sistema creado v0.5.0

api/node_modules/express/lib/application.js

@@ -14,24 +14,29 @@
  */
 
 var finalhandler = require('finalhandler');
+var Router = require('./router');
+var methods = require('methods');
+var middleware = require('./middleware/init');
+var query = require('./middleware/query');
 var debug = require('debug')('express:application');
 var View = require('./view');
-var http = require('node:http');
-var methods = require('./utils').methods;
+var http = require('http');
 var compileETag = require('./utils').compileETag;
 var compileQueryParser = require('./utils').compileQueryParser;
 var compileTrust = require('./utils').compileTrust;
-var resolve = require('node:path').resolve;
-var once = require('once')
-var Router = require('router');
+var deprecate = require('depd')('express');
+var flatten = require('array-flatten');
+var merge = require('utils-merge');
+var resolve = require('path').resolve;
+var setPrototypeOf = require('setprototypeof')
 
 /**
  * Module variables.
  * @private
  */
 
+var hasOwnProperty = Object.prototype.hasOwnProperty
 var slice = Array.prototype.slice;
-var flatten = Array.prototype.flat;
 
 /**
  * Application prototype.
@@ -57,29 +62,11 @@ var trustProxyDefaultSymbol = '@@symbol:trust_proxy_default';
  */
 
 app.init = function init() {
-  var router = null;
-
-  this.cache = Object.create(null);
-  this.engines = Object.create(null);
-  this.settings = Object.create(null);
+  this.cache = {};
+  this.engines = {};
+  this.settings = {};
 
   this.defaultConfiguration();
-
-  // Setup getting to lazily add base router
-  Object.defineProperty(this, 'router', {
-    configurable: true,
-    enumerable: true,
-    get: function getrouter() {
-      if (router === null) {
-        router = new Router({
-          caseSensitive: this.enabled('case sensitive routing'),
-          strict: this.enabled('strict routing')
-        });
-      }
-
-      return router;
-    }
-  });
 };
 
 /**
@@ -94,7 +81,7 @@ app.defaultConfiguration = function defaultConfiguration() {
   this.enable('x-powered-by');
   this.set('etag', 'weak');
   this.set('env', env);
-  this.set('query parser', 'simple')
+  this.set('query parser', 'extended');
   this.set('subdomain offset', 2);
   this.set('trust proxy', false);
 
@@ -115,10 +102,10 @@ app.defaultConfiguration = function defaultConfiguration() {
     }
 
     // inherit protos
-    Object.setPrototypeOf(this.request, parent.request)
-    Object.setPrototypeOf(this.response, parent.response)
-    Object.setPrototypeOf(this.engines, parent.engines)
-    Object.setPrototypeOf(this.settings, parent.settings)
+    setPrototypeOf(this.request, parent.request)
+    setPrototypeOf(this.response, parent.response)
+    setPrototypeOf(this.engines, parent.engines)
+    setPrototypeOf(this.settings, parent.settings)
   });
 
   // setup locals
@@ -138,6 +125,32 @@ app.defaultConfiguration = function defaultConfiguration() {
   if (env === 'production') {
     this.enable('view cache');
   }
+
+  Object.defineProperty(this, 'router', {
+    get: function() {
+      throw new Error('\'app.router\' is deprecated!\nPlease see the 3.x to 4.x migration guide for details on how to update your app.');
+    }
+  });
+};
+
+/**
+ * lazily adds the base router if it has not yet been added.
+ *
+ * We cannot add the base router in the defaultConfiguration because
+ * it reads app settings which might be set after that has run.
+ *
+ * @private
+ */
+app.lazyrouter = function lazyrouter() {
+  if (!this._router) {
+    this._router = new Router({
+      caseSensitive: this.enabled('case sensitive routing'),
+      strict: this.enabled('strict routing')
+    });
+
+    this._router.use(query(this.get('query parser fn')));
+    this._router.use(middleware.init(this));
+  }
 };
 
 /**
@@ -150,31 +163,22 @@ app.defaultConfiguration = function defaultConfiguration() {
  */
 
 app.handle = function handle(req, res, callback) {
+  var router = this._router;
+
   // final handler
   var done = callback || finalhandler(req, res, {
     env: this.get('env'),
     onerror: logerror.bind(this)
   });
 
-  // set powered by header
-  if (this.enabled('x-powered-by')) {
-    res.setHeader('X-Powered-By', 'Express');
+  // no routes
+  if (!router) {
+    debug('no routes defined on app');
+    done();
+    return;
   }
 
-  // set circular references
-  req.res = res;
-  res.req = req;
-
-  // alter the prototypes
-  Object.setPrototypeOf(req, this.request)
-  Object.setPrototypeOf(res, this.response)
-
-  // setup locals
-  if (!res.locals) {
-    res.locals = Object.create(null);
-  }
-
-  this.router.handle(req, res, done);
+  router.handle(req, res, done);
 };
 
