expressjs · github-actions · Jul 6, 2026 · Jul 20, 2026 · Aug 10, 2026 · krzysdz
@@ -304,7 +304,7 @@ The Express.js project welcomes all constructive contributions. Contributions ta
 from code for bug fixes and enhancements, to additions and fixes to documentation, additional
 tests, triaging incoming pull requests and issues, and more!
 
-See the [Contributing Guide](https://github.com/expressjs/express/blob/master/Contributing.md) for more technical details on contributing.
+See the [Contributing Guide](https://github.com/expressjs/.github/blob/HEAD/CONTRIBUTING.md) for more technical details on contributing.
 
 ## License
 

@@ -124,7 +124,7 @@ The options can also contain any of the following (for the full list, see
 - `partitioned`: a boolean indicating whether to partition the cookie in Chrome for the [CHIPS Update](https://developers.google.com/privacy-sandbox/3pcd/chips) (`false` by default). If this is true, Cookies from embedded sites will be partitioned and only readable from the same top level site from which it was created.
 - `priority`: a string indicating the cookie priority. This can be set to `'low'`, `'medium'`, or `'high'`.
 - `sameSite`: a boolean or string indicating whether the cookie is a "same site" cookie (`false` by default). This can be set to `'strict'`, `'lax'`, `'none'`, or `true` (which maps to `'strict'`).
-- `secure`: a boolean indicating whether the cookie is only to be sent over HTTPS (`false` by default for HTTP, `true` by default for HTTPS). If this is set to `true` and Node.js is not directly over a TLS connection, be sure to read how to [setup Express behind proxies](/guide/behind-proxies) or the cookie may not ever set correctly.
+- `secure`: a boolean indicating whether the cookie is only to be sent over HTTPS (`false` by default for HTTP, `true` by default for HTTPS). If this is set to `true` and Node.js is not directly over a TLS connection, be sure to read how to [setup Express behind proxies](/guide/behind-proxies/) or the cookie may not ever set correctly.
 - `httpOnly`: a boolean indicating whether the cookie is only to be sent over HTTP(S), and not made available to client JavaScript (`true` by default).
 - `signed`: a boolean indicating whether the cookie is to be signed (`true` by default).
 - `overwrite`: a boolean indicating whether to overwrite previously set cookies of the same name (`true` by default).

@@ -15,7 +15,7 @@ import PackageManagerCommand from '@components/patterns/PackageManagerCommand/Pa
 
 HTTP request logger middleware for node.js
 
-> Named after [Dexter](http://en.wikipedia.org/wiki/Dexter_Morgan), a show you should not watch until completion.
+> Named after [Dexter](https://en.wikipedia.org/wiki/Dexter_Morgan), a show you should not watch until completion.
 
 ## Installation
 

@@ -287,7 +287,7 @@ memory storage is used.
 
 ### `limits`
 
-An object specifying the size limits of the following optional properties. Multer passes this object into busboy directly, and the details of the properties can be found on [busboy's page](https://github.com/mscdex/busboy#busboy-methods).
+An object specifying the size limits of the following optional properties. Multer passes this object into busboy directly, and the details of the properties can be found on [busboy's page](https://github.com/mscdex/busboy#exports).
 
 The following integer values are available:
 
@@ -337,7 +337,7 @@ Specifying the [limits](#limits) can help protect your site against denial of se
 ## Error handling
 
 When encountering an error, Multer will delegate the error to Express. You can
-display a nice error page using [the standard express way](/guide/error-handling).
+display a nice error page using [the standard express way](/guide/error-handling/).
 
 If you want to catch errors specifically from Multer, you can call the
 middleware function by yourself. Also, if you want to catch only [the Multer errors](https://github.com/expressjs/multer/blob/main/lib/multer-error.js), you can use the `MulterError` class that is attached to the `multer` object itself (e.g. `err instanceof multer.MulterError`).

@@ -39,7 +39,7 @@ var serveIndex = require('serve-index');
 
 ### serveIndex(path, options)
 
-Returns middlware that serves an index of the directory in the given `path`.
+Returns middleware that serves an index of the directory in the given `path`.
 
