Backlog for next releases

This is the current releases backlog in terms of status and priorities

**Important notes:**
- The state of the backlog is always reflected in the latest edition of this message.
- Packages and releases are prioritized based on user impact, with security updates and hotfixes considered the most critical.
- Some packages require maintenance releases, as it has been several years since their last update. These items are considered low priority.
- Ideally, each release has a clear leader.

### Security Releases (Highest priority)

_We intentionally do not disclose more details. This helps us organize the backlog more effectively, as not everyone is aware of which security patches are currently in progress._

- [x] **body-parser** ([repo](https://github.com/expressjs/body-parser), [npm](https://www.npmjs.com/package/body-parser))
- [x] semver-patch: https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4
- [x] 2.2.1: https://github.com/expressjs/body-parser/pull/659
- [x] **express** ([repo](https://github.com/expressjs/express), [npm](https://www.npmjs.com/package/express))
- [x] semver-minor: https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6
- [x] release: https://github.com/expressjs/express/pull/6921
- [x] release: https://github.com/expressjs/express/pull/6920
- [x] **multiparty** ([repo](https://github.com/pillarjs/multiparty), [npm](https://www.npmjs.com/package/multiparty))
- [x] semver-minor: https://github.com/pillarjs/multiparty/security/advisories/GHSA-65x3-rw7q-gx94

_This is organized in a specific order to ensure we apply patches on the latest versions. For example, Express depends on body-parser._

### High Priority

_The community is waiting for these releases, which contain patches and features that we need to ship soon._

- [ ] **cors** ([repo](https://github.com/expressjs/cors), [npm](https://www.npmjs.com/package/cors))
- Priority: https://github.com/expressjs/cors/issues/346
- Lead: @ulisesGascon / @efekrskl
- [ ] **compressible** ([repo](https://github.com/jshttp/compressible), [npm](https://www.npmjs.com/package/compressible)):
- Proposal 2.0.19: https://github.com/jshttp/compressible/pull/32
- Lead: @UlisesGascon
- [ ] **on-finished** ([repo](https://github.com/jshttp/on-finished), [npm](https://www.npmjs.com/package/on-finished)):
- semver-major: https://github.com/jshttp/on-finished/issues/57
- Lead: @Phillip9587 / @UlisesGascon
- [ ] **mime-db** ([repo](https://github.com/jshttp/mime-db), [npm](https://www.npmjs.com/package/mime-db)):
- [ ] Backlog: https://github.com/jshttp/mime-db/issues/414
- [ ] Create a release proposal PR
- Lead: @UlisesGascon
- [x] **iconv-lite** ([repo](https://github.com/pillarjs/iconv-lite), [npm](https://www.npmjs.com/package/iconv-lite)):
- Release: https://github.com/pillarjs/iconv-lite/pull/359
- Release: 1.x (TBC)
- Lead: @bjohansebas
- [x] **content-disposition** ([repo](https://github.com/jshttp/content-disposition/), [npm](https://npmjs.org/package/content-disposition)):
- Proposal 1.0.1: https://github.com/jshttp/content-disposition/pull/58
- Lead: @Phillip9587 / @UlisesGascon
- [x] **mime-types** ([repo](https://github.com/jshttp/mime-types), [npm](https://www.npmjs.com/package/mime-types)):
- Proposal 3.0.2 https://github.com/jshttp/mime-types/pull/169
- Lead: @UlisesGascon
- [x] **http-errors** ([repo](https://github.com/jshttp/http-errors), [npm](https://www.npmjs.com/package/http-errors)):
- Motivation: This would deduplicate the `statuses` package in our dependency tree: [npm graph](https://npmgraph.js.org/?q=express)
- Proposal 2.0.1 https://github.com/jshttp/http-errors/pull/140
- Lead: @UlisesGascon
- [x] **serve-static** ([repo](https://github.com/expressjs/serve-static), [npm](https://www.npmjs.com/package/serve-static))
- Lead: @UlisesGascon
- Priority: https://github.com/expressjs/serve-static/pull/227
- Release: https://github.com/expressjs/serve-static/pull/228
- Release: https://github.com/expressjs/serve-static/pull/229
- [x] **send** ([repo](https://github.com/pillarjs/send), [npm](https://www.npmjs.com/package/send))
- Lead: @UlisesGascon
- Priority: https://github.com/pillarjs/send/pull/279
- Release: https://github.com/pillarjs/send/pull/281
- Release: https://github.com/pillarjs/send/pull/280
- [x] **finalhandler** ([repo](https://github.com/pillarjs/finalhandler), [npm](https://www.npmjs.com/package/finalhandler))
- Lead: @UlisesGascon
- Priority: https://github.com/pillarjs/finalhandler/pull/118 and https://github.com/pillarjs/finalhandler/pull/119
- Release: https://github.com/pillarjs/finalhandler/pull/120
- Release: https://github.com/pillarjs/finalhandler/pull/121
- [x] **body-parser** ([repo](https://github.com/expressjs/body-parser), [npm](https://www.npmjs.com/package/body-parser))
- Lead: @UlisesGascon
- Priority: https://github.com/expressjs/body-parser/pull/668
- Release: https://github.com/expressjs/body-parser/pull/672
- 2.2.2: https://github.com/expressjs/body-parser/pull/691
- [x] **cookie** ([repo](https://github.com/jshttp/cookie), [npm](https://www.npmjs.com/package/cookie))
- Lead: @blakeembrey
- `cookie@1.1.0`: https://github.com/jshttp/cookie/releases/tag/v1.1.0