 /**
@@ -207,14 +211,15 @@ app.use = function use(fn) {
     }
   }
 
-  var fns = flatten.call(slice.call(arguments, offset), Infinity);
+  var fns = flatten(slice.call(arguments, offset));
 
   if (fns.length === 0) {
     throw new TypeError('app.use() requires a middleware function')
   }
 
-  // get router
-  var router = this.router;
+  // setup router
+  this.lazyrouter();
+  var router = this._router;
 
   fns.forEach(function (fn) {
     // non-express app
@@ -230,8 +235,8 @@ app.use = function use(fn) {
     router.use(path, function mounted_app(req, res, next) {
       var orig = req.app;
       fn.handle(req, res, function (err) {
-        Object.setPrototypeOf(req, orig.request)
-        Object.setPrototypeOf(res, orig.response)
+        setPrototypeOf(req, orig.request)
+        setPrototypeOf(res, orig.response)
         next(err);
       });
     });
@@ -254,7 +259,8 @@ app.use = function use(fn) {
  */
 
 app.route = function route(path) {
-  return this.router.route(path);
+  this.lazyrouter();
+  return this._router.route(path);
 };
 
 /**
@@ -320,6 +326,8 @@ app.engine = function engine(ext, fn) {
  */
 
 app.param = function param(name, fn) {
+  this.lazyrouter();
+
   if (Array.isArray(name)) {
     for (var i = 0; i < name.length; i++) {
       this.param(name[i], fn);
@@ -328,7 +336,7 @@ app.param = function param(name, fn) {
     return this;
   }
 
-  this.router.param(name, fn);
+  this._router.param(name, fn);
 
   return this;
 };
@@ -351,7 +359,17 @@ app.param = function param(name, fn) {
 app.set = function set(setting, val) {
   if (arguments.length === 1) {
     // app.get(setting)
-    return this.settings[setting];
+    var settings = this.settings
+
+    while (settings && settings !== Object.prototype) {
+      if (hasOwnProperty.call(settings, setting)) {
+        return settings[setting]
+      }
+
+      settings = Object.getPrototypeOf(settings)
+    }
+
+    return undefined
   }
 
   debug('set "%s" to %o', setting, val);
@@ -468,14 +486,16 @@ app.disable = function disable(setting) {
  * Delegate `.VERB(...)` calls to `router.VERB(...)`.
  */
 
-methods.forEach(function (method) {
-  app[method] = function (path) {
+methods.forEach(function(method){
+  app[method] = function(path){
     if (method === 'get' && arguments.length === 1) {
       // app.get(setting)
       return this.set(path);
     }
 
-    var route = this.route(path);
+    this.lazyrouter();
+
+    var route = this._router.route(path);
     route[method].apply(route, slice.call(arguments, 1));
     return this;
   };
@@ -492,7 +512,9 @@ methods.forEach(function (method) {
  */
 
 app.all = function all(path) {
-  var route = this.route(path);
+  this.lazyrouter();
+
+  var route = this._router.route(path);
   var args = slice.call(arguments, 1);
 
   for (var i = 0; i < methods.length; i++) {
@@ -502,6 +524,10 @@ app.all = function all(path) {
   return this;
 };
 
+// del -> delete alias
+
+app.del = deprecate.function(app.delete, 'app.del: Use app.delete instead');
+
 /**
  * Render the given view `name` name with `options`
  * and a callback accepting an error and the
@@ -524,6 +550,7 @@ app.render = function render(name, options, callback) {
   var done = callback;
   var engines = this.engines;
   var opts = options;
+  var renderOptions = {};
   var view;
 
   // support callback function as second arg
@@ -532,8 +559,16 @@ app.render = function render(name, options, callback) {
     opts = {};
   }
 
+  // merge app.locals
+  merge(renderOptions, this.locals);
+
+  // merge options._locals
+  if (opts._locals) {
+    merge(renderOptions, opts._locals);
+  }
+
   // merge options
-  var renderOptions = { ...this.locals, ...opts._locals, ...opts };
+  merge(renderOptions, opts);
 
   // set .cache unless explicitly provided
   if (renderOptions.cache == null) {
@@ -583,8 +618,8 @@ app.render = function render(name, options, callback) {
  * and HTTPS server you may do so with the "http"
  * and "https" modules as shown here:
  *
- *    var http = require('node:http')
- *      , https = require('node:https')
+ *    var http = require('http')
+ *      , https = require('https')
  *      , express = require('express')
  *      , app = express();
  *
@@ -596,14 +631,9 @@ app.render = function render(name, options, callback) {
  */
 
 app.listen = function listen() {
-  var server = http.createServer(this)
-  var args = Array.prototype.slice.call(arguments)
-  if (typeof args[args.length - 1] === 'function') {
-    var done = args[args.length - 1] = once(args[args.length - 1])
-    server.once('error', done)
-  }
-  return server.listen.apply(server, args)
-}
+  var server = http.createServer(this);
+  return server.listen.apply(server, arguments);
+};
 
