b795b3ab2ae97c2131585b0560c1d35716 Mon Sep 17 00:00:00 2001
From: Nacim Goura <nacim.goura@gmail.com>
Date: Tue, 10 Apr 2018 11:33:43 +0200
Subject: [PATCH 1213/1265] build: support Node.js 9.x

closes #3617
---
 .travis.yml  | 3 +--
 appveyor.yml | 1 +
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index a49b22edcf3..aad455e48ba 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,10 +10,9 @@ node_js:
   - "6.14"
   - "7.10"
   - "8.12"
+  - "9.11"
 matrix:
   include:
-    - node_js: "9"
-      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
     - node_js: "10"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
     - node_js: "11"
diff --git a/appveyor.yml b/appveyor.yml
index fc3582e4a5a..0a911723cf2 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -10,6 +10,7 @@ environment:
     - nodejs_version: "6.14"
     - nodejs_version: "7.10"
     - nodejs_version: "8.12"
+    - nodejs_version: "9.11"
 cache:
   - node_modules
 install:

From 44e539e1dcdc010638812fc96f541da3f02d35de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felix=20Bu=CC=88nemann?= <buenemann@louis.info>
Date: Wed, 16 May 2018 18:27:06 +0200
Subject: [PATCH 1214/1265] build: support Node.js 10.x

closes #3617
---
 .travis.yml  | 3 +--
 appveyor.yml | 1 +
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index aad455e48ba..c802e4fd3a7 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,10 +11,9 @@ node_js:
   - "7.10"
   - "8.12"
   - "9.11"
+  - "10.12"
 matrix:
   include:
-    - node_js: "10"
-      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
     - node_js: "11"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
diff --git a/appveyor.yml b/appveyor.yml
index 0a911723cf2..4006a5e51d9 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -11,6 +11,7 @@ environment:
     - nodejs_version: "7.10"
     - nodejs_version: "8.12"
     - nodejs_version: "9.11"
+    - nodejs_version: "10.12"
 cache:
   - node_modules
 install:

From 6bcdfef6ad148672872e4f5930a01a5a45dd9df0 Mon Sep 17 00:00:00 2001
From: void <thevoidf@gmail.com>
Date: Sun, 4 Mar 2018 04:56:32 +0400
Subject: [PATCH 1215/1265] Improve error message for non-strings to
 res.sendFile

closes #3582
---
 History.md           | 5 +++++
 lib/response.js      | 4 ++++
 test/res.sendFile.js | 8 ++++++++
 3 files changed, 17 insertions(+)

diff --git a/History.md b/History.md
index 2f6eab101ae..6a0699421ad 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Improve error message for non-strings to `res.sendFile`
+
 4.16.4 / 2018-10-10
 ===================
 
diff --git a/lib/response.js b/lib/response.js
index 2e445ac02c5..11adeb614a9 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -411,6 +411,10 @@ res.sendFile = function sendFile(path, options, callback) {
     throw new TypeError('path argument is required to res.sendFile');
   }
 
+  if (typeof path !== 'string') {
+    throw new TypeError('path must be a string to res.sendFile')
+  }
+
   // support function as second arg
   if (typeof options === 'function') {
     done = options;
diff --git a/test/res.sendFile.js b/test/res.sendFile.js
index d7585b7704c..5f494f1e0bc 100644
--- a/test/res.sendFile.js
+++ b/test/res.sendFile.js
@@ -20,6 +20,14 @@ describe('res', function(){
       .expect(500, /path.*required/, done);
     });
 
+    it('should error for non-string path', function (done) {
+      var app = createApp(42)
+
+      request(app)
+      .get('/')
+      .expect(500, /TypeError: path must be a string to res.sendFile/, done)
+    })
+
     it('should transfer a file', function (done) {
       var app = createApp(path.resolve(fixtures, 'name.txt'));
 

From 8da51108e7bb501344c537d3f1f846a7477ae329 Mon Sep 17 00:00:00 2001
From: Joshua Caron <joshua@joshuacaron.ca>
Date: Thu, 12 Nov 2015 13:33:06 -0500
Subject: [PATCH 1216/1265] Improve error message for null/undefined to
 res.status

closes #2795
closes #2797
closes #3111
---
 History.md         |  1 +
 lib/response.js    |  4 ++++
 test/res.status.js | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 37 insertions(+)

diff --git a/History.md b/History.md
index 6a0699421ad..35147d390d3 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Improve error message for non-strings to `res.sendFile`
+  * Improve error message for `null`/`undefined` to `res.status`
 
 4.16.4 / 2018-10-10
 ===================
diff --git a/lib/response.js b/lib/response.js
index 11adeb614a9..60f8979e859 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -64,6 +64,10 @@ var charsetRegExp = /;\s*charset\s*=/;
  */
 
 res.status = function status(code) {
+  if (code === undefined || code === null) {
+    throw new TypeError('code argument is required to res.status')
+  }
+
   this.statusCode = code;
   return this;
 };
diff --git a/test/res.status.js b/test/res.status.js
index 8c173a645c5..3f928ec0b0b 100644
--- a/test/res.status.js
+++ b/test/res.status.js
@@ -16,5 +16,37 @@ describe('res', function(){
       .expect('Created')
       .expect(201, done);
     })
+
+    describe('when code is undefined', function () {
+      it('should throw a TypeError', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.status(undefined).send('OK')
+        })
+
+        request(app)
+        .get('/')
+        .expect(500)
+        .expect(/TypeError: code argument is required to res.status/)
+        .end(done)
+      })
+    })
+
+    describe('when code is null', function () {
+      it('should throw a TypeError', function (done) {
+        var app = express()
+
+        app.use(function (req, res) {
+          res.status(null).send('OK')
+        })
+
+        request(app)
+        .get('/')
+        .expect(500)
+        .expect(/TypeError: code argument is required to res.status/)
+        .end(done)
+      })
+    })
   })
 })

From b93ffd4bdc09c3af925eed80c28bd37f63bb3cfc Mon Sep 17 00:00:00 2001
From: Horatiu Eugen Vlad <horatiu@vlad.eu>
Date: Sun, 3 Dec 2017 19:52:46 +0100
Subject: [PATCH 1217/1265] Support multiple hosts in X-Forwarded-Host

fixes #3494
closes #3495
---
 History.md           |  1 +
 lib/request.js       |  4 ++++
 test/req.hostname.js | 50 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 55 insertions(+)

diff --git a/History.md b/History.md
index 35147d390d3..c29a4490bd4 100644
--- a/History.md
+++ b/History.md
@@ -3,6 +3,7 @@ unreleased
 
   * Improve error message for non-strings to `res.sendFile`
   * Improve error message for `null`/`undefined` to `res.status`
+  * Support multiple hosts in `X-Forwarded-Host`
 
 4.16.4 / 2018-10-10
 ===================
diff --git a/lib/request.js b/lib/request.js
index 8bb86a9acc4..a9400ef99de 100644
--- a/lib/request.js
+++ b/lib/request.js
@@ -430,6 +430,10 @@ defineGetter(req, 'hostname', function hostname(){
 
   if (!host || !trust(this.connection.remoteAddress, 0)) {
     host = this.get('Host');
+  } else if (host.indexOf(',') !== -1) {
+    // Note: X-Forwarded-Host is normally only ever a
+    //       single value, but this is to be safe.
+    host = host.substring(0, host.indexOf(',')).trimRight()
   }
 
   if (!host) return;
diff --git a/test/req.hostname.js b/test/req.hostname.js
index 816cd597990..09bfb899898 100644
--- a/test/req.hostname.js
+++ b/test/req.hostname.js
@@ -116,6 +116,56 @@ describe('req', function(){
         .set('Host', 'example.com')
         .expect('example.com', done);
       })
+
+      describe('when multiple X-Forwarded-Host', function () {
+        it('should use the first value', function (done) {
+          var app = express()
+
+          app.enable('trust proxy')
+
+          app.use(function (req, res) {
+            res.send(req.hostname)
+          })
+
+          request(app)
+          .get('/')
+          .set('Host', 'localhost')
+          .set('X-Forwarded-Host', 'example.com, foobar.com')
+          .expect(200, 'example.com', done)
+        })
+
+        it('should remove OWS around comma', function (done) {
+          var app = express()
+
+          app.enable('trust proxy')
+
+          app.use(function (req, res) {
+            res.send(req.hostname)
+          })
+
+          request(app)
+          .get('/')
+          .set('Host', 'localhost')
+          .set('X-Forwarded-Host', 'example.com , foobar.com')
+          .expect(200, 'example.com', done)
+        })
+
+        it('should strip port number', function (done) {
+          var app = express()
+
+          app.enable('trust proxy')
+
+          app.use(function (req, res) {
+            res.send(req.hostname)
+          })
+
+          request(app)
+          .get('/')
+          .set('Host', 'localhost')
+          .set('X-Forwarded-Host', 'example.com:8080 , foobar.com:8888')
+          .expect(200, 'example.com', done)
+        })
+      })
     })
 
     describe('when "trust proxy" is disabled', function(){

From 95c31f7041fe31b24175ce9a6537a0d0d6b807f7 Mon Sep 17 00:00:00 2001
From: HubCodes <krlrhkstk12@gmail.com>
Date: Thu, 13 Dec 2018 16:04:27 +0900
Subject: [PATCH 1218/1265] docs: fix typo in contributing

closes #3827
---
 Contributing.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Contributing.md b/Contributing.md
index 41386568d64..f84c0138cb0 100644
--- a/Contributing.md
+++ b/Contributing.md
@@ -19,7 +19,7 @@ expertise to resolve rare disputes.
 
 Log an issue for any question or problem you might have. When in doubt, log an issue, and
 any additional policies about what to include will be provided in the responses. The only
-exception is security dislosures which should be sent privately.
+exception is security disclosures which should be sent privately.
 
 Committers may direct you to another repository, ask for additional clarifications, and
 add appropriate metadata before the issue is addressed.

From 0ae10bb15471745795a44d9316e324b697725524 Mon Sep 17 00:00:00 2001
From: Austin Scriver <ascriver@live.com>
Date: Mon, 26 Nov 2018 20:00:47 -0700
Subject: [PATCH 1219/1265] docs: fix typos in history

closes #3810
---
 History.md | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/History.md b/History.md
index c29a4490bd4..20cee356455 100644
--- a/History.md
+++ b/History.md
@@ -301,7 +301,7 @@ unreleased
     - Fix including type extensions in parameters in `Accept` parsing
     - Fix parsing `Accept` parameters with quoted equals
     - Fix parsing `Accept` parameters with quoted semicolons
-    - Many performance improvments
+    - Many performance improvements
     - deps: mime-types@~2.1.11
     - deps: negotiator@0.6.1
   * deps: content-type@~1.0.2
@@ -316,7 +316,7 @@ unreleased
     - perf: enable strict mode
     - perf: hoist regular expression
     - perf: use for loop in parse
-    - perf: use string concatination for serialization
+    - perf: use string concatenation for serialization
   * deps: finalhandler@0.5.0
     - Change invalid or non-numeric status code to 500
     - Overwrite status message to match set status code
@@ -326,7 +326,7 @@ unreleased
   * deps: proxy-addr@~1.1.2
     - Fix accepting various invalid netmasks
     - Fix IPv6-mapped IPv4 validation edge cases
-    - IPv4 netmasks must be contingous
+    - IPv4 netmasks must be contiguous
     - IPv6 addresses cannot be used as a netmask
     - deps: ipaddr.js@1.1.1
   * deps: qs@6.2.0
@@ -1104,13 +1104,13 @@ unreleased
    - deps: negotiator@0.4.6
  * deps: debug@1.0.2
  * deps: send@0.4.3
-   - Do not throw un-catchable error on file open race condition
+   - Do not throw uncatchable error on file open race condition
    - Use `escape-html` for HTML escaping
    - deps: debug@1.0.2
    - deps: finished@1.2.2
    - deps: fresh@0.2.2
  * deps: serve-static@1.2.3
-   - Do not throw un-catchable error on file open race condition
+   - Do not throw uncatchable error on file open race condition
    - deps: send@0.4.3
 
 4.4.2 / 2014-06-09
@@ -1990,7 +1990,7 @@ unreleased
    - deps: serve-static@1.2.3
  * deps: debug@1.0.2
  * deps: send@0.4.3
-   - Do not throw un-catchable error on file open race condition
+   - Do not throw uncatchable error on file open race condition
    - Use `escape-html` for HTML escaping
    - deps: debug@1.0.2
    - deps: finished@1.2.2
@@ -3175,7 +3175,7 @@ Shaw]
   * Updated haml submodule
   * Changed ETag; removed inode, modified time only
   * Fixed LF to CRLF for setting multiple cookies
-  * Fixed cookie complation; values are now urlencoded
+  * Fixed cookie compilation; values are now urlencoded
   * Fixed cookies parsing; accepts quoted values and url escaped cookies
 
 0.11.0 / 2010-05-06
@@ -3370,7 +3370,7 @@ Shaw]
 
   * Added "plot" format option for Profiler (for gnuplot processing)
   * Added request number to Profiler plugin
-  * Fixed binary encoding for multi-part file uploads, was previously defaulting to UTF8
+  * Fixed binary encoding for multipart file uploads, was previously defaulting to UTF8
   * Fixed issue with routes not firing when not files are present. Closes #184
   * Fixed process.Promise -> events.Promise
 
@@ -3416,7 +3416,7 @@ Shaw]
   * Updated sample chat app to show messages on load
   * Updated libxmljs parseString -> parseHtmlString
   * Fixed `make init` to work with older versions of git
-  * Fixed specs can now run independent specs for those who cant build deps. Closes #127
+  * Fixed specs can now run independent specs for those who can't build deps. Closes #127
   * Fixed issues introduced by the node url module changes. Closes 126.
   * Fixed two assertions failing due to Collection#keys() returning strings
   * Fixed faulty Collection#toArray() spec due to keys() returning strings

From 02f3933b6962114cf46c637105db7983d32a156a Mon Sep 17 00:00:00 2001
From: Alvin Smith <alvinsmith.nz@gmail.com>
Date: Thu, 29 Nov 2018 21:02:55 +1300
Subject: [PATCH 1220/1265] examples: minor fixes to some examples

closes #3812
---
 examples/downloads/index.js            | 2 +-
 examples/mvc/public/style.css          | 2 +-
 examples/static-files/public/js/app.js | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/examples/downloads/index.js b/examples/downloads/index.js
index e6f3fa9db69..5f0772697c1 100644
--- a/examples/downloads/index.js
+++ b/examples/downloads/index.js
@@ -21,7 +21,7 @@ app.get('/files/:file(*)', function(req, res, next){
 
   res.download(filePath, function (err) {
     if (!err) return; // file sent
-    if (err && err.status !== 404) return next(err); // non-404 error
+    if (err.status !== 404) return next(err); // non-404 error
     // file for download not found
     res.statusCode = 404;
     res.send('Cant find that file, sorry!');
diff --git a/examples/mvc/public/style.css b/examples/mvc/public/style.css
index 69fde2e23aa..8a23f9d41c4 100644
--- a/examples/mvc/public/style.css
+++ b/examples/mvc/public/style.css
@@ -1,6 +1,6 @@
 body {
   padding: 50px;
-  font: 16px "Helvetica Neue", Helvetica, Arial;
+  font: 16px "Helvetica Neue", Helvetica, Arial, sans-serif;
 }
 a {
   color: #107aff;
diff --git a/examples/static-files/public/js/app.js b/examples/static-files/public/js/app.js
index 257cc5642cb..775eb734b02 100644
--- a/examples/static-files/public/js/app.js
+++ b/examples/static-files/public/js/app.js
@@ -1 +1 @@
-foo
+// foo

