From 4330611b9fcb6b15b6ad54d96e14d2cfff4d6171 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Jun 2015 21:31:08 -0400
Subject: [PATCH 001/529] build: skip istanbul coverage on Node.js 0.8

---
 .travis.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 01b92ea2..23d5c798 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,5 +7,12 @@ node_js:
   - "1.8"
   - "2.0"
 sudo: false
-script: "npm run-script test-travis"
-after_script: "npm install coveralls@2.10.0 && cat ./coverage/lcov.info | coveralls"
+before_install:
+  # Setup Node.js version-specific dependencies
+  - "test $TRAVIS_NODE_VERSION != '0.8' || npm rm --save-dev istanbul"
+script:
+  # Run test script, depending on istanbul install
+  - "test -n $(npm -ps ls istanbul) || npm test"
+  - "test -z $(npm -ps ls istanbul) || npm run-script test-travis"
+after_script:
+  - "test -e ./coverage/lcov.info && npm install coveralls@2 && cat ./coverage/lcov.info | coveralls"

From 168cae2fdc8d6d8a84b69ffdd5d6b0618e034187 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Jun 2015 21:31:33 -0400
Subject: [PATCH 002/529] build: io.js@2.2

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 23d5c798..5835742a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -6,6 +6,7 @@ node_js:
   - "1.0"
   - "1.8"
   - "2.0"
+  - "2.2"
 sudo: false
 before_install:
   # Setup Node.js version-specific dependencies

From 7407316d0809d13e507b3feee82587b2daddb32e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Jun 2015 21:34:56 -0400
Subject: [PATCH 003/529] build: istanbul@0.3.15

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ee978bbe..9ecc8faf 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "after": "0.8.1",
     "cookie-parser": "~1.3.5",
     "express": "~4.12.4",
-    "istanbul": "0.3.9",
+    "istanbul": "0.3.15",
     "mocha": "2.2.5",
     "supertest": "1.0.1"
   },

From 41b71b022161116209deec1dfca4817850e1dccd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Jun 2015 21:46:25 -0400
Subject: [PATCH 004/529] docs: update license

---
 LICENSE  | 2 +-
 index.js | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/LICENSE b/LICENSE
index f24497a5..9b59ff85 100644
--- a/LICENSE
+++ b/LICENSE
@@ -2,7 +2,7 @@
 
 Copyright (c) 2010 Sencha Inc.
 Copyright (c) 2011 TJ Holowaychuk <tj@vision-media.ca>
-Copyright (c) 2014 Douglas Christopher Wilson <doug@somethingdoug.com>
+Copyright (c) 2014-2015 Douglas Christopher Wilson <doug@somethingdoug.com>
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
diff --git a/index.js b/index.js
index 6f6d1b52..5e12c9fc 100644
--- a/index.js
+++ b/index.js
@@ -2,7 +2,7 @@
  * express-session
  * Copyright(c) 2010 Sencha Inc.
  * Copyright(c) 2011 TJ Holowaychuk
- * Copyright(c) 2014 Douglas Christopher Wilson
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
  * MIT Licensed
  */
 

From f4ddfb1e02dec0fbc67997b37bba14c34a0e54b1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Jun 2015 21:53:09 -0400
Subject: [PATCH 005/529] deps: crc@3.3.0

---
 HISTORY.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 0d60507c..53c9c411 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -3,6 +3,7 @@ unreleased
 
   * deps: cookie@0.1.3
     - Slight optimizations
+  * deps: crc@3.3.0
 
 1.11.2 / 2015-05-10
 ===================
diff --git a/package.json b/package.json
index 9ecc8faf..b4651787 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,7 @@
   "dependencies": {
     "cookie": "0.1.3",
     "cookie-signature": "1.0.6",
-    "crc": "3.2.1",
+    "crc": "3.3.0",
     "debug": "~2.2.0",
     "depd": "~1.0.1",
     "on-headers": "~1.0.0",

From 64e2e7a2d21da881ea53ab984f9eff4be58d7caf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Jun 2015 21:54:03 -0400
Subject: [PATCH 006/529] 1.11.3

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 53c9c411..c0842e09 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.11.3 / 2015-05-22
+===================
 
   * deps: cookie@0.1.3
     - Slight optimizations
diff --git a/package.json b/package.json
index b4651787..242ffe73 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.11.2",
+  "version": "1.11.3",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 1b15e969e570c7331f7feab417ba7a214389fea9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 29 Jun 2015 23:23:16 -0400
Subject: [PATCH 007/529] build: istanbul@0.3.17

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 242ffe73..aceffe15 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "after": "0.8.1",
     "cookie-parser": "~1.3.5",
     "express": "~4.12.4",
-    "istanbul": "0.3.15",
+    "istanbul": "0.3.17",
     "mocha": "2.2.5",
     "supertest": "1.0.1"
   },

From 05375000add28b9259c8db1ab34d52c719329ab4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 29 Jun 2015 23:23:41 -0400
Subject: [PATCH 008/529] build: express@~4.13.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index aceffe15..f5860496 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
   "devDependencies": {
     "after": "0.8.1",
     "cookie-parser": "~1.3.5",
-    "express": "~4.12.4",
+    "express": "~4.13.0",
     "istanbul": "0.3.17",
     "mocha": "2.2.5",
     "supertest": "1.0.1"

From 40b22dc8738f2b85992c75d275b4726f566539b6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 29 Jun 2015 23:24:29 -0400
Subject: [PATCH 009/529] build: io.js@2.3

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 5835742a..d03ff37c 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -6,7 +6,7 @@ node_js:
   - "1.0"
   - "1.8"
   - "2.0"
-  - "2.2"
+  - "2.3"
 sudo: false
 before_install:
   # Setup Node.js version-specific dependencies

From 458f9da24c26ca54d9d8d144816ab391826203ed Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 29 Jun 2015 23:31:42 -0400
Subject: [PATCH 010/529] docs: add req.sessionID

closes #178
---
 README.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/README.md b/README.md
index 0902d8d6..745d0a66 100644
--- a/README.md
+++ b/README.md
@@ -293,6 +293,12 @@ to its original value.
 req.session.cookie.maxAge // => 30000
 ```
 
+### req.sessionID
+
+To get the ID of the loaded session, access the request property
+`req.sessionID`. This is simply a read-only value set when a session
+is loaded/created.
+
 ## Session Store Implementation
 
 Every session store _must_ be an `EventEmitter` and implement the following

From a0f07f5d88a2c72a01f5869175633e4b999af825 Mon Sep 17 00:00:00 2001
From: Robin Cijvat <robin.cijvat@monetdbsolutions.com>
Date: Wed, 24 Jun 2015 18:36:17 +0200
Subject: [PATCH 011/529] docs: add connect-monetdb to list of session stores

---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index 745d0a66..5a3d0b65 100644
--- a/README.md
+++ b/README.md
@@ -329,6 +329,10 @@ module. Please make a PR to add additional modules :)
 [connect-mssql-url]: https://www.npmjs.com/package/connect-mssql
 [connect-mssql-image]: https://img.shields.io/github/stars/patriksimek/connect-mssql.svg?label=%E2%98%85
 
+[![Github Stars][connect-monetdb-image] connect-monetdb][connect-monetdb-url] A MonetDB-based session store.
+[connect-monetdb-url]: https://www.npmjs.com/package/connect-monetdb
+[connect-monetdb-image]: https://img.shields.io/github/stars/MonetDB/npm-connect-monetdb.svg?label=%E2%98%85
+
 [![Github Stars][connect-mongo-image] connect-mongo][connect-mongo-url] A MongoDB-based session store.
 [connect-mongo-url]: https://www.npmjs.com/package/connect-mongo
 [connect-mongo-image]: https://img.shields.io/github/stars/kcbanner/connect-mongo.svg?label=%E2%98%85

From 3db8535e2fb1e672bc08233a9ab2d4afa1a8d7e2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 Jul 2015 22:17:06 -0400
Subject: [PATCH 012/529] build: express@~4.13.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f5860496..b0c3108f 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
   "devDependencies": {
     "after": "0.8.1",
     "cookie-parser": "~1.3.5",
-    "express": "~4.13.0",
+    "express": "~4.13.1",
     "istanbul": "0.3.17",
     "mocha": "2.2.5",
     "supertest": "1.0.1"

From a8fb6da01dfd920732f4f5020bdc79103a49f8ca Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 Jul 2015 22:31:42 -0400
Subject: [PATCH 013/529] docs: expand on session store implementation

closes #147
---
 README.md | 70 +++++++++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 60 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index 5a3d0b65..1c528a2f 100644
--- a/README.md
+++ b/README.md
@@ -301,20 +301,70 @@ is loaded/created.
 
 ## Session Store Implementation
 
-Every session store _must_ be an `EventEmitter` and implement the following
-methods:
+Every session store _must_ be an `EventEmitter` and implement specific
+methods. The following methods are the list of **required**, **recommended**,
+and **optional**.
 
-   - `.get(sid, callback)`
-   - `.set(sid, session, callback)`
-   - `.destroy(sid, callback)`
+  * Required methods are ones that this module will always call on the store.
+  * Recommended methods are ones that this module will call on the store if
+    available.
+  * Optional methods are ones this module does not call at all, but helps
+    present uniform stores to users.
 
-Recommended methods include, but are not limited to:
+For an example implementation view the [connect-redis](http://github.com/visionmedia/connect-redis) repo.
 
-   - `.touch(sid, session, callback)`
-   - `.length(callback)`
-   - `.clear(callback)`
+### store.destroy(sid, callback)
 
-For an example implementation view the [connect-redis](http://github.com/visionmedia/connect-redis) repo.
+**Required**
+
+This required method is used to destroy/delete a session from the store given
+a session ID (`sid`). The `callback` should be called as `callback(error)` once
+the session is destroyed.
+
+### store.clear(callback)
+
+**Optional**
+
+This optional method is used to delete all sessions from the store. The
+`callback` should be called as `callback(error)` once the store is cleared.
+
+### store.length(callback)
+
+**Optional**
+
+This optional method is used to get the count of all sessions in the store.
+The `callback` should be called as `callback(error, len)`.
+
+### store.get(sid, callback)
+
+**Required**
+
+This required method is used to get a session from the store given a session
+ID (`sid`). The `callback` should be called as `callback(error, session)`.
+
+The `session` argument should be a session if found, otherwise `null` or
+`undefined` if the session was not found (and there was no error). A special
+case is made when `error.code === 'ENOENT'` to act like `callback(null, null)`.
+
+### store.set(sid, session, callback)
+
+**Required**
+
+This required method is used to upsert a session into the store given a
+session ID (`sid`) and session (`session`) object. The callback should be
+called as `callback(error)` once the session has been set in the store.
+
+### store.touch(sid, session, callback)
+
+**Recommended**
+
+This recommended method is used to "touch" a given session given a
+session ID (`sid`) and session (`session`) object. The `callback` should be
+called as `callback(error)` once the session has been touched.
+
+This is primarily used when the store will automatically delete idle sessions
+and this method is used to signal to the store the given session is active,
+potentially resetting the idle timer.
 
 ## Compatible Session Stores
 

From 94f20daa0ae71f1092e1bdd6304a57cff77a8e2d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 Jul 2015 22:33:44 -0400
Subject: [PATCH 014/529] docs: add store.all() as an optional listed method

closes #184
---
 README.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/README.md b/README.md
index 1c528a2f..07aedbdf 100644
--- a/README.md
+++ b/README.md
@@ -313,6 +313,13 @@ and **optional**.
 
 For an example implementation view the [connect-redis](http://github.com/visionmedia/connect-redis) repo.
 
+### store.all(callback)
+
+**Optional**
+
+This optional method is used to get all sessions in the store as an array. The
+`callback` should be called as `callback(error, sessions)`.
+
 ### store.destroy(sid, callback)
 
 **Required**

From 98a9723af7d532e9b306395e3f2b7bbfa3130b97 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 6 Aug 2015 22:09:11 -0400
Subject: [PATCH 015/529] build: fix running Node.js 0.8 tests on Travis CI

---
 .travis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index d03ff37c..b6fa08fa 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ before_install:
   - "test $TRAVIS_NODE_VERSION != '0.8' || npm rm --save-dev istanbul"
 script:
   # Run test script, depending on istanbul install
-  - "test -n $(npm -ps ls istanbul) || npm test"
-  - "test -z $(npm -ps ls istanbul) || npm run-script test-travis"
+  - "test ! -z $(npm -ps ls istanbul) || npm test"
+  - "test   -z $(npm -ps ls istanbul) || npm run-script test-travis"
 after_script:
   - "test -e ./coverage/lcov.info && npm install coveralls@2 && cat ./coverage/lcov.info | coveralls"

From b72054c2d2775a5f1ab6134ff8451fe8246a186c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 6 Aug 2015 22:09:57 -0400
Subject: [PATCH 016/529] build: io.js@2.5

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index b6fa08fa..b9c20bbe 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -6,7 +6,7 @@ node_js:
   - "1.0"
   - "1.8"
   - "2.0"
-  - "2.3"
+  - "2.5"
 sudo: false
 before_install:
   # Setup Node.js version-specific dependencies

From 85df0b7b3378671dda78f7813bffc1c877aa12ef Mon Sep 17 00:00:00 2001
From: AJ ONeal <awesome@coolaj86.com>
Date: Sun, 26 Jul 2015 02:05:56 -0600
Subject: [PATCH 017/529] docs: add cluster-store to list of session stores

closes #187
---
 README.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/README.md b/README.md
index 07aedbdf..649fa28b 100644
--- a/README.md
+++ b/README.md
@@ -382,6 +382,12 @@ module. Please make a PR to add additional modules :)
 [cassandra-store-url]: https://www.npmjs.com/package/cassandra-store
 [cassandra-store-image]: https://img.shields.io/github/stars/webcc/cassandra-store.svg?label=%E2%98%85
 
+[![Github Stars][cluster-store-image] cluster-store][cluster-store-url] A wrapper for using in-process / embedded
+stores - such as SQLite (via knex), leveldb, files, or memory - with node cluster (desirable for Raspberry Pi 2
+and other multi-core embedded devices).
+[cluster-store-url]: https://www.npmjs.com/package/cluster-store
+[cluster-store-image]: https://img.shields.io/github/stars/coolaj86/cluster-store.svg?label=%E2%98%85
+
 [![Github Stars][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
 [connect-mssql-url]: https://www.npmjs.com/package/connect-mssql
 [connect-mssql-image]: https://img.shields.io/github/stars/patriksimek/connect-mssql.svg?label=%E2%98%85

From c1da3f70826f3b543f3faf39f21ecc1d22bdd6f9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 11 Aug 2015 14:01:18 -0400
Subject: [PATCH 018/529] build: support io.js 3.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index b9c20bbe..86391141 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,6 +7,7 @@ node_js:
   - "1.8"
   - "2.0"
   - "2.5"
+  - "3.0"
 sudo: false
 before_install:
   # Setup Node.js version-specific dependencies

From 977a39be97851c970e9c8ea2624db783bb2d6fb3 Mon Sep 17 00:00:00 2001
From: Carlos Cardona <carlos@wine.com>
Date: Mon, 10 Aug 2015 15:45:31 -0700
Subject: [PATCH 019/529] docs: add connect-couchbase to list of session stores

closes #192
---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index 649fa28b..8afdcc55 100644
--- a/README.md
+++ b/README.md
@@ -388,6 +388,10 @@ and other multi-core embedded devices).
 [cluster-store-url]: https://www.npmjs.com/package/cluster-store
 [cluster-store-image]: https://img.shields.io/github/stars/coolaj86/cluster-store.svg?label=%E2%98%85
 
+[![Github Stars][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store.
+[connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase
+[connect-couchbase-image]: https://img.shields.io/github/stars/christophermina/connect-couchbase.svg?label=%E2%98%85
+
 [![Github Stars][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
 [connect-mssql-url]: https://www.npmjs.com/package/connect-mssql
 [connect-mssql-image]: https://img.shields.io/github/stars/patriksimek/connect-mssql.svg?label=%E2%98%85

From dad99efb59ac3ab70c91d480539f171a0448095e Mon Sep 17 00:00:00 2001
From: Konstantin Kitmanov <doctor.hogart@gmail.com>
Date: Tue, 11 Aug 2015 20:48:05 +0300
Subject: [PATCH 020/529] docs: add connect-session-sequelize to list of
 session stores

closes #195
closes #196
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 8afdcc55..44c3d963 100644
--- a/README.md
+++ b/README.md
@@ -417,6 +417,11 @@ and other multi-core embedded devices).
 [connect-session-knex-url]: https://www.npmjs.com/package/connect-session-knex
 [connect-session-knex-image]: https://img.shields.io/github/stars/llambda/connect-session-knex.svg?label=%E2%98%85
 
+[![Github Stars][connect-session-sequelize-image] connect-session-sequelize][connect-session-sequelize-url] A session store using
+[Sequelize.js](http://sequelizejs.com/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL.
+[connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize
+[connect-session-sequelize-image]: https://img.shields.io/github/stars/mweibel/connect-session-sequelize.svg?label=%E2%98%85
+
 [![Github Stars][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store.
 [level-session-store-url]: https://www.npmjs.com/package/level-session-store
 [level-session-store-image]: https://img.shields.io/github/stars/scriptollc/level-session-store.svg?label=%E2%98%85

From e6386a806f509c55de85994ba03aba1482c0714d Mon Sep 17 00:00:00 2001
From: Jason Karns <jason.karns@gmail.com>
Date: Wed, 12 Aug 2015 14:31:22 -0400
Subject: [PATCH 021/529] docs: readme grammar tweaks

closes #197
---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 44c3d963..a54fba54 100644
--- a/README.md
+++ b/README.md
@@ -222,7 +222,7 @@ app.use(function(req, res, next) {
 
 #### Session.regenerate()
 
-To regenerate the session simply invoke the method, once complete
+To regenerate the session simply invoke the method. Once complete,
 a new SID and `Session` instance will be initialized at `req.session`.
 