 /**
  * Log error using console.error.

api/node_modules/express/lib/express.js

@@ -13,10 +13,11 @@
  */
 
 var bodyParser = require('body-parser')
-var EventEmitter = require('node:events').EventEmitter;
+var EventEmitter = require('events').EventEmitter;
 var mixin = require('merge-descriptors');
 var proto = require('./application');
-var Router = require('router');
+var Route = require('./router/route');
+var Router = require('./router');
 var req = require('./request');
 var res = require('./response');
 
@@ -67,7 +68,7 @@ exports.response = res;
  * Expose constructors.
  */
 
-exports.Route = Router.Route;
+exports.Route = Route;
 exports.Router = Router;
 
 /**
@@ -75,7 +76,41 @@ exports.Router = Router;
  */
 
 exports.json = bodyParser.json
+exports.query = require('./middleware/query');
 exports.raw = bodyParser.raw
 exports.static = require('serve-static');
 exports.text = bodyParser.text
 exports.urlencoded = bodyParser.urlencoded
+
+/**
+ * Replace removed middleware with an appropriate error message.
+ */
+
+var removedMiddlewares = [
+  'bodyParser',
+  'compress',
+  'cookieSession',
+  'session',
+  'logger',
+  'cookieParser',
+  'favicon',
+  'responseTime',
+  'errorHandler',
+  'timeout',
+  'methodOverride',
+  'vhost',
+  'csrf',
+  'directory',
+  'limit',
+  'multipart',
+  'staticCache'
+]
+
+removedMiddlewares.forEach(function (name) {
+  Object.defineProperty(exports, name, {
+    get: function () {
+      throw new Error('Most middleware (like ' + name + ') is no longer bundled with Express and must be installed separately. Please see https://github.com/senchalabs/connect#middleware.');
+    },
+    configurable: true
+  });
+});

api/node_modules/express/lib/request.js

@@ -14,9 +14,10 @@
  */
 
 var accepts = require('accepts');
-var isIP = require('node:net').isIP;
+var deprecate = require('depd')('express');
+var isIP = require('net').isIP;
 var typeis = require('type-is');
-var http = require('node:http');
+var http = require('http');
 var fresh = require('fresh');
 var parseRange = require('range-parser');
 var parse = require('parseurl');
@@ -146,6 +147,9 @@ req.acceptsEncodings = function(){
   return accept.encodings.apply(accept, arguments);
 };
 
+req.acceptsEncoding = deprecate.function(req.acceptsEncodings,
+  'req.acceptsEncoding: Use acceptsEncodings instead');
+
 /**
  * Check if the given `charset`s are acceptable,
  * otherwise you should respond with 406 "Not Acceptable".
@@ -160,6 +164,9 @@ req.acceptsCharsets = function(){
   return accept.charsets.apply(accept, arguments);
 };
 
+req.acceptsCharset = deprecate.function(req.acceptsCharsets,
+  'req.acceptsCharset: Use acceptsCharsets instead');
+
 /**
  * Check if the given `lang`s are acceptable,
  * otherwise you should respond with 406 "Not Acceptable".
@@ -174,6 +181,9 @@ req.acceptsLanguages = function(){
   return accept.languages.apply(accept, arguments);
 };
 
+req.acceptsLanguage = deprecate.function(req.acceptsLanguages,
+  'req.acceptsLanguage: Use acceptsLanguages instead');
+
 /**
  * Parse Range header field, capping to the given `size`.
  *
@@ -206,27 +216,38 @@ req.range = function range(size, options) {
 };
 
 /**
- * Parse the query string of `req.url`.
+ * Return the value of param `name` when present or `defaultValue`.
  *
- * This uses the "query parser" setting to parse the raw
- * string into an object.
+ *  - Checks route placeholders, ex: _/user/:id_
+ *  - Checks body params, ex: id=12, {"id":12}
+ *  - Checks query string params, ex: ?id=12
  *
+ * To utilize request bodies, `req.body`
+ * should be an object. This can be done by using
+ * the `bodyParser()` middleware.
+ *
+ * @param {String} name
+ * @param {Mixed} [defaultValue]
  * @return {String}
- * @api public
+ * @public
  */
 
-defineGetter(req, 'query', function query(){
-  var queryparse = this.app.get('query parser fn');
+req.param = function param(name, defaultValue) {
+  var params = this.params || {};
+  var body = this.body || {};
+  var query = this.query || {};
 
-  if (!queryparse) {
-    // parsing is disabled
-    return Object.create(null);
-  }
+  var args = arguments.length === 1
+    ? 'name'
+    : 'name, default';
+  deprecate('req.param(' + args + '): Use req.params, req.body, or req.query instead');
 