From 186a206a0aed799699e6a7400aed9aeef31c21e9 Mon Sep 17 00:00:00 2001
From: Ciro Santilli <ciro.santilli@gmail.com>
Date: Tue, 5 Feb 2019 09:39:46 +0000
Subject: [PATCH 1221/1265] docs: add listening address to example

closes #3873
---
 Readme.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Readme.md b/Readme.md
index 582e8958c59..9053d79006d 100644
--- a/Readme.md
+++ b/Readme.md
@@ -90,6 +90,8 @@ $ npm install
 $ npm start
 ```
 
+  View the website at: http://localhost:3000
+
 ## Philosophy
 
   The Express philosophy is to provide small, robust tooling for HTTP servers, making

From 6f12eee8abcfdd672c7a3d638d3dbf744a6b1801 Mon Sep 17 00:00:00 2001
From: Louis <artonge@chmn.me>
Date: Thu, 17 Jan 2019 18:33:01 +0100
Subject: [PATCH 1222/1265] docs: fix typo in jsdoc comment

closes #3859
---
 lib/response.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/response.js b/lib/response.js
index 60f8979e859..c1514901c57 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -822,7 +822,7 @@ res.clearCookie = function clearCookie(name, options) {
  *    // "Remember Me" for 15 minutes
  *    res.cookie('rememberme', '1', { expires: new Date(Date.now() + 900000), httpOnly: true });
  *
- *    // save as above
+ *    // same as above
  *    res.cookie('rememberme', '1', { maxAge: 900000, httpOnly: true })
  *
  * @param {String} name

From b9b1b19758b0996680100c65ae87128d623c5f7e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EA=B9=80=EC=A0=95=ED=99=98?= <jh.kim@woowahan.com>
Date: Fri, 1 Feb 2019 09:56:14 +0900
Subject: [PATCH 1223/1265] tests: fix typos in descriptions

closes #3875
---
 test/app.router.js           | 2 +-
 test/req.acceptsCharset.js   | 4 ++--
 test/req.acceptsCharsets.js  | 4 ++--
 test/req.acceptsEncodings.js | 2 +-
 test/req.query.js            | 2 +-
 test/res.download.js         | 4 ++--
 6 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/test/app.router.js b/test/app.router.js
index d716ea4b046..5a31b5fb90c 100644
--- a/test/app.router.js
+++ b/test/app.router.js
@@ -567,7 +567,7 @@ describe('app.router', function(){
       .expect('/user/tobi.json', done)
     })
 
-    it('should decore the capture', function (done) {
+    it('should decode the capture', function (done) {
       var app = express()
 
       app.get('*', function (req, res) {
diff --git a/test/req.acceptsCharset.js b/test/req.acceptsCharset.js
index 0d0ed8b5e41..f7d0cc0e300 100644
--- a/test/req.acceptsCharset.js
+++ b/test/req.acceptsCharset.js
@@ -18,8 +18,8 @@ describe('req', function(){
       })
     })
 
-    describe('when Accept-Charset is not present', function(){
-      it('should return true when present', function(done){
+    describe('when Accept-Charset is present', function () {
+      it('should return true', function (done) {
         var app = express();
 
         app.use(function(req, res, next){
diff --git a/test/req.acceptsCharsets.js b/test/req.acceptsCharsets.js
index 2f4574c5244..d1c459174a9 100644
--- a/test/req.acceptsCharsets.js
+++ b/test/req.acceptsCharsets.js
@@ -18,8 +18,8 @@ describe('req', function(){
       })
     })
 
-    describe('when Accept-Charset is not present', function(){
-      it('should return true when present', function(done){
+    describe('when Accept-Charset is present', function () {
+      it('should return true', function (done) {
         var app = express();
 
         app.use(function(req, res, next){
diff --git a/test/req.acceptsEncodings.js b/test/req.acceptsEncodings.js
index aba8ea5fbeb..a5cf747d41c 100644
--- a/test/req.acceptsEncodings.js
+++ b/test/req.acceptsEncodings.js
@@ -3,7 +3,7 @@ var express = require('../')
   , request = require('supertest');
 
 describe('req', function(){
-  describe('.acceptsEncodingss', function(){
+  describe('.acceptsEncodings', function () {
     it('should be true if encoding accepted', function(done){
       var app = express();
 
diff --git a/test/req.query.js b/test/req.query.js
index d3d29abd16d..7819420ce01 100644
--- a/test/req.query.js
+++ b/test/req.query.js
@@ -70,7 +70,7 @@ describe('req', function(){
       });
     });
 
-    describe('when "query parser" disabled', function () {
+    describe('when "query parser" enabled', function () {
       it('should not parse complex keys', function (done) {
         var app = createApp(true);
 
diff --git a/test/res.download.js b/test/res.download.js
index 084b3c7164d..cf3b3ca53e1 100644
--- a/test/res.download.js
+++ b/test/res.download.js
@@ -110,7 +110,7 @@ describe('res', function(){
     })
 
     describe('when options.headers contains Content-Disposition', function () {
-      it('should should be ignored', function (done) {
+      it('should be ignored', function (done) {
         var app = express()
 
         app.use(function (req, res) {
@@ -130,7 +130,7 @@ describe('res', function(){
         .end(done)
       })
 
-      it('should should be ignored case-insensitively', function (done) {
+      it('should be ignored case-insensitively', function (done) {
         var app = express()
 
         app.use(function (req, res) {

From 6eda52a3dc953f297942a98c333b609519141c49 Mon Sep 17 00:00:00 2001
From: Marcin Wanago <wanago.marcin@gmail.com>
Date: Wed, 30 Jan 2019 23:42:29 +0100
Subject: [PATCH 1224/1265] docs: use const in readme example

fixes #3867
closes #3868
---
 Readme.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Readme.md b/Readme.md
index 9053d79006d..b25b240c7da 100644
--- a/Readme.md
+++ b/Readme.md
@@ -9,8 +9,8 @@
   [![Test Coverage][coveralls-image]][coveralls-url]
 
 ```js
-var express = require('express')
-var app = express()
+const express = require('express')
+const app = express()
 
 app.get('/', function (req, res) {
   res.send('Hello World')

From 8a97346eaf3a5e39ba8185b244af4918d2ca43b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EA=B9=80=EC=A0=95=ED=99=98?= <6pack@madup.com>
Date: Fri, 1 Feb 2019 21:33:07 +0900
Subject: [PATCH 1225/1265] tests: assert calls order in middleware basic tests

closes #3878
---
 test/middleware.basic.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/test/middleware.basic.js b/test/middleware.basic.js
index ce59589230b..4616842ed60 100644
--- a/test/middleware.basic.js
+++ b/test/middleware.basic.js
@@ -1,4 +1,5 @@
 
+var assert = require('assert')
 var express = require('../');
 var request = require('supertest');
 
@@ -33,6 +34,7 @@ describe('middleware', function(){
       .set('Content-Type', 'application/json')
       .send('{"foo":"bar"}')
       .expect('Content-Type', 'application/json')
+      .expect(function () { assert.deepEqual(calls, ['one', 'two']) })
       .expect(200, '{"foo":"bar"}', done)
     })
   })

From 9e5d1a30c3671f99b5d80a231b697a311f5fe489 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Apr 2019 10:44:27 -0400
Subject: [PATCH 1226/1265] build: test against Node.js 12.x nightly

---
 .travis.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index c802e4fd3a7..36e7e75e568 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,6 +16,8 @@ matrix:
   include:
     - node_js: "11"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
+    - node_js: "12"
+      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
     # Allow the nightly installs to fail
     - env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"

From cf5c813d2f6499be2d38a55a26dd5bd1b71b749c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Apr 2019 15:51:33 -0400
Subject: [PATCH 1227/1265] build: hbs@4.0.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 74196ad68e2..0b8bec48632 100644
--- a/package.json
+++ b/package.json
@@ -66,7 +66,7 @@
     "ejs": "2.6.1",
     "eslint": "2.13.1",
     "express-session": "1.15.6",
-    "hbs": "4.0.1",
+    "hbs": "4.0.4",
     "istanbul": "0.4.5",
     "marked": "0.5.1",
     "method-override": "3.0.0",

From 4218d04183e0f7bd04f3db7d23b53d6d3857ed10 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Apr 2019 15:58:26 -0400
Subject: [PATCH 1228/1265] build: marked@0.6.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 0b8bec48632..6dd72c1f7c0 100644
--- a/package.json
+++ b/package.json
@@ -68,7 +68,7 @@
     "express-session": "1.15.6",
     "hbs": "4.0.4",
     "istanbul": "0.4.5",
-    "marked": "0.5.1",
+    "marked": "0.6.2",
     "method-override": "3.0.0",
     "mocha": "5.2.0",
     "morgan": "1.9.1",

From 952484f73a84743c53abfc4b51a6614f2d1e13cd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Apr 2019 16:00:02 -0400
Subject: [PATCH 1229/1265] deps: content-disposition@0.5.3

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 20cee356455..5343b0ba85d 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,7 @@ unreleased
   * Improve error message for non-strings to `res.sendFile`
   * Improve error message for `null`/`undefined` to `res.status`
   * Support multiple hosts in `X-Forwarded-Host`
+  * deps: content-disposition@0.5.3
 
 4.16.4 / 2018-10-10
 ===================
diff --git a/package.json b/package.json
index 6dd72c1f7c0..9255d77d07b 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "accepts": "~1.3.5",
     "array-flatten": "1.1.1",
     "body-parser": "1.18.3",
-    "content-disposition": "0.5.2",
+    "content-disposition": "0.5.3",
     "content-type": "~1.0.4",
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",

From 50eb5e43774a78737a82405c17ac8ca3ff5532ff Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Apr 2019 16:05:17 -0400
Subject: [PATCH 1230/1265] deps: proxy-addr@~2.0.5

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5343b0ba85d..f8a5c0c0e10 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,8 @@ unreleased
   * Improve error message for `null`/`undefined` to `res.status`
   * Support multiple hosts in `X-Forwarded-Host`
   * deps: content-disposition@0.5.3
+  * deps: proxy-addr@~2.0.5
+    - deps: ipaddr.js@1.9.0
 
 4.16.4 / 2018-10-10
 ===================
diff --git a/package.json b/package.json
index 9255d77d07b..92102c2a76f 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.2",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~2.0.4",
+    "proxy-addr": "~2.0.5",
     "qs": "6.5.2",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.2",

From 03341204ff13fb35ac7082adf3dd694081ab68d3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Apr 2019 16:06:35 -0400
Subject: [PATCH 1231/1265] deps: parseurl@~1.3.3

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f8a5c0c0e10..e1f238bb90a 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,7 @@ unreleased
   * Improve error message for `null`/`undefined` to `res.status`
   * Support multiple hosts in `X-Forwarded-Host`
   * deps: content-disposition@0.5.3
+  * deps: parseurl@~1.3.3
   * deps: proxy-addr@~2.0.5
     - deps: ipaddr.js@1.9.0
 
diff --git a/package.json b/package.json
index 92102c2a76f..e548b609272 100644
--- a/package.json
+++ b/package.json
@@ -44,7 +44,7 @@
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",
     "on-finished": "~2.3.0",
-    "parseurl": "~1.3.2",
+    "parseurl": "~1.3.3",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~2.0.5",
     "qs": "6.5.2",

From b02d3a1744db80a1ad6951f55f4cb6b996db4b53 Mon Sep 17 00:00:00 2001
From: James George <jamesgeorge998001@gmail.com>
Date: Thu, 27 Dec 2018 12:59:51 +0530
Subject: [PATCH 1232/1265] docs: add link to contributing guide