 ```js
@@ -233,7 +233,7 @@ req.session.regenerate(function(err) {
 
 #### Session.destroy()
 
-Destroys the session, removing `req.session`, will be re-generated next request.
+Destroys the session, removing `req.session`; will be re-generated next request.
 
 ```js
 req.session.destroy(function(err) {

From 86def481609d9e932fd873b43ced062d8f8c5117 Mon Sep 17 00:00:00 2001
From: Pelle Wessman <pelle@kodfabrik.se>
Date: Sat, 22 Aug 2015 18:51:04 +0200
Subject: [PATCH 022/529] docs: add connect-pg-simple to list of session stores

closes #199
---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index a54fba54..abcd337b 100644
--- a/README.md
+++ b/README.md
@@ -408,6 +408,10 @@ and other multi-core embedded devices).
 [connect-mongodb-session-url]: https://www.npmjs.com/package/connect-mongodb-session
 [connect-mongodb-session-image]: https://img.shields.io/github/stars/mongodb-js/connect-mongodb-session.svg?label=%E2%98%85
 
+[![Github Stars][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
+[connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple
+[connect-pg-simple-image]: https://img.shields.io/github/stars/voxpelli/node-connect-pg-simple.svg?label=%E2%98%85
+
 [![Github Stars][connect-redis-image] connect-redis][connect-redis-url] A Redis-based session store.
 [connect-redis-url]: https://www.npmjs.com/package/connect-redis
 [connect-redis-image]: https://img.shields.io/github/stars/tj/connect-redis.svg?label=%E2%98%85

From 1fe84a45b8bbbd99e6d686cfeae916b07b459cf1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Oct 2015 19:08:48 -0400
Subject: [PATCH 023/529] deps: on-headers@~1.0.1

---
 HISTORY.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index c0842e09..4f00b30f 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: on-headers@~1.0.1
+    - perf: enable strict mode
+
 1.11.3 / 2015-05-22
 ===================
 
diff --git a/package.json b/package.json
index b0c3108f..cb14e6e9 100644
--- a/package.json
+++ b/package.json
@@ -15,7 +15,7 @@
     "crc": "3.3.0",
     "debug": "~2.2.0",
     "depd": "~1.0.1",
-    "on-headers": "~1.0.0",
+    "on-headers": "~1.0.1",
     "parseurl": "~1.3.0",
     "uid-safe": "~2.0.0",
     "utils-merge": "1.0.0"

From 7f56905193fd2adf9d7b5b10156750a2d6e532fa Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Oct 2015 19:10:16 -0400
Subject: [PATCH 024/529] build: mocha@2.3.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index cb14e6e9..8e63a0d9 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "cookie-parser": "~1.3.5",
     "express": "~4.13.1",
     "istanbul": "0.3.17",
-    "mocha": "2.2.5",
+    "mocha": "2.3.3",
     "supertest": "1.0.1"
   },
   "files": [

From 5b1837b3566650b3fa6d3d0760b9be6bbd14e29a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Oct 2015 19:10:59 -0400
Subject: [PATCH 025/529] build: supertest@1.1.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 8e63a0d9..e8d3e5e5 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "express": "~4.13.1",
     "istanbul": "0.3.17",
     "mocha": "2.3.3",
-    "supertest": "1.0.1"
+    "supertest": "1.1.0"
   },
   "files": [
     "session/",

From a32ec03475b1adcea9fe59f698ca5818ab82e511 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Oct 2015 19:11:20 -0400
Subject: [PATCH 026/529] deps: depd@~1.1.0

---
 HISTORY.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 4f00b30f..12e18ffa 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,9 @@
 unreleased
 ==========
 
+  * deps: depd@~1.1.0
+    - Enable strict mode in more places
+    - Support web browser loading
   * deps: on-headers@~1.0.1
     - perf: enable strict mode
 
diff --git a/package.json b/package.json
index e8d3e5e5..570408fc 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,7 @@
     "cookie-signature": "1.0.6",
     "crc": "3.3.0",
     "debug": "~2.2.0",
-    "depd": "~1.0.1",
+    "depd": "~1.1.0",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.0",
     "uid-safe": "~2.0.0",

From f002713dd7760398f79e86a03325a5d964a180b2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Oct 2015 19:14:31 -0400
Subject: [PATCH 027/529] deps: cookie@0.2.2

---
 HISTORY.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 12e18ffa..9bb23753 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,8 @@
 unreleased
 ==========
 
+  * deps: cookie@0.2.2
+    - Throw on invalid values provided to `serialize`
   * deps: depd@~1.1.0
     - Enable strict mode in more places
     - Support web browser loading
diff --git a/package.json b/package.json
index 570408fc..b8b642f4 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   "repository": "expressjs/session",
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.1.3",
+    "cookie": "0.2.2",
     "cookie-signature": "1.0.6",
     "crc": "3.3.0",
     "debug": "~2.2.0",

From 1be6318f112bebfe5e978e9317bc18a9286de73f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Oct 2015 19:26:44 -0400
Subject: [PATCH 028/529] build: cookie-parser@~1.4.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index b8b642f4..f3b200a2 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
   },
   "devDependencies": {
     "after": "0.8.1",
-    "cookie-parser": "~1.3.5",
+    "cookie-parser": "~1.4.0",
     "express": "~4.13.1",
     "istanbul": "0.3.17",
     "mocha": "2.3.3",

From 468e13323e8d5e5bfffd1c99cd544c97b9323414 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Oct 2015 19:27:40 -0400
Subject: [PATCH 029/529] build: express@~4.13.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f3b200a2..513f5c4a 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
   "devDependencies": {
     "after": "0.8.1",
     "cookie-parser": "~1.4.0",
-    "express": "~4.13.1",
+    "express": "~4.13.3",
     "istanbul": "0.3.17",
     "mocha": "2.3.3",
     "supertest": "1.1.0"

From dd1214800002d6659d6749b4f442bb7ab6a05742 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 9 Oct 2015 10:05:43 -0400
Subject: [PATCH 030/529] build: io.js@3.3

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 86391141..43c43e91 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,6 +8,7 @@ node_js:
   - "2.0"
   - "2.5"
   - "3.0"
+  - "3.3"
 sudo: false
 before_install:
   # Setup Node.js version-specific dependencies

From 396ef9b60fcaeb6fa573bd55d1fe79744bda0e8c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 25 Oct 2015 17:54:11 -0400
Subject: [PATCH 031/529] build: support Node.js 4.x

---
 .travis.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 43c43e91..803d78d3 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,6 +9,8 @@ node_js:
   - "2.5"
   - "3.0"
   - "3.3"
+  - "4.0"
+  - "4.2"
 sudo: false
 before_install:
   # Setup Node.js version-specific dependencies

From 8d26b760d94baea8ae5626c35ebcabb095b28da0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 25 Oct 2015 17:54:29 -0400
Subject: [PATCH 032/529] build: istanbul@0.4.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 513f5c4a..c3846f2c 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "after": "0.8.1",
     "cookie-parser": "~1.4.0",
     "express": "~4.13.3",
-    "istanbul": "0.3.17",
+    "istanbul": "0.4.0",
     "mocha": "2.3.3",
     "supertest": "1.1.0"
   },

From 7824746eb65b6a0927126d2b1b796883752cd048 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 25 Oct 2015 17:56:54 -0400
Subject: [PATCH 033/529] docs: document req.session.id

closes #217
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index abcd337b..dfa078a5 100644
--- a/README.md
+++ b/README.md
@@ -264,6 +264,11 @@ req.session.save(function(err) {
 Updates the `.maxAge` property. Typically this is
 not necessary to call, as the session middleware does this for you.
 
+### req.session.id
+
+Each session has a unique ID associated with it. This property will
+contain the session ID and cannot be modified.
+
 ### req.session.cookie
 
 Each session has a unique cookie object accompany it. This allows

From a34fd39f5cc0232510eda7a1a598fac7fc39819a Mon Sep 17 00:00:00 2001
From: "Merrifield, Jay" <fracmak@gmail.com>
Date: Tue, 15 Sep 2015 15:06:50 -0400
Subject: [PATCH 034/529] Support the value "auto" in the "cookie.secure"
 option

closes #209
---
 HISTORY.md      |  1 +
 README.md       |  7 +++++
 index.js        | 10 +++++--
 test/session.js | 79 +++++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 94 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 9bb23753..bcde1b77 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Support the value `'auto'` in the `cookie.secure` option
   * deps: cookie@0.2.2
     - Throw on invalid values provided to `serialize`
   * deps: depd@~1.1.0
diff --git a/README.md b/README.md
index dfa078a5..13b7cc56 100644
--- a/README.md
+++ b/README.md
@@ -192,6 +192,13 @@ if (app.get('env') === 'production') {
 app.use(session(sess))
 ```
 
+The `cookie.secure` option can also be set to the special value `'auto'` to have
+this setting automatically match the determined security of the connection. Be
+careful when using this setting if the site is available both as HTTP and HTTPS,
+as once the cookie is set on HTTPS, it will no longer be visible over HTTP. This
+is useful when the Express `"trust proxy"` setting is properly setup to simplify
+development vs production configuration.
+
 By default `cookie.maxAge` is `null`, meaning no "expires" parameter is set
 so the cookie becomes a browser-session cookie. When the user closes the
 browser the cookie (and session) will be removed.
diff --git a/index.js b/index.js
index 5e12c9fc..ab7bdc93 100644
--- a/index.js
+++ b/index.js
@@ -86,10 +86,10 @@ function session(options){
   //  name - previously "options.key"
     , name = options.name || options.key || 'connect.sid'
     , store = options.store || new MemoryStore
-    , cookie = options.cookie || {}
     , trustProxy = options.proxy
     , storeReady = true
     , rollingSessions = options.rolling || false;
+  var cookieOptions = options.cookie || {};
   var resaveSession = options.resave;
   var saveUninitializedSession = options.saveUninitialized;
   var secret = options.secret;
@@ -139,7 +139,11 @@ function session(options){
   store.generate = function(req){
     req.sessionID = generateId(req);
     req.session = new Session(req);
-    req.session.cookie = new Cookie(cookie);
+    req.session.cookie = new Cookie(cookieOptions);
+
+    if (cookieOptions.secure === 'auto') {
+      req.session.cookie.secure = issecure(req, trustProxy);
+    }
   };
 
   var storeImplementsTouch = typeof store.touch === 'function';
@@ -156,7 +160,7 @@ function session(options){
 
     // pathname mismatch
     var originalPath = parseUrl.original(req).pathname;
-    if (0 != originalPath.indexOf(cookie.path || '/')) return next();
+    if (originalPath.indexOf(cookieOptions.path || '/') !== 0) return next();
 
     // ensure a secret is available or bail
     if (!secret && !req.secret) {
diff --git a/test/session.js b/test/session.js
index f592ef3f..9a56ed7f 100644
--- a/test/session.js
+++ b/test/session.js
@@ -638,6 +638,67 @@ describe('session()', function(){
     })
   })
 
+  describe('cookie option', function () {
+    describe('when "secure" set to "auto"', function () {
+      describe('when "proxy" is "true"', function () {
+        before(function () {
+          this.server = createServer({ proxy: true, cookie: { maxAge: 5, secure: 'auto' }})
+        })
+
+        it('should set secure when X-Forwarded-Proto is https', function (done) {
+          request(this.server)
+          .get('/')
+          .set('X-Forwarded-Proto', 'https')
+          .expect(shouldSetCookie('connect.sid'))
+          .expect(shouldSetSecureCookie('connect.sid'))
+          .expect(200, done)
+        })
+      })
+
+      describe('when "proxy" is "false"', function () {
+        before(function () {
+          this.server = createServer({ proxy: false, cookie: { maxAge: 5, secure: 'auto' }})
+        })
+
+        it('should not set secure when X-Forwarded-Proto is https', function (done) {
+          request(this.server)
+          .get('/')
+          .set('X-Forwarded-Proto', 'https')
+          .expect(shouldSetCookie('connect.sid'))
+          .expect(shouldNotSetSecureCookie('connect.sid'))
+          .expect(200, done)
+        })
+      })
+
+      describe('when "proxy" is undefined', function() {
+        before(function () {
+          this.app = express()
+            .use(function(req, res, next) { Object.defineProperty(req, 'secure', { value: JSON.parse(req.headers['x-secure']) }); next(); })
+            .use(session({ secret: 'keyboard cat', cookie: { maxAge: min, secure: 'auto' }}))
+            .use(function(req, res) { res.json(req.secure); });
+        })
+
+        it('should set secure if req.secure = true', function (done) {
+          request(this.app)
+          .get('/')
+          .set('X-Secure', 'true')
+          .expect(shouldSetCookie('connect.sid'))
+          .expect(shouldSetSecureCookie('connect.sid'))
+          .expect(200, 'true', done)
+        })
+
+        it('should not set secure if req.secure = false', function (done) {
+          request(this.app)
+          .get('/')
+          .set('X-Secure', 'false')
+          .expect(shouldSetCookie('connect.sid'))
+          .expect(shouldNotSetSecureCookie('connect.sid'))
+          .expect(200, 'false', done)
+        })
+      })
+    })
+  })
+
   describe('genid option', function(){
     it('should reject non-function values', function(){
       assert.throws(session.bind(null, { genid: 'bogus!' }), /genid.*must/)
@@ -2055,6 +2116,15 @@ function shouldNotHaveHeader(header) {
   }
 }
 
+function shouldNotSetSecureCookie(name) {
+  return function (res) {
+    var header = cookie(res)
+    assert.ok(header, 'should have a cookie header')
+    assert.equal(header.split('=')[0], name, 'should set cookie ' + name)
+    assert.ok(header.toLowerCase().split(/; */).every(function (k) { return k !== 'secure'; }), 'should not set secure cookie')
+  }
+}
+
 function shouldSetCookie(name) {
   return function (res) {
     var header = cookie(res)
@@ -2072,6 +2142,15 @@ function shouldSetCookieToValue(name, val) {
   }
 }
 
+function shouldSetSecureCookie(name) {
+  return function (res) {
+    var header = cookie(res)
+    assert.ok(header, 'should have a cookie header')
+    assert.equal(header.split('=')[0], name, 'should set cookie ' + name)
+    assert.ok(header.toLowerCase().split(/; */).some(function (k) { return k === 'secure'; }), 'should set secure cookie')
+  }
+}
+
 function sid(res) {
   var match = /^[^=]+=s%3A([^;\.]+)[\.;]/.exec(cookie(res))
   var val = match ? match[1] : undefined

From 0112953322f163f51d5f700dc95bce7412e8122f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 25 Oct 2015 20:30:00 -0400
Subject: [PATCH 035/529] 1.12.0

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index bcde1b77..4f7f2b80 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.12.0 / 2015-10-25
+===================
 
   * Support the value `'auto'` in the `cookie.secure` option
   * deps: cookie@0.2.2
diff --git a/package.json b/package.json
index c3846f2c..c911154f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.11.3",
+  "version": "1.12.0",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 9b84f883d8b3cc79951318c1329c34d98d864b5d Mon Sep 17 00:00:00 2001
From: Louis Chatriot <louis.chatriot@gmail.com>
Date: Wed, 28 Oct 2015 09:53:27 +0100
Subject: [PATCH 036/529] docs: add express-nedb-session to list of session
 stores

closes #219
---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index 13b7cc56..a5b0bc5c 100644
--- a/README.md
+++ b/README.md
@@ -438,6 +438,10 @@ and other multi-core embedded devices).
 [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize
 [connect-session-sequelize-image]: https://img.shields.io/github/stars/mweibel/connect-session-sequelize.svg?label=%E2%98%85
 
+[![Github Stars][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store.
+[express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session
+[express-nedb-session-image]: https://img.shields.io/github/stars/louischatriot/express-nedb-session.svg?label=%E2%98%85
+
 [![Github Stars][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store.
 [level-session-store-url]: https://www.npmjs.com/package/level-session-store
 [level-session-store-image]: https://img.shields.io/github/stars/scriptollc/level-session-store.svg?label=%E2%98%85

From 61e45f98b08e149ac7be05b3dd06bd5673f24d49 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 29 Oct 2015 11:00:45 -0400
Subject: [PATCH 037/529] deps: cookie@0.2.3

---
 HISTORY.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 4f7f2b80..a8d2a6e5 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: cookie@0.2.3
+    - Fix cookie `Max-Age` to never be a floating point number
+
 1.12.0 / 2015-10-25
 ===================
 
diff --git a/package.json b/package.json
index c911154f..c58c4814 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   "repository": "expressjs/session",
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.2.2",
+    "cookie": "0.2.3",
     "cookie-signature": "1.0.6",
     "crc": "3.3.0",
     "debug": "~2.2.0",

From 3c7a35bde7b364917581fb86f566c697fc174a1b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 29 Oct 2015 11:01:50 -0400
Subject: [PATCH 038/529] 1.12.1

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index a8d2a6e5..5585b036 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.12.1 / 2015-10-29
+===================
 
   * deps: cookie@0.2.3
     - Fix cookie `Max-Age` to never be a floating point number
diff --git a/package.json b/package.json
index c58c4814..f3fc14e3 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.12.0",
+  "version": "1.12.1",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 4311dc9b093385b8b22ee8acc78bf5a61fde8609 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 22 Nov 2015 23:09:46 -0500
Subject: [PATCH 039/529] build: reduce runtime versions to one per major

---
 .travis.yml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 803d78d3..2d149ab7 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -3,13 +3,9 @@ node_js:
   - "0.8"
   - "0.10"
   - "0.12"
-  - "1.0"
   - "1.8"
-  - "2.0"
   - "2.5"
-  - "3.0"
   - "3.3"
-  - "4.0"
   - "4.2"
 sudo: false
 before_install:

From a04a4730eeaf47ad3d9aea370e9b0ff19ae15061 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 14 Dec 2015 23:33:02 -0500
Subject: [PATCH 040/529] build: istanbul@0.4.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f3fc14e3..fc5a972f 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "after": "0.8.1",
     "cookie-parser": "~1.4.0",
     "express": "~4.13.3",
-    "istanbul": "0.4.0",
+    "istanbul": "0.4.1",
     "mocha": "2.3.3",
     "supertest": "1.1.0"
   },

From fdf84fb6b3b93553e9ad9fd8788916dc2ed6e220 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 14 Dec 2015 23:34:34 -0500
Subject: [PATCH 041/529] build: mocha@2.3.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index fc5a972f..73973feb 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "cookie-parser": "~1.4.0",
     "express": "~4.13.3",
     "istanbul": "0.4.1",
-    "mocha": "2.3.3",
+    "mocha": "2.3.4",
     "supertest": "1.1.0"
   },
   "files": [

From 06262c9f2f09015940c7bc6858db9594366b71bd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 14 Dec 2015 23:38:21 -0500
Subject: [PATCH 042/529] deps: crc@3.4.0

---
 HISTORY.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 5585b036..03cd90e1 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * deps: crc@3.4.0
+
 1.12.1 / 2015-10-29
 ===================
 
diff --git a/package.json b/package.json
index 73973feb..a77324ae 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,7 @@
   "dependencies": {
     "cookie": "0.2.3",
     "cookie-signature": "1.0.6",
-    "crc": "3.3.0",
+    "crc": "3.4.0",
     "debug": "~2.2.0",
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",

From 34471a4adab6d213e17a5d84df7dd1686ddbfac4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 14 Dec 2015 23:44:48 -0500
Subject: [PATCH 043/529] tests: remove unused varaibles

---
 test/session.js | 2 --
 1 file changed, 2 deletions(-)

diff --git a/test/session.js b/test/session.js
index 9a56ed7f..4cb47306 100644
--- a/test/session.js
+++ b/test/session.js
@@ -760,7 +760,6 @@ describe('session()', function(){
       var app = express();
       app.use(session({ secret: 'keyboard cat', cookie: { maxAge: min }}));
       app.use(function(req, res, next){
-        var save = req.session.save;
         req.session.user = 'bob';
         res.end();
       });
@@ -782,7 +781,6 @@ describe('session()', function(){
       var app = express();
       app.use(session({ rolling: true, secret: 'keyboard cat', cookie: { maxAge: min }}));
       app.use(function(req, res, next){
-        var save = req.session.save;
         req.session.user = 'bob';
         res.end();
       });

From 85667685a518fb73f2ac6a4cd97d482a3a536584 Mon Sep 17 00:00:00 2001
From: "James M. Greene" <james.m.greene@gmail.com>
Date: Thu, 10 Dec 2015 09:19:32 -0600
Subject: [PATCH 044/529] Fix rolling: true to not set cookie without session

fixes #239
closes #240
---
 README.md       |  8 +++++-
 index.js        |  7 +-----
 test/session.js | 65 +++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 73 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index a5b0bc5c..04521bd9 100644
--- a/README.md
+++ b/README.md
@@ -108,10 +108,16 @@ likely need `resave: true`.
 