-  var querystring = parse(this).query;
+  if (null != params[name] && params.hasOwnProperty(name)) return params[name];
+  if (null != body[name]) return body[name];
+  if (null != query[name]) return query[name];
 
-  return queryparse(querystring);
-});
+  return defaultValue;
+};
 
 /**
  * Check if the incoming request contains the "Content-Type"
@@ -393,7 +414,7 @@ defineGetter(req, 'path', function path() {
 });
 
 /**
- * Parse the "Host" header field to a host.
+ * Parse the "Host" header field to a hostname.
  *
  * When the "trust proxy" setting trusts the socket
  * address, the "X-Forwarded-Host" header field will
@@ -403,35 +424,18 @@ defineGetter(req, 'path', function path() {
  * @public
  */
 
-defineGetter(req, 'host', function host(){
+defineGetter(req, 'hostname', function hostname(){
   var trust = this.app.get('trust proxy fn');
-  var val = this.get('X-Forwarded-Host');
+  var host = this.get('X-Forwarded-Host');
 
-  if (!val || !trust(this.connection.remoteAddress, 0)) {
-    val = this.get('Host');
-  } else if (val.indexOf(',') !== -1) {
+  if (!host || !trust(this.connection.remoteAddress, 0)) {
+    host = this.get('Host');
+  } else if (host.indexOf(',') !== -1) {
     // Note: X-Forwarded-Host is normally only ever a
     //       single value, but this is to be safe.
-    val = val.substring(0, val.indexOf(',')).trimRight()
+    host = host.substring(0, host.indexOf(',')).trimRight()
   }
 
-  return val || undefined;
-});
-
-/**
- * Parse the "Host" header field to a hostname.
- *
- * When the "trust proxy" setting trusts the socket
- * address, the "X-Forwarded-Host" header field will
- * be trusted.
- *
- * @return {String}
- * @api public
- */
-
-defineGetter(req, 'hostname', function hostname(){
-  var host = this.host;
-
   if (!host) return;
 
   // IPv6 literal support
@@ -445,9 +449,15 @@ defineGetter(req, 'hostname', function hostname(){
     : host;
 });
 
+// TODO: change req.host to return host in next major
+
+defineGetter(req, 'host', deprecate.function(function host(){
+  return this.hostname;
+}, 'req.host: Use req.hostname instead'));
+
 /**
  * Check if the request is fresh, aka
- * Last-Modified or the ETag
+ * Last-Modified and/or the ETag
  * still match.
  *
  * @return {Boolean}

api/node_modules/express/lib/response.js

@@ -12,16 +12,18 @@
  * @private
  */
 
+var Buffer = require('safe-buffer').Buffer
 var contentDisposition = require('content-disposition');
 var createError = require('http-errors')
+var deprecate = require('depd')('express');
 var encodeUrl = require('encodeurl');
 var escapeHtml = require('escape-html');
-var http = require('node:http');
+var http = require('http');
+var isAbsolute = require('./utils').isAbsolute;
 var onFinished = require('on-finished');
-var mime = require('mime-types')
-var path = require('node:path');
-var pathIsAbsolute = require('node:path').isAbsolute;
+var path = require('path');
 var statuses = require('statuses')
+var merge = require('utils-merge');
 var sign = require('cookie-signature').sign;
 var normalizeType = require('./utils').normalizeType;
 var normalizeTypes = require('./utils').normalizeTypes;
@@ -29,6 +31,7 @@ var setCharset = require('./utils').setCharset;
 var cookie = require('cookie');
 var send = require('send');
 var extname = path.extname;
+var mime = send.mime;
 var resolve = path.resolve;
 var vary = require('vary');
 
@@ -47,28 +50,24 @@ var res = Object.create(http.ServerResponse.prototype)
 module.exports = res
 
 /**
- * Set the HTTP status code for the response.
+ * Module variables.
+ * @private
+ */
+
+var charsetRegExp = /;\s*charset\s*=/;
+
+/**
+ * Set status `code`.
  *
- * Expects an integer value between 100 and 999 inclusive.
- * Throws an error if the provided status code is not an integer or if it's outside the allowable range.
- *
- * @param {number} code - The HTTP status code to set.
- * @return {ServerResponse} - Returns itself for chaining methods.
- * @throws {TypeError} If `code` is not an integer.
- * @throws {RangeError} If `code` is outside the range 100 to 999.
+ * @param {Number} code
+ * @return {ServerResponse}
  * @public
  */
 