closes #3846
---
 Readme.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Readme.md b/Readme.md
index b25b240c7da..81d8d91615e 100644
--- a/Readme.md
+++ b/Readme.md
@@ -127,6 +127,10 @@ $ npm install
 $ npm test
 ```
 
+## Contributing
+
+[Contributing Guide](Contributing.md)
+
 ## People
 
 The original author of Express is [TJ Holowaychuk](https://github.com/tj)

From 7eacdcef190990f2e5a199bb1140322c687e65d7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 22 Apr 2019 13:40:23 -0400
Subject: [PATCH 1233/1265] deps: setprototypeof@1.1.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index e1f238bb90a..4f9dcbe96ff 100644
--- a/History.md
+++ b/History.md
@@ -8,6 +8,7 @@ unreleased
   * deps: parseurl@~1.3.3
   * deps: proxy-addr@~2.0.5
     - deps: ipaddr.js@1.9.0
+  * deps: setprototypeof@1.1.1
 
 4.16.4 / 2018-10-10
 ===================
diff --git a/package.json b/package.json
index e548b609272..719d689137c 100644
--- a/package.json
+++ b/package.json
@@ -52,7 +52,7 @@
     "safe-buffer": "5.1.2",
     "send": "0.16.2",
     "serve-static": "1.13.2",
-    "setprototypeof": "1.1.0",
+    "setprototypeof": "1.1.1",
     "statuses": "~1.4.0",
     "type-is": "~1.6.16",
     "utils-merge": "1.0.1",

From 9afa1cfc85171dfd8b3595e7b25b7be783c79ae8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 30 Apr 2019 22:17:03 -0400
Subject: [PATCH 1234/1265] deps: statuses@~1.5.0

---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 4f9dcbe96ff..f0001629d88 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,8 @@ unreleased
   * deps: proxy-addr@~2.0.5
     - deps: ipaddr.js@1.9.0
   * deps: setprototypeof@1.1.1
+  * deps: statuses@~1.5.0
+    - Add `103 Early Hints`
 
 4.16.4 / 2018-10-10
 ===================
diff --git a/package.json b/package.json
index 719d689137c..3834b1f1d2f 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "send": "0.16.2",
     "serve-static": "1.13.2",
     "setprototypeof": "1.1.1",
-    "statuses": "~1.4.0",
+    "statuses": "~1.5.0",
     "type-is": "~1.6.16",
     "utils-merge": "1.0.1",
     "vary": "~1.1.2"

From 40dbfa2de21588d23a8e8e8d43dae5664f0267af Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 30 Apr 2019 22:24:35 -0400
Subject: [PATCH 1235/1265] deps: accepts@~1.3.7

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f0001629d88..850f4333cff 100644
--- a/History.md
+++ b/History.md
@@ -4,6 +4,7 @@ unreleased
   * Improve error message for non-strings to `res.sendFile`
   * Improve error message for `null`/`undefined` to `res.status`
   * Support multiple hosts in `X-Forwarded-Host`
+  * deps: accepts@~1.3.7
   * deps: content-disposition@0.5.3
   * deps: parseurl@~1.3.3
   * deps: proxy-addr@~2.0.5
diff --git a/package.json b/package.json
index 3834b1f1d2f..ee093cc1acb 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.3.5",
+    "accepts": "~1.3.7",
     "array-flatten": "1.1.1",
     "body-parser": "1.18.3",
     "content-disposition": "0.5.3",

From 6d9dd2da49c8d5fce9fccdd9d8257004040a19a7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 30 Apr 2019 22:48:56 -0400
Subject: [PATCH 1236/1265] deps: type-is@~1.6.18

---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 850f4333cff..6a7aab401c6 100644
--- a/History.md
+++ b/History.md
@@ -12,6 +12,9 @@ unreleased
   * deps: setprototypeof@1.1.1
   * deps: statuses@~1.5.0
     - Add `103 Early Hints`
+  * deps: type-is@~1.6.18
+    - deps: mime-types@~2.1.24
+    - perf: prevent internal `throw` on invalid type
 
 4.16.4 / 2018-10-10
 ===================
diff --git a/package.json b/package.json
index ee093cc1acb..efb712f81fd 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,7 @@
     "serve-static": "1.13.2",
     "setprototypeof": "1.1.1",
     "statuses": "~1.5.0",
-    "type-is": "~1.6.16",
+    "type-is": "~1.6.18",
     "utils-merge": "1.0.1",
     "vary": "~1.1.2"
   },

From 32f5293afa2edb7dd9052922dda3ebdd9eab658d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 30 Apr 2019 23:06:50 -0400
Subject: [PATCH 1237/1265] deps: qs@6.7.0

---
 History.md        | 2 ++
 package.json      | 2 +-
 test/req.query.js | 4 ++--
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 6a7aab401c6..5051207e8ac 100644
--- a/History.md
+++ b/History.md
@@ -9,6 +9,8 @@ unreleased
   * deps: parseurl@~1.3.3
   * deps: proxy-addr@~2.0.5
     - deps: ipaddr.js@1.9.0
+  * deps: qs@6.7.0
+    - Fix parsing array brackets after index
   * deps: setprototypeof@1.1.1
   * deps: statuses@~1.5.0
     - Add `103 Early Hints`
diff --git a/package.json b/package.json
index efb712f81fd..9730acccbb4 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
     "parseurl": "~1.3.3",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~2.0.5",
-    "qs": "6.5.2",
+    "qs": "6.7.0",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.2",
     "send": "0.16.2",
diff --git a/test/req.query.js b/test/req.query.js
index 7819420ce01..0e810b8ef91 100644
--- a/test/req.query.js
+++ b/test/req.query.js
@@ -25,8 +25,8 @@ describe('req', function(){
         var app = createApp('extended');
 
         request(app)
-        .get('/?user[name]=tj')
-        .expect(200, '{"user":{"name":"tj"}}', done);
+        .get('/?foo[0][bar]=baz&foo[0][fizz]=buzz&foo[]=done!')
+        .expect(200, '{"foo":[{"bar":"baz","fizz":"buzz"},"done!"]}', done);
       });
 
       it('should parse parameters with dots', function (done) {

From 2f782d8478948124a1c96fe04de259385163100f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 30 Apr 2019 23:31:32 -0400
Subject: [PATCH 1238/1265] deps: body-parser@1.19.0

---
 History.md   | 10 ++++++++++
 package.json |  2 +-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5051207e8ac..3c2b59a6e22 100644
--- a/History.md
+++ b/History.md
@@ -5,6 +5,16 @@ unreleased
   * Improve error message for `null`/`undefined` to `res.status`
   * Support multiple hosts in `X-Forwarded-Host`
   * deps: accepts@~1.3.7
+  * deps: body-parser@1.19.0
+    - Add encoding MIK
+    - Add petabyte (`pb`) support
+    - Fix parsing array brackets after index
+    - deps: bytes@3.1.0
+    - deps: http-errors@1.7.2
+    - deps: iconv-lite@0.4.24
+    - deps: qs@6.7.0
+    - deps: raw-body@2.4.0
+    - deps: type-is@~1.6.17
   * deps: content-disposition@0.5.3
   * deps: parseurl@~1.3.3
   * deps: proxy-addr@~2.0.5
diff --git a/package.json b/package.json
index 9730acccbb4..b443c34c82e 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
   "dependencies": {
     "accepts": "~1.3.7",
     "array-flatten": "1.1.1",
-    "body-parser": "1.18.3",
+    "body-parser": "1.19.0",
     "content-disposition": "0.5.3",
     "content-type": "~1.0.4",
     "cookie": "0.3.1",

From 955f2a5f78c75cd58f8c4517725a14dd3ee199a4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 May 2019 22:59:42 -0400
Subject: [PATCH 1239/1265] tests: add express.json test suite

---
 test/exports.js      |   6 +
 test/express.json.js | 664 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 670 insertions(+)
 create mode 100644 test/express.json.js

diff --git a/test/exports.js b/test/exports.js
index 2a80eedbbe8..bc2bb410fce 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -1,4 +1,5 @@
 
+var assert = require('assert')
 var express = require('../');
 var request = require('supertest');
 var should = require('should');
@@ -8,6 +9,11 @@ describe('exports', function(){
     express.Router.should.be.a.Function()
   })
 
+  it('should expose json middleware', function () {
+    assert.equal(typeof express.json, 'function')
+    assert.equal(express.json.length, 1)
+  })
+
   it('should expose the application prototype', function(){
     express.application.set.should.be.a.Function()
   })
diff --git a/test/express.json.js b/test/express.json.js
new file mode 100644
index 00000000000..907fa0cfeb8
--- /dev/null
+++ b/test/express.json.js
@@ -0,0 +1,664 @@
+
+var assert = require('assert')
+var Buffer = require('safe-buffer').Buffer
+var express = require('..')
+var request = require('supertest')
+
+describe('express.json()', function () {
+  it('should parse JSON', function (done) {
+    request(createApp())
+      .post('/')
+      .set('Content-Type', 'application/json')
+      .send('{"user":"tobi"}')
+      .expect(200, '{"user":"tobi"}', done)
+  })
+
+  it('should handle Content-Length: 0', function (done) {
+    request(createApp())
+      .post('/')
+      .set('Content-Type', 'application/json')
+      .set('Content-Length', '0')
+      .expect(200, '{}', done)
+  })
+
+  it('should handle empty message-body', function (done) {
+    request(createApp())
+      .post('/')
+      .set('Content-Type', 'application/json')
+      .set('Transfer-Encoding', 'chunked')
+      .expect(200, '{}', done)
+  })
+
+  it('should handle no message-body', function (done) {
+    request(createApp())
+      .post('/')
+      .set('Content-Type', 'application/json')
+      .unset('Transfer-Encoding')
+      .expect(200, '{}', done)
+  })
+
+  it('should 400 when invalid content-length', function (done) {
+    var app = express()
+
+    app.use(function (req, res, next) {
+      req.headers['content-length'] = '20' // bad length
+      next()
+    })
+
+    app.use(express.json())
+
+    app.post('/', function (req, res) {
+      res.json(req.body)
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'application/json')
+      .send('{"str":')
+      .expect(400, /content length/, done)
+  })
+
+  it('should handle duplicated middleware', function (done) {
+    var app = express()
+
+    app.use(express.json())
+    app.use(express.json())
+
+    app.post('/', function (req, res) {
+      res.json(req.body)
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'application/json')
+      .send('{"user":"tobi"}')
+      .expect(200, '{"user":"tobi"}', done)
+  })
+
+  describe('when JSON is invalid', function () {
+    before(function () {
+      this.app = createApp()
+    })
+
+    it('should 400 for bad token', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send('{:')
+        .expect(400, parseError('{:'), done)
+    })
+
+    it('should 400 for incomplete', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send('{"user"')
+        .expect(400, parseError('{"user"'), done)
+    })
+
+    it('should error with type = "entity.parse.failed"', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .set('X-Error-Property', 'type')
+        .send(' {"user"')
+        .expect(400, 'entity.parse.failed', done)
+    })
+
+    it('should include original body on error object', function (done) {
+      request(this.app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .set('X-Error-Property', 'body')
+        .send(' {"user"')
+        .expect(400, ' {"user"', done)
+    })
+  })
+
+  describe('with limit option', function () {
+    it('should 413 when over limit with Content-Length', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      request(createApp({ limit: '1kb' }))
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .set('Content-Length', '1034')
+        .send(JSON.stringify({ str: buf.toString() }))
+        .expect(413, done)
+    })
+
+    it('should error with type = "entity.too.large"', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      request(createApp({ limit: '1kb' }))
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .set('Content-Length', '1034')
+        .set('X-Error-Property', 'type')
+        .send(JSON.stringify({ str: buf.toString() }))
+        .expect(413, 'entity.too.large', done)
+    })
+
+    it('should 413 when over limit with chunked encoding', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      var server = createApp({ limit: '1kb' })
+      var test = request(server).post('/')
+      test.set('Content-Type', 'application/json')
+      test.set('Transfer-Encoding', 'chunked')
+      test.write('{"str":')
+      test.write('"' + buf.toString() + '"}')
+      test.expect(413, done)
+    })
+
+    it('should accept number of bytes', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      request(createApp({ limit: 1024 }))
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send(JSON.stringify({ str: buf.toString() }))
+        .expect(413, done)
+    })
+
+    it('should not change when options altered', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      var options = { limit: '1kb' }
+      var server = createApp(options)
+
+      options.limit = '100kb'
+
+      request(server)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send(JSON.stringify({ str: buf.toString() }))
+        .expect(413, done)
+    })
+
+    it('should not hang response', function (done) {
+      var buf = Buffer.alloc(10240, '.')
+      var server = createApp({ limit: '8kb' })
+      var test = request(server).post('/')
+      test.set('Content-Type', 'application/json')
+      test.write(buf)
+      test.write(buf)
+      test.write(buf)
+      test.expect(413, done)
+    })
+  })
+
+  describe('with inflate option', function () {
+    describe('when false', function () {
+      before(function () {
+        this.app = createApp({ inflate: false })
+      })
+
+      it('should not accept content-encoding', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Encoding', 'gzip')
+        test.set('Content-Type', 'application/json')
+        test.write(Buffer.from('1f8b080000000000000bab56ca4bcc4d55b2527ab16e97522d00515be1cc0e000000', 'hex'))
+        test.expect(415, 'content encoding unsupported', done)
+      })
+    })
+
+    describe('when true', function () {
+      before(function () {
+        this.app = createApp({ inflate: true })
+      })
+
+      it('should accept content-encoding', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Encoding', 'gzip')
+        test.set('Content-Type', 'application/json')
+        test.write(Buffer.from('1f8b080000000000000bab56ca4bcc4d55b2527ab16e97522d00515be1cc0e000000', 'hex'))
+        test.expect(200, '{"name":"论"}', done)
+      })
+    })
+  })
+
+  describe('with strict option', function () {
+    describe('when undefined', function () {
+      before(function () {
+        this.app = createApp()
+      })
+
+      it('should 400 on primitives', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .send('true')
+          .expect(400, parseError('#rue').replace('#', 't'), done)
+      })
+    })
+
+    describe('when false', function () {
+      before(function () {
+        this.app = createApp({ strict: false })
+      })
+
+      it('should parse primitives', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .send('true')
+          .expect(200, 'true', done)
+      })
+    })
+
+    describe('when true', function () {
+      before(function () {
+        this.app = createApp({ strict: true })
+      })
+
+      it('should not parse primitives', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .send('true')
+          .expect(400, parseError('#rue').replace('#', 't'), done)
+      })
+
+      it('should not parse primitives with leading whitespaces', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .send('    true')
+          .expect(400, parseError('    #rue').replace('#', 't'), done)
+      })
+
+      it('should allow leading whitespaces in JSON', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .send('   { "user": "tobi" }')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should error with type = "entity.parse.failed"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .set('X-Error-Property', 'type')
+          .send('true')
+          .expect(400, 'entity.parse.failed', done)
+      })
+
+      it('should include correct message in stack trace', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .set('X-Error-Property', 'stack')
+          .send('true')
+          .expect(400)
+          .expect(shouldContainInBody(parseError('#rue').replace('#', 't')))
+          .end(done)
+      })
+    })
+  })
+
+  describe('with type option', function () {
+    describe('when "application/vnd.api+json"', function () {
+      before(function () {
+        this.app = createApp({ type: 'application/vnd.api+json' })
+      })
+
+      it('should parse JSON for custom type', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/vnd.api+json')
+          .send('{"user":"tobi"}')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should ignore standard type', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .send('{"user":"tobi"}')
+          .expect(200, '{}', done)
+      })
+    })
+
+    describe('when ["application/json", "application/vnd.api+json"]', function () {
+      before(function () {
+        this.app = createApp({
+          type: ['application/json', 'application/vnd.api+json']
+        })
+      })
+
+      it('should parse JSON for "application/json"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/json')
+          .send('{"user":"tobi"}')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should parse JSON for "application/vnd.api+json"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/vnd.api+json')
+          .send('{"user":"tobi"}')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should ignore "application/x-json"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-json')
+          .send('{"user":"tobi"}')
+          .expect(200, '{}', done)
+      })
+    })
+
+    describe('when a function', function () {
+      it('should parse when truthy value returned', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          return req.headers['content-type'] === 'application/vnd.api+json'
+        }
+
+        request(app)
+          .post('/')
+          .set('Content-Type', 'application/vnd.api+json')
+          .send('{"user":"tobi"}')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should work without content-type', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          return true
+        }
+
+        var test = request(app).post('/')
+        test.write('{"user":"tobi"}')
+        test.expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should not invoke without a body', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          throw new Error('oops!')
+        }
+
+        request(app)
+          .get('/')
+          .expect(404, done)
+      })
+    })
+  })
+
+  describe('with verify option', function () {
+    it('should assert value if function', function () {
+      assert.throws(createApp.bind(null, { verify: 'lol' }),
+        /TypeError: option verify must be function/)
+    })
+
+    it('should error from verify', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x5b) throw new Error('no arrays')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send('["tobi"]')
+        .expect(403, 'no arrays', done)
+    })
+
+    it('should error with type = "entity.verify.failed"', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x5b) throw new Error('no arrays')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .set('X-Error-Property', 'type')
+        .send('["tobi"]')
+        .expect(403, 'entity.verify.failed', done)
+    })
+
+    it('should allow custom codes', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] !== 0x5b) return
+        var err = new Error('no arrays')
+        err.status = 400
+        throw err
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send('["tobi"]')
+        .expect(400, 'no arrays', done)
+    })
+
+    it('should allow custom type', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] !== 0x5b) return
+        var err = new Error('no arrays')
+        err.type = 'foo.bar'
+        throw err
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .set('X-Error-Property', 'type')
+        .send('["tobi"]')
+        .expect(403, 'foo.bar', done)
+    })
+
+    it('should include original body on error object', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x5b) throw new Error('no arrays')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .set('X-Error-Property', 'body')
+        .send('["tobi"]')
+        .expect(403, '["tobi"]', done)
+    })
+
+    it('should allow pass-through', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x5b) throw new Error('no arrays')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/json')
+        .send('{"user":"tobi"}')
+        .expect(200, '{"user":"tobi"}', done)
+    })
+
+    it('should work with different charsets', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x5b) throw new Error('no arrays')
+      } })
+
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/json; charset=utf-16')
