2026-08-03 Express TC Meeting

[github-actions]

Date/Time

Timezone	Date/Time
America/Los_Angeles	Mon, Aug 03, 2026, 11:00 AM
America/Denver	Mon, Aug 03, 2026, 12:00 PM
America/Chicago	Mon, Aug 03, 2026, 01:00 PM
America/Bogota	Mon, Aug 03, 2026, 01:00 PM
America/New_York	Mon, Aug 03, 2026, 02:00 PM
UTC	Mon, Aug 03, 2026, 06:00 PM
Europe/London	Mon, Aug 03, 2026, 07:00 PM
Europe/Madrid	Mon, Aug 03, 2026, 08:00 PM
Europe/Paris	Mon, Aug 03, 2026, 08:00 PM
Europe/Warsaw	Mon, Aug 03, 2026, 08:00 PM
Europe/Moscow	Mon, Aug 03, 2026, 09:00 PM
Asia/Kolkata	Mon, Aug 03, 2026, 11:30 PM
Asia/Shanghai	Tue, Aug 04, 2026, 02:00 AM
Asia/Tokyo	Tue, Aug 04, 2026, 03:00 AM
Australia/Sydney	Tue, Aug 04, 2026, 04:00 AM

Or in your local time:

• https://www.timeanddate.com/worldclock/fixedtime.html?msg=2026-08-03%20Express%20TC%20Meeting&iso=20260803T1800&p1=1440&ah=1

Agenda

• fix: prevent host header injection by sanitizing userinfo in Host header express#7317 the ask here is for reviews from folks, do we want to do this kind of sanitization? is it worth it on the hot path?
• Remove the extended option and stop being opinionated about parsers #511 do we want to remove the app.set('query parser', 'extended'); option in v6?

Proposed Agenda Items

Extracted from tc agenda labelled issues and pull requests from expressjs/discussions prior to the meeting.

• Expose Express 5 & 6 GitHub Projects Publicly #512
• Remove the extended option and stop being opinionated about parsers #511
• Batch governance changes and present to CPC #466
• Access to Cloudflare Analytics for the Website Captains #465
• Update the organization logo #426
• Express CLI #197
• docs: add RFC for shared logging facade (@expressjs/log) #509
• feat: propose sponsors level for opencollective and github #496
• docs: new Collaborator role #486
• docs: update governance to allow long-term contributors to be nominated as committers and captains #485
• Rfc for reusable workflows naming repository #455
• Default workflows part of all repositories #444
• Reusable workflows for npm publish #443
• fix: prevent host header injection by sanitizing userinfo in Host header express#7317
• proposal: add the security-triage team as security manager of the organizations security-wg#62

Invited

• @expressjs/express-tc
• @expressjs/triagers
• @expressjs/security-wg

Observers/Guests

This meeting is open for anyone who wants to attend. Reminder to follow our Code of Conduct.

Joining the meeting

• link for participants: https://zoom-lfx.platform.linuxfoundation.org/meeting/95266714809?password=f37cff1b-cb3a-4a21-9425-210e4714c72e

---

Please use the following emoji reactions in this post to indicate your
availability.

• 👍 - Attending
• 👎 - Not attending
• 😕 - Not sure yet