2025-09-10 Express Working Session

[github-actions]

Date/Time

Timezone	Date/Time
America/Los_Angeles	Wed, Sep 10, 2025, 01:00 PM
America/Denver	Wed, Sep 10, 2025, 02:00 PM
America/Chicago	Wed, Sep 10, 2025, 03:00 PM
America/Bogota	Wed, Sep 10, 2025, 03:00 PM
America/New_York	Wed, Sep 10, 2025, 04:00 PM
UTC	Wed, Sep 10, 2025, 08:00 PM
Europe/London	Wed, Sep 10, 2025, 09:00 PM
Europe/Madrid	Wed, Sep 10, 2025, 10:00 PM
Europe/Paris	Wed, Sep 10, 2025, 10:00 PM
Europe/Warsaw	Wed, Sep 10, 2025, 10:00 PM
Europe/Moscow	Wed, Sep 10, 2025, 11:00 PM
Asia/Kolkata	Thu, Sep 11, 2025, 01:30 AM
Asia/Shanghai	Thu, Sep 11, 2025, 04:00 AM
Asia/Tokyo	Thu, Sep 11, 2025, 05:00 AM
Australia/Sydney	Thu, Sep 11, 2025, 06:00 AM

Or in your local time:

• https://www.timeanddate.com/worldclock/fixedtime.html?msg=2025-09-10%20Express%20Working%20Session&iso=20250910T2000&p1=1440&ah=1

Agenda

Extracted from top priority labelled issues and pull requests from expressjs/discussions prior to the meeting.

• Give admin access to the captains on their own repositories #422
• Discussion: consolidating a linter within the project #327
• Propose a higher minimum Node.js version for all the packages (CI related) #236
• docs: documentation for third-party services used in the project #424
• docs: iconv-lite captains #421
• docs: update governance document to remove outdated sections #386
• governance.md: add inactivity policy for any roles #378
• charter: update TC membership guidelines to ensure diverse representation #376
• clarify nomination process for Technical Committee members #375
• fix(docs): perf-wg, security-wg, remove wes from body-parser #360
• Add policy to align engines fields with ci #289
• add Github Access Structure Overview section express#5503

Invited

• @expressjs/express-tc
• @expressjs/triagers
• @expressjs/security-wg

Observers/Guests

This meeting is open for anyone who wants to attend. Reminder to follow our Code of Conduct.

Joining the meeting

• link for participants: https://zoom-lfx.platform.linuxfoundation.org/meeting/95258037175?password=07aad89d-ff43-45df-9b28-f437e167a0b9

---

Please use the following emoji reactions in this post to indicate your
availability.

• 👍 - Attending
• 👎 - Not attending
• 😕 - Not sure yet

[wesleytodd]

I was hoping we could use some time (privately) to have some discussions and maybe fix up a few of the github and npm settings we have while additionally discussing the recent supply chain attacks and what we need to be doing in relation to them. Specifically with debug impacting us. I know this may clear some of the agenda, but I think it might be the most pressing topic at the moment.

[bjohansebas]

Basically, #422 would be part of the priority for tomorrow, and some policies like #378, regarding inactivity.

It would be great to attend, hopefully, I can find some time tomorrow to join.

[jonchurch]

Minutes:

• We are checking all of the packages on npm to ensure that they have 2fa enforced for publishing (we already have 2fa enforced for all users, but this is a seperate setting)
  • @UlisesGascon can you check the ones you are added to? checking under Package page => Settings => "Publishing access"
• We are enabling branch protection rulesets at the Org level vs at the repo level (need to get the Open JSF to ask Github to give pillarjs and jshttp orgs Gitub team plan so we can use rulesets)

Basic branch protection ruleset for importing:

Protects the default branch with:

• What it does ("Rule Name in UI")
• No deletion ("Restrict deletions")
• No force push ("Block force pushes")
• No pushing directly to default branch, force landing commits via PR ("Require a pull request before merging")
• Require 1 PR reviewer ("Required Approvals")
• PR's can only be landed via squash/rebase no merge commit, this is an opinion/preferance of the TC ("Allowed merge methods")
• No merge commits pushed to branch, idk honestly if this is relevant when combined with "require PR" setting ("Require linear history")

{
  "id": 8040275,
  "name": "Default branch protection",
  "target": "branch",
  "source_type": "Organization",
  "source": "expressjs",
  "enforcement": "active",
  "conditions": {
    "ref_name": {
      "exclude": [],
      "include": [
        "~DEFAULT_BRANCH"
      ]
    },
    "repository_property": {
      "exclude": [],
      "include": []
    }
  },
  "rules": [
    {
      "type": "deletion"
    },
    {
      "type": "non_fast_forward"
    },
    {
      "type": "required_linear_history"
    },
    {
      "type": "pull_request",
      "parameters": {
        "required_approving_review_count": 1,
        "dismiss_stale_reviews_on_push": false,
        "require_code_owner_review": false,
        "require_last_push_approval": false,
        "required_review_thread_resolution": false,
        "automatic_copilot_code_review_enabled": false,
        "allowed_merge_methods": [
          "squash",
          "rebase"
        ]
      }
    }
  ],
  "bypass_actors": []
}