+      test.write(Buffer.from('feff007b0022006e0061006d00650022003a00228bba0022007d', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should 415 on unknown charset prior to verify', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        throw new Error('unexpected verify call')
+      } })
+
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/json; charset=x-bogus')
+      test.write(Buffer.from('00000000', 'hex'))
+      test.expect(415, 'unsupported charset "X-BOGUS"', done)
+    })
+  })
+
+  describe('charset', function () {
+    before(function () {
+      this.app = createApp()
+    })
+
+    it('should parse utf-8', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/json; charset=utf-8')
+      test.write(Buffer.from('7b226e616d65223a22e8aeba227d', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should parse utf-16', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/json; charset=utf-16')
+      test.write(Buffer.from('feff007b0022006e0061006d00650022003a00228bba0022007d', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should parse when content-length != char length', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/json; charset=utf-8')
+      test.set('Content-Length', '13')
+      test.write(Buffer.from('7b2274657374223a22c3a5227d', 'hex'))
+      test.expect(200, '{"test":"å"}', done)
+    })
+
+    it('should default to utf-8', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('7b226e616d65223a22e8aeba227d', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should fail on unknown charset', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/json; charset=koi8-r')
+      test.write(Buffer.from('7b226e616d65223a22cec5d4227d', 'hex'))
+      test.expect(415, 'unsupported charset "KOI8-R"', done)
+    })
+
+    it('should error with type = "charset.unsupported"', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/json; charset=koi8-r')
+      test.set('X-Error-Property', 'type')
+      test.write(Buffer.from('7b226e616d65223a22cec5d4227d', 'hex'))
+      test.expect(415, 'charset.unsupported', done)
+    })
+  })
+
+  describe('encoding', function () {
+    before(function () {
+      this.app = createApp({ limit: '1kb' })
+    })
+
+    it('should parse without encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('7b226e616d65223a22e8aeba227d', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should support identity encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'identity')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('7b226e616d65223a22e8aeba227d', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should support gzip encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('1f8b080000000000000bab56ca4bcc4d55b2527ab16e97522d00515be1cc0e000000', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should support deflate encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'deflate')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('789cab56ca4bcc4d55b2527ab16e97522d00274505ac', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should be case-insensitive', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'GZIP')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('1f8b080000000000000bab56ca4bcc4d55b2527ab16e97522d00515be1cc0e000000', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should 415 on unknown encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'nulls')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('000000000000', 'hex'))
+      test.expect(415, 'unsupported content encoding "nulls"', done)
+    })
+
+    it('should error with type = "encoding.unsupported"', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'nulls')
+      test.set('Content-Type', 'application/json')
+      test.set('X-Error-Property', 'type')
+      test.write(Buffer.from('000000000000', 'hex'))
+      test.expect(415, 'encoding.unsupported', done)
+    })
+
+    it('should 400 on malformed encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('1f8b080000000000000bab56cc4d55b2527ab16e97522d00515be1cc0e000000', 'hex'))
+      test.expect(400, done)
+    })
+
+    it('should 413 when inflated value exceeds limit', function (done) {
+      // gzip'd data exceeds 1kb, but deflated below 1kb
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/json')
+      test.write(Buffer.from('1f8b080000000000000bedc1010d000000c2a0f74f6d0f071400000000000000', 'hex'))
+      test.write(Buffer.from('0000000000000000000000000000000000000000000000000000000000000000', 'hex'))
+      test.write(Buffer.from('0000000000000000004f0625b3b71650c30000', 'hex'))
+      test.expect(413, done)
+    })
+  })
+})
+
+function createApp (options) {
+  var app = express()
+
+  app.use(express.json(options))
+
+  app.use(function (err, req, res, next) {
+    res.status(err.status || 500)
+    res.send(String(err[req.headers['x-error-property'] || 'message']))
+  })
+
+  app.post('/', function (req, res) {
+    res.json(req.body)
+  })
+
+  return app
+}
+
+function parseError (str) {
+  try {
+    JSON.parse(str); throw new SyntaxError('strict violation')
+  } catch (e) {
+    return e.message
+  }
+}
+
+function shouldContainInBody (str) {
+  return function (res) {
+    assert.ok(res.text.indexOf(str) !== -1,
+      'expected \'' + res.text + '\' to contain \'' + str + '\'')
+  }
+}

From 8b71f39516135f8b729de3456f3ae7f6d33442a1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 May 2019 23:29:28 -0400
Subject: [PATCH 1240/1265] tests: add express.urlencoded test suite

---
 test/exports.js            |   5 +
 test/express.urlencoded.js | 734 +++++++++++++++++++++++++++++++++++++
 test/support/env.js        |   2 +-
 3 files changed, 740 insertions(+), 1 deletion(-)
 create mode 100644 test/express.urlencoded.js

diff --git a/test/exports.js b/test/exports.js
index bc2bb410fce..57b3265bd6f 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -14,6 +14,11 @@ describe('exports', function(){
     assert.equal(express.json.length, 1)
   })
 
+  it('should expose urlencoded middleware', function () {
+    assert.equal(typeof express.urlencoded, 'function')
+    assert.equal(express.urlencoded.length, 1)
+  })
+
   it('should expose the application prototype', function(){
     express.application.set.should.be.a.Function()
   })
diff --git a/test/express.urlencoded.js b/test/express.urlencoded.js
new file mode 100644
index 00000000000..6011de05f7a
--- /dev/null
+++ b/test/express.urlencoded.js
@@ -0,0 +1,734 @@
+
+var assert = require('assert')
+var Buffer = require('safe-buffer').Buffer
+var express = require('..')
+var request = require('supertest')
+
+describe('express.urlencoded()', function () {
+  before(function () {
+    this.app = createApp()
+  })
+
+  it('should parse x-www-form-urlencoded', function (done) {
+    request(this.app)
+      .post('/')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .send('user=tobi')
+      .expect(200, '{"user":"tobi"}', done)
+  })
+
+  it('should 400 when invalid content-length', function (done) {
+    var app = express()
+
+    app.use(function (req, res, next) {
+      req.headers['content-length'] = '20' // bad length
+      next()
+    })
+
+    app.use(express.urlencoded())
+
+    app.post('/', function (req, res) {
+      res.json(req.body)
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .send('str=')
+      .expect(400, /content length/, done)
+  })
+
+  it('should handle Content-Length: 0', function (done) {
+    request(this.app)
+      .post('/')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .set('Content-Length', '0')
+      .send('')
+      .expect(200, '{}', done)
+  })
+
+  it('should handle empty message-body', function (done) {
+    request(createApp({ limit: '1kb' }))
+      .post('/')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .set('Transfer-Encoding', 'chunked')
+      .send('')
+      .expect(200, '{}', done)
+  })
+
+  it('should handle duplicated middleware', function (done) {
+    var app = express()
+
+    app.use(express.urlencoded())
+    app.use(express.urlencoded())
+
+    app.post('/', function (req, res) {
+      res.json(req.body)
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .send('user=tobi')
+      .expect(200, '{"user":"tobi"}', done)
+  })
+
+  it('should parse extended syntax', function (done) {
+    request(this.app)
+      .post('/')
+      .set('Content-Type', 'application/x-www-form-urlencoded')
+      .send('user[name][first]=Tobi')
+      .expect(200, '{"user":{"name":{"first":"Tobi"}}}', done)
+  })
+
+  describe('with extended option', function () {
+    describe('when false', function () {
+      before(function () {
+        this.app = createApp({ extended: false })
+      })
+
+      it('should not parse extended syntax', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('user[name][first]=Tobi')
+          .expect(200, '{"user[name][first]":"Tobi"}', done)
+      })
+
+      it('should parse multiple key instances', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('user=Tobi&user=Loki')
+          .expect(200, '{"user":["Tobi","Loki"]}', done)
+      })
+    })
+
+    describe('when true', function () {
+      before(function () {
+        this.app = createApp({ extended: true })
+      })
+
+      it('should parse multiple key instances', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('user=Tobi&user=Loki')
+          .expect(200, '{"user":["Tobi","Loki"]}', done)
+      })
+
+      it('should parse extended syntax', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('user[name][first]=Tobi')
+          .expect(200, '{"user":{"name":{"first":"Tobi"}}}', done)
+      })
+
+      it('should parse parameters with dots', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('user.name=Tobi')
+          .expect(200, '{"user.name":"Tobi"}', done)
+      })
+
+      it('should parse fully-encoded extended syntax', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('user%5Bname%5D%5Bfirst%5D=Tobi')
+          .expect(200, '{"user":{"name":{"first":"Tobi"}}}', done)
+      })
+
+      it('should parse array index notation', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('foo[0]=bar&foo[1]=baz')
+          .expect(200, '{"foo":["bar","baz"]}', done)
+      })
+
+      it('should parse array index notation with large array', function (done) {
+        var str = 'f[0]=0'
+
+        for (var i = 1; i < 500; i++) {
+          str += '&f[' + i + ']=' + i.toString(16)
+        }
+
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(str)
+          .expect(function (res) {
+            var obj = JSON.parse(res.text)
+            assert.strictEqual(Object.keys(obj).length, 1)
+            assert.strictEqual(Array.isArray(obj.f), true)
+            assert.strictEqual(obj.f.length, 500)
+          })
+          .expect(200, done)
+      })
+
+      it('should parse array of objects syntax', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('foo[0][bar]=baz&foo[0][fizz]=buzz&foo[]=done!')
+          .expect(200, '{"foo":[{"bar":"baz","fizz":"buzz"},"done!"]}', done)
+      })
+
+      it('should parse deep object', function (done) {
+        var str = 'foo'
+
+        for (var i = 0; i < 500; i++) {
+          str += '[p]'
+        }
+
+        str += '=bar'
+
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(str)
+          .expect(function (res) {
+            var obj = JSON.parse(res.text)
+            assert.strictEqual(Object.keys(obj).length, 1)
+            assert.strictEqual(typeof obj.foo, 'object')
+
+            var depth = 0
+            var ref = obj.foo
+            while ((ref = ref.p)) { depth++ }
+            assert.strictEqual(depth, 500)
+          })
+          .expect(200, done)
+      })
+    })
+  })
+
+  describe('with inflate option', function () {
+    describe('when false', function () {
+      before(function () {
+        this.app = createApp({ inflate: false })
+      })
+
+      it('should not accept content-encoding', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Encoding', 'gzip')
+        test.set('Content-Type', 'application/x-www-form-urlencoded')
+        test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+        test.expect(415, 'content encoding unsupported', done)
+      })
+    })
+
+    describe('when true', function () {
+      before(function () {
+        this.app = createApp({ inflate: true })
+      })
+
+      it('should accept content-encoding', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Encoding', 'gzip')
+        test.set('Content-Type', 'application/x-www-form-urlencoded')
+        test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+        test.expect(200, '{"name":"论"}', done)
+      })
+    })
+  })
+
+  describe('with limit option', function () {
+    it('should 413 when over limit with Content-Length', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      request(createApp({ limit: '1kb' }))
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .set('Content-Length', '1028')
+        .send('str=' + buf.toString())
+        .expect(413, done)
+    })
+
+    it('should 413 when over limit with chunked encoding', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      var app = createApp({ limit: '1kb' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.set('Transfer-Encoding', 'chunked')
+      test.write('str=')
+      test.write(buf.toString())
+      test.expect(413, done)
+    })
+
+    it('should accept number of bytes', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      request(createApp({ limit: 1024 }))
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .send('str=' + buf.toString())
+        .expect(413, done)
+    })
+
+    it('should not change when options altered', function (done) {
+      var buf = Buffer.alloc(1024, '.')
+      var options = { limit: '1kb' }
+      var app = createApp(options)
+
+      options.limit = '100kb'
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .send('str=' + buf.toString())
+        .expect(413, done)
+    })
+
+    it('should not hang response', function (done) {
+      var buf = Buffer.alloc(10240, '.')
+      var app = createApp({ limit: '8kb' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(buf)
+      test.write(buf)
+      test.write(buf)
+      test.expect(413, done)
+    })
+  })
+
+  describe('with parameterLimit option', function () {
+    describe('with extended: false', function () {
+      it('should reject 0', function () {
+        assert.throws(createApp.bind(null, { extended: false, parameterLimit: 0 }),
+          /TypeError: option parameterLimit must be a positive number/)
+      })
+
+      it('should reject string', function () {
+        assert.throws(createApp.bind(null, { extended: false, parameterLimit: 'beep' }),
+          /TypeError: option parameterLimit must be a positive number/)
+      })
+
+      it('should 413 if over limit', function (done) {
+        request(createApp({ extended: false, parameterLimit: 10 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(11))
+          .expect(413, /too many parameters/, done)
+      })
+
+      it('should error with type = "parameters.too.many"', function (done) {
+        request(createApp({ extended: false, parameterLimit: 10 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .set('X-Error-Property', 'type')
+          .send(createManyParams(11))
+          .expect(413, 'parameters.too.many', done)
+      })
+
+      it('should work when at the limit', function (done) {
+        request(createApp({ extended: false, parameterLimit: 10 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(10))
+          .expect(expectKeyCount(10))
+          .expect(200, done)
+      })
+
+      it('should work if number is floating point', function (done) {
+        request(createApp({ extended: false, parameterLimit: 10.1 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(11))
+          .expect(413, /too many parameters/, done)
+      })
+
+      it('should work with large limit', function (done) {
+        request(createApp({ extended: false, parameterLimit: 5000 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(5000))
+          .expect(expectKeyCount(5000))
+          .expect(200, done)
+      })
+
+      it('should work with Infinity limit', function (done) {
+        request(createApp({ extended: false, parameterLimit: Infinity }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(10000))
+          .expect(expectKeyCount(10000))
+          .expect(200, done)
+      })
+    })
+
+    describe('with extended: true', function () {
+      it('should reject 0', function () {
+        assert.throws(createApp.bind(null, { extended: true, parameterLimit: 0 }),
+          /TypeError: option parameterLimit must be a positive number/)
+      })
+
+      it('should reject string', function () {
+        assert.throws(createApp.bind(null, { extended: true, parameterLimit: 'beep' }),
+          /TypeError: option parameterLimit must be a positive number/)
+      })
+
+      it('should 413 if over limit', function (done) {
+        request(createApp({ extended: true, parameterLimit: 10 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(11))
+          .expect(413, /too many parameters/, done)
+      })
+
+      it('should error with type = "parameters.too.many"', function (done) {
+        request(createApp({ extended: true, parameterLimit: 10 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .set('X-Error-Property', 'type')
+          .send(createManyParams(11))
+          .expect(413, 'parameters.too.many', done)
+      })
+
+      it('should work when at the limit', function (done) {
+        request(createApp({ extended: true, parameterLimit: 10 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(10))
+          .expect(expectKeyCount(10))
+          .expect(200, done)
+      })
+
+      it('should work if number is floating point', function (done) {
+        request(createApp({ extended: true, parameterLimit: 10.1 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(11))
+          .expect(413, /too many parameters/, done)
+      })
+
+      it('should work with large limit', function (done) {
+        request(createApp({ extended: true, parameterLimit: 5000 }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(5000))
+          .expect(expectKeyCount(5000))
+          .expect(200, done)
+      })
+
+      it('should work with Infinity limit', function (done) {
+        request(createApp({ extended: true, parameterLimit: Infinity }))
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send(createManyParams(10000))
+          .expect(expectKeyCount(10000))
+          .expect(200, done)
+      })
+    })
+  })
+
+  describe('with type option', function () {
+    describe('when "application/vnd.x-www-form-urlencoded"', function () {
+      before(function () {
+        this.app = createApp({ type: 'application/vnd.x-www-form-urlencoded' })
+      })
+
+      it('should parse for custom type', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/vnd.x-www-form-urlencoded')
+          .send('user=tobi')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should ignore standard type', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('user=tobi')
+          .expect(200, '{}', done)
+      })
+    })
+
+    describe('when ["urlencoded", "application/x-pairs"]', function () {
+      before(function () {
+        this.app = createApp({
+          type: ['urlencoded', 'application/x-pairs']
+        })
+      })
+
+      it('should parse "application/x-www-form-urlencoded"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-www-form-urlencoded')
+          .send('user=tobi')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should parse "application/x-pairs"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-pairs')
+          .send('user=tobi')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should ignore application/x-foo', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'application/x-foo')
+          .send('user=tobi')
+          .expect(200, '{}', done)
+      })
+    })
+
+    describe('when a function', function () {
+      it('should parse when truthy value returned', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          return req.headers['content-type'] === 'application/vnd.something'
+        }
+
+        request(app)
+          .post('/')
+          .set('Content-Type', 'application/vnd.something')
+          .send('user=tobi')