 ##### rolling
 
-Force a cookie to be set on every response. This resets the expiration date.
+Force a session identifier cookie to be set on every response. The expiration
+is reset to the original [`maxAge`](#cookiemaxage), resetting the expiration
+countdown.
 
 The default value is `false`.
 
+**Note** When this option is set to `true` but the `saveUnitialized` option is
+set to `false`, the cookie will not be set on a response with an uninitialized
+session.
+
 ##### saveUninitialized
 
 Forces a session that is "uninitialized" to be saved to the store. A session is
diff --git a/index.js b/index.js
index ab7bdc93..3077cd72 100644
--- a/index.js
+++ b/index.js
@@ -385,14 +385,9 @@ function session(options){
         return false;
       }
 
-      // in case of rolling session, always reset the cookie
-      if (rollingSessions) {
-        return true;
-      }
-
       return cookieId != req.sessionID
         ? saveUninitializedSession || isModified(req.session)
-        : req.session.cookie.expires != null && isModified(req.session);
+        : rollingSessions || req.session.cookie.expires != null && isModified(req.session);
     }
 
     // generate a session if the browser doesn't send a sessionID
diff --git a/test/session.js b/test/session.js
index 4cb47306..682cb8d0 100644
--- a/test/session.js
+++ b/test/session.js
@@ -797,6 +797,71 @@ describe('session()', function(){
         .expect(200, done)
       });
     });
+
+    it('should not force cookie on uninitialized session if saveUninitialized option is set to false', function(done){
+      var count = 0;
+      var app = express();
+      app.use(session({ rolling: true, saveUninitialized: false, secret: 'keyboard cat', cookie: { maxAge: min }}));
+      app.use(function(req, res, next){
+        var save = req.session.save;
+        res.setHeader('x-count', count);
+        req.session.save = function(fn){
+          res.setHeader('x-count', ++count);
+          return save.call(this, fn);
+        };
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .expect('x-count', '0')
+      .expect(shouldNotHaveHeader('Set-Cookie'))
+      .expect(200, done)
+    });
+
+    it('should force cookie and save uninitialized session if saveUninitialized option is set to true', function(done){
+      var count = 0;
+      var app = express();
+      app.use(session({ rolling: true, saveUninitialized: true, secret: 'keyboard cat', cookie: { maxAge: min }}));
+      app.use(function(req, res, next){
+        var save = req.session.save;
+        res.setHeader('x-count', count);
+        req.session.save = function(fn){
+          res.setHeader('x-count', ++count);
+          return save.call(this, fn);
+        };
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .expect('x-count', '1')
+      .expect(shouldSetCookie('connect.sid'))
+      .expect(200, done)
+    });
+
+    it('should force cookie and save modified session even if saveUninitialized option is set to false', function(done){
+      var count = 0;
+      var app = express();
+      app.use(session({ rolling: true, saveUninitialized: false, secret: 'keyboard cat', cookie: { maxAge: min }}));
+      app.use(function(req, res, next){
+        var save = req.session.save;
+        res.setHeader('x-count', count);
+        req.session.count = count;
+        req.session.user = 'bob';
+        req.session.save = function(fn){
+          res.setHeader('x-count', ++count);
+          return save.call(this, fn);
+        };
+        res.end();
+      });
+
+      request(app)
+      .get('/')
+      .expect('x-count', '1')
+      .expect(shouldSetCookie('connect.sid'))
+      .expect(200, done);
+    });
   });
 
   describe('resave option', function(){

From ada97acf3849c06420d9d0a26e8b98f3e8391271 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 14 Dec 2015 23:58:56 -0500
Subject: [PATCH 045/529] docs: fix default genid documentation

fixes #233
---
 HISTORY.md | 2 ++
 README.md  | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 03cd90e1..755292c8 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,8 @@
 unreleased
 ==========
 
+  * Fix `rolling: true` to not set cookie when no session exists
+    - Better `saveUninitialized: false` + `rolling: true` behavior
   * deps: crc@3.4.0
 
 1.12.1 / 2015-10-29
diff --git a/README.md b/README.md
index 04521bd9..3daf2f50 100644
--- a/README.md
+++ b/README.md
@@ -50,7 +50,7 @@ a string that will be used as a session ID. The function is given `req` as the
 first argument if you want to use some value attached to `req` when generating
 the ID.
 
-The default value is a function which uses the `uid2` library to generate IDs.
+The default value is a function which uses the `uid-safe` library to generate IDs.
 
 **NOTE** be careful to generate unique IDs so your sessions do not conflict.
 

From b5b231b4b0dbd61b6621283b4c91865e86d2536d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 15 Dec 2015 00:03:29 -0500
Subject: [PATCH 046/529] docs: update req.session example for specific URL

closes #231
---
 README.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 3daf2f50..50db7640 100644
--- a/README.md
+++ b/README.md
@@ -216,9 +216,11 @@ which is (generally) serialized as JSON by the store, so nested objects
 are typically fine. For example below is a user-specific view counter:
 
 ```js
+// Use the session middleware
 app.use(session({ secret: 'keyboard cat', cookie: { maxAge: 60000 }}))
 
-app.use(function(req, res, next) {
+// Access the session as req.session
+app.get('/', function(req, res, next) {
   var sess = req.session
   if (sess.views) {
     sess.views++

From 79273aeca8e36e7483d343a9fea98c7abf61a8a2 Mon Sep 17 00:00:00 2001
From: "James M. Greene" <james.m.greene@gmail.com>
Date: Thu, 10 Dec 2015 12:59:18 -0600
Subject: [PATCH 047/529] docs: add nedb-session-store to list of session
 stores

closes #243
---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index 50db7640..096d0472 100644
--- a/README.md
+++ b/README.md
@@ -458,6 +458,10 @@ and other multi-core embedded devices).
 [mssql-session-store-url]: https://www.npmjs.com/package/mssql-session-store
 [mssql-session-store-image]: https://img.shields.io/github/stars/jwathen/mssql-session-store.svg?label=%E2%98%85
 
+[![Github Stars][nedb-session-store-image] nedb-session-store][nedb-session-store-url] An alternate NeDB-based (either in-memory or file-persisted) session store.
+[nedb-session-store-url]: https://www.npmjs.com/package/nedb-session-store
+[nedb-session-store-image]: https://img.shields.io/github/stars/JamesMGreene/nedb-session-store.svg?label=%E2%98%85
+
 [![Github Stars][session-file-store-image] session-file-store][session-file-store-url] A file system-based session store.
 [session-file-store-url]: https://www.npmjs.com/package/session-file-store
 [session-file-store-image]: https://img.shields.io/github/stars/valery-barysok/session-file-store.svg?label=%E2%98%85

From 5720c9e8b42e8152807dad311604f9f5ad34100f Mon Sep 17 00:00:00 2001
From: Valeri Vicneanschi <vicneanschi@gmail.com>
Date: Wed, 16 Dec 2015 11:29:05 -0500
Subject: [PATCH 048/529] docs: add connect-sqlite3 to list of session stores

closes #245
---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index 096d0472..49a49da6 100644
--- a/README.md
+++ b/README.md
@@ -446,6 +446,10 @@ and other multi-core embedded devices).
 [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize
 [connect-session-sequelize-image]: https://img.shields.io/github/stars/mweibel/connect-session-sequelize.svg?label=%E2%98%85
 
+[![Github Stars][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store.
+[connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3
+[connect-sqlite3-image]: https://img.shields.io/github/stars/rawberg/connect-sqlite3.svg?label=%E2%98%85
+
 [![Github Stars][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store.
 [express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session
 [express-nedb-session-image]: https://img.shields.io/github/stars/louischatriot/express-nedb-session.svg?label=%E2%98%85

From ead2b9f58dd1d2f7e071e507a2b9aba00f607955 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Dec 2015 20:27:32 -0500
Subject: [PATCH 049/529] build: support Node.js 5.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 2d149ab7..01d447a5 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,6 +7,7 @@ node_js:
   - "2.5"
   - "3.3"
   - "4.2"
+  - "5.2"
 sudo: false
 before_install:
   # Setup Node.js version-specific dependencies

From 77f931401d45c33b1fb69b0a445a5a6f6c672819 Mon Sep 17 00:00:00 2001
From: Tomek Paprocki <chojrak11@gmail.com>
Date: Mon, 4 Jan 2016 15:40:27 +0100
Subject: [PATCH 050/529] docs: add connect-memcached to list of session stores

closes #247
closes #249
---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index 49a49da6..0f57a99f 100644
--- a/README.md
+++ b/README.md
@@ -436,6 +436,10 @@ and other multi-core embedded devices).
 [connect-redis-url]: https://www.npmjs.com/package/connect-redis
 [connect-redis-image]: https://img.shields.io/github/stars/tj/connect-redis.svg?label=%E2%98%85
 
+[![Github Stars][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store.
+[connect-memcached-url]: https://www.npmjs.com/package/connect-memcached
+[connect-memcached-image]: https://img.shields.io/github/stars/balor/connect-memcached.svg?label=%E2%98%85
+
 [![Github Stars][connect-session-knex-image] connect-session-knex][connect-session-knex-url] A session store using
 [Knex.js](http://knexjs.org/), which is a SQL query builder for PostgreSQL, MySQL, MariaDB, SQLite3, and Oracle.
 [connect-session-knex-url]: https://www.npmjs.com/package/connect-session-knex

From b8329e8edc37ce2e11b09bf0d61a2bf45b03f610 Mon Sep 17 00:00:00 2001
From: Matt McFarland <contact@mattmcfarland.com>
Date: Wed, 6 Jan 2016 20:40:58 -0500
Subject: [PATCH 051/529] docs: add sequelstore-connect to list of session
 stores

closes #250
---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index 0f57a99f..7f1229e0 100644
--- a/README.md
+++ b/README.md
@@ -470,6 +470,10 @@ and other multi-core embedded devices).
 [nedb-session-store-url]: https://www.npmjs.com/package/nedb-session-store
 [nedb-session-store-image]: https://img.shields.io/github/stars/JamesMGreene/nedb-session-store.svg?label=%E2%98%85
 
+[![Github Stars][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](http://sequelizejs.com/).
+[sequelstore-connect-url]: https://www.npmjs.com/package/sequelstore-connect
+[sequelstore-connect-image]: https://img.shields.io/github/stars/MattMcFarland/sequelstore-connect.svg?label=%E2%98%85
+
 [![Github Stars][session-file-store-image] session-file-store][session-file-store-url] A file system-based session store.
 [session-file-store-url]: https://www.npmjs.com/package/session-file-store
 [session-file-store-image]: https://img.shields.io/github/stars/valery-barysok/session-file-store.svg?label=%E2%98%85

From c34a3f3609f2eec78bb78a86944e59b906f8d3da Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Jan 2016 22:23:10 -0500
Subject: [PATCH 052/529] docs: add better alt text to GitHub stars badges

---
 README.md | 40 ++++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/README.md b/README.md
index 7f1229e0..6ce0010e 100644
--- a/README.md
+++ b/README.md
@@ -398,87 +398,87 @@ potentially resetting the idle timer.
 The following modules implement a session store that is compatible with this
 module. Please make a PR to add additional modules :)
 
-[![Github Stars][cassandra-store-image] cassandra-store][cassandra-store-url] An Apache Cassandra-based session store.
+[![★][cassandra-store-image] cassandra-store][cassandra-store-url] An Apache Cassandra-based session store.
 [cassandra-store-url]: https://www.npmjs.com/package/cassandra-store
 [cassandra-store-image]: https://img.shields.io/github/stars/webcc/cassandra-store.svg?label=%E2%98%85
 
-[![Github Stars][cluster-store-image] cluster-store][cluster-store-url] A wrapper for using in-process / embedded
+[![★][cluster-store-image] cluster-store][cluster-store-url] A wrapper for using in-process / embedded
 stores - such as SQLite (via knex), leveldb, files, or memory - with node cluster (desirable for Raspberry Pi 2
 and other multi-core embedded devices).
 [cluster-store-url]: https://www.npmjs.com/package/cluster-store
 [cluster-store-image]: https://img.shields.io/github/stars/coolaj86/cluster-store.svg?label=%E2%98%85
 
-[![Github Stars][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store.
+[![★][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store.
 [connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase
 [connect-couchbase-image]: https://img.shields.io/github/stars/christophermina/connect-couchbase.svg?label=%E2%98%85
 
-[![Github Stars][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
+[![★][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
 [connect-mssql-url]: https://www.npmjs.com/package/connect-mssql
 [connect-mssql-image]: https://img.shields.io/github/stars/patriksimek/connect-mssql.svg?label=%E2%98%85
 
-[![Github Stars][connect-monetdb-image] connect-monetdb][connect-monetdb-url] A MonetDB-based session store.
+[![★][connect-monetdb-image] connect-monetdb][connect-monetdb-url] A MonetDB-based session store.
 [connect-monetdb-url]: https://www.npmjs.com/package/connect-monetdb
 [connect-monetdb-image]: https://img.shields.io/github/stars/MonetDB/npm-connect-monetdb.svg?label=%E2%98%85
 
-[![Github Stars][connect-mongo-image] connect-mongo][connect-mongo-url] A MongoDB-based session store.
+[![★][connect-mongo-image] connect-mongo][connect-mongo-url] A MongoDB-based session store.
 [connect-mongo-url]: https://www.npmjs.com/package/connect-mongo
 [connect-mongo-image]: https://img.shields.io/github/stars/kcbanner/connect-mongo.svg?label=%E2%98%85
 
-[![Github Stars][connect-mongodb-session-image] connect-mongodb-session][connect-mongodb-session-url] Lightweight MongoDB-based session store built and maintained by MongoDB.
+[![★][connect-mongodb-session-image] connect-mongodb-session][connect-mongodb-session-url] Lightweight MongoDB-based session store built and maintained by MongoDB.
 [connect-mongodb-session-url]: https://www.npmjs.com/package/connect-mongodb-session
 [connect-mongodb-session-image]: https://img.shields.io/github/stars/mongodb-js/connect-mongodb-session.svg?label=%E2%98%85
 
-[![Github Stars][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
+[![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
 [connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple
 [connect-pg-simple-image]: https://img.shields.io/github/stars/voxpelli/node-connect-pg-simple.svg?label=%E2%98%85
 
-[![Github Stars][connect-redis-image] connect-redis][connect-redis-url] A Redis-based session store.
+[![★][connect-redis-image] connect-redis][connect-redis-url] A Redis-based session store.
 [connect-redis-url]: https://www.npmjs.com/package/connect-redis
 [connect-redis-image]: https://img.shields.io/github/stars/tj/connect-redis.svg?label=%E2%98%85
 
-[![Github Stars][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store.
+[![★][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store.
 [connect-memcached-url]: https://www.npmjs.com/package/connect-memcached
 [connect-memcached-image]: https://img.shields.io/github/stars/balor/connect-memcached.svg?label=%E2%98%85
 
-[![Github Stars][connect-session-knex-image] connect-session-knex][connect-session-knex-url] A session store using
+[![★][connect-session-knex-image] connect-session-knex][connect-session-knex-url] A session store using
 [Knex.js](http://knexjs.org/), which is a SQL query builder for PostgreSQL, MySQL, MariaDB, SQLite3, and Oracle.
 [connect-session-knex-url]: https://www.npmjs.com/package/connect-session-knex
 [connect-session-knex-image]: https://img.shields.io/github/stars/llambda/connect-session-knex.svg?label=%E2%98%85
 
-[![Github Stars][connect-session-sequelize-image] connect-session-sequelize][connect-session-sequelize-url] A session store using
+[![★][connect-session-sequelize-image] connect-session-sequelize][connect-session-sequelize-url] A session store using
 [Sequelize.js](http://sequelizejs.com/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL.
 [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize
 [connect-session-sequelize-image]: https://img.shields.io/github/stars/mweibel/connect-session-sequelize.svg?label=%E2%98%85
 
-[![Github Stars][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store.
+[![★][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store.
 [connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3
 [connect-sqlite3-image]: https://img.shields.io/github/stars/rawberg/connect-sqlite3.svg?label=%E2%98%85
 
-[![Github Stars][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store.
+[![★][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store.
 [express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session
 [express-nedb-session-image]: https://img.shields.io/github/stars/louischatriot/express-nedb-session.svg?label=%E2%98%85
 
-[![Github Stars][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store.
+[![★][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store.
 [level-session-store-url]: https://www.npmjs.com/package/level-session-store
 [level-session-store-image]: https://img.shields.io/github/stars/scriptollc/level-session-store.svg?label=%E2%98%85
 
-[![Github Stars][mssql-session-store-image] mssql-session-store][mssql-session-store-url] A SQL Server-based session store.
+[![★][mssql-session-store-image] mssql-session-store][mssql-session-store-url] A SQL Server-based session store.
 [mssql-session-store-url]: https://www.npmjs.com/package/mssql-session-store
 [mssql-session-store-image]: https://img.shields.io/github/stars/jwathen/mssql-session-store.svg?label=%E2%98%85
 
-[![Github Stars][nedb-session-store-image] nedb-session-store][nedb-session-store-url] An alternate NeDB-based (either in-memory or file-persisted) session store.
+[![★][nedb-session-store-image] nedb-session-store][nedb-session-store-url] An alternate NeDB-based (either in-memory or file-persisted) session store.
 [nedb-session-store-url]: https://www.npmjs.com/package/nedb-session-store
 [nedb-session-store-image]: https://img.shields.io/github/stars/JamesMGreene/nedb-session-store.svg?label=%E2%98%85
 
-[![Github Stars][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](http://sequelizejs.com/).
+[![★][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](http://sequelizejs.com/).
 [sequelstore-connect-url]: https://www.npmjs.com/package/sequelstore-connect
 [sequelstore-connect-image]: https://img.shields.io/github/stars/MattMcFarland/sequelstore-connect.svg?label=%E2%98%85
 
-[![Github Stars][session-file-store-image] session-file-store][session-file-store-url] A file system-based session store.
+[![★][session-file-store-image] session-file-store][session-file-store-url] A file system-based session store.
 [session-file-store-url]: https://www.npmjs.com/package/session-file-store
 [session-file-store-image]: https://img.shields.io/github/stars/valery-barysok/session-file-store.svg?label=%E2%98%85
 
-[![Github Stars][session-rethinkdb-image] session-rethinkdb][session-rethinkdb-url] A [RethinkDB](http://rethinkdb.com/)-based session store.
+[![★][session-rethinkdb-image] session-rethinkdb][session-rethinkdb-url] A [RethinkDB](http://rethinkdb.com/)-based session store.
 [session-rethinkdb-url]: https://www.npmjs.com/package/session-rethinkdb
 [session-rethinkdb-image]: https://img.shields.io/github/stars/llambda/session-rethinkdb.svg?label=%E2%98%85
 

From b1ee74ebc3e808d8886fc378cf4cff3b3a2427df Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Jan 2016 22:36:42 -0500
Subject: [PATCH 053/529] docs: expand session.save() documentation

closes #208
---
 README.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/README.md b/README.md
index 6ce0010e..c62f4298 100644
--- a/README.md
+++ b/README.md
@@ -268,6 +268,18 @@ req.session.reload(function(err) {
 
 #### Session.save()
 
+Save the session back to the store, replacing the contents on the store with the
+contents in memory (though a store may do something else--consult the store's
+documentation for exact behavior).
+
+This method is automatically called at the end of the HTTP response if the
+session data has been altered (though this behavior can be altered with various
+options in the middleware constructor). Because of this, typically this method
+does not need to be called.
+
+There are some cases where it is useful to call this method, for example, long-
+lived requests or in WebSockets.
+
 ```js
 req.session.save(function(err) {
   // session saved