### Medium Priority

_The community is waiting for these releases, which include patches and features that we can release without urgency. In some cases, the release backlog is not yet ready._

- [ ] **multer** ([repo](https://github.com/expressjs/multer), [npm](https://www.npmjs.com/package/multer)):
- semver-major and semver-patch pending: https://github.com/expressjs/multer/issues/1310
- Lead: @bjohansebas / @UlisesGascon / @LinusU
- [ ] **compression** ([repo](https://github.com/expressjs/compression), [npm](https://www.npmjs.com/package/compression)):
- semver-major: https://github.com/expressjs/compression/issues/234
- Lead: @bjohansebas / @ulisesgascon
- [ ] **express-session** ([repo](https://github.com/expressjs/session), [npm](https://www.npmjs.com/package/express-session)):
- semver-major: https://github.com/expressjs/session/issues/1006
- Lead: @UlisesGascon / @bjohansebas
- [ ] **response-time** ([repo](https://github.com/expressjs/response-time), [npm](https://www.npmjs.com/package/response-time))
- semver-major: https://github.com/expressjs/response-time/issues/25
- Lead: @carpasse / @UlisesGascon
- [ ] **basic-auth-connect** ([repo](https://github.com/expressjs/basic-auth-connect), [npm](https://www.npmjs.com/package/basic-auth-connect)):
- semver-major: https://github.com/expressjs/basic-auth-connect/issues/8
- Lead: @UlisesGascon
- [ ] **hbs** ([repo](https://github.com/pillarjs/hbs), [npm](https://www.npmjs.com/package/hbs))
- semver-major: https://github.com/pillarjs/hbs/tree/5.0
- Lead: @UlisesGascon / @mfdebian
- [ ] **on-headers** ([repo](https://github.com/jshttp/on-headers), [npm](https://www.npmjs.com/package/on-headers)):
- semver-major: https://github.com/jshttp/on-headers/issues/18
- Lead: @bjohansebas / @UlisesGascon
- [ ] **content-type** ([repo](https://github.com/jshttp/content-type), [npm](https://www.npmjs.com/package/content-type)):
- semver-major: https://github.com/jshttp/content-type/issues/27
- Lead: @Phillip9587 / @UlisesGascon
- [ ] **basic-auth** ([repo](https://github.com/jshttp/basic-auth), [npm](https://www.npmjs.com/package/basic-auth)):
- semver-major: https://github.com/jshttp/basic-auth/issues/70
- Lead: @Phillip9587 / @UlisesGascon
- [x] **errorhandler** ([repo](https://github.com/expressjs/errorhandler), [npm](https://npmjs.org/package/errorhandler))
- Lead: @UlisesGascon / @nanotower
- [ ] **cookies** ([repo](https://github.com/pillarjs/cookies), [npm](https://www.npmjs.com/package/cookies))
- semver-major proposal: https://github.com/pillarjs/cookies/pull/48
- Lead: @UlisesGascon / @imangas
- [ ] **http-assert** ([repo](https://github.com/jshttp/http-assert), [npm](https://www.npmjs.com/package/http-assert))
- Motivation: https://github.com/jshttp/http-assert/pull/37
- Lead: @UlisesGascon