 res.status = function status(code) {
-  // Check if the status code is not an integer
-  if (!Number.isInteger(code)) {
-    throw new TypeError(`Invalid status code: ${JSON.stringify(code)}. Status code must be an integer.`);
+  if ((typeof code === 'string' || Math.floor(code) !== code) && code > 99 && code < 1000) {
+    deprecate('res.status(' + JSON.stringify(code) + '): use res.status(' + Math.floor(code) + ') instead')
   }
-  // Check if the status code is outside of Node's valid range
-  if (code < 100 || code > 999) {
-    throw new RangeError(`Invalid status code: ${JSON.stringify(code)}. Status code must be greater than 99 and less than 1000.`);
-  }
-
   this.statusCode = code;
   return this;
 };
@@ -80,11 +79,7 @@ res.status = function status(code) {
  *
  *    res.links({
  *      next: 'http://api.example.com/users?page=2',
- *      last: 'http://api.example.com/users?page=5',
- *      pages: [
- *        'http://api.example.com/users?page=1',
- *        'http://api.example.com/users?page=2'
- *      ]
+ *      last: 'http://api.example.com/users?page=5'
  *    });
  *
  * @param {Object} links
@@ -92,18 +87,11 @@ res.status = function status(code) {
  * @public
  */
 
-res.links = function(links) {
+res.links = function(links){
   var link = this.get('Link') || '';
   if (link) link += ', ';
-  return this.set('Link', link + Object.keys(links).map(function(rel) {
-    // Allow multiple links if links[rel] is an array
-    if (Array.isArray(links[rel])) {
-      return links[rel].map(function (singleLink) {
-        return `<${singleLink}>; rel="${rel}"`;
-      }).join(', ');
-    } else {
-      return `<${links[rel]}>; rel="${rel}"`;
-    }
+  return this.set('Link', link + Object.keys(links).map(function(rel){
+    return '<' + links[rel] + '>; rel="' + rel + '"';
   }).join(', '));
 };
 
@@ -129,6 +117,31 @@ res.send = function send(body) {
   // settings
   var app = this.app;
 
+  // allow status / body
+  if (arguments.length === 2) {
+    // res.send(body, status) backwards compat
+    if (typeof arguments[0] !== 'number' && typeof arguments[1] === 'number') {
+      deprecate('res.send(body, status): Use res.status(status).send(body) instead');
+      this.statusCode = arguments[1];
+    } else {
+      deprecate('res.send(status, body): Use res.status(status).send(body) instead');
+      this.statusCode = arguments[0];
+      chunk = arguments[1];
+    }
+  }
+
+  // disambiguate res.send(status) and res.send(status, num)
+  if (typeof chunk === 'number' && arguments.length === 1) {
+    // res.send(status) will set status message as text string
+    if (!this.get('Content-Type')) {
+      this.type('txt');
+    }
+
+    deprecate('res.send(status): Use res.sendStatus(status) instead');
+    this.statusCode = chunk;
+    chunk = statuses.message[chunk]
+  }
+
   switch (typeof chunk) {
     // string defaulting to html
     case 'string':
@@ -141,7 +154,7 @@ res.send = function send(body) {
     case 'object':
       if (chunk === null) {
         chunk = '';
-      } else if (ArrayBuffer.isView(chunk)) {
+      } else if (Buffer.isBuffer(chunk)) {
         if (!this.get('Content-Type')) {
           this.type('bin');
         }
@@ -194,7 +207,7 @@ res.send = function send(body) {
   }
 
   // freshness
-  if (req.fresh) this.status(304);
+  if (req.fresh) this.statusCode = 304;
 
   // strip irrelevant headers
   if (204 === this.statusCode || 304 === this.statusCode) {
@@ -235,12 +248,27 @@ res.send = function send(body) {
  */
 
 res.json = function json(obj) {
+  var val = obj;
+
+  // allow status / body
+  if (arguments.length === 2) {
+    // res.json(body, status) backwards compat
+    if (typeof arguments[1] === 'number') {
+      deprecate('res.json(obj, status): Use res.status(status).json(obj) instead');
+      this.statusCode = arguments[1];
+    } else {
+      deprecate('res.json(status, obj): Use res.status(status).json(obj) instead');
+      this.statusCode = arguments[0];
+      val = arguments[1];
+    }
+  }
+
   // settings
   var app = this.app;
   var escape = app.get('json escape')
   var replacer = app.get('json replacer');
   var spaces = app.get('json spaces');
-  var body = stringify(obj, replacer, spaces, escape)
+  var body = stringify(val, replacer, spaces, escape)
 
   // content-type
   if (!this.get('Content-Type')) {
@@ -263,12 +291,27 @@ res.json = function json(obj) {
  */
 
 res.jsonp = function jsonp(obj) {
+  var val = obj;
+
+  // allow status / body
+  if (arguments.length === 2) {
+    // res.jsonp(body, status) backwards compat
+    if (typeof arguments[1] === 'number') {
+      deprecate('res.jsonp(obj, status): Use res.status(status).jsonp(obj) instead');
+      this.statusCode = arguments[1];
+    } else {
+      deprecate('res.jsonp(status, obj): Use res.status(status).jsonp(obj) instead');
+      this.statusCode = arguments[0];
+      val = arguments[1];
+    }
+  }
+
   // settings
   var app = this.app;
   var escape = app.get('json escape')
   var replacer = app.get('json replacer');
   var spaces = app.get('json spaces');
-  var body = stringify(obj, replacer, spaces, escape)
+  var body = stringify(val, replacer, spaces, escape)
   var callback = this.req.query[app.get('jsonp callback name')];
 