From 222b30ddeb9589ec700ae53b4e70b47a95114b77 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Jan 2016 23:45:31 -0500
Subject: [PATCH 054/529] 1.13.0

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 755292c8..68e8eed4 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.13.0 / 2016-01-10
+===================
 
   * Fix `rolling: true` to not set cookie when no session exists
     - Better `saveUninitialized: false` + `rolling: true` behavior
diff --git a/package.json b/package.json
index a77324ae..f63ebb2d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.12.1",
+  "version": "1.13.0",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 22a3bafde16c81fcb17d05aae5322c053ac47eeb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 11 Jan 2016 10:14:25 -0500
Subject: [PATCH 055/529] build: cookie-parser@1.4.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f63ebb2d..41a966aa 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
   },
   "devDependencies": {
     "after": "0.8.1",
-    "cookie-parser": "~1.4.0",
+    "cookie-parser": "1.4.1",
     "express": "~4.13.3",
     "istanbul": "0.4.1",
     "mocha": "2.3.4",

From 07e7c30ecd0e8853f589667740188c97fc68a7d1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 11 Jan 2016 10:15:43 -0500
Subject: [PATCH 056/529] build: istanbul@0.4.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 41a966aa..e5a65dc3 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "after": "0.8.1",
     "cookie-parser": "1.4.1",
     "express": "~4.13.3",
-    "istanbul": "0.4.1",
+    "istanbul": "0.4.2",
     "mocha": "2.3.4",
     "supertest": "1.1.0"
   },

From 3e19c88ea01c2636dd0aca7968f90a79564044b3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 11 Jan 2016 10:18:31 -0500
Subject: [PATCH 057/529] build: Node.js@5.4

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 01d447a5..0280df88 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,7 +7,7 @@ node_js:
   - "2.5"
   - "3.3"
   - "4.2"
-  - "5.2"
+  - "5.4"
 sudo: false
 before_install:
   # Setup Node.js version-specific dependencies

From 6eeec0e6a5a8e04503a2092bde2cbc3fcdcd37c9 Mon Sep 17 00:00:00 2001
From: Paul Esson <paul.esson@gmail.com>
Date: Fri, 22 Jan 2016 14:57:00 +1100
Subject: [PATCH 058/529] docs: fix note about overlapping cookie names

closes #260
---
 README.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index c62f4298..3c71dae9 100644
--- a/README.md
+++ b/README.md
@@ -70,9 +70,10 @@ request).
 
 The default value is `'connect.sid'`.
 
-**Note** if you have multiple apps running on the same host (hostname + port),
-then you need to separate the session cookies from each other. The simplest
-method is to simply set different `name`s per app.
+**Note** if you have multiple apps running on the same hostname (this is just
+the name, i.e. `localhost` or `127.0.0.1`; different schemes and ports do not
+name a different hostname), then you need to separate the session cookies from
+each other. The simplest method is to simply set different `name`s per app.
 
 ##### proxy
 

From a69509d8987f32bb43ba1debf17d632c6b3ecc0b Mon Sep 17 00:00:00 2001
From: Ryan Tran <myoldemailname@gmail.com>
Date: Wed, 27 Jan 2016 14:06:31 -0800
Subject: [PATCH 059/529] docs: fix typo of option name

closes #263
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 3c71dae9..857f754c 100644
--- a/README.md
+++ b/README.md
@@ -115,7 +115,7 @@ countdown.
 
 The default value is `false`.
 
-**Note** When this option is set to `true` but the `saveUnitialized` option is
+**Note** When this option is set to `true` but the `saveUninitialized` option is
 set to `false`, the cookie will not be set on a response with an uninitialized
 session.
 

From faa1a4ce166180329b591369ad444983ea779345 Mon Sep 17 00:00:00 2001
From: Michael Irigoyen <goyney@gmail.com>
Date: Fri, 29 Jan 2016 11:01:15 -0500
Subject: [PATCH 060/529] docs: add connect-dynamodb to list of session stores

closes #265
---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index 857f754c..f81381f2 100644
--- a/README.md
+++ b/README.md
@@ -425,6 +425,10 @@ and other multi-core embedded devices).
 [connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase
 [connect-couchbase-image]: https://img.shields.io/github/stars/christophermina/connect-couchbase.svg?label=%E2%98%85
 
+[![★][connect-dynamodb-image] connect-dynamodb][connect-dynamodb-url] A DynamoDB-based session store.
+[connect-dynamodb-url]: https://github.com/ca98am79/connect-dynamodb
+[connect-dynamodb-image]: https://img.shields.io/github/stars/ca98am79/connect-dynamodb.svg?label=%E2%98%85
+
 [![★][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
 [connect-mssql-url]: https://www.npmjs.com/package/connect-mssql
 [connect-mssql-image]: https://img.shields.io/github/stars/patriksimek/connect-mssql.svg?label=%E2%98%85

From 328476b37e3830b25a788fb4f26b7c375c835c2e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 29 Jan 2016 13:15:20 -0500
Subject: [PATCH 061/529] build: mocha@2.4.5

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e5a65dc3..77e00b97 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "cookie-parser": "1.4.1",
     "express": "~4.13.3",
     "istanbul": "0.4.2",
-    "mocha": "2.3.4",
+    "mocha": "2.4.5",
     "supertest": "1.1.0"
   },
   "files": [

From 00422dddf5a8c2205508749cf9dd0839eced4f67 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 29 Jan 2016 13:16:02 -0500
Subject: [PATCH 062/529] build: express@4.13.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 77e00b97..76c063f7 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
   "devDependencies": {
     "after": "0.8.1",
     "cookie-parser": "1.4.1",
-    "express": "~4.13.3",
+    "express": "4.13.4",
     "istanbul": "0.4.2",
     "mocha": "2.4.5",
     "supertest": "1.1.0"

From 9a9faf9198d217ffe2873adbfa93d6dd98d11f21 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 29 Jan 2016 13:17:47 -0500
Subject: [PATCH 063/529] deps: parseurl@~1.3.1

---
 HISTORY.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 68e8eed4..2db17e1d 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: parseurl@~1.3.1
+    - perf: enable strict mode
+
 1.13.0 / 2016-01-10
 ===================
 
diff --git a/package.json b/package.json
index 76c063f7..43f95fe7 100644
--- a/package.json
+++ b/package.json
@@ -16,7 +16,7 @@
     "debug": "~2.2.0",
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",
-    "parseurl": "~1.3.0",
+    "parseurl": "~1.3.1",
     "uid-safe": "~2.0.0",
     "utils-merge": "1.0.0"
   },

From f2044eb86f8f389e9a84245335947171853cec88 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 29 Jan 2016 13:20:00 -0500
Subject: [PATCH 064/529] deps: uid-safe@~2.1.0

---
 HISTORY.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 2db17e1d..210d6853 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -3,6 +3,8 @@ unreleased
 
   * deps: parseurl@~1.3.1
     - perf: enable strict mode
+  * deps: uid-safe@~2.1.0
+    - Use `random-bytes` for byte source
 
 1.13.0 / 2016-01-10
 ===================
diff --git a/package.json b/package.json
index 43f95fe7..8b945f2e 100644
--- a/package.json
+++ b/package.json
@@ -17,7 +17,7 @@
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.1",
-    "uid-safe": "~2.0.0",
+    "uid-safe": "~2.1.0",
     "utils-merge": "1.0.0"
   },
   "devDependencies": {

From 9de44c668aafd99ab7fe5b99f1aaf7d4b1b05eaf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 29 Jan 2016 13:21:24 -0500
Subject: [PATCH 065/529] build: Node.js@5.5

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 0280df88..d28b24e4 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,7 +7,7 @@ node_js:
   - "2.5"
   - "3.3"
   - "4.2"
-  - "5.4"
+  - "5.5"
 sudo: false
 before_install:
   # Setup Node.js version-specific dependencies

From fb381f26c7d10ee1f8cd374cb5cecf95773513fc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 29 Jan 2016 13:22:47 -0500
Subject: [PATCH 066/529] perf: enable strict mode

---
 HISTORY.md         | 1 +
 index.js           | 2 ++
 session/cookie.js  | 3 ++-
 session/memory.js  | 2 ++
 session/session.js | 3 ++-
 session/store.js   | 3 ++-
 6 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 210d6853..727834eb 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -5,6 +5,7 @@ unreleased
     - perf: enable strict mode
   * deps: uid-safe@~2.1.0
     - Use `random-bytes` for byte source
+  * perf: enable strict mode
 
 1.13.0 / 2016-01-10
 ===================
diff --git a/index.js b/index.js
index 3077cd72..0de7c62f 100644
--- a/index.js
+++ b/index.js
@@ -6,6 +6,8 @@
  * MIT Licensed
  */
 
+'use strict';
+
 /**
  * Module dependencies.
  * @private
diff --git a/session/cookie.js b/session/cookie.js
index 86591de3..a4dbd8a8 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -1,4 +1,3 @@
-
 /*!
  * Connect - session - Cookie
  * Copyright(c) 2010 Sencha Inc.
@@ -6,6 +5,8 @@
  * MIT Licensed
  */
 
+'use strict';
+
 /**
  * Module dependencies.
  */
diff --git a/session/memory.js b/session/memory.js
index 9887680d..ae2175ba 100644
--- a/session/memory.js
+++ b/session/memory.js
@@ -6,6 +6,8 @@
  * MIT Licensed
  */
 
+'use strict';
+
 /**
  * Module dependencies.
  * @private
diff --git a/session/session.js b/session/session.js
index 4647f9da..c3c0f15a 100644
--- a/session/session.js
+++ b/session/session.js
@@ -1,4 +1,3 @@
-
 /*!
  * Connect - session - Session
  * Copyright(c) 2010 Sencha Inc.
@@ -6,6 +5,8 @@
  * MIT Licensed
  */
 
+'use strict';
+
 /**
  * Expose Session.
  */
diff --git a/session/store.js b/session/store.js
index 54294cbd..ca3d4a9d 100644
--- a/session/store.js
+++ b/session/store.js
@@ -1,4 +1,3 @@
-
 /*!
  * Connect - session - Store
  * Copyright(c) 2010 Sencha Inc.
@@ -6,6 +5,8 @@
  * MIT Licensed
  */
 
+'use strict';
+
 /**
  * Module dependencies.
  */

From a9fa4b0d3c7c34fe7d36f5a197dd0ed9b2da91b4 Mon Sep 17 00:00:00 2001
From: Cian Clarke <cian@cianclarke.com>
Date: Tue, 1 Mar 2016 10:33:18 -0500
Subject: [PATCH 067/529] docs: fix session store list for CommonMark spec

fixes #248
closes #280
---
 README.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/README.md b/README.md
index f81381f2..f2a6df6b 100644
--- a/README.md
+++ b/README.md
@@ -412,90 +412,111 @@ The following modules implement a session store that is compatible with this
 module. Please make a PR to add additional modules :)
 
 [![★][cassandra-store-image] cassandra-store][cassandra-store-url] An Apache Cassandra-based session store.
+
 [cassandra-store-url]: https://www.npmjs.com/package/cassandra-store
 [cassandra-store-image]: https://img.shields.io/github/stars/webcc/cassandra-store.svg?label=%E2%98%85
 
 [![★][cluster-store-image] cluster-store][cluster-store-url] A wrapper for using in-process / embedded
 stores - such as SQLite (via knex), leveldb, files, or memory - with node cluster (desirable for Raspberry Pi 2
 and other multi-core embedded devices).
+
 [cluster-store-url]: https://www.npmjs.com/package/cluster-store
 [cluster-store-image]: https://img.shields.io/github/stars/coolaj86/cluster-store.svg?label=%E2%98%85
 
 [![★][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store.
+
 [connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase
 [connect-couchbase-image]: https://img.shields.io/github/stars/christophermina/connect-couchbase.svg?label=%E2%98%85
 
 [![★][connect-dynamodb-image] connect-dynamodb][connect-dynamodb-url] A DynamoDB-based session store.
+
 [connect-dynamodb-url]: https://github.com/ca98am79/connect-dynamodb
 [connect-dynamodb-image]: https://img.shields.io/github/stars/ca98am79/connect-dynamodb.svg?label=%E2%98%85
 
 [![★][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
+
 [connect-mssql-url]: https://www.npmjs.com/package/connect-mssql
 [connect-mssql-image]: https://img.shields.io/github/stars/patriksimek/connect-mssql.svg?label=%E2%98%85
 
 [![★][connect-monetdb-image] connect-monetdb][connect-monetdb-url] A MonetDB-based session store.
+
 [connect-monetdb-url]: https://www.npmjs.com/package/connect-monetdb
 [connect-monetdb-image]: https://img.shields.io/github/stars/MonetDB/npm-connect-monetdb.svg?label=%E2%98%85
 
 [![★][connect-mongo-image] connect-mongo][connect-mongo-url] A MongoDB-based session store.
+
 [connect-mongo-url]: https://www.npmjs.com/package/connect-mongo
 [connect-mongo-image]: https://img.shields.io/github/stars/kcbanner/connect-mongo.svg?label=%E2%98%85
 
 [![★][connect-mongodb-session-image] connect-mongodb-session][connect-mongodb-session-url] Lightweight MongoDB-based session store built and maintained by MongoDB.
+
 [connect-mongodb-session-url]: https://www.npmjs.com/package/connect-mongodb-session
 [connect-mongodb-session-image]: https://img.shields.io/github/stars/mongodb-js/connect-mongodb-session.svg?label=%E2%98%85
 
 [![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
+
 [connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple
 [connect-pg-simple-image]: https://img.shields.io/github/stars/voxpelli/node-connect-pg-simple.svg?label=%E2%98%85
 
 [![★][connect-redis-image] connect-redis][connect-redis-url] A Redis-based session store.
+
 [connect-redis-url]: https://www.npmjs.com/package/connect-redis
 [connect-redis-image]: https://img.shields.io/github/stars/tj/connect-redis.svg?label=%E2%98%85
 
 [![★][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store.
+
 [connect-memcached-url]: https://www.npmjs.com/package/connect-memcached
 [connect-memcached-image]: https://img.shields.io/github/stars/balor/connect-memcached.svg?label=%E2%98%85
 
 [![★][connect-session-knex-image] connect-session-knex][connect-session-knex-url] A session store using
 [Knex.js](http://knexjs.org/), which is a SQL query builder for PostgreSQL, MySQL, MariaDB, SQLite3, and Oracle.
+
 [connect-session-knex-url]: https://www.npmjs.com/package/connect-session-knex
 [connect-session-knex-image]: https://img.shields.io/github/stars/llambda/connect-session-knex.svg?label=%E2%98%85
 
 [![★][connect-session-sequelize-image] connect-session-sequelize][connect-session-sequelize-url] A session store using
 [Sequelize.js](http://sequelizejs.com/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL.
+
 [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize
 [connect-session-sequelize-image]: https://img.shields.io/github/stars/mweibel/connect-session-sequelize.svg?label=%E2%98%85
 