+          .expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should work without content-type', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          return true
+        }
+
+        var test = request(app).post('/')
+        test.write('user=tobi')
+        test.expect(200, '{"user":"tobi"}', done)
+      })
+
+      it('should not invoke without a body', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          throw new Error('oops!')
+        }
+
+        request(app)
+          .get('/')
+          .expect(404, done)
+      })
+    })
+  })
+
+  describe('with verify option', function () {
+    it('should assert value if function', function () {
+      assert.throws(createApp.bind(null, { verify: 'lol' }),
+        /TypeError: option verify must be function/)
+    })
+
+    it('should error from verify', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x20) throw new Error('no leading space')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .send(' user=tobi')
+        .expect(403, 'no leading space', done)
+    })
+
+    it('should error with type = "entity.verify.failed"', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x20) throw new Error('no leading space')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .set('X-Error-Property', 'type')
+        .send(' user=tobi')
+        .expect(403, 'entity.verify.failed', done)
+    })
+
+    it('should allow custom codes', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] !== 0x20) return
+        var err = new Error('no leading space')
+        err.status = 400
+        throw err
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .send(' user=tobi')
+        .expect(400, 'no leading space', done)
+    })
+
+    it('should allow custom type', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] !== 0x20) return
+        var err = new Error('no leading space')
+        err.type = 'foo.bar'
+        throw err
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .set('X-Error-Property', 'type')
+        .send(' user=tobi')
+        .expect(403, 'foo.bar', done)
+    })
+
+    it('should allow pass-through', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x5b) throw new Error('no arrays')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'application/x-www-form-urlencoded')
+        .send('user=tobi')
+        .expect(200, '{"user":"tobi"}', done)
+    })
+
+    it('should 415 on unknown charset prior to verify', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        throw new Error('unexpected verify call')
+      } })
+
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/x-www-form-urlencoded; charset=x-bogus')
+      test.write(Buffer.from('00000000', 'hex'))
+      test.expect(415, 'unsupported charset "X-BOGUS"', done)
+    })
+  })
+
+  describe('charset', function () {
+    before(function () {
+      this.app = createApp()
+    })
+
+    it('should parse utf-8', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/x-www-form-urlencoded; charset=utf-8')
+      test.write(Buffer.from('6e616d653de8aeba', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should parse when content-length != char length', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/x-www-form-urlencoded; charset=utf-8')
+      test.set('Content-Length', '7')
+      test.write(Buffer.from('746573743dc3a5', 'hex'))
+      test.expect(200, '{"test":"å"}', done)
+    })
+
+    it('should default to utf-8', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('6e616d653de8aeba', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should fail on unknown charset', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/x-www-form-urlencoded; charset=koi8-r')
+      test.write(Buffer.from('6e616d653dcec5d4', 'hex'))
+      test.expect(415, 'unsupported charset "KOI8-R"', done)
+    })
+  })
+
+  describe('encoding', function () {
+    before(function () {
+      this.app = createApp({ limit: '10kb' })
+    })
+
+    it('should parse without encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('6e616d653de8aeba', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should support identity encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'identity')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('6e616d653de8aeba', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should support gzip encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should support deflate encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'deflate')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('789ccb4bcc4db57db16e17001068042f', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should be case-insensitive', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'GZIP')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+      test.expect(200, '{"name":"论"}', done)
+    })
+
+    it('should fail on unknown encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'nulls')
+      test.set('Content-Type', 'application/x-www-form-urlencoded')
+      test.write(Buffer.from('000000000000', 'hex'))
+      test.expect(415, 'unsupported content encoding "nulls"', done)
+    })
+  })
+})
+
+function createManyParams (count) {
+  var str = ''
+
+  if (count === 0) {
+    return str
+  }
+
+  str += '0=0'
+
+  for (var i = 1; i < count; i++) {
+    var n = i.toString(36)
+    str += '&' + n + '=' + n
+  }
+
+  return str
+}
+
+function createApp (options) {
+  var app = express()
+
+  app.use(express.urlencoded(options))
+
+  app.use(function (err, req, res, next) {
+    res.status(err.status || 500)
+    res.send(String(err[req.headers['x-error-property'] || 'message']))
+  })
+
+  app.post('/', function (req, res) {
+    res.json(req.body)
+  })
+
+  return app
+}
+
+function expectKeyCount (count) {
+  return function (res) {
+    assert.strictEqual(Object.keys(JSON.parse(res.text)).length, count)
+  }
+}
diff --git a/test/support/env.js b/test/support/env.js
index 0701f5e334f..000638ceeae 100644
--- a/test/support/env.js
+++ b/test/support/env.js
@@ -1,3 +1,3 @@
 
 process.env.NODE_ENV = 'test';
-process.env.NO_DEPRECATION = 'express';
+process.env.NO_DEPRECATION = 'body-parser,express';

From 6f7a8301a1828febe0b10af62152558d118b039c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 2 May 2019 17:49:29 -0400
Subject: [PATCH 1241/1265] tests: add express.static test suite

---
 test/exports.js                            |   5 +
 test/express.static.js                     | 813 +++++++++++++++++++++
 test/fixtures/empty.txt                    |   0
 test/fixtures/nums.txt                     |   1 +
 test/fixtures/pets/names.txt               |   1 +
 "test/fixtures/snow \342\230\203/.gitkeep" |   0
 test/fixtures/todo.html                    |   1 +
 test/fixtures/todo.txt                     |   1 +
 test/fixtures/users/index.html             |   1 +
 test/fixtures/users/tobi.txt               |   1 +
 test/support/utils.js                      |  34 +
 11 files changed, 858 insertions(+)
 create mode 100644 test/express.static.js
 create mode 100644 test/fixtures/empty.txt
 create mode 100644 test/fixtures/nums.txt
 create mode 100644 test/fixtures/pets/names.txt
 create mode 100644 "test/fixtures/snow \342\230\203/.gitkeep"
 create mode 100644 test/fixtures/todo.html
 create mode 100644 test/fixtures/todo.txt
 create mode 100644 test/fixtures/users/index.html
 create mode 100644 test/fixtures/users/tobi.txt

diff --git a/test/exports.js b/test/exports.js
index 57b3265bd6f..e5fb6f2a9cf 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -14,6 +14,11 @@ describe('exports', function(){
     assert.equal(express.json.length, 1)
   })
 
+  it('should expose static middleware', function () {
+    assert.equal(typeof express.static, 'function')
+    assert.equal(express.static.length, 2)
+  })
+
   it('should expose urlencoded middleware', function () {
     assert.equal(typeof express.urlencoded, 'function')
     assert.equal(express.urlencoded.length, 1)
diff --git a/test/express.static.js b/test/express.static.js
new file mode 100644
index 00000000000..7c9852243e6
--- /dev/null
+++ b/test/express.static.js
@@ -0,0 +1,813 @@
+
+var assert = require('assert')
+var Buffer = require('safe-buffer').Buffer
+var express = require('..')
+var path = require('path')
+var request = require('supertest')
+var utils = require('./support/utils')
+
+var fixtures = path.join(__dirname, '/fixtures')
+var relative = path.relative(process.cwd(), fixtures)
+
+var skipRelative = ~relative.indexOf('..') || path.resolve(relative) === relative
+
+describe('express.static()', function () {
+  describe('basic operations', function () {
+    before(function () {
+      this.app = createApp()
+    })
+
+    it('should require root path', function () {
+      assert.throws(express.static.bind(), /root path required/)
+    })
+
+    it('should require root path to be string', function () {
+      assert.throws(express.static.bind(null, 42), /root path.*string/)
+    })
+
+    it('should serve static files', function (done) {
+      request(this.app)
+        .get('/todo.txt')
+        .expect(200, '- groceries', done)
+    })
+
+    it('should support nesting', function (done) {
+      request(this.app)
+        .get('/users/tobi.txt')
+        .expect(200, 'ferret', done)
+    })
+
+    it('should set Content-Type', function (done) {
+      request(this.app)
+        .get('/todo.txt')
+        .expect('Content-Type', 'text/plain; charset=UTF-8')
+        .expect(200, done)
+    })
+
+    it('should set Last-Modified', function (done) {
+      request(this.app)
+        .get('/todo.txt')
+        .expect('Last-Modified', /\d{2} \w{3} \d{4}/)
+        .expect(200, done)
+    })
+
+    it('should default max-age=0', function (done) {
+      request(this.app)
+        .get('/todo.txt')
+        .expect('Cache-Control', 'public, max-age=0')
+        .expect(200, done)
+    })
+
+    it('should support urlencoded pathnames', function (done) {
+      request(this.app)
+        .get('/%25%20of%20dogs.txt')
+        .expect(200, '20%', done)
+    })
+
+    it('should not choke on auth-looking URL', function (done) {
+      request(this.app)
+        .get('//todo@txt')
+        .expect(404, 'Not Found', done)
+    })
+
+    it('should support index.html', function (done) {
+      request(this.app)
+        .get('/users/')
+        .expect(200)
+        .expect('Content-Type', /html/)
+        .expect('<p>tobi, loki, jane</p>', done)
+    })
+
+    it('should support ../', function (done) {
+      request(this.app)
+        .get('/users/../todo.txt')
+        .expect(200, '- groceries', done)
+    })
+
+    it('should support HEAD', function (done) {
+      request(this.app)
+        .head('/todo.txt')
+        .expect(200)
+        .expect(utils.shouldNotHaveBody())
+        .end(done)
+    })
+
+    it('should skip POST requests', function (done) {
+      request(this.app)
+        .post('/todo.txt')
+        .expect(404, 'Not Found', done)
+    })
+
+    it('should support conditional requests', function (done) {
+      var app = this.app
+
+      request(app)
+        .get('/todo.txt')
+        .end(function (err, res) {
+          if (err) throw err
+          request(app)
+            .get('/todo.txt')
+            .set('If-None-Match', res.headers.etag)
+            .expect(304, done)
+        })
+    })
+
+    it('should support precondition checks', function (done) {
+      request(this.app)
+        .get('/todo.txt')
+        .set('If-Match', '"foo"')
+        .expect(412, done)
+    })
+
+    it('should serve zero-length files', function (done) {
+      request(this.app)
+        .get('/empty.txt')
+        .expect(200, '', done)
+    })
+
+    it('should ignore hidden files', function (done) {
+      request(this.app)
+        .get('/.name')
+        .expect(404, 'Not Found', done)
+    })
+  });
+
+  (skipRelative ? describe.skip : describe)('current dir', function () {
+    before(function () {
+      this.app = createApp('.')
+    })
+
+    it('should be served with "."', function (done) {
+      var dest = relative.split(path.sep).join('/')
+      request(this.app)
+        .get('/' + dest + '/todo.txt')
+        .expect(200, '- groceries', done)
+    })
+  })
+
+  describe('acceptRanges', function () {
+    describe('when false', function () {
+      it('should not include Accept-Ranges', function (done) {
+        request(createApp(fixtures, { 'acceptRanges': false }))
+          .get('/nums.txt')
+          .expect(utils.shouldNotHaveHeader('Accept-Ranges'))
+          .expect(200, '123456789', done)
+      })
+
+      it('should ignore Rage request header', function (done) {
+        request(createApp(fixtures, { 'acceptRanges': false }))
+          .get('/nums.txt')
+          .set('Range', 'bytes=0-3')
+          .expect(utils.shouldNotHaveHeader('Accept-Ranges'))
+          .expect(utils.shouldNotHaveHeader('Content-Range'))
+          .expect(200, '123456789', done)
+      })
+    })
+
+    describe('when true', function () {
+      it('should include Accept-Ranges', function (done) {
+        request(createApp(fixtures, { 'acceptRanges': true }))
+          .get('/nums.txt')
+          .expect('Accept-Ranges', 'bytes')
+          .expect(200, '123456789', done)
+      })
+
+      it('should obey Rage request header', function (done) {
+        request(createApp(fixtures, { 'acceptRanges': true }))
+          .get('/nums.txt')
+          .set('Range', 'bytes=0-3')
+          .expect('Accept-Ranges', 'bytes')
+          .expect('Content-Range', 'bytes 0-3/9')
+          .expect(206, '1234', done)
+      })
+    })
+  })
+
+  describe('cacheControl', function () {
+    describe('when false', function () {
+      it('should not include Cache-Control', function (done) {
+        request(createApp(fixtures, { 'cacheControl': false }))
+          .get('/nums.txt')
+          .expect(utils.shouldNotHaveHeader('Cache-Control'))
+          .expect(200, '123456789', done)
+      })
+
+      it('should ignore maxAge', function (done) {
+        request(createApp(fixtures, { 'cacheControl': false, 'maxAge': 12000 }))
+          .get('/nums.txt')
+          .expect(utils.shouldNotHaveHeader('Cache-Control'))
+          .expect(200, '123456789', done)
+      })
+    })
+
+    describe('when true', function () {
+      it('should include Cache-Control', function (done) {
+        request(createApp(fixtures, { 'cacheControl': true }))
+          .get('/nums.txt')
+          .expect('Cache-Control', 'public, max-age=0')
+          .expect(200, '123456789', done)
+      })
+    })
+  })
+
+  describe('extensions', function () {
+    it('should be not be enabled by default', function (done) {
+      request(createApp(fixtures))
+        .get('/todo')
+        .expect(404, done)
+    })
+
+    it('should be configurable', function (done) {
+      request(createApp(fixtures, { 'extensions': 'txt' }))
+        .get('/todo')
+        .expect(200, '- groceries', done)
+    })
+
+    it('should support disabling extensions', function (done) {
+      request(createApp(fixtures, { 'extensions': false }))
+        .get('/todo')
+        .expect(404, done)
+    })
+
+    it('should support fallbacks', function (done) {
+      request(createApp(fixtures, { 'extensions': ['htm', 'html', 'txt'] }))
+        .get('/todo')
+        .expect(200, '<li>groceries</li>', done)
+    })
+
+    it('should 404 if nothing found', function (done) {
+      request(createApp(fixtures, { 'extensions': ['htm', 'html', 'txt'] }))
+        .get('/bob')
+        .expect(404, done)
+    })
+  })
+
+  describe('fallthrough', function () {
+    it('should default to true', function (done) {
+      request(createApp())
+        .get('/does-not-exist')
+        .expect(404, 'Not Found', done)
+    })
+
+    describe('when true', function () {
+      before(function () {
+        this.app = createApp(fixtures, { 'fallthrough': true })
+      })
+
+      it('should fall-through when OPTIONS request', function (done) {
+        request(this.app)
+          .options('/todo.txt')
+          .expect(404, 'Not Found', done)
+      })
+
+      it('should fall-through when URL malformed', function (done) {
+        request(this.app)
+          .get('/%')
+          .expect(404, 'Not Found', done)
+      })
+
+      it('should fall-through when traversing past root', function (done) {
+        request(this.app)
+          .get('/users/../../todo.txt')
+          .expect(404, 'Not Found', done)
+      })
+
+      it('should fall-through when URL too long', function (done) {
+        var app = express()
+        var root = fixtures + Array(10000).join('/foobar')
+
+        app.use(express.static(root, { 'fallthrough': true }))
+        app.use(function (req, res, next) {
+          res.sendStatus(404)
+        })
+
+        request(app)
+          .get('/')
+          .expect(404, 'Not Found', done)
+      })
+
+      describe('with redirect: true', function () {
+        before(function () {
+          this.app = createApp(fixtures, { 'fallthrough': true, 'redirect': true })
+        })
+
+        it('should fall-through when directory', function (done) {
+          request(this.app)
+            .get('/pets/')
+            .expect(404, 'Not Found', done)
+        })
+
+        it('should redirect when directory without slash', function (done) {
+          request(this.app)
+            .get('/pets')
+            .expect(301, /Redirecting/, done)
+        })
+      })
+
+      describe('with redirect: false', function () {
+        before(function () {
+          this.app = createApp(fixtures, { 'fallthrough': true, 'redirect': false })
+        })
+
+        it('should fall-through when directory', function (done) {
+          request(this.app)
+            .get('/pets/')
+            .expect(404, 'Not Found', done)
+        })
+
+        it('should fall-through when directory without slash', function (done) {
+          request(this.app)
+            .get('/pets')
+            .expect(404, 'Not Found', done)
+        })
+      })
+    })
+
+    describe('when false', function () {
+      before(function () {
+        this.app = createApp(fixtures, { 'fallthrough': false })
+      })
+
+      it('should 405 when OPTIONS request', function (done) {
+        request(this.app)
+          .options('/todo.txt')
+          .expect('Allow', 'GET, HEAD')
+          .expect(405, done)
+      })
+
+      it('should 400 when URL malformed', function (done) {
+        request(this.app)
+          .get('/%')
+          .expect(400, /BadRequestError/, done)
+      })
+
+      it('should 403 when traversing past root', function (done) {
+        request(this.app)
+          .get('/users/../../todo.txt')
+          .expect(403, /ForbiddenError/, done)
+      })
+
+      it('should 404 when URL too long', function (done) {
+        var app = express()
+        var root = fixtures + Array(10000).join('/foobar')
+
+        app.use(express.static(root, { 'fallthrough': false }))
+        app.use(function (req, res, next) {
+          res.sendStatus(404)
+        })
+
+        request(app)
+          .get('/')
+          .expect(404, /ENAMETOOLONG/, done)
+      })
+
+      describe('with redirect: true', function () {
+        before(function () {
+          this.app = createApp(fixtures, { 'fallthrough': false, 'redirect': true })
+        })
+
+        it('should 404 when directory', function (done) {
+          request(this.app)
+            .get('/pets/')
+            .expect(404, /NotFoundError|ENOENT/, done)
+        })
+
+        it('should redirect when directory without slash', function (done) {
+          request(this.app)
+            .get('/pets')
+            .expect(301, /Redirecting/, done)
+        })
+      })
+
+      describe('with redirect: false', function () {
+        before(function () {
+          this.app = createApp(fixtures, { 'fallthrough': false, 'redirect': false })
+        })
+
+        it('should 404 when directory', function (done) {
+          request(this.app)
+            .get('/pets/')
+            .expect(404, /NotFoundError|ENOENT/, done)
+        })
+
+        it('should 404 when directory without slash', function (done) {
+          request(this.app)
+            .get('/pets')
+            .expect(404, /NotFoundError|ENOENT/, done)
+        })
+      })
+    })
+  })
+
+  describe('hidden files', function () {
+    before(function () {
+      this.app = createApp(fixtures, { 'dotfiles': 'allow' })