   // content-type
@@ -326,7 +369,7 @@ res.jsonp = function jsonp(obj) {
 res.sendStatus = function sendStatus(statusCode) {
   var body = statuses.message[statusCode] || String(statusCode)
 
-  this.status(statusCode);
+  this.statusCode = statusCode;
   this.type('txt');
 
   return this.send(body);
@@ -394,15 +437,12 @@ res.sendFile = function sendFile(path, options, callback) {
     opts = {};
   }
 
-  if (!opts.root && !pathIsAbsolute(path)) {
+  if (!opts.root && !isAbsolute(path)) {
     throw new TypeError('path must be absolute or specify root to res.sendFile');
   }
 
   // create file stream
   var pathname = encodeURI(path);
-
-  // wire application etag option to send
-  opts.etag = this.app.enabled('etag');
   var file = send(req, pathname, opts);
 
   // transfer
@@ -417,6 +457,78 @@ res.sendFile = function sendFile(path, options, callback) {
   });
 };
 
+/**
+ * Transfer the file at the given `path`.
+ *
+ * Automatically sets the _Content-Type_ response header field.
+ * The callback `callback(err)` is invoked when the transfer is complete
+ * or when an error occurs. Be sure to check `res.headersSent`
+ * if you wish to attempt responding, as the header and some data
+ * may have already been transferred.
+ *
+ * Options:
+ *
+ *   - `maxAge`   defaulting to 0 (can be string converted by `ms`)
+ *   - `root`     root directory for relative filenames
+ *   - `headers`  object of headers to serve with file
+ *   - `dotfiles` serve dotfiles, defaulting to false; can be `"allow"` to send them
+ *
+ * Other options are passed along to `send`.
+ *
+ * Examples:
+ *
+ *  The following example illustrates how `res.sendfile()` may
+ *  be used as an alternative for the `static()` middleware for
+ *  dynamic situations. The code backing `res.sendfile()` is actually
+ *  the same code, so HTTP cache support etc is identical.
+ *
+ *     app.get('/user/:uid/photos/:file', function(req, res){
+ *       var uid = req.params.uid
+ *         , file = req.params.file;
+ *
+ *       req.user.mayViewFilesFrom(uid, function(yes){
+ *         if (yes) {
+ *           res.sendfile('/uploads/' + uid + '/' + file);
+ *         } else {
+ *           res.send(403, 'Sorry! you cant see that.');
+ *         }
+ *       });
+ *     });
+ *
+ * @public
+ */
+
+res.sendfile = function (path, options, callback) {
+  var done = callback;
+  var req = this.req;
+  var res = this;
+  var next = req.next;
+  var opts = options || {};
+
+  // support function as second arg
+  if (typeof options === 'function') {
+    done = options;
+    opts = {};
+  }
+
+  // create file stream
+  var file = send(req, path, opts);
+
+  // transfer
+  sendfile(res, file, opts, function (err) {
+    if (done) return done(err);
+    if (err && err.code === 'EISDIR') return next();
+
+    // next() all but write errors
+    if (err && err.code !== 'ECONNABORTED' && err.syscall !== 'write') {
+      next(err);
+    }
+  });
+};
+
+res.sendfile = deprecate.function(res.sendfile,
+  'res.sendfile: Use res.sendFile instead');
+
 /**
  * Transfer the file at the given `path` as an attachment.
  *
@@ -487,10 +599,8 @@ res.download = function download (path, filename, options, callback) {
 };
 
 /**
- * Set _Content-Type_ response header with `type` through `mime.contentType()`
+ * Set _Content-Type_ response header with `type` through `mime.lookup()`
  * when it does not contain "/", or set the Content-Type to `type` otherwise.
- * When no mapping is found though `mime.contentType()`, the type is set to
- * "application/octet-stream".
  *
  * Examples:
  *
@@ -508,7 +618,7 @@ res.download = function download (path, filename, options, callback) {
 res.contentType =
 res.type = function contentType(type) {
   var ct = type.indexOf('/') === -1
-    ? (mime.contentType(type) || 'application/octet-stream')
+    ? mime.lookup(type)
     : type;
 