 [![★][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store.
+
 [connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3
 [connect-sqlite3-image]: https://img.shields.io/github/stars/rawberg/connect-sqlite3.svg?label=%E2%98%85
 
 [![★][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store.
+
 [express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session
 [express-nedb-session-image]: https://img.shields.io/github/stars/louischatriot/express-nedb-session.svg?label=%E2%98%85
 
 [![★][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store.
+
 [level-session-store-url]: https://www.npmjs.com/package/level-session-store
 [level-session-store-image]: https://img.shields.io/github/stars/scriptollc/level-session-store.svg?label=%E2%98%85
 
 [![★][mssql-session-store-image] mssql-session-store][mssql-session-store-url] A SQL Server-based session store.
+
 [mssql-session-store-url]: https://www.npmjs.com/package/mssql-session-store
 [mssql-session-store-image]: https://img.shields.io/github/stars/jwathen/mssql-session-store.svg?label=%E2%98%85
 
 [![★][nedb-session-store-image] nedb-session-store][nedb-session-store-url] An alternate NeDB-based (either in-memory or file-persisted) session store.
+
 [nedb-session-store-url]: https://www.npmjs.com/package/nedb-session-store
 [nedb-session-store-image]: https://img.shields.io/github/stars/JamesMGreene/nedb-session-store.svg?label=%E2%98%85
 
 [![★][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](http://sequelizejs.com/).
+
 [sequelstore-connect-url]: https://www.npmjs.com/package/sequelstore-connect
 [sequelstore-connect-image]: https://img.shields.io/github/stars/MattMcFarland/sequelstore-connect.svg?label=%E2%98%85
 
 [![★][session-file-store-image] session-file-store][session-file-store-url] A file system-based session store.
+
 [session-file-store-url]: https://www.npmjs.com/package/session-file-store
 [session-file-store-image]: https://img.shields.io/github/stars/valery-barysok/session-file-store.svg?label=%E2%98%85
 
 [![★][session-rethinkdb-image] session-rethinkdb][session-rethinkdb-url] A [RethinkDB](http://rethinkdb.com/)-based session store.
+
 [session-rethinkdb-url]: https://www.npmjs.com/package/session-rethinkdb
 [session-rethinkdb-image]: https://img.shields.io/github/stars/llambda/session-rethinkdb.svg?label=%E2%98%85
 

From 3ff41846fa618bf89d355a138f8e0e2ff4c4a091 Mon Sep 17 00:00:00 2001
From: Mike Goodwin <mike.goodwin@owaps.org>
Date: Sun, 6 Mar 2016 23:00:31 +0000
Subject: [PATCH 068/529] docs: add connect-azuretables to list of session
 stores

closes #285
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index f2a6df6b..56e47732 100644
--- a/README.md
+++ b/README.md
@@ -423,6 +423,11 @@ and other multi-core embedded devices).
 [cluster-store-url]: https://www.npmjs.com/package/cluster-store
 [cluster-store-image]: https://img.shields.io/github/stars/coolaj86/cluster-store.svg?label=%E2%98%85
 
+[![★][connect-azuretables-image] connect-azuretables][connect-azuretables-url] An [Azure Table Storage](https://azure.microsoft.com/en-gb/services/storage/tables/)-based session store.
+
+[connect-azuretables-url]: https://www.npmjs.com/package/connect-azuretables
+[connect-azuretables-image]: https://img.shields.io/github/stars/mike-goodwin/connect-azuretables.svg?label=%E2%98%85
+
 [![★][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store.
 
 [connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase

From 7d085d5154f31972791835639ecea0d98c27d5c0 Mon Sep 17 00:00:00 2001
From: Charles Hill <chill@degreesofzero.com>
Date: Tue, 2 Feb 2016 16:11:51 +0100
Subject: [PATCH 069/529] docs: add express-mysql-session to list of session
 stores

closes #268
---
 README.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/README.md b/README.md
index 56e47732..ca9da9d1 100644
--- a/README.md
+++ b/README.md
@@ -485,6 +485,12 @@ and other multi-core embedded devices).
 [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize
 [connect-session-sequelize-image]: https://img.shields.io/github/stars/mweibel/connect-session-sequelize.svg?label=%E2%98%85
 
+[![★][express-mysql-session-image] express-mysql-session][express-mysql-session-url] A session store using native
+[MySQL](https://www.mysql.com/) via the [node-mysql](https://github.com/felixge/node-mysql) module.
+
+[express-mysql-session-url]: https://www.npmjs.com/package/express-mysql-session
+[express-mysql-session-image]: https://img.shields.io/github/stars/chill117/express-mysql-session.svg?label=%E2%98%85
+
 [![★][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store.
 
 [connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3

From 27be0879fbce1e9601cad7ed60f400f100bd1994 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 Apr 2016 22:04:36 -0400
Subject: [PATCH 070/529] build: Node.js@4.4

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index d28b24e4..af57a7f6 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -6,7 +6,7 @@ node_js:
   - "1.8"
   - "2.5"
   - "3.3"
-  - "4.2"
+  - "4.4"
   - "5.5"
 sudo: false
 before_install:

From 454b64bd167a41450ee8ce8a726c4dea5f5c2b93 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 Apr 2016 22:06:51 -0400
Subject: [PATCH 071/529] build: Node.js@5.10

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index af57a7f6..86e88f36 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,7 +7,7 @@ node_js:
   - "2.5"
   - "3.3"
   - "4.4"
-  - "5.5"
+  - "5.10"
 sudo: false
 before_install:
   # Setup Node.js version-specific dependencies

From ecb41b5cec04fd174e08fb02a799b18fed4262e0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 Apr 2016 22:10:44 -0400
Subject: [PATCH 072/529] build: cache node_modules on Travis CI

---
 .travis.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 86e88f36..96f65184 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,9 +9,15 @@ node_js:
   - "4.4"
   - "5.10"
 sudo: false
+cache:
+  directories:
+    - node_modules
 before_install:
   # Setup Node.js version-specific dependencies
   - "test $TRAVIS_NODE_VERSION != '0.8' || npm rm --save-dev istanbul"
+  # Update Node.js modules
+  - "test ! -d node_modules || npm prune"
+  - "test ! -d node_modules || npm rebuild"
 script:
   # Run test script, depending on istanbul install
   - "test ! -z $(npm -ps ls istanbul) || npm test"

From bce5eb6d1875a71c3a697bee3330fa5b3a5a6f43 Mon Sep 17 00:00:00 2001
From: Brendon <parker.brendon@gmail.com>
Date: Wed, 18 May 2016 14:59:30 -0400
Subject: [PATCH 073/529] docs: add note that PassportJS has fixed empty object

closes #314
closes #316
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index ca9da9d1..2e7f8c96 100644
--- a/README.md
+++ b/README.md
@@ -135,7 +135,7 @@ choose what is appropriate to your use-case.
 **Note** if you are using Session in conjunction with PassportJS, Passport
 will add an empty Passport object to the session for use after a user is
 authenticated, which will be treated as a modification to the session, causing
-it to be saved.
+it to be saved. *This has been fixed in PassportJS 0.3.0*
 
 ##### secret
 

From 0b735d4d2b0252a60951f33a703a48a0cc784487 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 12 Jun 2016 23:14:36 -0400
Subject: [PATCH 074/529] build: cookie-parser@1.4.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 8b945f2e..4f1fa617 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
   },
   "devDependencies": {
     "after": "0.8.1",
-    "cookie-parser": "1.4.1",
+    "cookie-parser": "1.4.3",
     "express": "4.13.4",
     "istanbul": "0.4.2",
     "mocha": "2.4.5",

From a4d27229091c195253e8f78d30151a6ad5e052c3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 12 Jun 2016 23:15:05 -0400
Subject: [PATCH 075/529] build: istanbul@0.4.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 4f1fa617..9e5aa6c3 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "after": "0.8.1",
     "cookie-parser": "1.4.3",
     "express": "4.13.4",
-    "istanbul": "0.4.2",
+    "istanbul": "0.4.3",
     "mocha": "2.4.5",
     "supertest": "1.1.0"
   },

From 2869dec5b264b4b2ca0d8af579920c7d646d3bbc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 12 Jun 2016 23:15:37 -0400
Subject: [PATCH 076/529] build: mocha@2.5.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 9e5aa6c3..2cd0a55e 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "cookie-parser": "1.4.3",
     "express": "4.13.4",
     "istanbul": "0.4.3",
-    "mocha": "2.4.5",
+    "mocha": "2.5.3",
     "supertest": "1.1.0"
   },
   "files": [

From 0cccca2c825de5861d75960cc882eee794eb65dd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 12 Jun 2016 23:16:01 -0400
Subject: [PATCH 077/529] build: Node.js@5.11

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 96f65184..388f282d 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,7 +7,7 @@ node_js:
   - "2.5"
   - "3.3"
   - "4.4"
-  - "5.10"
+  - "5.11"
 sudo: false
 cache:
   directories:

From 839959036c0f6add53166f4a4d73edfc126d5ab7 Mon Sep 17 00:00:00 2001
From: Gabriel Foust <gfoust@cse.tamu.edu>
Date: Wed, 2 Mar 2016 14:54:08 -0600
Subject: [PATCH 078/529] Methods are no longer enumerable on req.session
 object

closes #282
---
 HISTORY.md         |  1 +
 session/session.js | 39 ++++++++++++++++++++++++++++-----------
 test/session.js    | 18 ++++++++++++++++++
 3 files changed, 47 insertions(+), 11 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 727834eb..a44eebf0 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Methods are no longer enumerable on `req.session` object
   * deps: parseurl@~1.3.1
     - perf: enable strict mode
   * deps: uid-safe@~2.1.0
diff --git a/session/session.js b/session/session.js
index c3c0f15a..2eacde60 100644
--- a/session/session.js
+++ b/session/session.js
@@ -44,9 +44,9 @@ function Session(req, data) {
  * @api public
  */
 
-Session.prototype.touch = function(){
+defineMethod(Session.prototype, 'touch', function touch() {
   return this.resetMaxAge();
-};
+});
 
 /**
  * Reset `.maxAge` to `.originalMaxAge`.
@@ -55,10 +55,10 @@ Session.prototype.touch = function(){
  * @api public
  */
 
-Session.prototype.resetMaxAge = function(){
+defineMethod(Session.prototype, 'resetMaxAge', function resetMaxAge() {
   this.cookie.maxAge = this.cookie.originalMaxAge;
   return this;
-};
+});
 
 /**
  * Save the session data with optional callback `fn(err)`.
@@ -68,10 +68,10 @@ Session.prototype.resetMaxAge = function(){
  * @api public
  */
 
-Session.prototype.save = function(fn){
+defineMethod(Session.prototype, 'save', function save(fn) {
   this.req.sessionStore.set(this.id, this, fn || function(){});
   return this;
-};
+});
 
 /**
  * Re-loads the session data _without_ altering
@@ -85,7 +85,7 @@ Session.prototype.save = function(fn){
  * @api public
  */
 
-Session.prototype.reload = function(fn){
+defineMethod(Session.prototype, 'reload', function reload(fn) {
   var req = this.req
     , store = this.req.sessionStore;
   store.get(this.id, function(err, sess){
@@ -95,7 +95,7 @@ Session.prototype.reload = function(fn){
     fn();
   });
   return this;
-};
+});
 
 /**
  * Destroy `this` session.
@@ -105,11 +105,11 @@ Session.prototype.reload = function(fn){
  * @api public
  */
 
-Session.prototype.destroy = function(fn){
+defineMethod(Session.prototype, 'destroy', function destroy(fn) {
   delete this.req.session;
   this.req.sessionStore.destroy(this.id, fn);
   return this;
-};
+});
 
 /**
  * Regenerate this request's session.
@@ -119,7 +119,24 @@ Session.prototype.destroy = function(fn){
  * @api public
  */
 
-Session.prototype.regenerate = function(fn){
+defineMethod(Session.prototype, 'regenerate', function regenerate(fn) {
   this.req.sessionStore.regenerate(this.req, fn);
   return this;
+});
+
+/**
+ * Helper function for creating a method on a prototype.
+ *
+ * @param {Object} obj
+ * @param {String} name
+ * @param {Function} fn
+ * @private
+ */
+function defineMethod(obj, name, fn) {
+  Object.defineProperty(obj, name, {
+    configurable: true,
+    enumerable: false,
+    value: fn,
+    writable: true
+  });
 };
diff --git a/test/session.js b/test/session.js
index 682cb8d0..35f20de2 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1420,6 +1420,24 @@ describe('session()', function(){
       });
     })
 
+    it('should not have enumerable methods', function (done) {
+      var app = express()
+        .use(session({ secret: 'keyboard cat', cookie: { maxAge: min }}))
+        .use(function(req, res, next) {
+          req.session.foo = 'foo';
+          req.session.bar = 'bar';
+          var keys = [];
+          for (var key in req.session) {
+            keys.push(key);
+          }
+          res.end(keys.sort().join(','));
+        });
+
+      request(app)
+      .get('/')
+      .expect(200, 'bar,cookie,foo', done);
+    });
+
     describe('.destroy()', function(){
       it('should destroy the previous session', function(done){
         var app = express()

From 76f8fcbc0f976e4450dc1d6065b314d9639aad02 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 12 Jun 2016 23:36:05 -0400
Subject: [PATCH 079/529] deps: cookie@0.3.1

---
 HISTORY.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index a44eebf0..3d6753c0 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -2,6 +2,13 @@ unreleased
 ==========
 
   * Methods are no longer enumerable on `req.session` object
+  * deps: cookie@0.3.1
+    - Add `sameSite` option
+    - Improve error message when `encode` is not a function
+    - Improve error message when `expires` is not a `Date`
+    - perf: enable strict mode
+    - perf: use for loop in parse
+    - perf: use string concatination for serialization
   * deps: parseurl@~1.3.1
     - perf: enable strict mode
   * deps: uid-safe@~2.1.0
diff --git a/package.json b/package.json
index 2cd0a55e..af85d794 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   "repository": "expressjs/session",
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.2.3",
+    "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "crc": "3.4.0",
     "debug": "~2.2.0",

From 650a0fecd1d0466d3aa582f3ca9f4d0eb8391e5b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 Jun 2016 00:25:20 -0400
Subject: [PATCH 080/529] docs: move cookie-parser note to the top

---
 README.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 2e7f8c96..b85066c2 100644
--- a/README.md
+++ b/README.md
@@ -25,6 +25,11 @@ Create a session middleware with the given `options`.
 **Note** Session data is _not_ saved in the cookie itself, just the session ID.
 Session data is stored server-side.
 
+**Note** Since version 1.5.0, the [`cookie-parser` middleware](https://www.npmjs.com/package/cookie-parser)
+no longer needs to be used for this module to work. This module now directly reads
+and writes cookies on `req`/`res`. Using `cookie-parser` may result in issues
+if the `secret` is not the same between this module and `cookie-parser`.
+
 **Warning** The default server-side session storage, `MemoryStore`, is _purposely_
 not designed for a production environment. It will leak memory under most
 conditions, does not scale past a single process, and is meant for debugging and
@@ -163,11 +168,6 @@ The default value is `'keep'`.
 
 #### Cookie options
 
-**Note** Since version 1.5.0, the [`cookie-parser` middleware](https://www.npmjs.com/package/cookie-parser)
-no longer needs to be used for this module to work. This module now directly reads
-and writes cookies on `req`/`res`. Using `cookie-parser` may result in issues
-if the `secret` is not the same between this module and `cookie-parser`.
-
 Please note that `secure: true` is a **recommended** option. However, it requires an https-enabled website, i.e., HTTPS is necessary for secure cookies.
 If `secure` is set, and you access your site over HTTP, the cookie will not be set. If you have your node.js behind a proxy and are using `secure: true`, you need to set "trust proxy" in express:
 

From 3fb472d0249cbe58f78ecac8c77b08d656e67a98 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 Jun 2016 00:28:52 -0400
Subject: [PATCH 081/529] docs: move cookies documentation under cookie section

---
 README.md | 93 ++++++++++++++++++++++++++++---------------------------
 1 file changed, 47 insertions(+), 46 deletions(-)

diff --git a/README.md b/README.md
index b85066c2..f3b47eb9 100644
--- a/README.md
+++ b/README.md
@@ -43,11 +43,56 @@ For a list of stores, see [compatible session stores](#compatible-session-stores
 
 ##### cookie
 
-Settings for the session ID cookie. See the "Cookie options" section below for
-more information on the different values.
+Settings for the session ID cookie.
 
 The default value is `{ path: '/', httpOnly: true, secure: false, maxAge: null }`.
 
+Please note that `secure: true` is a **recommended** option. However, it requires
+an https-enabled website, i.e., HTTPS is necessary for secure cookies. If `secure`
+is set, and you access your site over HTTP, the cookie will not be set. If you
+have your node.js behind a proxy and are using `secure: true`, you need to set
+"trust proxy" in express:
+
+```js
+var app = express()
+app.set('trust proxy', 1) // trust first proxy
+app.use(session({
+  secret: 'keyboard cat',
+  resave: false,
+  saveUninitialized: true,
+  cookie: { secure: true }
+}))
+```
+
+For using secure cookies in production, but allowing for testing in development,
+the following is an example of enabling this setup based on `NODE_ENV` in express:
+
+```js
+var app = express()
+var sess = {
+  secret: 'keyboard cat',
+  cookie: {}
+}
+
+if (app.get('env') === 'production') {
+  app.set('trust proxy', 1) // trust first proxy
+  sess.cookie.secure = true // serve secure cookies
+}
+
+app.use(session(sess))
+```
+
+The `cookie.secure` option can also be set to the special value `'auto'` to have
+this setting automatically match the determined security of the connection. Be
+careful when using this setting if the site is available both as HTTP and HTTPS,
+as once the cookie is set on HTTPS, it will no longer be visible over HTTP. This
+is useful when the Express `"trust proxy"` setting is properly setup to simplify
+development vs production configuration.
+
+By default `cookie.maxAge` is `null`, meaning no "expires" parameter is set
+so the cookie becomes a browser-session cookie. When the user closes the
+browser the cookie (and session) will be removed.
+
 ##### genid
 
 Function to call to generate a new session ID. Provide a function that returns
@@ -166,50 +211,6 @@ The default value is `'keep'`.
   - `'keep'` The session in the store will be kept, but modifications made during
     the request are ignored and not saved.
 