+    })
+
+    it('should be served when dotfiles: "allow" is given', function (done) {
+      request(this.app)
+        .get('/.name')
+        .expect(200)
+        .expect(utils.shouldHaveBody(Buffer.from('tobi')))
+        .end(done)
+    })
+  })
+
+  describe('immutable', function () {
+    it('should default to false', function (done) {
+      request(createApp(fixtures))
+        .get('/nums.txt')
+        .expect('Cache-Control', 'public, max-age=0', done)
+    })
+
+    it('should set immutable directive in Cache-Control', function (done) {
+      request(createApp(fixtures, { 'immutable': true, 'maxAge': '1h' }))
+        .get('/nums.txt')
+        .expect('Cache-Control', 'public, max-age=3600, immutable', done)
+    })
+  })
+
+  describe('lastModified', function () {
+    describe('when false', function () {
+      it('should not include Last-Modifed', function (done) {
+        request(createApp(fixtures, { 'lastModified': false }))
+          .get('/nums.txt')
+          .expect(utils.shouldNotHaveHeader('Last-Modified'))
+          .expect(200, '123456789', done)
+      })
+    })
+
+    describe('when true', function () {
+      it('should include Last-Modifed', function (done) {
+        request(createApp(fixtures, { 'lastModified': true }))
+          .get('/nums.txt')
+          .expect('Last-Modified', /^\w{3}, \d+ \w+ \d+ \d+:\d+:\d+ \w+$/)
+          .expect(200, '123456789', done)
+      })
+    })
+  })
+
+  describe('maxAge', function () {
+    it('should accept string', function (done) {
+      request(createApp(fixtures, { 'maxAge': '30d' }))
+        .get('/todo.txt')
+        .expect('cache-control', 'public, max-age=' + (60 * 60 * 24 * 30))
+        .expect(200, done)
+    })
+
+    it('should be reasonable when infinite', function (done) {
+      request(createApp(fixtures, { 'maxAge': Infinity }))
+        .get('/todo.txt')
+        .expect('cache-control', 'public, max-age=' + (60 * 60 * 24 * 365))
+        .expect(200, done)
+    })
+  })
+
+  describe('redirect', function () {
+    before(function () {
+      this.app = express()
+      this.app.use(function (req, res, next) {
+        req.originalUrl = req.url =
+          req.originalUrl.replace(/\/snow(\/|$)/, '/snow \u2603$1')
+        next()
+      })
+      this.app.use(express.static(fixtures))
+    })
+
+    it('should redirect directories', function (done) {
+      request(this.app)
+        .get('/users')
+        .expect('Location', '/users/')
+        .expect(301, done)
+    })
+
+    it('should include HTML link', function (done) {
+      request(this.app)
+        .get('/users')
+        .expect('Location', '/users/')
+        .expect(301, /<a href="\/users\/">/, done)
+    })
+
+    it('should redirect directories with query string', function (done) {
+      request(this.app)
+        .get('/users?name=john')
+        .expect('Location', '/users/?name=john')
+        .expect(301, done)
+    })
+
+    it('should not redirect to protocol-relative locations', function (done) {
+      request(this.app)
+        .get('//users')
+        .expect('Location', '/users/')
+        .expect(301, done)
+    })
+
+    it('should ensure redirect URL is properly encoded', function (done) {
+      request(this.app)
+        .get('/snow')
+        .expect('Location', '/snow%20%E2%98%83/')
+        .expect('Content-Type', /html/)
+        .expect(301, />Redirecting to <a href="\/snow%20%E2%98%83\/">\/snow%20%E2%98%83\/<\/a></, done)
+    })
+
+    it('should respond with default Content-Security-Policy', function (done) {
+      request(this.app)
+        .get('/users')
+        .expect('Content-Security-Policy', "default-src 'self'")
+        .expect(301, done)
+    })
+
+    it('should not redirect incorrectly', function (done) {
+      request(this.app)
+        .get('/')
+        .expect(404, done)
+    })
+
+    describe('when false', function () {
+      before(function () {
+        this.app = createApp(fixtures, { 'redirect': false })
+      })
+
+      it('should disable redirect', function (done) {
+        request(this.app)
+          .get('/users')
+          .expect(404, done)
+      })
+    })
+  })
+
+  describe('setHeaders', function () {
+    before(function () {
+      this.app = express()
+      this.app.use(express.static(fixtures, { 'setHeaders': function (res) {
+        res.setHeader('x-custom', 'set')
+      } }))
+    })
+
+    it('should reject non-functions', function () {
+      assert.throws(express.static.bind(null, fixtures, { 'setHeaders': 3 }), /setHeaders.*function/)
+    })
+
+    it('should get called when sending file', function (done) {
+      request(this.app)
+        .get('/nums.txt')
+        .expect('x-custom', 'set')
+        .expect(200, done)
+    })
+
+    it('should not get called on 404', function (done) {
+      request(this.app)
+        .get('/bogus')
+        .expect(utils.shouldNotHaveHeader('x-custom'))
+        .expect(404, done)
+    })
+
+    it('should not get called on redirect', function (done) {
+      request(this.app)
+        .get('/users')
+        .expect(utils.shouldNotHaveHeader('x-custom'))
+        .expect(301, done)
+    })
+  })
+
+  describe('when traversing past root', function () {
+    before(function () {
+      this.app = createApp(fixtures, { 'fallthrough': false })
+    })
+
+    it('should catch urlencoded ../', function (done) {
+      request(this.app)
+        .get('/users/%2e%2e/%2e%2e/todo.txt')
+        .expect(403, done)
+    })
+
+    it('should not allow root path disclosure', function (done) {
+      request(this.app)
+        .get('/users/../../fixtures/todo.txt')
+        .expect(403, done)
+    })
+  })
+
+  describe('when request has "Range" header', function () {
+    before(function () {
+      this.app = createApp()
+    })
+
+    it('should support byte ranges', function (done) {
+      request(this.app)
+        .get('/nums.txt')
+        .set('Range', 'bytes=0-4')
+        .expect('12345', done)
+    })
+
+    it('should be inclusive', function (done) {
+      request(this.app)
+        .get('/nums.txt')
+        .set('Range', 'bytes=0-0')
+        .expect('1', done)
+    })
+
+    it('should set Content-Range', function (done) {
+      request(this.app)
+        .get('/nums.txt')
+        .set('Range', 'bytes=2-5')
+        .expect('Content-Range', 'bytes 2-5/9', done)
+    })
+
+    it('should support -n', function (done) {
+      request(this.app)
+        .get('/nums.txt')
+        .set('Range', 'bytes=-3')
+        .expect('789', done)
+    })
+
+    it('should support n-', function (done) {
+      request(this.app)
+        .get('/nums.txt')
+        .set('Range', 'bytes=3-')
+        .expect('456789', done)
+    })
+
+    it('should respond with 206 "Partial Content"', function (done) {
+      request(this.app)
+        .get('/nums.txt')
+        .set('Range', 'bytes=0-4')
+        .expect(206, done)
+    })
+
+    it('should set Content-Length to the # of octets transferred', function (done) {
+      request(this.app)
+        .get('/nums.txt')
+        .set('Range', 'bytes=2-3')
+        .expect('Content-Length', '2')
+        .expect(206, '34', done)
+    })
+
+    describe('when last-byte-pos of the range is greater than current length', function () {
+      it('is taken to be equal to one less than the current length', function (done) {
+        request(this.app)
+          .get('/nums.txt')
+          .set('Range', 'bytes=2-50')
+          .expect('Content-Range', 'bytes 2-8/9', done)
+      })
+
+      it('should adapt the Content-Length accordingly', function (done) {
+        request(this.app)
+          .get('/nums.txt')
+          .set('Range', 'bytes=2-50')
+          .expect('Content-Length', '7')
+          .expect(206, done)
+      })
+    })
+
+    describe('when the first- byte-pos of the range is greater than the current length', function () {
+      it('should respond with 416', function (done) {
+        request(this.app)
+          .get('/nums.txt')
+          .set('Range', 'bytes=9-50')
+          .expect(416, done)
+      })
+
+      it('should include a Content-Range header of complete length', function (done) {
+        request(this.app)
+          .get('/nums.txt')
+          .set('Range', 'bytes=9-50')
+          .expect('Content-Range', 'bytes */9')
+          .expect(416, done)
+      })
+    })
+
+    describe('when syntactically invalid', function () {
+      it('should respond with 200 and the entire contents', function (done) {
+        request(this.app)
+          .get('/nums.txt')
+          .set('Range', 'asdf')
+          .expect('123456789', done)
+      })
+    })
+  })
+
+  describe('when index at mount point', function () {
+    before(function () {
+      this.app = express()
+      this.app.use('/users', express.static(fixtures + '/users'))
+    })
+
+    it('should redirect correctly', function (done) {
+      request(this.app)
+        .get('/users')
+        .expect('Location', '/users/')
+        .expect(301, done)
+    })
+  })
+
+  describe('when mounted', function () {
+    before(function () {
+      this.app = express()
+      this.app.use('/static', express.static(fixtures))
+    })
+
+    it('should redirect relative to the originalUrl', function (done) {
+      request(this.app)
+        .get('/static/users')
+        .expect('Location', '/static/users/')
+        .expect(301, done)
+    })
+
+    it('should not choke on auth-looking URL', function (done) {
+      request(this.app)
+        .get('//todo@txt')
+        .expect(404, done)
+    })
+  })
+
+  //
+  // NOTE: This is not a real part of the API, but
+  //       over time this has become something users
+  //       are doing, so this will prevent unseen
+  //       regressions around this use-case.
+  //
+  describe('when mounted "root" as a file', function () {
+    before(function () {
+      this.app = express()
+      this.app.use('/todo.txt', express.static(fixtures + '/todo.txt'))
+    })
+
+    it('should load the file when on trailing slash', function (done) {
+      request(this.app)
+        .get('/todo.txt')
+        .expect(200, '- groceries', done)
+    })
+
+    it('should 404 when trailing slash', function (done) {
+      request(this.app)
+        .get('/todo.txt/')
+        .expect(404, done)
+    })
+  })
+
+  describe('when responding non-2xx or 304', function () {
+    it('should not alter the status', function (done) {
+      var app = express()
+
+      app.use(function (req, res, next) {
+        res.status(501)
+        next()
+      })
+      app.use(express.static(fixtures))
+
+      request(app)
+        .get('/todo.txt')
+        .expect(501, '- groceries', done)
+    })
+  })
+
+  describe('when index file serving disabled', function () {
+    before(function () {
+      this.app = express()
+      this.app.use('/static', express.static(fixtures, { 'index': false }))
+      this.app.use(function (req, res, next) {
+        res.sendStatus(404)
+      })
+    })
+
+    it('should next() on directory', function (done) {
+      request(this.app)
+        .get('/static/users/')
+        .expect(404, 'Not Found', done)
+    })
+
+    it('should redirect to trailing slash', function (done) {
+      request(this.app)
+        .get('/static/users')
+        .expect('Location', '/static/users/')
+        .expect(301, done)
+    })
+
+    it('should next() on mount point', function (done) {
+      request(this.app)
+        .get('/static/')
+        .expect(404, 'Not Found', done)
+    })
+
+    it('should redirect to trailing slash mount point', function (done) {
+      request(this.app)
+        .get('/static')
+        .expect('Location', '/static/')
+        .expect(301, done)
+    })
+  })
+})
+
+function createApp (dir, options, fn) {
+  var app = express()
+  var root = dir || fixtures
+
+  app.use(express.static(root, options))
+
+  app.use(function (req, res, next) {
+    res.sendStatus(404)
+  })
+
+  return app
+}
diff --git a/test/fixtures/empty.txt b/test/fixtures/empty.txt
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/test/fixtures/nums.txt b/test/fixtures/nums.txt
new file mode 100644
index 00000000000..e2e107ac61a
--- /dev/null
+++ b/test/fixtures/nums.txt
@@ -0,0 +1 @@
+123456789
\ No newline at end of file
diff --git a/test/fixtures/pets/names.txt b/test/fixtures/pets/names.txt
new file mode 100644
index 00000000000..91407a3e048
--- /dev/null
+++ b/test/fixtures/pets/names.txt
@@ -0,0 +1 @@
+tobi,loki
\ No newline at end of file
diff --git "a/test/fixtures/snow \342\230\203/.gitkeep" "b/test/fixtures/snow \342\230\203/.gitkeep"
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/test/fixtures/todo.html b/test/fixtures/todo.html
new file mode 100644
index 00000000000..e7af6d7998d
--- /dev/null
+++ b/test/fixtures/todo.html
@@ -0,0 +1 @@
+<li>groceries</li>
\ No newline at end of file
diff --git a/test/fixtures/todo.txt b/test/fixtures/todo.txt
new file mode 100644
index 00000000000..8c3539d9461
--- /dev/null
+++ b/test/fixtures/todo.txt
@@ -0,0 +1 @@
+- groceries
\ No newline at end of file
diff --git a/test/fixtures/users/index.html b/test/fixtures/users/index.html
new file mode 100644
index 00000000000..00a2db41f75
--- /dev/null
+++ b/test/fixtures/users/index.html
@@ -0,0 +1 @@
+<p>tobi, loki, jane</p>
\ No newline at end of file
diff --git a/test/fixtures/users/tobi.txt b/test/fixtures/users/tobi.txt
new file mode 100644
index 00000000000..9d9529d47d7
--- /dev/null
+++ b/test/fixtures/users/tobi.txt
@@ -0,0 +1 @@
+ferret
\ No newline at end of file
diff --git a/test/support/utils.js b/test/support/utils.js
index ec6b801bc09..579f042a0c2 100644
--- a/test/support/utils.js
+++ b/test/support/utils.js
@@ -3,14 +3,48 @@
  * Module dependencies.
  * @private
  */
+
 var assert = require('assert');
+var Buffer = require('safe-buffer').Buffer
 
 /**
  * Module exports.
  * @public
  */
+
+exports.shouldHaveBody = shouldHaveBody
+exports.shouldNotHaveBody = shouldNotHaveBody
 exports.shouldNotHaveHeader = shouldNotHaveHeader;
 
+/**
+ * Assert that a supertest response has a specific body.
+ *
+ * @param {Buffer} buf
+ * @returns {function}
+ */
+
+function shouldHaveBody (buf) {
+  return function (res) {
+    var body = !Buffer.isBuffer(res.body)
+      ? Buffer.from(res.text)
+      : res.body
+    assert.ok(body, 'response has body')
+    assert.strictEqual(body.toString('hex'), buf.toString('hex'))
+  }
+}
+
+/**
+ * Assert that a supertest response does not have a body.
+ *
+ * @returns {function}
+ */
+
+function shouldNotHaveBody () {
+  return function (res) {
+    assert.ok(res.text === '' || res.text === undefined)
+  }
+}
+
 /**
  * Assert that a supertest response does not have a header.
  *

From 70a19472f1ec22642ea98baa5f76b5ba656e7235 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 7 May 2019 23:05:37 -0400
Subject: [PATCH 1242/1265] deps: send@0.17.0

---
 History.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 3c2b59a6e22..688efb690e9 100644
--- a/History.md
+++ b/History.md
@@ -21,6 +21,12 @@ unreleased
     - deps: ipaddr.js@1.9.0
   * deps: qs@6.7.0
     - Fix parsing array brackets after index
+  * deps: send@0.17.0
+    - deps: http-errors@~1.7.2
+    - deps: mime@1.6.0
+    - deps: ms@2.1.1
+    - deps: statuses@~1.5.0
+    - perf: remove redundant `path.normalize` call
   * deps: setprototypeof@1.1.1
   * deps: statuses@~1.5.0
     - Add `103 Early Hints`
diff --git a/package.json b/package.json
index b443c34c82e..53753369f7b 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "qs": "6.7.0",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.2",
-    "send": "0.16.2",
+    "send": "0.17.0",
     "serve-static": "1.13.2",
     "setprototypeof": "1.1.1",
     "statuses": "~1.5.0",

From 60aacac1670f01857961fb7d765eb015efb0be5b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 7 May 2019 23:42:36 -0400
Subject: [PATCH 1243/1265] deps: serve-static@1.14.0

closes #3486
---
 History.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 688efb690e9..71db3e8ef7a 100644
--- a/History.md
+++ b/History.md
@@ -27,6 +27,9 @@ unreleased
     - deps: ms@2.1.1
     - deps: statuses@~1.5.0
     - perf: remove redundant `path.normalize` call
+  * deps: serve-static@1.14.0
+    - deps: parseurl@~1.3.3
+    - deps: send@0.17.0
   * deps: setprototypeof@1.1.1
   * deps: statuses@~1.5.0
     - Add `103 Early Hints`
diff --git a/package.json b/package.json
index 53753369f7b..ef83d58d116 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.2",
     "send": "0.17.0",
-    "serve-static": "1.13.2",
+    "serve-static": "1.14.0",
     "setprototypeof": "1.1.1",
     "statuses": "~1.5.0",
     "type-is": "~1.6.18",

From 0bcdd88dd089c8da7f29e76e8f152a40ca0bcf69 Mon Sep 17 00:00:00 2001
From: Amit Zur <sendwithchibo@gmail.com>
Date: Wed, 8 Aug 2018 07:42:00 +0300
Subject: [PATCH 1244/1265] Add express.raw to parse bodies into Buffer

closes #3708
---
 History.md      | 1 +
 lib/express.js  | 1 +
 test/exports.js | 5 +++++
 3 files changed, 7 insertions(+)

diff --git a/History.md b/History.md
index 71db3e8ef7a..35259befeea 100644
--- a/History.md
+++ b/History.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Add `express.raw` to parse bodies into `Buffer`
   * Improve error message for non-strings to `res.sendFile`
   * Improve error message for `null`/`undefined` to `res.status`
   * Support multiple hosts in `X-Forwarded-Host`
diff --git a/lib/express.js b/lib/express.js
index 594007b5b43..f618ccc125a 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -77,6 +77,7 @@ exports.Router = Router;
 
 exports.json = bodyParser.json
 exports.query = require('./middleware/query');
+exports.raw = bodyParser.raw
 exports.static = require('serve-static');
 exports.urlencoded = bodyParser.urlencoded
 
diff --git a/test/exports.js b/test/exports.js
index e5fb6f2a9cf..f43df44c34c 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -14,6 +14,11 @@ describe('exports', function(){
     assert.equal(express.json.length, 1)
   })
 
+  it('should expose raw middleware', function () {
+    assert.equal(typeof express.raw, 'function')
+    assert.equal(express.raw.length, 1)
+  })
+
   it('should expose static middleware', function () {
     assert.equal(typeof express.static, 'function')
     assert.equal(express.static.length, 2)

From 11192bd168c5996efe718664a3f4d8f77dbaa71b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 8 May 2019 00:58:08 -0400
Subject: [PATCH 1245/1265] tests: add express.raw test suite

---
 test/express.raw.js | 387 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 387 insertions(+)
 create mode 100644 test/express.raw.js

diff --git a/test/express.raw.js b/test/express.raw.js
new file mode 100644
index 00000000000..571c29ca9bc
--- /dev/null
+++ b/test/express.raw.js
@@ -0,0 +1,387 @@
+
+var assert = require('assert')
+var Buffer = require('safe-buffer').Buffer
+var express = require('..')
+var request = require('supertest')
+
+describe('express.raw()', function () {
+  before(function () {
+    this.app = createApp()
+  })
+
+  it('should parse application/octet-stream', function (done) {
+    request(this.app)
+      .post('/')
+      .set('Content-Type', 'application/octet-stream')
+      .send('the user is tobi')
+      .expect(200, { buf: '746865207573657220697320746f6269' }, done)
+  })
+
+  it('should 400 when invalid content-length', function (done) {
+    var app = express()
+
+    app.use(function (req, res, next) {
+      req.headers['content-length'] = '20' // bad length
+      next()
+    })
+
+    app.use(express.raw())
+
+    app.post('/', function (req, res) {
+      if (Buffer.isBuffer(req.body)) {
+        res.json({ buf: req.body.toString('hex') })
+      } else {
+        res.json(req.body)
+      }
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'application/octet-stream')
+      .send('stuff')
+      .expect(400, /content length/, done)
+  })
+
+  it('should handle Content-Length: 0', function (done) {
+    request(this.app)
+      .post('/')
+      .set('Content-Type', 'application/octet-stream')
+      .set('Content-Length', '0')
+      .expect(200, { buf: '' }, done)
+  })
+
+  it('should handle empty message-body', function (done) {
+    request(this.app)
+      .post('/')
+      .set('Content-Type', 'application/octet-stream')
+      .set('Transfer-Encoding', 'chunked')
+      .send('')
+      .expect(200, { buf: '' }, done)
+  })
+