### Backlog

_We need to plan the release content. These releases are considered blocked until we gain more traction._

- **serve-index** ([repo](https://github.com/expressjs/serve-index), [npm](https://www.npmjs.com/package/serve-index))
- **method-override** ([repo](https://github.com/expressjs/method-override), [npm](https://www.npmjs.com/package/method-override))
- **vhost** ([repo](https://github.com/expressjs/vhost), [npm](https://www.npmjs.com/package/vhost))
- **parseurl** ([repo](https://github.com/pillarjs/parseurl), [npm](https://www.npmjs.com/package/parseurl))
- **csrf** ([repo](https://github.com/pillarjs/csrf), [npm](https://www.npmjs.com/package/csrf))
- **resolve-path** ([repo](https://github.com/pillarjs/resolve-path), [npm](https://www.npmjs.com/package/resolve-path))
- **media-typer** ([repo](https://github.com/jshttp/media-typer), [npm](https://www.npmjs.com/package/media-typer))
- **vary** ([repo](https://github.com/jshttp/vary), [npm](https://www.npmjs.com/package/vary))
- **methods** ([repo](https://github.com/jshttp/methods), [npm](https://www.npmjs.com/package/methods))
- **range-parser** ([repo](https://github.com/jshttp/range-parser), [npm](https://www.npmjs.com/package/range-parser))
- **proxy-addr** ([repo](https://github.com/jshttp/proxy-addr), [npm](https://www.npmjs.com/package/proxy-addr))
- **etag** ([repo](https://github.com/jshttp/etag), [npm](https://www.npmjs.com/package/etag))
- **http-errors** ([repo](https://github.com/jshttp/http-errors), [npm](https://www.npmjs.com/package/http-errors))
- **forwarded** ([repo](https://github.com/jshttp/forwarded), [npm](https://npmjs.org/package/forwarded))
- semver-major proposal: https://github.com/jshttp/forwarded/pull/1

### On hold

_We released a version recently, but we can prepare a new one containing the remaining open issues, dependency upgrades, and other improvements._

- **morgan** ([repo](https://github.com/expressjs/morgan), [npm](https://www.npmjs.com/package/morgan))
- **serve-favicon** ([repo](https://github.com/expressjs/serve-favicon), [npm](https://www.npmjs.com/package/serve-favicon))
- **connect-timeout** ([repo](https://github.com/expressjs/timeout), [npm](https://www.npmjs.com/package/connect-timeout))
- **statuses** ([repo](https://github.com/jshttp/statuses), [npm](https://www.npmjs.com/package/statuses))
- **fresh** ([repo](https://github.com/jshttp/fresh), [npm](https://www.npmjs.com/package/fresh))
- **negotiator** ([repo](https://github.com/jshttp/negotiator), [npm](https://www.npmjs.com/package/negotiator))
- **type-is** ([repo](https://github.com/jshttp/type-is), [npm](https://www.npmjs.com/package/type-is))
- **encodeurl** ([repo](https://github.com/jshttp/encodeurl), [npm](https://www.npmjs.com/package/encodeurl))
- **iconv-lite** ([repo](https://github.com/jshttp/iconv-lite), [npm](https://www.npmjs.com/package/iconv-lite))
- **router** ([repo](https://github.com/pillarjs/router), [npm](https://www.npmjs.com/package/router))
- **cookie-parser** ([repo](https://github.com/expressjs/cookie-parser), [npm](https://www.npmjs.com/package/cookie-parser))
- **cookie-session** ([repo](https://github.com/expressjs/cookie-session), [npm](https://www.npmjs.com/package/cookie-session))
- **path-to-regexp** ([repo](https://github.com/pillarjs/path-to-regexp), [npm](https://www.npmjs.com/package/path-to-regexp))