-#### Cookie options
-
-Please note that `secure: true` is a **recommended** option. However, it requires an https-enabled website, i.e., HTTPS is necessary for secure cookies.
-If `secure` is set, and you access your site over HTTP, the cookie will not be set. If you have your node.js behind a proxy and are using `secure: true`, you need to set "trust proxy" in express:
-
-```js
-var app = express()
-app.set('trust proxy', 1) // trust first proxy
-app.use(session({
-  secret: 'keyboard cat',
-  resave: false,
-  saveUninitialized: true,
-  cookie: { secure: true }
-}))
-```
-
-For using secure cookies in production, but allowing for testing in development, the following is an example of enabling this setup based on `NODE_ENV` in express:
-
-```js
-var app = express()
-var sess = {
-  secret: 'keyboard cat',
-  cookie: {}
-}
-
-if (app.get('env') === 'production') {
-  app.set('trust proxy', 1) // trust first proxy
-  sess.cookie.secure = true // serve secure cookies
-}
-
-app.use(session(sess))
-```
-
-The `cookie.secure` option can also be set to the special value `'auto'` to have
-this setting automatically match the determined security of the connection. Be
-careful when using this setting if the site is available both as HTTP and HTTPS,
-as once the cookie is set on HTTPS, it will no longer be visible over HTTP. This
-is useful when the Express `"trust proxy"` setting is properly setup to simplify
-development vs production configuration.
-
-By default `cookie.maxAge` is `null`, meaning no "expires" parameter is set
-so the cookie becomes a browser-session cookie. When the user closes the
-browser the cookie (and session) will be removed.
-
 ### req.session
 
 To store or access session data, simply use the request property `req.session`,

From 40afdb04bf83448b82bcc681293c12c620b9856c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 Jun 2016 00:37:22 -0400
Subject: [PATCH 082/529] docs: add full documentation on the cookie option

---
 README.md | 76 ++++++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 70 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index f3b47eb9..02a41b8a 100644
--- a/README.md
+++ b/README.md
@@ -43,9 +43,77 @@ For a list of stores, see [compatible session stores](#compatible-session-stores
 
 ##### cookie
 
-Settings for the session ID cookie.
+Settings object for the session ID cookie. The default value is
+`{ path: '/', httpOnly: true, secure: false, maxAge: null }`.
 
-The default value is `{ path: '/', httpOnly: true, secure: false, maxAge: null }`.
+The following are options that can be set in this object.
+
+###### domain
+
+Specifies the value for the `Domain` `Set-Cookie` attribute. By default, no domain
+is set, and most clients will consider the cookie to apply to only the current
+domain.
+
+###### expires
+
+Specifies the `Date` object to be the value for the `Expires` `Set-Cookie` attribute.
+By default, no expiration is set, and most clients will consider this a
+"non-persistent cookie" and will delete it on a condition like exiting a web browser
+application.
+
+**Note** The cookie storage model specification states that if both `expires` and
+`magAge` are set, then `maxAge` takes precedence, but it is possiblke not all
+clients by obey this, so if both are set, they should point to the same date and
+time.
+
+###### httpOnly
+
+Specifies the `boolean` value for the `HttpOnly` `Set-Cookie` attribute. When truthy,
+the `HttpOnly` attribute is set, otherwise it is not. By default, the `HttpOnly`
+attribute is set.
+
+**Note** be careful when setting this to `true`, as compliant clients will not allow
+client-side JavaScript to see the cookie in `document.cookie`.
+
+###### maxAge
+
+Specifies the `number` (in seconds) to be the value for the `Max-Age` `Set-Cookie` attribute.
+The given number will be converted to an integer by rounding down. By default, no maximum
+age is set.
+
+**Note** the cookie storage model specification states that if both `expires` and `magAge`
+are set, then `maxAge` takes precedence, but it is possible not all clients by obey this,
+so if both are set, they should point to the same date and time.
+
+###### path
+
+Specifies the value for the `Path` `Set-Cookie`. By default, this is set to `'/'`, which
+is the root path of the domain.
+
+###### sameSite
+
+Specifies the `boolean` or `string` to be the value for the `SameSite` `Set-Cookie` attribute.
+
+  - `true` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
+  - `false` will not set the `SameSite` attribute.
+  - `'lax'` will set the `SameSite` attribute to `Lax` for lax same site enforcement.
+  - `'strict'` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
+
+More information about the different enforcement levels can be found in the specification
+https://tools.ietf.org/html/draft-west-first-party-cookies-07#section-4.1.1
+
+**Note** This is an attribute that has not yet been fully standardized, and may change in
+the future. This also means many clients may ignore this attribute until they understand it.
+
+###### secure
+
+Specifies the `boolean` value for the `Secure` `Set-Cookie` attribute. When truthy,
+the `Secure` attribute is set, otherwise it is not. By default, the `Secure`
+attribute is not set.
+
+**Note** be careful when setting this to `true`, as compliant clients will not send
+the cookie back to the server in the future if the browser does not have an HTTPS
+connection.
 
 Please note that `secure: true` is a **recommended** option. However, it requires
 an https-enabled website, i.e., HTTPS is necessary for secure cookies. If `secure`
@@ -89,10 +157,6 @@ as once the cookie is set on HTTPS, it will no longer be visible over HTTP. This
 is useful when the Express `"trust proxy"` setting is properly setup to simplify
 development vs production configuration.
 
-By default `cookie.maxAge` is `null`, meaning no "expires" parameter is set
-so the cookie becomes a browser-session cookie. When the user closes the
-browser the cookie (and session) will be removed.
-
 ##### genid
 
 Function to call to generate a new session ID. Provide a function that returns

From 87300c0f57903553fa5ed14374ce9c3ac6141e04 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 Jun 2016 00:44:55 -0400
Subject: [PATCH 083/529] tests: ignore production warning in coverage

---
 index.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/index.js b/index.js
index 0de7c62f..4f465609 100644
--- a/index.js
+++ b/index.js
@@ -134,6 +134,7 @@ function session(options){
   // notify user that this store is not
   // meant for a production environment
   if ('production' == env && store instanceof MemoryStore) {
+    /* istanbul ignore next: not tested */
     console.warn(warning);
   }
 

From 1b424378781d13d2baa54c2e66b894934f1f9d03 Mon Sep 17 00:00:00 2001
From: Gabriel D <delucaga@kean.edu>
Date: Mon, 13 Jun 2016 20:53:13 -0400
Subject: [PATCH 084/529] docs: fix typo in readme

closes #321
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 02a41b8a..dbd1e081 100644
--- a/README.md
+++ b/README.md
@@ -62,7 +62,7 @@ By default, no expiration is set, and most clients will consider this a
 application.
 
 **Note** The cookie storage model specification states that if both `expires` and
-`magAge` are set, then `maxAge` takes precedence, but it is possiblke not all
+`magAge` are set, then `maxAge` takes precedence, but it is possible not all
 clients by obey this, so if both are set, they should point to the same date and
 time.
 

From 1940ce9abc00e123967c2b11c4426da48c3681c9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 Jun 2016 21:03:09 -0400
Subject: [PATCH 085/529] docs: fix cookie expires/maxAge documentation

fixes #320
---
 README.md | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index dbd1e081..b88ed824 100644
--- a/README.md
+++ b/README.md
@@ -61,10 +61,11 @@ By default, no expiration is set, and most clients will consider this a
 "non-persistent cookie" and will delete it on a condition like exiting a web browser
 application.
 
-**Note** The cookie storage model specification states that if both `expires` and
-`magAge` are set, then `maxAge` takes precedence, but it is possible not all
-clients by obey this, so if both are set, they should point to the same date and
-time.
+**Note** If both `expires` and `maxAge` are set in the options, then the last one
+defined in the object is what is used.
+
+**Note** The `expires` option should not be set directly; instead only use the `maxAge`
+option.
 
 ###### httpOnly
 
@@ -77,13 +78,13 @@ client-side JavaScript to see the cookie in `document.cookie`.
 
 ###### maxAge
 
-Specifies the `number` (in seconds) to be the value for the `Max-Age` `Set-Cookie` attribute.
-The given number will be converted to an integer by rounding down. By default, no maximum
-age is set.
+Specifies the `number` (in milliseconds) to use when calculating the `Expires`
+`Set-Cookie` attribute. This is done by taking the current server time and adding
+`maxAge` milliseconds to the value to calculate an `Expires` datetime. By default,
+no maximum age is set.
 
-**Note** the cookie storage model specification states that if both `expires` and `magAge`
-are set, then `maxAge` takes precedence, but it is possible not all clients by obey this,
-so if both are set, they should point to the same date and time.
+**Note** If both `expires` and `maxAge` are set in the options, then the last one
+defined in the object is what is used.
 
 ###### path
 

From 50cdae238a3806df75302f73ed280e361f13eebb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 Jun 2016 22:12:40 -0400
Subject: [PATCH 086/529] Fix issue where Set-Cookie Expires was not always
 updated

closes #276
closes #277
closes #296
---
 HISTORY.md      |  1 +
 index.js        | 17 ++++++++---------
 test/session.js | 28 ++++++++++++++++++++++++++++
 3 files changed, 37 insertions(+), 9 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 3d6753c0..27694bbe 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix issue where `Set-Cookie` `Expires` was not always updated
   * Methods are no longer enumerable on `req.session` object
   * deps: cookie@0.3.1
     - Add `sameSite` option
diff --git a/index.js b/index.js
index 4f465609..8bec911d 100644
--- a/index.js
+++ b/index.js
@@ -192,19 +192,21 @@ function session(options){
         return;
       }
 
-      var cookie = req.session.cookie;
+      if (!shouldSetCookie(req)) {
+        return;
+      }
 
       // only send secure cookies via https
-      if (cookie.secure && !issecure(req, trustProxy)) {
+      if (req.session.cookie.secure && !issecure(req, trustProxy)) {
         debug('not secured');
         return;
       }
 
-      if (!shouldSetCookie(req)) {
-        return;
-      }
+      // touch session
+      req.session.touch();
 
-      setcookie(res, name, req.sessionID, secrets[0], cookie.data);
+      // set cookie
+      setcookie(res, name, req.sessionID, secrets[0], req.session.cookie.data);
     });
 
     // proxy end() to commit the session
@@ -285,9 +287,6 @@ function session(options){
         return _end.call(res, chunk, encoding);
       }
 
-      // touch session
-      req.session.touch();
-
       if (shouldSave(req)) {
         req.session.save(function onsave(err) {
           if (err) {
diff --git a/test/session.js b/test/session.js
index 35f20de2..b6b6f01d 100644
--- a/test/session.js
+++ b/test/session.js
@@ -255,6 +255,34 @@ describe('session()', function(){
     })
   })
 
+  it('should update cookie expiration when slow write', function (done) {
+    var app = express();
+    app.use(session({ rolling: true, secret: 'keyboard cat', cookie: { maxAge: min }}));
+    app.use(function (req, res, next) {
+      req.session.user = 'bob';
+      res.write('hello, ');
+      setTimeout(function () {
+        res.end('world!');
+      }, 200);
+    });
+
+    request(app)
+    .get('/')
+    .expect(shouldSetCookie('connect.sid'))
+    .expect(200, function (err, res) {
+      if (err) return done(err);
+      var originalExpires = expires(res);
+      setTimeout(function () {
+        request(app)
+        .get('/')
+        .set('Cookie', cookie(res))
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(function (res) { assert.notEqual(originalExpires, expires(res)); })
+        .expect(200, done);
+      }, (1000 - (Date.now() % 1000) + 200));
+    });
+  });
+
   describe('when response ended', function () {
     it('should have saved session', function (done) {
       var saved = false

From 68709738dcb895c91f88e84bc1d50481f95bb8d7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Jun 2016 13:18:22 -0400
Subject: [PATCH 087/529] deps: uid-safe@~2.1.1

---
 HISTORY.md   | 3 ++-
 package.json | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 27694bbe..f48a6b4d 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -12,8 +12,9 @@ unreleased
     - perf: use string concatination for serialization
   * deps: parseurl@~1.3.1
     - perf: enable strict mode
-  * deps: uid-safe@~2.1.0
+  * deps: uid-safe@~2.1.1
     - Use `random-bytes` for byte source
+    - deps: base64-url@1.2.2
   * perf: enable strict mode
 
 1.13.0 / 2016-01-10
diff --git a/package.json b/package.json
index af85d794..f5763b5a 100644
--- a/package.json
+++ b/package.json
@@ -17,7 +17,7 @@
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.1",
-    "uid-safe": "~2.1.0",
+    "uid-safe": "~2.1.1",
     "utils-merge": "1.0.0"
   },
   "devDependencies": {

From f2a820345a1816639196d7f89688d024e042df50 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Jun 2016 13:18:50 -0400
Subject: [PATCH 088/529] build: express@4.14.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f5763b5a..f871967c 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
   "devDependencies": {
     "after": "0.8.1",
     "cookie-parser": "1.4.3",
-    "express": "4.13.4",
+    "express": "4.14.0",
     "istanbul": "0.4.3",
     "mocha": "2.5.3",
     "supertest": "1.1.0"

From 16cbfb29860499470d4daa3f2e4b886b62f1fb79 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Jun 2016 18:03:24 -0400
Subject: [PATCH 089/529] Correctly inherit from EventEmitter class in Store
 base class

---
 HISTORY.md       |  1 +
 session/store.js | 26 ++++++++++++++++++--------
 test/session.js  |  8 +++++---
 3 files changed, 24 insertions(+), 11 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index f48a6b4d..a6834d49 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Correctly inherit from `EventEmitter` class in `Store` base class
   * Fix issue where `Set-Cookie` `Expires` was not always updated
   * Methods are no longer enumerable on `req.session` object
   * deps: cookie@0.3.1
diff --git a/session/store.js b/session/store.js
index ca3d4a9d..7dac9453 100644
--- a/session/store.js
+++ b/session/store.js
@@ -9,25 +9,35 @@
 
 /**
  * Module dependencies.
+ * @private
  */
 
+var Cookie = require('./cookie')
 var EventEmitter = require('events').EventEmitter
-  , Session = require('./session')
-  , Cookie = require('./cookie');
+var Session = require('./session')
+var util = require('util')
 
 /**
- * Initialize abstract `Store`.
- *
- * @api private
+ * Module exports.
+ * @public
+ */
+
+module.exports = Store
+
+/**
+ * Abstract base class for session stores.
+ * @public
  */
 
-var Store = module.exports = function Store(options){};
+function Store () {
+  EventEmitter.call(this)
+}
 
 /**
- * Inherit from `EventEmitter.prototype`.
+ * Inherit from EventEmitter.
  */
 
-Store.prototype.__proto__ = EventEmitter.prototype;
+util.inherits(Store, EventEmitter)
 
 /**
  * Re-generate the given requests's session.
diff --git a/test/session.js b/test/session.js
index b6b6f01d..727a9ed2 100644
--- a/test/session.js
+++ b/test/session.js
@@ -11,6 +11,7 @@ var express = require('express')
 var fs = require('fs')
 var http = require('http')
 var https = require('https')
+var util = require('util')
 
 var min = 60 * 1000;
 
@@ -2289,11 +2290,12 @@ function writePatch() {
   }
 }
 
-function SyncStore() {
-  this.sessions = Object.create(null);
+function SyncStore () {
+  session.Store.call(this)
+  this.sessions = Object.create(null)
 }
 
-SyncStore.prototype.__proto__ = session.Store.prototype;
+util.inherits(SyncStore, session.Store)
 
 SyncStore.prototype.destroy = function destroy(sid, callback) {
   delete this.sessions[sid];

From 3c1cc028b10cfb3acf96123d6e9f4dab0869c3d8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Jun 2016 22:05:46 -0400
Subject: [PATCH 090/529] build: istanbul@0.4.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f871967c..5eae7025 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "after": "0.8.1",
     "cookie-parser": "1.4.3",
     "express": "4.14.0",
-    "istanbul": "0.4.3",
+    "istanbul": "0.4.4",
     "mocha": "2.5.3",
     "supertest": "1.1.0"
   },

From 9d21d90f3e07f4380b6b187faa21e096ec9db6a2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Jun 2016 22:21:19 -0400
Subject: [PATCH 091/529] tests: add tests for store disconnect and connect

---
 index.js        | 21 +++++++++++++++++----
 test/session.js | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+), 4 deletions(-)

diff --git a/index.js b/index.js
index 8bec911d..a00dda0d 100644
--- a/index.js
+++ b/index.js
@@ -150,16 +150,29 @@ function session(options){
   };
 
   var storeImplementsTouch = typeof store.touch === 'function';
-  store.on('disconnect', function(){ storeReady = false; });
-  store.on('connect', function(){ storeReady = true; });
+
+  // register event listeners for the store
+  store.on('disconnect', function ondisconnect() {
+    storeReady = false
+  })
+  store.on('connect', function onconnect() {
+    storeReady = true
+  })
 
   return function session(req, res, next) {
     // self-awareness
-    if (req.session) return next();
+    if (req.session) {
+      next()
+      return
+    }
 
     // Handle connection as if there is no session if
     // the store has temporarily disconnected etc
-    if (!storeReady) return debug('store is disconnected'), next();
+    if (!storeReady) {
+      debug('store is disconnected')
+      next()
+      return
+    }
 
     // pathname mismatch
     var originalPath = parseUrl.original(req).pathname;
diff --git a/test/session.js b/test/session.js
index 727a9ed2..e2258114 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1467,6 +1467,42 @@ describe('session()', function(){
       .expect(200, 'bar,cookie,foo', done);
     });
 
+    it('should not be set if store is disconnected', function (done) {
+      var store = new session.MemoryStore()
+      var server = createServer({ store: store }, function (req, res) {
+        res.end(typeof req.session)
+      })
+
+      store.emit('disconnect')
+
+      request(server)
+      .get('/')
+      .expect(shouldNotHaveHeader('Set-Cookie'))
+      .expect(200, 'undefined', done)
+    })
+
+    it('should be set when store reconnects', function (done) {
+      var store = new session.MemoryStore()
+      var server = createServer({ store: store }, function (req, res) {
+        res.end(typeof req.session)
+      })
+
+      store.emit('disconnect')
+
+      request(server)
+      .get('/')
+      .expect(shouldNotHaveHeader('Set-Cookie'))
+      .expect(200, 'undefined', function (err) {
+        if (err) return done(err)
+
+        store.emit('connect')
+
+        request(server)
+        .get('/')
+        .expect(200, 'object', done)
+      })
+    })
+
     describe('.destroy()', function(){
       it('should destroy the previous session', function(done){
         var app = express()