 The `path` is based off the `req.url` value, so a `req.url` of `'/some/dir`
 with a `path` of `'public'` will look at `'public/some/dir'`. If you are using
@@ -149,8 +149,8 @@ app.listen(3000);
 
 ## License
 
-[MIT](https://github.com/expressjs/serve-index/blob/HEAD/LICENSE). The [Silk](https://web.archive.org/web/20230105212205/http://www.famfamfam.com/lab/icons/silk/) icons
-are created by/copyright of [FAMFAMFAM](https://web.archive.org/web/20251120154741/http://www.famfamfam.com/).
+[MIT](https://github.com/expressjs/serve-index/blob/HEAD/LICENSE). The [Silk](https://web.archive.org/web/20230105212205/https://web.archive.org/web/20230105212205/http://www.famfamfam.com/lab/icons/silk/) icons
+are created by/copyright of [FAMFAMFAM](https://web.archive.org/web/20230109095739/https://web.archive.org/web/20251120154741/http://www.famfamfam.com/).
 # Apply configured URL replacements (dead/moved links → working alternatives). 
 # The lookahead requires the match to end at a URL boundary, so a URL that is a 
 # prefix of another (e.g. the site root vs a sub-path) isn't corrupted. 
 for pair in "${URL_REPLACEMENTS[@]}"; do 
   FROM="${pair%%|*}" 
   TO="${pair#*|}" 
   CONTENT=$(FROM="$FROM" TO="$TO" perl -pe 's/\Q$ENV{FROM}\E(?=[\s)">]|$)/$ENV{TO}/g' <<<"$CONTENT") 
 done 
 # Apply configured URL replacements (dead/moved links → working alternatives). 
 # The lookahead requires the match to end at a URL boundary, so a URL that is a 
 # prefix of another (e.g. the site root vs a sub-path) isn't corrupted. 
 for pair in "${URL_REPLACEMENTS[@]}"; do 
   FROM="${pair%%|*}" 
   TO="${pair#*|}" 
   CONTENT=$(FROM="$FROM" TO="$TO" perl -pe 's/\Q$ENV{FROM}\E(?=[\s)">]|$)/$ENV{TO}/g' <<<"$CONTENT") 
 done 
 
 [appveyor-url]: https://ci.appveyor.com/project/dougwilson/serve-index
 [downloads-url]: https://npmjs.org/package/serve-index

@@ -127,7 +127,7 @@ defined in the object is what is used.
 
 ##### cookie.partitioned
 
-Specifies the `boolean` value for the [`Partitioned` `Set-Cookie`](https://github.com/expressjs/session/blob/HEAD/rfc-cutler-httpbis-partitioned-cookies)
+Specifies the `boolean` value for the [`Partitioned` `Set-Cookie`][rfc-cutler-httpbis-partitioned-cookies]
 attribute. When truthy, the `Partitioned` attribute is set, otherwise it is not.
 By default, the `Partitioned` attribute is not set.
 
@@ -142,6 +142,12 @@ More information about can be found in [the proposal](https://github.com/privacy
 Specifies the value for the `Path` `Set-Cookie`. By default, this is set to `'/'`, which
 is the root path of the domain.
 
+Since 1.19.1, path matching follows [RFC 6265 section 5.1.4][rfc-6265-5.1.4]. This means
+the session middleware will only activate when the request path is an exact match or falls
+under a segment boundary of the cookie path. For example, a cookie path of `/admin` will
+match `/admin` and `/admin/users` but will **not** match `/administrator`. Prior versions
+used a simple prefix check that did not enforce segment boundaries.
+
 ##### cookie.priority
 
 Specifies the `string` to be the value for the [`Priority` `Set-Cookie` attribute][rfc-west-cookie-priority-00-4.1].
@@ -1002,6 +1008,7 @@ On Windows, use the corresponding command;
 
 [MIT](https://github.com/expressjs/session/blob/HEAD/LICENSE)
 
+[rfc-6265-5.1.4]: https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.4
 [rfc-6265bis-03-4.1.2.7]: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.2.7
 [rfc-cutler-httpbis-partitioned-cookies]: https://tools.ietf.org/html/draft-cutler-httpbis-partitioned-cookies/
 [rfc-west-cookie-priority-00-4.1]: https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1