+  it('should handle duplicated middleware', function (done) {
+    var app = express()
+
+    app.use(express.raw())
+    app.use(express.raw())
+
+    app.post('/', function (req, res) {
+      if (Buffer.isBuffer(req.body)) {
+        res.json({ buf: req.body.toString('hex') })
+      } else {
+        res.json(req.body)
+      }
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'application/octet-stream')
+      .send('the user is tobi')
+      .expect(200, { buf: '746865207573657220697320746f6269' }, done)
+  })
+
+  describe('with limit option', function () {
+    it('should 413 when over limit with Content-Length', function (done) {
+      var buf = Buffer.alloc(1028, '.')
+      var app = createApp({ limit: '1kb' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.set('Content-Length', '1028')
+      test.write(buf)
+      test.expect(413, done)
+    })
+
+    it('should 413 when over limit with chunked encoding', function (done) {
+      var buf = Buffer.alloc(1028, '.')
+      var app = createApp({ limit: '1kb' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.set('Transfer-Encoding', 'chunked')
+      test.write(buf)
+      test.expect(413, done)
+    })
+
+    it('should accept number of bytes', function (done) {
+      var buf = Buffer.alloc(1028, '.')
+      var app = createApp({ limit: 1024 })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(buf)
+      test.expect(413, done)
+    })
+
+    it('should not change when options altered', function (done) {
+      var buf = Buffer.alloc(1028, '.')
+      var options = { limit: '1kb' }
+      var app = createApp(options)
+
+      options.limit = '100kb'
+
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(buf)
+      test.expect(413, done)
+    })
+
+    it('should not hang response', function (done) {
+      var buf = Buffer.alloc(10240, '.')
+      var app = createApp({ limit: '8kb' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(buf)
+      test.write(buf)
+      test.write(buf)
+      test.expect(413, done)
+    })
+  })
+
+  describe('with inflate option', function () {
+    describe('when false', function () {
+      before(function () {
+        this.app = createApp({ inflate: false })
+      })
+
+      it('should not accept content-encoding', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Encoding', 'gzip')
+        test.set('Content-Type', 'application/octet-stream')
+        test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+        test.expect(415, 'content encoding unsupported', done)
+      })
+    })
+
+    describe('when true', function () {
+      before(function () {
+        this.app = createApp({ inflate: true })
+      })
+
+      it('should accept content-encoding', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Encoding', 'gzip')
+        test.set('Content-Type', 'application/octet-stream')
+        test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+        test.expect(200, { buf: '6e616d653de8aeba' }, done)
+      })
+    })
+  })
+
+  describe('with type option', function () {
+    describe('when "application/vnd+octets"', function () {
+      before(function () {
+        this.app = createApp({ type: 'application/vnd+octets' })
+      })
+
+      it('should parse for custom type', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Type', 'application/vnd+octets')
+        test.write(Buffer.from('000102', 'hex'))
+        test.expect(200, { buf: '000102' }, done)
+      })
+
+      it('should ignore standard type', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Type', 'application/octet-stream')
+        test.write(Buffer.from('000102', 'hex'))
+        test.expect(200, '{}', done)
+      })
+    })
+
+    describe('when ["application/octet-stream", "application/vnd+octets"]', function () {
+      before(function () {
+        this.app = createApp({
+          type: ['application/octet-stream', 'application/vnd+octets']
+        })
+      })
+
+      it('should parse "application/octet-stream"', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Type', 'application/octet-stream')
+        test.write(Buffer.from('000102', 'hex'))
+        test.expect(200, { buf: '000102' }, done)
+      })
+
+      it('should parse "application/vnd+octets"', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Type', 'application/vnd+octets')
+        test.write(Buffer.from('000102', 'hex'))
+        test.expect(200, { buf: '000102' }, done)
+      })
+
+      it('should ignore "application/x-foo"', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Type', 'application/x-foo')
+        test.write(Buffer.from('000102', 'hex'))
+        test.expect(200, '{}', done)
+      })
+    })
+
+    describe('when a function', function () {
+      it('should parse when truthy value returned', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          return req.headers['content-type'] === 'application/vnd.octet'
+        }
+
+        var test = request(app).post('/')
+        test.set('Content-Type', 'application/vnd.octet')
+        test.write(Buffer.from('000102', 'hex'))
+        test.expect(200, { buf: '000102' }, done)
+      })
+
+      it('should work without content-type', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          return true
+        }
+
+        var test = request(app).post('/')
+        test.write(Buffer.from('000102', 'hex'))
+        test.expect(200, { buf: '000102' }, done)
+      })
+
+      it('should not invoke without a body', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          throw new Error('oops!')
+        }
+
+        request(app)
+          .get('/')
+          .expect(404, done)
+      })
+    })
+  })
+
+  describe('with verify option', function () {
+    it('should assert value is function', function () {
+      assert.throws(createApp.bind(null, { verify: 'lol' }),
+        /TypeError: option verify must be function/)
+    })
+
+    it('should error from verify', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x00) throw new Error('no leading null')
+      } })
+
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('000102', 'hex'))
+      test.expect(403, 'no leading null', done)
+    })
+
+    it('should allow custom codes', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] !== 0x00) return
+        var err = new Error('no leading null')
+        err.status = 400
+        throw err
+      } })
+
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('000102', 'hex'))
+      test.expect(400, 'no leading null', done)
+    })
+
+    it('should allow pass-through', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x00) throw new Error('no leading null')
+      } })
+
+      var test = request(app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('0102', 'hex'))
+      test.expect(200, { buf: '0102' }, done)
+    })
+  })
+
+  describe('charset', function () {
+    before(function () {
+      this.app = createApp()
+    })
+
+    it('should ignore charset', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/octet-stream; charset=utf-8')
+      test.write(Buffer.from('6e616d6520697320e8aeba', 'hex'))
+      test.expect(200, { buf: '6e616d6520697320e8aeba' }, done)
+    })
+  })
+
+  describe('encoding', function () {
+    before(function () {
+      this.app = createApp({ limit: '10kb' })
+    })
+
+    it('should parse without encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('6e616d653de8aeba', 'hex'))
+      test.expect(200, { buf: '6e616d653de8aeba' }, done)
+    })
+
+    it('should support identity encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'identity')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('6e616d653de8aeba', 'hex'))
+      test.expect(200, { buf: '6e616d653de8aeba' }, done)
+    })
+
+    it('should support gzip encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+      test.expect(200, { buf: '6e616d653de8aeba' }, done)
+    })
+
+    it('should support deflate encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'deflate')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('789ccb4bcc4db57db16e17001068042f', 'hex'))
+      test.expect(200, { buf: '6e616d653de8aeba' }, done)
+    })
+
+    it('should be case-insensitive', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'GZIP')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4db57db16e170099a4bad608000000', 'hex'))
+      test.expect(200, { buf: '6e616d653de8aeba' }, done)
+    })
+
+    it('should fail on unknown encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'nulls')
+      test.set('Content-Type', 'application/octet-stream')
+      test.write(Buffer.from('000000000000', 'hex'))
+      test.expect(415, 'unsupported content encoding "nulls"', done)
+    })
+  })
+})
+
+function createApp (options) {
+  var app = express()
+
+  app.use(express.raw(options))
+
+  app.use(function (err, req, res, next) {
+    res.status(err.status || 500)
+    res.send(String(err[req.headers['x-error-property'] || 'message']))
+  })
+
+  app.post('/', function (req, res) {
+    if (Buffer.isBuffer(req.body)) {
+      res.json({ buf: req.body.toString('hex') })
+    } else {
+      res.json(req.body)
+    }
+  })
+
+  return app
+}

From 7f4e37f3ea0bf99287472dd72f48d12a3b3d0b71 Mon Sep 17 00:00:00 2001
From: Ilya Guterman <amfernusus@gmail.com>
Date: Mon, 23 Oct 2017 18:00:19 +0300
Subject: [PATCH 1246/1265] Add express.text to parse bodies into string

closes #3455
---
 History.md      | 1 +
 lib/express.js  | 1 +
 test/exports.js | 5 +++++
 3 files changed, 7 insertions(+)

diff --git a/History.md b/History.md
index 35259befeea..2410810d337 100644
--- a/History.md
+++ b/History.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Add `express.raw` to parse bodies into `Buffer`
+  * Add `express.text` to parse bodies into string
   * Improve error message for non-strings to `res.sendFile`
   * Improve error message for `null`/`undefined` to `res.status`
   * Support multiple hosts in `X-Forwarded-Host`
diff --git a/lib/express.js b/lib/express.js
index f618ccc125a..d188a16db70 100644
--- a/lib/express.js
+++ b/lib/express.js
@@ -79,6 +79,7 @@ exports.json = bodyParser.json
 exports.query = require('./middleware/query');
 exports.raw = bodyParser.raw
 exports.static = require('serve-static');
+exports.text = bodyParser.text
 exports.urlencoded = bodyParser.urlencoded
 
 /**
diff --git a/test/exports.js b/test/exports.js
index f43df44c34c..7624a8c8641 100644
--- a/test/exports.js
+++ b/test/exports.js
@@ -24,6 +24,11 @@ describe('exports', function(){
     assert.equal(express.static.length, 2)
   })
 
+  it('should expose text middleware', function () {
+    assert.equal(typeof express.text, 'function')
+    assert.equal(express.text.length, 1)
+  })
+
   it('should expose urlencoded middleware', function () {
     assert.equal(typeof express.urlencoded, 'function')
     assert.equal(express.urlencoded.length, 1)

From bb5211fa1cdf6da767960c2a8aa97f8c8f31e9c5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 8 May 2019 23:39:45 -0400
Subject: [PATCH 1247/1265] tests: add express.text test suite

---
 test/express.text.js | 441 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 441 insertions(+)
 create mode 100644 test/express.text.js

diff --git a/test/express.text.js b/test/express.text.js
new file mode 100644
index 00000000000..7c92f90e5aa
--- /dev/null
+++ b/test/express.text.js
@@ -0,0 +1,441 @@
+
+var assert = require('assert')
+var Buffer = require('safe-buffer').Buffer
+var express = require('..')
+var request = require('supertest')
+
+describe('express.text()', function () {
+  before(function () {
+    this.app = createApp()
+  })
+
+  it('should parse text/plain', function (done) {
+    request(this.app)
+      .post('/')
+      .set('Content-Type', 'text/plain')
+      .send('user is tobi')
+      .expect(200, '"user is tobi"', done)
+  })
+
+  it('should 400 when invalid content-length', function (done) {
+    var app = express()
+
+    app.use(function (req, res, next) {
+      req.headers['content-length'] = '20' // bad length
+      next()
+    })
+
+    app.use(express.text())
+
+    app.post('/', function (req, res) {
+      res.json(req.body)
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'text/plain')
+      .send('user')
+      .expect(400, /content length/, done)
+  })
+
+  it('should handle Content-Length: 0', function (done) {
+    request(createApp({ limit: '1kb' }))
+      .post('/')
+      .set('Content-Type', 'text/plain')
+      .set('Content-Length', '0')
+      .expect(200, '""', done)
+  })
+
+  it('should handle empty message-body', function (done) {
+    request(createApp({ limit: '1kb' }))
+      .post('/')
+      .set('Content-Type', 'text/plain')
+      .set('Transfer-Encoding', 'chunked')
+      .send('')
+      .expect(200, '""', done)
+  })
+
+  it('should handle duplicated middleware', function (done) {
+    var app = express()
+
+    app.use(express.text())
+    app.use(express.text())
+
+    app.post('/', function (req, res) {
+      res.json(req.body)
+    })
+
+    request(app)
+      .post('/')
+      .set('Content-Type', 'text/plain')
+      .send('user is tobi')
+      .expect(200, '"user is tobi"', done)
+  })
+
+  describe('with defaultCharset option', function () {
+    it('should change default charset', function (done) {
+      var app = createApp({ defaultCharset: 'koi8-r' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('6e616d6520697320cec5d4', 'hex'))
+      test.expect(200, '"name is нет"', done)
+    })
+
+    it('should honor content-type charset', function (done) {
+      var app = createApp({ defaultCharset: 'koi8-r' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'text/plain; charset=utf-8')
+      test.write(Buffer.from('6e616d6520697320e8aeba', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+  })
+
+  describe('with limit option', function () {
+    it('should 413 when over limit with Content-Length', function (done) {
+      var buf = Buffer.alloc(1028, '.')
+      request(createApp({ limit: '1kb' }))
+        .post('/')
+        .set('Content-Type', 'text/plain')
+        .set('Content-Length', '1028')
+        .send(buf.toString())
+        .expect(413, done)
+    })
+
+    it('should 413 when over limit with chunked encoding', function (done) {
+      var buf = Buffer.alloc(1028, '.')
+      var app = createApp({ limit: '1kb' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'text/plain')
+      test.set('Transfer-Encoding', 'chunked')
+      test.write(buf.toString())
+      test.expect(413, done)
+    })
+
+    it('should accept number of bytes', function (done) {
+      var buf = Buffer.alloc(1028, '.')
+      request(createApp({ limit: 1024 }))
+        .post('/')
+        .set('Content-Type', 'text/plain')
+        .send(buf.toString())
+        .expect(413, done)
+    })
+
+    it('should not change when options altered', function (done) {
+      var buf = Buffer.alloc(1028, '.')
+      var options = { limit: '1kb' }
+      var app = createApp(options)
+
+      options.limit = '100kb'
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'text/plain')
+        .send(buf.toString())
+        .expect(413, done)
+    })
+
+    it('should not hang response', function (done) {
+      var buf = Buffer.alloc(10240, '.')
+      var app = createApp({ limit: '8kb' })
+      var test = request(app).post('/')
+      test.set('Content-Type', 'text/plain')
+      test.write(buf)
+      test.write(buf)
+      test.write(buf)
+      test.expect(413, done)
+    })
+  })
+
+  describe('with inflate option', function () {
+    describe('when false', function () {
+      before(function () {
+        this.app = createApp({ inflate: false })
+      })
+
+      it('should not accept content-encoding', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Encoding', 'gzip')
+        test.set('Content-Type', 'text/plain')
+        test.write(Buffer.from('1f8b080000000000000bcb4bcc4d55c82c5678b16e170072b3e0200b000000', 'hex'))
+        test.expect(415, 'content encoding unsupported', done)
+      })
+    })
+
+    describe('when true', function () {
+      before(function () {
+        this.app = createApp({ inflate: true })
+      })
+
+      it('should accept content-encoding', function (done) {
+        var test = request(this.app).post('/')
+        test.set('Content-Encoding', 'gzip')
+        test.set('Content-Type', 'text/plain')
+        test.write(Buffer.from('1f8b080000000000000bcb4bcc4d55c82c5678b16e170072b3e0200b000000', 'hex'))
+        test.expect(200, '"name is 论"', done)
+      })
+    })
+  })
+
+  describe('with type option', function () {
+    describe('when "text/html"', function () {
+      before(function () {
+        this.app = createApp({ type: 'text/html' })
+      })
+
+      it('should parse for custom type', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'text/html')
+          .send('<b>tobi</b>')
+          .expect(200, '"<b>tobi</b>"', done)
+      })
+
+      it('should ignore standard type', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'text/plain')
+          .send('user is tobi')
+          .expect(200, '{}', done)
+      })
+    })
+
+    describe('when ["text/html", "text/plain"]', function () {
+      before(function () {
+        this.app = createApp({ type: ['text/html', 'text/plain'] })
+      })
+
+      it('should parse "text/html"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'text/html')
+          .send('<b>tobi</b>')
+          .expect(200, '"<b>tobi</b>"', done)
+      })
+
+      it('should parse "text/plain"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'text/plain')
+          .send('tobi')
+          .expect(200, '"tobi"', done)
+      })
+
+      it('should ignore "text/xml"', function (done) {
+        request(this.app)
+          .post('/')
+          .set('Content-Type', 'text/xml')
+          .send('<user>tobi</user>')
+          .expect(200, '{}', done)
+      })
+    })
+
+    describe('when a function', function () {
+      it('should parse when truthy value returned', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          return req.headers['content-type'] === 'text/vnd.something'
+        }
+
+        request(app)
+          .post('/')
+          .set('Content-Type', 'text/vnd.something')
+          .send('user is tobi')
+          .expect(200, '"user is tobi"', done)
+      })
+
+      it('should work without content-type', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          return true
+        }
+
+        var test = request(app).post('/')
+        test.write('user is tobi')
+        test.expect(200, '"user is tobi"', done)
+      })
+
+      it('should not invoke without a body', function (done) {
+        var app = createApp({ type: accept })
+
+        function accept (req) {
+          throw new Error('oops!')
+        }
+
+        request(app)
+          .get('/')
+          .expect(404, done)
+      })
+    })
+  })
+
+  describe('with verify option', function () {
+    it('should assert value is function', function () {
+      assert.throws(createApp.bind(null, { verify: 'lol' }),
+        /TypeError: option verify must be function/)
+    })
+
+    it('should error from verify', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x20) throw new Error('no leading space')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'text/plain')
+        .send(' user is tobi')
+        .expect(403, 'no leading space', done)
+    })
+
+    it('should allow custom codes', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] !== 0x20) return
+        var err = new Error('no leading space')
+        err.status = 400
+        throw err
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'text/plain')
+        .send(' user is tobi')
+        .expect(400, 'no leading space', done)
+    })
+
+    it('should allow pass-through', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        if (buf[0] === 0x20) throw new Error('no leading space')
+      } })
+
+      request(app)
+        .post('/')
+        .set('Content-Type', 'text/plain')
+        .send('user is tobi')
+        .expect(200, '"user is tobi"', done)
+    })
+
+    it('should 415 on unknown charset prior to verify', function (done) {
+      var app = createApp({ verify: function (req, res, buf) {
+        throw new Error('unexpected verify call')
+      } })
+
+      var test = request(app).post('/')
+      test.set('Content-Type', 'text/plain; charset=x-bogus')