From d95275bd5345b161585ec7c6de22bcd77b484a65 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Jun 2016 22:50:55 -0400
Subject: [PATCH 092/529] perf: remove argument reassignment

---
 HISTORY.md       |  1 +
 index.js         | 50 ++++++++++++++++++++++++++++++++----------------
 session/store.js |  3 +--
 3 files changed, 35 insertions(+), 19 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index a6834d49..dbe831ea 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -17,6 +17,7 @@ unreleased
     - Use `random-bytes` for byte source
     - deps: base64-url@1.2.2
   * perf: enable strict mode
+  * perf: remove argument reassignment
 
 1.13.0 / 2016-01-10
 ===================
diff --git a/index.js b/index.js
index a00dda0d..5794118f 100644
--- a/index.js
+++ b/index.js
@@ -83,20 +83,35 @@ var defer = typeof setImmediate === 'function'
  * @public
  */
 
-function session(options){
-  var options = options || {}
-  //  name - previously "options.key"
-    , name = options.name || options.key || 'connect.sid'
-    , store = options.store || new MemoryStore
-    , trustProxy = options.proxy
-    , storeReady = true
-    , rollingSessions = options.rolling || false;
-  var cookieOptions = options.cookie || {};
-  var resaveSession = options.resave;
-  var saveUninitializedSession = options.saveUninitialized;
-  var secret = options.secret;
-
-  var generateId = options.genid || generateSessionId;
+function session(options) {
+  var opts = options || {}
+
+  // get the cookie options
+  var cookieOptions = opts.cookie || {}
+
+  // get the session id generate function
+  var generateId = opts.genid || generateSessionId
+
+  // get the session cookie name
+  var name = opts.name || opts.key || 'connect.sid'
+
+  // get the session store
+  var store = opts.store || new MemoryStore()
+
+  // get the trust proxy setting
+  var trustProxy = opts.proxy
+
+  // get the resave session option
+  var resaveSession = opts.resave;
+
+  // get the rolling session option
+  var rollingSessions = Boolean(opts.rolling)
+
+  // get the save uninitialized session option
+  var saveUninitializedSession = opts.saveUninitialized
+
+  // get the cookie signing secret
+  var secret = opts.secret
 
   if (typeof generateId !== 'function') {
     throw new TypeError('genid option must be a function');
@@ -112,12 +127,12 @@ function session(options){
     saveUninitializedSession = true;
   }
 
-  if (options.unset && options.unset !== 'destroy' && options.unset !== 'keep') {
+  if (opts.unset && opts.unset !== 'destroy' && opts.unset !== 'keep') {
     throw new TypeError('unset option must be "destroy" or "keep"');
   }
 
   // TODO: switch to "destroy" on next major
-  var unsetDestroy = options.unset === 'destroy';
+  var unsetDestroy = opts.unset === 'destroy'
 
   if (Array.isArray(secret) && secret.length === 0) {
     throw new TypeError('secret option array must contain one or more strings');
@@ -151,7 +166,8 @@ function session(options){
 
   var storeImplementsTouch = typeof store.touch === 'function';
 
-  // register event listeners for the store
+  // register event listeners for the store to track readiness
+  var storeReady = true
   store.on('disconnect', function ondisconnect() {
     storeReady = false
   })
diff --git a/session/store.js b/session/store.js
index 7dac9453..387469c5 100644
--- a/session/store.js
+++ b/session/store.js
@@ -70,8 +70,7 @@ Store.prototype.load = function(sid, fn){
     if (err) return fn(err);
     if (!sess) return fn();
     var req = { sessionID: sid, sessionStore: self };
-    sess = self.createSession(req, sess);
-    fn(null, sess);
+    fn(null, self.createSession(req, sess))
   });
 };
 

From af2fa7dcb2be7866fadca8500fd4204530b72ea3 Mon Sep 17 00:00:00 2001
From: Gabriel D <delucaga@kean.edu>
Date: Wed, 22 Jun 2016 02:28:34 -0500
Subject: [PATCH 093/529] tests: handle errors within tests

---
 test/session.js | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/test/session.js b/test/session.js
index e2258114..f9419d48 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1509,7 +1509,7 @@ describe('session()', function(){
           .use(session({ secret: 'keyboard cat' }))
           .use(function(req, res, next){
             req.session.destroy(function(err){
-              if (err) throw err;
+              if (err) return next(err)
               assert(!req.session, 'req.session after destroy');
               res.end();
             });
@@ -1529,7 +1529,7 @@ describe('session()', function(){
           .use(function(req, res, next){
             var id = req.session.id;
             req.session.regenerate(function(err){
-              if (err) throw err;
+              if (err) return next(err)
               assert.notEqual(id, req.session.id)
               res.end();
             });
@@ -1936,6 +1936,7 @@ describe('session()', function(){
           request(app)
           .get('/')
           .expect(200, '1', function (err, res) {
+            if (err) return done(err)
             var a = new Date(expires(res))
             var b = new Date
             var delta = a.valueOf() - b.valueOf()
@@ -1952,6 +1953,7 @@ describe('session()', function(){
           .get('/')
           .set('Cookie', val)
           .expect(200, '2', function (err, res) {
+            if (err) return done(err)
             var a = new Date(expires(res))
             var b = new Date
             var delta = a.valueOf() - b.valueOf()
@@ -1968,6 +1970,7 @@ describe('session()', function(){
           .get('/')
           .set('Cookie', val)
           .expect(200, '3', function (err, res) {
+            if (err) return done(err)
             var a = new Date(expires(res))
             var b = new Date
             var delta = a.valueOf() - b.valueOf()

From bf359988222c8919cc4234bb72e1c00985a69042 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 24 Jun 2016 00:16:45 -0400
Subject: [PATCH 094/529] Fix a merge error in MemoryStore to fix JSDoc
 comments

---
 session/memory.js | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/session/memory.js b/session/memory.js
index ae2175ba..25252b6c 100644
--- a/session/memory.js
+++ b/session/memory.js
@@ -116,6 +116,11 @@ MemoryStore.prototype.get = function get(sessionId, callback) {
  * @public
  */
 
+MemoryStore.prototype.set = function set(sessionId, session, callback) {
+  this.sessions[sessionId] = JSON.stringify(session)
+  callback && defer(callback)
+}
+
 /**
  * Get number of active sessions.
  *
@@ -130,11 +135,6 @@ MemoryStore.prototype.length = function length(callback) {
   })
 }
 
-MemoryStore.prototype.set = function set(sessionId, session, callback) {
-  this.sessions[sessionId] = JSON.stringify(session)
-  callback && defer(callback)
-}
-
 /**
  * Touch the given session object associated with the given session ID.
  *

From 9fd23195578eac5962d52f46781a75a297fbe685 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 1 Jul 2016 23:04:33 -0400
Subject: [PATCH 095/529] 1.14.0

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index dbe831ea..8ec88855 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.14.0 / 2016-07-01
+===================
 
   * Correctly inherit from `EventEmitter` class in `Store` base class
   * Fix issue where `Set-Cookie` `Expires` was not always updated
diff --git a/package.json b/package.json
index 5eae7025..d1852719 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From de4ea0150c27efd48ed8aa4b6c4f1112b9321874 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 15 Aug 2016 15:17:51 -0400
Subject: [PATCH 096/529] build: support Node.js 6.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 388f282d..fc45a8be 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,6 +8,7 @@ node_js:
   - "3.3"
   - "4.4"
   - "5.11"
+  - "6.2"
 sudo: false
 cache:
   directories:

From 5a6d259a595d5ca0d3ac94a064b8f210f1ef74db Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 15 Aug 2016 15:27:52 -0400
Subject: [PATCH 097/529] deps: uid-safe@~2.1.2

---
 HISTORY.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 8ec88855..26a24595 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: uid-safe@~2.1.2
+    - deps: base64-url@1.3.2
+
 1.14.0 / 2016-07-01
 ===================
 
diff --git a/package.json b/package.json
index d1852719..f2af341e 100644
--- a/package.json
+++ b/package.json
@@ -17,7 +17,7 @@
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.1",
-    "uid-safe": "~2.1.1",
+    "uid-safe": "~2.1.2",
     "utils-merge": "1.0.0"
   },
   "devDependencies": {

From 5d7b01d335f0704e74c25cd4ce20eb0f4c8a7290 Mon Sep 17 00:00:00 2001
From: Jan Hecking <jhecking@netgaroo.com>
Date: Mon, 11 Jul 2016 11:10:25 +0800
Subject: [PATCH 098/529] docs: add aerospike-session-store to list of session
 stores

closes #328
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index b88ed824..3bbca19a 100644
--- a/README.md
+++ b/README.md
@@ -477,6 +477,11 @@ potentially resetting the idle timer.
 The following modules implement a session store that is compatible with this
 module. Please make a PR to add additional modules :)
 
+[![★][aerospike-session-store-image] aerospike-session-store][aerospike-session-store-url] A session store using [Aerospike](http://www.aerospike.com/).
+
+[aerospike-session-store-url]: https://www.npmjs.com/package/aerospike-session-store
+[aerospike-session-store-image]: https://img.shields.io/github/stars/aerospike/aerospike-session-store-expressjs.svg?label=%E2%98%85
+
 [![★][cassandra-store-image] cassandra-store][cassandra-store-url] An Apache Cassandra-based session store.
 
 [cassandra-store-url]: https://www.npmjs.com/package/cassandra-store

From 4c85a80376f137dfea9456ecc2495c10cd018a4e Mon Sep 17 00:00:00 2001
From: Benjamin Vadant <benjaminvadant@gmail.com>
Date: Tue, 19 Jul 2016 22:12:43 +0200
Subject: [PATCH 099/529] docs: add medea-session-store to list of session
 stores

closes #332
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 3bbca19a..af6085b1 100644
--- a/README.md
+++ b/README.md
@@ -577,6 +577,11 @@ and other multi-core embedded devices).
 [level-session-store-url]: https://www.npmjs.com/package/level-session-store
 [level-session-store-image]: https://img.shields.io/github/stars/scriptollc/level-session-store.svg?label=%E2%98%85
 
+[![★][medea-session-store-image] medea-session-store][medea-session-store-url] A Medea-based session store.
+
+[medea-session-store-url]: https://www.npmjs.com/package/medea-session-store
+[medea-session-store-image]: https://img.shields.io/github/stars/scriptollc/medea-session-store.svg?label=%E2%98%85
+
 [![★][mssql-session-store-image] mssql-session-store][mssql-session-store-url] A SQL Server-based session store.
 
 [mssql-session-store-url]: https://www.npmjs.com/package/mssql-session-store

From 4d432ad482814f77ba2a7889c7411183a3ee8f97 Mon Sep 17 00:00:00 2001
From: Ali Lokhandwala <ali@huestones.co.uk>
Date: Sun, 24 Jul 2016 15:43:24 +0100
Subject: [PATCH 100/529] docs: add connect-db2 to list of session stores

closes #333
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index af6085b1..04e590f0 100644
--- a/README.md
+++ b/README.md
@@ -504,6 +504,11 @@ and other multi-core embedded devices).
 [connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase
 [connect-couchbase-image]: https://img.shields.io/github/stars/christophermina/connect-couchbase.svg?label=%E2%98%85
 
+[![★][connect-db2-image] connect-db2][connect-db2-url] An IBM DB2-based session store built using [ibm_db](https://www.npmjs.com/package/ibm_db) module.
+
+[connect-db2-url]: https://www.npmjs.com/package/connect-db2
+[connect-db2-image]: https://img.shields.io/github/stars/wallali/connect-db2.svg?label=%E2%98%85
+
 [![★][connect-dynamodb-image] connect-dynamodb][connect-dynamodb-url] A DynamoDB-based session store.
 
 [connect-dynamodb-url]: https://github.com/ca98am79/connect-dynamodb

From c3c26ba1a7b92eb5eed127fcd299dc29087be869 Mon Sep 17 00:00:00 2001
From: Guille Paz <guillermo.paz@mercadolibre.com>
Date: Tue, 19 Jul 2016 11:22:51 -0300
Subject: [PATCH 101/529] Fix the cookie sameSite option to actually alter the
 Set-Cookie

fixes #331
---
 HISTORY.md        | 1 +
 session/cookie.js | 1 +
 2 files changed, 2 insertions(+)

diff --git a/HISTORY.md b/HISTORY.md
index 26a24595..72617c30 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix the cookie `sameSite` option to actually alter the `Set-Cookie`
   * deps: uid-safe@~2.1.2
     - deps: base64-url@1.3.2
 
diff --git a/session/cookie.js b/session/cookie.js
index a4dbd8a8..60ef22af 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -102,6 +102,7 @@ Cookie.prototype = {
       , httpOnly: this.httpOnly
       , domain: this.domain
       , path: this.path
+      , sameSite: this.sameSite
     }
   },
 

From f224a325ce2247d967aa42f462a0ac767408c931 Mon Sep 17 00:00:00 2001
From: Benjamin Vadant <benjaminvadant@gmail.com>
Date: Tue, 16 Aug 2016 11:22:41 +0200
Subject: [PATCH 102/529] docs: fix image link for medea-session-store

closes #341
closes #344
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 04e590f0..92566e0f 100644
--- a/README.md
+++ b/README.md
@@ -585,7 +585,7 @@ and other multi-core embedded devices).
 [![★][medea-session-store-image] medea-session-store][medea-session-store-url] A Medea-based session store.
 
 [medea-session-store-url]: https://www.npmjs.com/package/medea-session-store
-[medea-session-store-image]: https://img.shields.io/github/stars/scriptollc/medea-session-store.svg?label=%E2%98%85
+[medea-session-store-image]: https://img.shields.io/github/stars/BenjaminVadant/medea-session-store.svg?label=%E2%98%85
 
 [![★][mssql-session-store-image] mssql-session-store][mssql-session-store-url] A SQL Server-based session store.
 

From cf3d960d021d988ac0b0c221d12beab12db053dc Mon Sep 17 00:00:00 2001
From: Nicolas Giard <github@ngpixel.com>
Date: Mon, 22 Aug 2016 12:02:56 -0400
Subject: [PATCH 103/529] docs: add connect-loki to list of session stores

closes #343
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 92566e0f..f052c876 100644
--- a/README.md
+++ b/README.md
@@ -514,6 +514,11 @@ and other multi-core embedded devices).
 [connect-dynamodb-url]: https://github.com/ca98am79/connect-dynamodb
 [connect-dynamodb-image]: https://img.shields.io/github/stars/ca98am79/connect-dynamodb.svg?label=%E2%98%85
 
+[![★][connect-loki-image] connect-loki][connect-loki-url] A Loki.js-based session store.
+
+[connect-loki-url]: https://www.npmjs.com/package/connect-loki
+[connect-loki-image]: https://img.shields.io/github/stars/Requarks/connect-loki.svg?label=%E2%98%85
+
 [![★][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
 
 [connect-mssql-url]: https://www.npmjs.com/package/connect-mssql

From 4c476fa7f01aac55ae8bc68d411ebfad22379eea Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Aug 2016 12:29:15 -0400
Subject: [PATCH 104/529] Fix not always resetting session max age before
 session save

fixes #340
---
 HISTORY.md      |  1 +
 index.js        | 14 ++++++++++++--
 test/session.js | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 49 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 72617c30..405e0a13 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix not always resetting session max age before session save
   * Fix the cookie `sameSite` option to actually alter the `Set-Cookie`
   * deps: uid-safe@~2.1.2
     - deps: base64-url@1.3.2
diff --git a/index.js b/index.js
index 5794118f..2241d974 100644
--- a/index.js
+++ b/index.js
@@ -207,6 +207,7 @@ function session(options) {
     var originalHash;
     var originalId;
     var savedHash;
+    var touched = false
 
     // expose store
     req.sessionStore = store;
@@ -231,8 +232,11 @@ function session(options) {
         return;
       }
 
-      // touch session
-      req.session.touch();
+      if (!touched) {
+        // touch session
+        req.session.touch()
+        touched = true
+      }
 
       // set cookie
       setcookie(res, name, req.sessionID, secrets[0], req.session.cookie.data);
@@ -316,6 +320,12 @@ function session(options) {
         return _end.call(res, chunk, encoding);
       }
 
+      if (!touched) {
+        // touch session
+        req.session.touch()
+        touched = true
+      }
+
       if (shouldSave(req)) {
         req.session.save(function onsave(err) {
           if (err) {
diff --git a/test/session.js b/test/session.js
index f9419d48..f553d1c5 100644
--- a/test/session.js
+++ b/test/session.js
@@ -396,6 +396,42 @@ describe('session()', function(){
         done()
       })
     })
+
+    it('should have saved session with updated cookie expiration', function (done) {
+      var store = new session.MemoryStore()
+      var server = createServer({ cookie: { maxAge: min }, store: store }, function (req, res) {
+        req.session.user = 'bob'
+        res.end(req.session.id)
+      })
+
+      request(server)
+      .get('/')
+      .expect(shouldSetCookie('connect.sid'))
+      .expect(200, function (err, res) {
+        if (err) return done(err)
+        var id = res.text
+        store.get(id, function (err, sess) {
+          if (err) return done(err)
+          assert.ok(sess, 'session saved to store')
+          var exp = new Date(sess.cookie.expires)
+          assert.equal(exp.toUTCString(), expires(res))
+          setTimeout(function () {
+            request(server)
+            .get('/')
+            .set('Cookie', cookie(res))
+            .expect(200, function (err, res) {
+              if (err) return done(err)
+              store.get(id, function (err, sess) {
+                assert.equal(res.text, id)
+                assert.ok(sess, 'session still in store')
+                assert.notEqual(new Date(sess.cookie.expires).toUTCString(), exp.toUTCString(), 'session cookie expiration updated')
+                done()
+              })
+            })
+          }, (1000 - (Date.now() % 1000) + 200))
+        })
+      })
+    })
   })
 
   describe('when sid not in store', function () {

From ec8cde2866ae00aed3796ce4ebcf61527298cdb2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Aug 2016 12:36:29 -0400
Subject: [PATCH 105/529] build: after@0.8.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f2af341e..743db1a9 100644
--- a/package.json
+++ b/package.json
@@ -21,7 +21,7 @@
     "utils-merge": "1.0.0"
   },
   "devDependencies": {
-    "after": "0.8.1",
+    "after": "0.8.2",
     "cookie-parser": "1.4.3",
     "express": "4.14.0",
     "istanbul": "0.4.4",