   return this.set('Content-Type', ct);
@@ -657,9 +767,6 @@ res.append = function append(field, val) {
  *
  * Aliased as `res.header()`.
  *
- * When the set header is "Content-Type", the type is expanded to include
- * the charset if not present using `mime.contentType()`.
- *
  * @param {String|Object} field
  * @param {String|Array} val
  * @return {ServerResponse} for chaining
@@ -678,7 +785,10 @@ res.header = function header(field, val) {
       if (Array.isArray(value)) {
         throw new TypeError('Content-Type cannot be set to an Array');
       }
-      value = mime.contentType(value)
+      if (!charsetRegExp.test(value)) {
+        var charset = mime.charsets.lookup(value.split(';')[0]);
+        if (charset) value += '; charset=' + charset.toLowerCase();
+      }
     }
 
     this.setHeader(field, value);
@@ -712,10 +822,15 @@ res.get = function(field){
  */
 
 res.clearCookie = function clearCookie(name, options) {
-  // Force cookie expiration by setting expires to the past
-  const opts = { path: '/', ...options, expires: new Date(1)};
-  // ensure maxAge is not passed
-  delete opts.maxAge
+  if (options) {
+    if (options.maxAge) {
+      deprecate('res.clearCookie: Passing "options.maxAge" is deprecated. In v5.0.0 of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.');
+    }
+    if (options.expires) {
+      deprecate('res.clearCookie: Passing "options.expires" is deprecated. In v5.0.0 of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.');
+    }
+  }
+  var opts = merge({ expires: new Date(1), path: '/' }, options);
 
   return this.cookie(name, '', opts);
 };
@@ -745,7 +860,7 @@ res.clearCookie = function clearCookie(name, options) {
  */
 
 res.cookie = function (name, value, options) {
-  var opts = { ...options };
+  var opts = merge({}, options);
   var secret = this.req.secret;
   var signed = opts.signed;
 
@@ -797,13 +912,27 @@ res.cookie = function (name, value, options) {
  */
 
 res.location = function location(url) {
-  return this.set('Location', encodeUrl(url));
+  var loc;
+
+  // "back" is an alias for the referrer
+  if (url === 'back') {
+    deprecate('res.location("back"): use res.location(req.get("Referrer") || "/") and refer to https://dub.sh/security-redirect for best practices');
+    loc = this.req.get('Referrer') || '/';
+  } else {
+    loc = String(url);
+  }
+
+  return this.set('Location', encodeUrl(loc));
 };
 
 /**
  * Redirect to the given `url` with optional response `status`
  * defaulting to 302.
  *
+ * The resulting `url` is determined by `res.location()`, so
+ * it will play nicely with mounted apps, relative paths,
+ * `"back"` etc.
+ *
  * Examples:
  *
  *    res.redirect('/foo/bar');
@@ -821,8 +950,13 @@ res.redirect = function redirect(url) {
 
   // allow status / url
   if (arguments.length === 2) {
-    status = arguments[0]
-    address = arguments[1]
+    if (typeof arguments[0] === 'number') {
+      status = arguments[0];
+      address = arguments[1];
+    } else {
+      deprecate('res.redirect(url, status): Use res.redirect(status, url) instead');
+      status = arguments[1];
+    }
   }
 
   // Set location header
@@ -845,7 +979,7 @@ res.redirect = function redirect(url) {
   });
 
   // Respond
-  this.status(status);
+  this.statusCode = status;
   this.set('Content-Length', Buffer.byteLength(body));
 
   if (this.req.method === 'HEAD') {
@@ -865,6 +999,12 @@ res.redirect = function redirect(url) {
  */
 
 res.vary = function(field){
+  // checks for back-compat
+  if (!field || (Array.isArray(field) && !field.length)) {
+    deprecate('res.vary(): Provide a field name');
+    return this;
+  }
+
   vary(this, field);
 
   return this;

api/node_modules/express/lib/utils.js

@@ -12,20 +12,17 @@
  * @api private
  */
 
-var { METHODS } = require('node:http');
+var Buffer = require('safe-buffer').Buffer
+var contentDisposition = require('content-disposition');
 var contentType = require('content-type');
+var deprecate = require('depd')('express');
+var flatten = require('array-flatten');
+var mime = require('send').mime;
 var etag = require('etag');
-var mime = require('mime-types')
 var proxyaddr = require('proxy-addr');
 var qs = require('qs');
 var querystring = require('querystring');
 
-/**
- * A list of lowercased HTTP methods that are supported by Node.js.
- * @api private
- */
-exports.methods = METHODS.map((method) => method.toLowerCase());
-
 /**
  * Return strong ETag for `body`.
  *
@@ -48,6 +45,31 @@ exports.etag = createETagGenerator({ weak: false })
 
 exports.wetag = createETagGenerator({ weak: true })
 