+      test.write(Buffer.from('00000000', 'hex'))
+      test.expect(415, 'unsupported charset "X-BOGUS"', done)
+    })
+  })
+
+  describe('charset', function () {
+    before(function () {
+      this.app = createApp()
+    })
+
+    it('should parse utf-8', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'text/plain; charset=utf-8')
+      test.write(Buffer.from('6e616d6520697320e8aeba', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+
+    it('should parse codepage charsets', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'text/plain; charset=koi8-r')
+      test.write(Buffer.from('6e616d6520697320cec5d4', 'hex'))
+      test.expect(200, '"name is нет"', done)
+    })
+
+    it('should parse when content-length != char length', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'text/plain; charset=utf-8')
+      test.set('Content-Length', '11')
+      test.write(Buffer.from('6e616d6520697320e8aeba', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+
+    it('should default to utf-8', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('6e616d6520697320e8aeba', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+
+    it('should 415 on unknown charset', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'text/plain; charset=x-bogus')
+      test.write(Buffer.from('00000000', 'hex'))
+      test.expect(415, 'unsupported charset "X-BOGUS"', done)
+    })
+  })
+
+  describe('encoding', function () {
+    before(function () {
+      this.app = createApp({ limit: '10kb' })
+    })
+
+    it('should parse without encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('6e616d6520697320e8aeba', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+
+    it('should support identity encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'identity')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('6e616d6520697320e8aeba', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+
+    it('should support gzip encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'gzip')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4d55c82c5678b16e170072b3e0200b000000', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+
+    it('should support deflate encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'deflate')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('789ccb4bcc4d55c82c5678b16e17001a6f050e', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+
+    it('should be case-insensitive', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'GZIP')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('1f8b080000000000000bcb4bcc4d55c82c5678b16e170072b3e0200b000000', 'hex'))
+      test.expect(200, '"name is 论"', done)
+    })
+
+    it('should fail on unknown encoding', function (done) {
+      var test = request(this.app).post('/')
+      test.set('Content-Encoding', 'nulls')
+      test.set('Content-Type', 'text/plain')
+      test.write(Buffer.from('000000000000', 'hex'))
+      test.expect(415, 'unsupported content encoding "nulls"', done)
+    })
+  })
+})
+
+function createApp (options) {
+  var app = express()
+
+  app.use(express.text(options))
+
+  app.use(function (err, req, res, next) {
+    res.status(err.status || 500)
+    res.send(err.message)
+  })
+
+  app.post('/', function (req, res) {
+    res.json(req.body)
+  })
+
+  return app
+}

From 7b076bd8e1c428da4887856d34b813aba2732c19 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 May 2019 18:03:12 -0400
Subject: [PATCH 1248/1265] build: Node.js@6.17

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 36e7e75e568..b07c383bb18 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,7 +7,7 @@ node_js:
   - "3.3"
   - "4.9"
   - "5.12"
-  - "6.14"
+  - "6.17"
   - "7.10"
   - "8.12"
   - "9.11"
diff --git a/appveyor.yml b/appveyor.yml
index 4006a5e51d9..f970f8a7174 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -7,7 +7,7 @@ environment:
     - nodejs_version: "3.3"
     - nodejs_version: "4.9"
     - nodejs_version: "5.12"
-    - nodejs_version: "6.14"
+    - nodejs_version: "6.17"
     - nodejs_version: "7.10"
     - nodejs_version: "8.12"
     - nodejs_version: "9.11"

From e91702872994523dbb9f7da1bf30854c5dfb834a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 May 2019 18:03:56 -0400
Subject: [PATCH 1249/1265] build: Node.js@8.16

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index b07c383bb18..457029de675 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "5.12"
   - "6.17"
   - "7.10"
-  - "8.12"
+  - "8.16"
   - "9.11"
   - "10.12"
 matrix:
diff --git a/appveyor.yml b/appveyor.yml
index f970f8a7174..c2cd643e1cb 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -9,7 +9,7 @@ environment:
     - nodejs_version: "5.12"
     - nodejs_version: "6.17"
     - nodejs_version: "7.10"
-    - nodejs_version: "8.12"
+    - nodejs_version: "8.16"
     - nodejs_version: "9.11"
     - nodejs_version: "10.12"
 cache:

From c754c8ad7b33a1d9ec6bec88bc44734c16c36167 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 May 2019 19:45:01 -0400
Subject: [PATCH 1250/1265] build: support Node.js 11.x

---
 .travis.yml  | 3 +--
 appveyor.yml | 1 +
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 457029de675..b55dc4ae52f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,10 +12,9 @@ node_js:
   - "8.16"
   - "9.11"
   - "10.12"
+  - "11.15"
 matrix:
   include:
-    - node_js: "11"
-      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
     - node_js: "12"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
diff --git a/appveyor.yml b/appveyor.yml
index c2cd643e1cb..82463dee7d1 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -12,6 +12,7 @@ environment:
     - nodejs_version: "8.16"
     - nodejs_version: "9.11"
     - nodejs_version: "10.12"
+    - nodejs_version: "11.15"
 cache:
   - node_modules
 install:

From bc07a41693f8c7e9bde2bfb4cd5390ad6e3b1337 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 May 2019 22:09:56 -0400
Subject: [PATCH 1251/1265] deps: finalhandler@~1.1.2

---
 History.md   | 4 ++++
 package.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 2410810d337..9ddfe35b884 100644
--- a/History.md
+++ b/History.md
@@ -18,6 +18,10 @@ unreleased
     - deps: raw-body@2.4.0
     - deps: type-is@~1.6.17
   * deps: content-disposition@0.5.3
+  * deps: finalhandler@~1.1.2
+    - Set stricter `Content-Security-Policy` header
+    - deps: parseurl@~1.3.3
+    - deps: statuses@~1.5.0
   * deps: parseurl@~1.3.3
   * deps: proxy-addr@~2.0.5
     - deps: ipaddr.js@1.9.0
diff --git a/package.json b/package.json
index ef83d58d116..6f89e3369de 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "encodeurl": "~1.0.2",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",
-    "finalhandler": "1.1.1",
+    "finalhandler": "~1.1.2",
     "fresh": "0.5.2",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",

From 8267c4b72422e68654849a71bfb74141d77bb875 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 10 May 2019 23:49:13 -0400
Subject: [PATCH 1252/1265] deps: send@0.17.1

---
 History.md   | 4 +++-
 package.json | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/History.md b/History.md
index 9ddfe35b884..312f4b96952 100644
--- a/History.md
+++ b/History.md
@@ -27,10 +27,12 @@ unreleased
     - deps: ipaddr.js@1.9.0
   * deps: qs@6.7.0
     - Fix parsing array brackets after index
-  * deps: send@0.17.0
+  * deps: send@0.17.1
+    - Set stricter CSP header in redirect & error responses
     - deps: http-errors@~1.7.2
     - deps: mime@1.6.0
     - deps: ms@2.1.1
+    - deps: range-parser@~1.2.1
     - deps: statuses@~1.5.0
     - perf: remove redundant `path.normalize` call
   * deps: serve-static@1.14.0
diff --git a/package.json b/package.json
index 6f89e3369de..34904ac0002 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "qs": "6.7.0",
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.2",
-    "send": "0.17.0",
+    "send": "0.17.1",
     "serve-static": "1.14.0",
     "setprototypeof": "1.1.1",
     "statuses": "~1.5.0",

From 88f9733ffa58ce89bd5a9b207f0c8b4c2965fec6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 11 May 2019 19:29:33 -0400
Subject: [PATCH 1253/1265] deps: serve-static@1.14.1

---
 History.md             | 5 +++--
 package.json           | 2 +-
 test/express.static.js | 2 +-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index 312f4b96952..b0685594a3b 100644
--- a/History.md
+++ b/History.md
@@ -35,9 +35,10 @@ unreleased
     - deps: range-parser@~1.2.1
     - deps: statuses@~1.5.0
     - perf: remove redundant `path.normalize` call
-  * deps: serve-static@1.14.0
+  * deps: serve-static@1.14.1
+    - Set stricter CSP header in redirect response
     - deps: parseurl@~1.3.3
-    - deps: send@0.17.0
+    - deps: send@0.17.1
   * deps: setprototypeof@1.1.1
   * deps: statuses@~1.5.0
     - Add `103 Early Hints`
diff --git a/package.json b/package.json
index 34904ac0002..3a6a00d153b 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
     "range-parser": "~1.2.0",
     "safe-buffer": "5.1.2",
     "send": "0.17.1",
-    "serve-static": "1.14.0",
+    "serve-static": "1.14.1",
     "setprototypeof": "1.1.1",
     "statuses": "~1.5.0",
     "type-is": "~1.6.18",
diff --git a/test/express.static.js b/test/express.static.js
index 7c9852243e6..485ee4c0c10 100644
--- a/test/express.static.js
+++ b/test/express.static.js
@@ -513,7 +513,7 @@ describe('express.static()', function () {
     it('should respond with default Content-Security-Policy', function (done) {
       request(this.app)
         .get('/users')
-        .expect('Content-Security-Policy', "default-src 'self'")
+        .expect('Content-Security-Policy', "default-src 'none'")
         .expect(301, done)
     })
 

From da6f701317d154e47921139257ffcefb15d15ca7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 12 May 2019 22:01:06 -0400
Subject: [PATCH 1254/1265] deps: range-parser@~1.2.1

---
 History.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index b0685594a3b..ef9aec948c3 100644
--- a/History.md
+++ b/History.md
@@ -27,6 +27,7 @@ unreleased
     - deps: ipaddr.js@1.9.0
   * deps: qs@6.7.0
     - Fix parsing array brackets after index
+  * deps: range-parser@~1.2.1
   * deps: send@0.17.1
     - Set stricter CSP header in redirect & error responses
     - deps: http-errors@~1.7.2
diff --git a/package.json b/package.json
index 3a6a00d153b..c722e230776 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~2.0.5",
     "qs": "6.7.0",
-    "range-parser": "~1.2.0",
+    "range-parser": "~1.2.1",
     "safe-buffer": "5.1.2",
     "send": "0.17.1",
     "serve-static": "1.14.1",

From e502dde3c8c82ff107603f78d6cac9a33a699dd7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 12 May 2019 22:09:35 -0400
Subject: [PATCH 1255/1265] build: Node.js@10.15

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index b55dc4ae52f..4706b75982f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,7 @@ node_js:
   - "7.10"
   - "8.16"
   - "9.11"
-  - "10.12"
+  - "10.15"
   - "11.15"
 matrix:
   include:
diff --git a/appveyor.yml b/appveyor.yml
index 82463dee7d1..b222f6b7b75 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -11,7 +11,7 @@ environment:
     - nodejs_version: "7.10"
     - nodejs_version: "8.16"
     - nodejs_version: "9.11"
-    - nodejs_version: "10.12"
+    - nodejs_version: "10.15"
     - nodejs_version: "11.15"
 cache:
   - node_modules

From 5266f3a5cb25fdd6846b76a727d601506791c4ce Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 12 May 2019 22:15:36 -0400
Subject: [PATCH 1256/1265] build: test against Node.js 13.x nightly

---
 .travis.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 4706b75982f..73422a7aa6c 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,6 +17,8 @@ matrix:
   include:
     - node_js: "12"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
+    - node_js: "13"
+      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
     # Allow the nightly installs to fail
     - env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"

From b9ecb9afe336ad00eb6e2dbc055e838649fe784f Mon Sep 17 00:00:00 2001
From: huadong zuo <admin@zuohuadong.cn>
Date: Wed, 24 Apr 2019 19:44:09 +0800
Subject: [PATCH 1257/1265] build: support Node.js 12.x

closes #3946
---
 .travis.yml  | 3 +--
 appveyor.yml | 1 +
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 73422a7aa6c..7b11677ec87 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,10 +13,9 @@ node_js:
   - "9.11"
   - "10.15"
   - "11.15"
+  - "12.2"
 matrix:
   include:
-    - node_js: "12"
-      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
     - node_js: "13"
       env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
   allow_failures:
diff --git a/appveyor.yml b/appveyor.yml
index b222f6b7b75..84476a597d7 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -13,6 +13,7 @@ environment:
     - nodejs_version: "9.11"
     - nodejs_version: "10.15"
     - nodejs_version: "11.15"
+    - nodejs_version: "12.2"
 cache:
   - node_modules
 install:

From efcb17dcb21699ef685eff4455a9443f707a4901 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 May 2019 09:55:26 -0400
Subject: [PATCH 1258/1265] deps: cookie@0.4.0

closes #3958
---
 History.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index ef9aec948c3..da36866652c 100644
--- a/History.md
+++ b/History.md
@@ -18,6 +18,8 @@ unreleased
     - deps: raw-body@2.4.0
     - deps: type-is@~1.6.17
   * deps: content-disposition@0.5.3
+  * deps: cookie@0.4.0
+    - Add `SameSite=None` support
   * deps: finalhandler@~1.1.2
     - Set stricter `Content-Security-Policy` header
     - deps: parseurl@~1.3.3
diff --git a/package.json b/package.json
index c722e230776..b8b0b19e9ff 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,7 @@
     "body-parser": "1.19.0",
     "content-disposition": "0.5.3",
     "content-type": "~1.0.4",
-    "cookie": "0.3.1",
+    "cookie": "0.4.0",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "~1.1.2",

From 94e48a16f273963dc37829352b7381e4e9222315 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 May 2019 09:58:40 -0400
Subject: [PATCH 1259/1265] build: update example dependencies

---
 package.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index b8b0b19e9ff..87b80ce33d2 100644
--- a/package.json
+++ b/package.json
@@ -60,12 +60,12 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "connect-redis": "3.4.0",
-    "cookie-parser": "~1.4.3",
-    "cookie-session": "1.3.2",
+    "connect-redis": "3.4.1",
+    "cookie-parser": "~1.4.4",
+    "cookie-session": "1.3.3",
     "ejs": "2.6.1",
     "eslint": "2.13.1",
-    "express-session": "1.15.6",
+    "express-session": "1.16.1",
     "hbs": "4.0.4",
     "istanbul": "0.4.5",
     "marked": "0.6.2",

From b8e50568af9c73ef1ade434e92c60d389868361d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 May 2019 10:04:24 -0400
Subject: [PATCH 1260/1265] tests: ignore unreachable line

---
 lib/response.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/response.js b/lib/response.js
index c1514901c57..a4f10cbb2e1 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -1135,6 +1135,7 @@ function stringify (value, replacer, spaces, escape) {
           return '\\u003e'
         case 0x26:
           return '\\u0026'
+        /* istanbul ignore next: unreachable default */
         default:
           return c
       }

From 9dadca2c64ae717063b0e9071143065896ebb676 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 May 2019 20:53:07 -0400
Subject: [PATCH 1261/1265] docs: remove Gratipay links

---
 Readme.md | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/Readme.md b/Readme.md
index 81d8d91615e..1f91297312b 100644
--- a/Readme.md
+++ b/Readme.md
@@ -153,7 +153,3 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d
 [appveyor-url]: https://ci.appveyor.com/project/dougwilson/express
 [coveralls-image]: https://img.shields.io/coveralls/expressjs/express/master.svg
 [coveralls-url]: https://coveralls.io/r/expressjs/express?branch=master
-[gratipay-image-visionmedia]: https://img.shields.io/gratipay/visionmedia.svg
-[gratipay-url-visionmedia]: https://gratipay.com/visionmedia/
-[gratipay-image-dougwilson]: https://img.shields.io/gratipay/dougwilson.svg
-[gratipay-url-dougwilson]: https://gratipay.com/dougwilson/

From 10c7756764fbe969b307b15a72fd074479c00f8d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 May 2019 21:25:42 -0400
Subject: [PATCH 1262/1265] 4.17.0

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index da36866652c..cca851d2e0f 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.17.0 / 2019-05-16
+===================
 
   * Add `express.raw` to parse bodies into `Buffer`
   * Add `express.text` to parse bodies into string
diff --git a/package.json b/package.json
index 87b80ce33d2..726af2f6bab 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.16.4",
+  "version": "4.17.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",

From eed05a1464485edc5154ce989a679ba602f11ed8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 24 May 2019 23:20:52 -0400
Subject: [PATCH 1263/1265] build: Node.js@12.3

---
 .travis.yml  | 2 +-
 appveyor.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 7b11677ec87..c3ebc583d6b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "9.11"
   - "10.15"
   - "11.15"
-  - "12.2"
+  - "12.3"
 matrix:
   include:
     - node_js: "13"
diff --git a/appveyor.yml b/appveyor.yml
index 84476a597d7..24434cd14af 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -13,7 +13,7 @@ environment:
     - nodejs_version: "9.11"
     - nodejs_version: "10.15"
     - nodejs_version: "11.15"
-    - nodejs_version: "12.2"
+    - nodejs_version: "12.3"
 cache:
   - node_modules
 install:

From 0a48e18056865364b2461b2ece7ccb2d1075d3c9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 25 May 2019 18:15:13 -0400
Subject: [PATCH 1264/1265] Revert "Improve error message for null/undefined to
 res.status"

fixes #3968
---
 History.md         |  5 +++++
 lib/response.js    |  4 ----
 test/res.status.js | 32 --------------------------------
 3 files changed, 5 insertions(+), 36 deletions(-)

diff --git a/History.md b/History.md
index cca851d2e0f..631e0e5170b 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Revert "Improve error message for `null`/`undefined` to `res.status`"
+
 4.17.0 / 2019-05-16
 ===================
 
diff --git a/lib/response.js b/lib/response.js
index a4f10cbb2e1..c9f08cd54f4 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -64,10 +64,6 @@ var charsetRegExp = /;\s*charset\s*=/;
  */
 
 res.status = function status(code) {
-  if (code === undefined || code === null) {
-    throw new TypeError('code argument is required to res.status')
-  }
-
   this.statusCode = code;
   return this;
 };
diff --git a/test/res.status.js b/test/res.status.js
index 3f928ec0b0b..8c173a645c5 100644
--- a/test/res.status.js
+++ b/test/res.status.js
@@ -16,37 +16,5 @@ describe('res', function(){
       .expect('Created')
       .expect(201, done);
     })
-
-    describe('when code is undefined', function () {
-      it('should throw a TypeError', function (done) {
-        var app = express()
-
-        app.use(function (req, res) {
-          res.status(undefined).send('OK')
-        })
-
-        request(app)
-        .get('/')
-        .expect(500)
-        .expect(/TypeError: code argument is required to res.status/)
-        .end(done)
-      })
-    })
-
-    describe('when code is null', function () {
-      it('should throw a TypeError', function (done) {
-        var app = express()
-
-        app.use(function (req, res) {
-          res.status(null).send('OK')
-        })
-
-        request(app)
-        .get('/')
-        .expect(500)
-        .expect(/TypeError: code argument is required to res.status/)
-        .end(done)
-      })
-    })
   })
 })

From e1b45ebd050b6f06aa38cda5aaf0c21708b0c71e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 26 May 2019 00:24:55 -0400
Subject: [PATCH 1265/1265] 4.17.1

---
 History.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 631e0e5170b..6e62a6ddb85 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+4.17.1 / 2019-05-25
+===================
 
   * Revert "Improve error message for `null`/`undefined` to `res.status`"
 
diff --git a/package.json b/package.json
index 726af2f6bab..2979d57a22f 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.17.0",
+  "version": "4.17.1",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",