+/**
+ * Check if `path` looks absolute.
+ *
+ * @param {String} path
+ * @return {Boolean}
+ * @api private
+ */
+
+exports.isAbsolute = function(path){
+  if ('/' === path[0]) return true;
+  if (':' === path[1] && ('\\' === path[2] || '/' === path[2])) return true; // Windows device path
+  if ('\\\\' === path.substring(0, 2)) return true; // Microsoft Azure absolute path
+};
+
+/**
+ * Flatten the given `arr`.
+ *
+ * @param {Array} arr
+ * @return {Array}
+ * @api private
+ */
+
+exports.flatten = deprecate.function(flatten,
+  'utils.flatten: use array-flatten npm module instead');
+
 /**
  * Normalize the given `type`, for example "html" becomes "text/html".
  *
@@ -59,7 +81,7 @@ exports.wetag = createETagGenerator({ weak: true })
 exports.normalizeType = function(type){
   return ~type.indexOf('/')
     ? acceptParams(type)
-    : { value: (mime.lookup(type) || 'application/octet-stream'), params: {} }
+    : { value: mime.lookup(type), params: {} };
 };
 
 /**
@@ -70,10 +92,27 @@ exports.normalizeType = function(type){
  * @api private
  */
 
-exports.normalizeTypes = function(types) {
-  return types.map(exports.normalizeType);
+exports.normalizeTypes = function(types){
+  var ret = [];
+
+  for (var i = 0; i < types.length; ++i) {
+    ret.push(exports.normalizeType(types[i]));
+  }
+
+  return ret;
 };
 
+/**
+ * Generate Content-Disposition header appropriate for the filename.
+ * non-ascii filenames are urlencoded and a filename* parameter is added
+ *
+ * @param {String} filename
+ * @return {String}
+ * @api private
+ */
+
+exports.contentDisposition = deprecate.function(contentDisposition,
+  'utils.contentDisposition: use content-disposition npm module instead');
 
 /**
  * Parse accept params `str` returning an
@@ -85,33 +124,16 @@ exports.normalizeTypes = function(types) {
  */
 
 function acceptParams (str) {
-  var length = str.length;
-  var colonIndex = str.indexOf(';');
-  var index = colonIndex === -1 ? length : colonIndex;
-  var ret = { value: str.slice(0, index).trim(), quality: 1, params: {} };
+  var parts = str.split(/ *; */);
+  var ret = { value: parts[0], quality: 1, params: {} }
 
-  while (index < length) {
-    var splitIndex = str.indexOf('=', index);
-    if (splitIndex === -1) break;
-
-    var colonIndex = str.indexOf(';', index);
-    var endIndex = colonIndex === -1 ? length : colonIndex;
-
-    if (splitIndex > endIndex) {
-      index = str.lastIndexOf(';', splitIndex - 1) + 1;
-      continue;
-    }
-
-    var key = str.slice(index, splitIndex).trim();
-    var value = str.slice(splitIndex + 1, endIndex).trim();
-
-    if (key === 'q') {
-      ret.quality = parseFloat(value);
+  for (var i = 1; i < parts.length; ++i) {
+    var pms = parts[i].split(/ *= */);
+    if ('q' === pms[0]) {
+      ret.quality = parseFloat(pms[1]);
     } else {
-      ret.params[key] = value;
+      ret.params[pms[0]] = pms[1];
     }
-
-    index = endIndex + 1;
   }
 
   return ret;
@@ -170,6 +192,7 @@ exports.compileQueryParser = function compileQueryParser(val) {
       fn = querystring.parse;
       break;
     case false:
+      fn = newObject;
       break;
     case 'extended':
       fn = parseExtendedQueryString;
@@ -267,3 +290,14 @@ function parseExtendedQueryString(str) {
     allowPrototypes: true
   });
 }
+
+/**
+ * Return new empty object.
+ *
+ * @return {Object}
+ * @api private
+ */
+
+function newObject() {
+  return {};
+}

api/node_modules/express/lib/view.js

@@ -14,8 +14,8 @@
  */
 
 var debug = require('debug')('express:view');
-var path = require('node:path');
-var fs = require('node:fs');
+var path = require('path');
+var fs = require('fs');
 
 /**
  * Module variables.
@@ -131,31 +131,8 @@ View.prototype.lookup = function lookup(name) {
  */
 
 View.prototype.render = function render(options, callback) {
-  var sync = true;
-
   debug('render "%s"', this.path);
-
-  // render, normalizing sync callbacks
-  this.engine(this.path, options, function onRender() {
-    if (!sync) {
-      return callback.apply(this, arguments);
-    }
-
-    // copy arguments
-    var args = new Array(arguments.length);
-    var cntx = this;
-
-    for (var i = 0; i < arguments.length; i++) {
-      args[i] = arguments[i];
-    }
-
-    // force callback to be async
-    return process.nextTick(function renderTick() {
-      return callback.apply(cntx, args);
-    });
-  });
-
-  sync = false;
+  this.engine(this.path, options, callback);
 };
 
 /**