From e8ae80d9b760c0af579dfe48d190446dec00b4f5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Aug 2016 12:36:59 -0400
Subject: [PATCH 106/529] build: istanbul@0.4.5

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 743db1a9..5ecc5f8c 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "after": "0.8.2",
     "cookie-parser": "1.4.3",
     "express": "4.14.0",
-    "istanbul": "0.4.4",
+    "istanbul": "0.4.5",
     "mocha": "2.5.3",
     "supertest": "1.1.0"
   },

From d78676fc22da3e5fc08f026f98b72b648e63ebb5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Aug 2016 12:37:43 -0400
Subject: [PATCH 107/529] build: Node.js@4.5

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index fc45a8be..9d13ceb0 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -6,7 +6,7 @@ node_js:
   - "1.8"
   - "2.5"
   - "3.3"
-  - "4.4"
+  - "4.5"
   - "5.11"
   - "6.2"
 sudo: false

From 4c19dfeb41323fe26083bdf802177e1b7503e78f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Aug 2016 12:38:09 -0400
Subject: [PATCH 108/529] build: Node.js@5.12

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 9d13ceb0..a27e3a0d 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -7,7 +7,7 @@ node_js:
   - "2.5"
   - "3.3"
   - "4.5"
-  - "5.11"
+  - "5.12"
   - "6.2"
 sudo: false
 cache:

From 8fca4176d7ce4d552425e433f5b8292cffc0f709 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Aug 2016 12:38:19 -0400
Subject: [PATCH 109/529] build: Node.js@6.4

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index a27e3a0d..ce9f6754 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "3.3"
   - "4.5"
   - "5.12"
-  - "6.2"
+  - "6.4"
 sudo: false
 cache:
   directories:

From 19b8f725d924035574d71e22bcb0a7d06c09ae80 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Aug 2016 13:11:35 -0400
Subject: [PATCH 110/529] 1.14.1

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 405e0a13..972d1c96 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.14.1 / 2016-08-24
+===================
 
   * Fix not always resetting session max age before session save
   * Fix the cookie `sameSite` option to actually alter the `Set-Cookie`
diff --git a/package.json b/package.json
index 5ecc5f8c..47dfa5e8 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.14.0",
+  "version": "1.14.1",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From b8f29abb2fe2853c880af868726a3512b8404788 Mon Sep 17 00:00:00 2001
From: Gabriel D <delucaga@kean.edu>
Date: Tue, 30 Aug 2016 01:06:38 -0400
Subject: [PATCH 111/529] tests: handle errors within tests

closes #352
---
 test/session.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/test/session.js b/test/session.js
index f553d1c5..9eb3d38e 100644
--- a/test/session.js
+++ b/test/session.js
@@ -422,6 +422,7 @@ describe('session()', function(){
             .expect(200, function (err, res) {
               if (err) return done(err)
               store.get(id, function (err, sess) {
+                if (err) return done(err)
                 assert.equal(res.text, id)
                 assert.ok(sess, 'session still in store')
                 assert.notEqual(new Date(sess.cookie.expires).toUTCString(), exp.toUTCString(), 'session cookie expiration updated')

From e99d8a6d3ea256853bb9f4e321842ad9e339d16e Mon Sep 17 00:00:00 2001
From: Gajus Kuizinas <gajus@gajus.com>
Date: Wed, 31 Aug 2016 16:23:30 +0100
Subject: [PATCH 112/529] docs: add express-session-level to list of session
 stores

closes #353
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index f052c876..dbb263ca 100644
--- a/README.md
+++ b/README.md
@@ -582,6 +582,11 @@ and other multi-core embedded devices).
 [express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session
 [express-nedb-session-image]: https://img.shields.io/github/stars/louischatriot/express-nedb-session.svg?label=%E2%98%85
 
+[![★][express-session-level-image] express-session-level][express-session-level-url] A [LevelDB](https://github.com/Level/levelup) based session store.
+
+[express-session-level-url]: https://www.npmjs.com/package/express-session-level
+[express-session-level-image]: https://img.shields.io/github/stars/tgohn/express-session-level.svg?label=%E2%98%85
+
 [![★][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store.
 
 [level-session-store-url]: https://www.npmjs.com/package/level-session-store

From 81e6d097e840f5d2473eca65fc0926813ec8b2cf Mon Sep 17 00:00:00 2001
From: "Daniel W. Hieber" <dwhieb@gmail.com>
Date: Sun, 28 Aug 2016 02:03:52 -0500
Subject: [PATCH 113/529] docs: add documentdb-session to list of session
 stores

closes #348
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index dbb263ca..c47171d1 100644
--- a/README.md
+++ b/README.md
@@ -577,6 +577,11 @@ and other multi-core embedded devices).
 [connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3
 [connect-sqlite3-image]: https://img.shields.io/github/stars/rawberg/connect-sqlite3.svg?label=%E2%98%85
 
+[![★][documentdb-session-image] documentdb-session][documentdb-session-url] A session store for Microsoft Azure's [DocumentDB](https://azure.microsoft.com/en-us/services/documentdb/) NoSQL database service.
+
+[documentdb-session-url]: https://www.npmjs.com/package/documentdb-session
+[documentdb-session-image]: https://img.shields.io/github/stars/dwhieb/documentdb-session.svg?label=%E2%98%85
+
 [![★][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store.
 
 [express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session

From 8e57b21bef0d53010c4d37f4beee3f0341f3eaa6 Mon Sep 17 00:00:00 2001
From: Matt Savino <jackspaniel99@gmail.com>
Date: Wed, 24 Aug 2016 10:35:06 -0700
Subject: [PATCH 114/529] docs: add hazelcast-store to list of session stores

closes #346
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index c47171d1..d826a8b9 100644
--- a/README.md
+++ b/README.md
@@ -592,6 +592,11 @@ and other multi-core embedded devices).
 [express-session-level-url]: https://www.npmjs.com/package/express-session-level
 [express-session-level-image]: https://img.shields.io/github/stars/tgohn/express-session-level.svg?label=%E2%98%85
 
+[![★][hazelcast-store-image] hazelcast-store][hazelcast-store-url] A Hazelcast-based session store built on the [Hazelcast Node Client](https://www.npmjs.com/package/hazelcast-client).
+
+[hazelcast-store-url]: https://www.npmjs.com/package/hazelcast-store
+[hazelcast-store-image]: https://img.shields.io/github/stars/jackspaniel/hazelcast-store.svg?label=%E2%98%85
+
 [![★][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store.
 
 [level-session-store-url]: https://www.npmjs.com/package/level-session-store

From 708a70b28729ee3ce5f530f31540b560f2efc713 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 2 Oct 2016 22:09:46 -0400
Subject: [PATCH 115/529] build: Node.js@4.6

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index ce9f6754..fa54996f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -6,7 +6,7 @@ node_js:
   - "1.8"
   - "2.5"
   - "3.3"
-  - "4.5"
+  - "4.6"
   - "5.12"
   - "6.4"
 sudo: false

From 7ede22400b5cb67dc24bcdaedb1415c624c68747 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 2 Oct 2016 22:12:33 -0400
Subject: [PATCH 116/529] build: Node.js@6.7

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index fa54996f..06387449 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "3.3"
   - "4.6"
   - "5.12"
-  - "6.4"
+  - "6.7"
 sudo: false
 cache:
   directories:

From 12b050286659da76dfe025dd2d2fd05a59e6fa9b Mon Sep 17 00:00:00 2001
From: Alex Movsisyan <dev@movsisyan.com>
Date: Tue, 23 Aug 2016 11:21:37 +0400
Subject: [PATCH 117/529] docs: add express-sessions to list of session stores

closes #345
---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index d826a8b9..525efe53 100644
--- a/README.md
+++ b/README.md
@@ -572,6 +572,10 @@ and other multi-core embedded devices).
 [express-mysql-session-url]: https://www.npmjs.com/package/express-mysql-session
 [express-mysql-session-image]: https://img.shields.io/github/stars/chill117/express-mysql-session.svg?label=%E2%98%85
 
+[![★][express-sessions-image] express-sessions][express-sessions-url]: A session store supporting both MongoDB and Redis.
+[express-sessions-url]: https://www.npmjs.com/package/express-sessions
+[express-sessions-image]: https://img.shields.io/github/stars/konteck/express-sessions.svg?label=%E2%98%85
+
 [![★][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store.
 
 [connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3

From fba7be43c569834ce5b111d0c9a0580e893dd624 Mon Sep 17 00:00:00 2001
From: Olli Kankare <gildean@salaliitto.com>
Date: Wed, 7 Sep 2016 12:23:32 +0300
Subject: [PATCH 118/529] docs: add express-etcd to the list of session stores

closes #358
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 525efe53..a71e093c 100644
--- a/README.md
+++ b/README.md
@@ -596,6 +596,11 @@ and other multi-core embedded devices).
 [express-session-level-url]: https://www.npmjs.com/package/express-session-level
 [express-session-level-image]: https://img.shields.io/github/stars/tgohn/express-session-level.svg?label=%E2%98%85
 
+[![★][express-etcd-image] express-etcd][express-etcd-url] An [etcd](https://github.com/stianeikeland/node-etcd) based session store.
+
+[express-etcd-url]: https://www.npmjs.com/package/express-etcd
+[express-etcd-image]: https://img.shields.io/github/stars/gildean/express-etcd.svg?label=%E2%98%85
+
 [![★][hazelcast-store-image] hazelcast-store][hazelcast-store-url] A Hazelcast-based session store built on the [Hazelcast Node Client](https://www.npmjs.com/package/hazelcast-client).
 
 [hazelcast-store-url]: https://www.npmjs.com/package/hazelcast-store

From 30a4d886229b16791a944d97750a6cba0ea476d9 Mon Sep 17 00:00:00 2001
From: Adrian Tanasa <adrian_tanasa@yahoo.com>
Date: Thu, 6 Oct 2016 10:26:32 +0100
Subject: [PATCH 119/529] docs: add connect-datacache to the list of session
 stores

closes #368
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index a71e093c..91ac2c0d 100644
--- a/README.md
+++ b/README.md
@@ -504,6 +504,11 @@ and other multi-core embedded devices).
 [connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase
 [connect-couchbase-image]: https://img.shields.io/github/stars/christophermina/connect-couchbase.svg?label=%E2%98%85
 
+[![★][connect-datacache-image] connect-datacache][connect-datacache-url] An [IBM Bluemix Data Cache](http://www.ibm.com/cloud-computing/bluemix/)-based session store.
+
+[connect-datacache-url]: https://www.npmjs.com/package/connect-datacache
+[connect-datacache-image]: https://img.shields.io/github/stars/adriantanasa/connect-datacache.svg?label=%E2%98%85
+
 [![★][connect-db2-image] connect-db2][connect-db2-url] An IBM DB2-based session store built using [ibm_db](https://www.npmjs.com/package/ibm_db) module.
 
 [connect-db2-url]: https://www.npmjs.com/package/connect-db2

From ddffd58e9eaffb6ac59ff29e7f864012691bfd1e Mon Sep 17 00:00:00 2001
From: Bruce Holt <bruce.holt@marklogic.com>
Date: Wed, 12 Oct 2016 08:35:16 -0600
Subject: [PATCH 120/529] docs: add connect-ml to the list of session stores

closes #370
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 91ac2c0d..073c43ab 100644
--- a/README.md
+++ b/README.md
@@ -524,6 +524,11 @@ and other multi-core embedded devices).
 [connect-loki-url]: https://www.npmjs.com/package/connect-loki
 [connect-loki-image]: https://img.shields.io/github/stars/Requarks/connect-loki.svg?label=%E2%98%85
 
+[![★][connect-ml-image] connect-ml][connect-ml-url] A MarkLogic Server-based session store.
+
+[connect-ml-url]: https://www.npmjs.com/package/connect-ml
+[connect-ml-image]: https://img.shields.io/github/stars/bluetorch/connect-ml.svg?label=%E2%98%85
+
 [![★][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
 
 [connect-mssql-url]: https://www.npmjs.com/package/connect-mssql

From b7c6974be37a8f97811c3158916a3d2aecfaa4b1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 27 Oct 2016 15:15:34 -0400
Subject: [PATCH 121/529] docs: flatten cookie options into option header level

closes #356
closes #378
---
 README.md | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index 073c43ab..a8938b5d 100644
--- a/README.md
+++ b/README.md
@@ -48,13 +48,13 @@ Settings object for the session ID cookie. The default value is
 
 The following are options that can be set in this object.
 
-###### domain
+##### cookie.domain
 
 Specifies the value for the `Domain` `Set-Cookie` attribute. By default, no domain
 is set, and most clients will consider the cookie to apply to only the current
 domain.
 
-###### expires
+##### cookie.expires
 
 Specifies the `Date` object to be the value for the `Expires` `Set-Cookie` attribute.
 By default, no expiration is set, and most clients will consider this a
@@ -67,7 +67,7 @@ defined in the object is what is used.
 **Note** The `expires` option should not be set directly; instead only use the `maxAge`
 option.
 
-###### httpOnly
+##### cookie.httpOnly
 
 Specifies the `boolean` value for the `HttpOnly` `Set-Cookie` attribute. When truthy,
 the `HttpOnly` attribute is set, otherwise it is not. By default, the `HttpOnly`
@@ -76,7 +76,7 @@ attribute is set.
 **Note** be careful when setting this to `true`, as compliant clients will not allow
 client-side JavaScript to see the cookie in `document.cookie`.
 
-###### maxAge
+##### cookie.maxAge
 
 Specifies the `number` (in milliseconds) to use when calculating the `Expires`
 `Set-Cookie` attribute. This is done by taking the current server time and adding
@@ -86,12 +86,12 @@ no maximum age is set.
 **Note** If both `expires` and `maxAge` are set in the options, then the last one
 defined in the object is what is used.
 
-###### path
+##### cookie.path
 
 Specifies the value for the `Path` `Set-Cookie`. By default, this is set to `'/'`, which
 is the root path of the domain.
 
-###### sameSite
+##### cookie.sameSite
 
 Specifies the `boolean` or `string` to be the value for the `SameSite` `Set-Cookie` attribute.
 
@@ -106,7 +106,7 @@ https://tools.ietf.org/html/draft-west-first-party-cookies-07#section-4.1.1
 **Note** This is an attribute that has not yet been fully standardized, and may change in
 the future. This also means many clients may ignore this attribute until they understand it.
 
-###### secure
+##### cookie.secure
 
 Specifies the `boolean` value for the `Secure` `Set-Cookie` attribute. When truthy,
 the `Secure` attribute is set, otherwise it is not. By default, the `Secure`

From 2667028d39b3655a45eb1f9579d7f66f26a6937f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 27 Oct 2016 21:21:28 -0400
Subject: [PATCH 122/529] docs: add callback to method signatures that take one

closes #379
---
 README.md | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index a8938b5d..2062421b 100644
--- a/README.md
+++ b/README.md
@@ -302,10 +302,11 @@ app.get('/', function(req, res, next) {
 })
 ```
 
-#### Session.regenerate()
+#### Session.regenerate(callback)
 
 To regenerate the session simply invoke the method. Once complete,
-a new SID and `Session` instance will be initialized at `req.session`.
+a new SID and `Session` instance will be initialized at `req.session`
+and the `callback` will be invoked.
 
 ```js
 req.session.regenerate(function(err) {
@@ -313,9 +314,10 @@ req.session.regenerate(function(err) {
 })
 ```
 
-#### Session.destroy()
+#### Session.destroy(callback)
 
-Destroys the session, removing `req.session`; will be re-generated next request.
+Destroys the session and will unset the `req.session` property.
+Once complete, the `callback` will be invoked.
 
 ```js
 req.session.destroy(function(err) {
@@ -323,9 +325,10 @@ req.session.destroy(function(err) {
 })
 ```
 
-#### Session.reload()
+#### Session.reload(callback)
 
-Reloads the session data.
+Reloads the session data from the store and re-populates the
+`req.session` object. Once complete, the `callback` will be invoked.
 
 ```js
 req.session.reload(function(err) {
@@ -333,7 +336,7 @@ req.session.reload(function(err) {
 })
 ```
 
-#### Session.save()
+#### Session.save(callback)
 
 Save the session back to the store, replacing the contents on the store with the
 contents in memory (though a store may do something else--consult the store's

From 1c6ea4457c1dfd9addf24ba86c2a674dc4471571 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 27 Oct 2016 21:22:53 -0400
Subject: [PATCH 123/529] build: Node.js@6.9

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 06387449..fa13448d 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "3.3"
   - "4.6"
   - "5.12"
-  - "6.7"
+  - "6.9"
 sudo: false
 cache:
   directories:

From 69f07ec527f66feeccf42b55a00fa974c9360d1a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 28 Oct 2016 16:40:48 -0400
Subject: [PATCH 124/529] deps: crc@3.4.1

fixes #380
---
 HISTORY.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 972d1c96..549222ab 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: crc@3.4.1
+    - Fix deprecation warning in Node.js 7.x
+
 1.14.1 / 2016-08-24
 ===================
 
diff --git a/package.json b/package.json
index 47dfa5e8..b2578bd1 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,7 @@
   "dependencies": {
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
-    "crc": "3.4.0",
+    "crc": "3.4.1",
     "debug": "~2.2.0",
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",

From dcc6241d1320b9abcfd4742a2af2dced54e4ce15 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 31 Oct 2016 00:58:54 -0400
Subject: [PATCH 125/529] deps: uid-safe@~2.1.3

---
 HISTORY.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 549222ab..aac80fbd 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -3,6 +3,8 @@ unreleased
 
   * deps: crc@3.4.1
     - Fix deprecation warning in Node.js 7.x
+  * deps: uid-safe@~2.1.3
+    - deps: base64-url@1.3.3
 
 1.14.1 / 2016-08-24
 ===================
diff --git a/package.json b/package.json
index b2578bd1..7bcab08c 100644
--- a/package.json
+++ b/package.json
@@ -17,7 +17,7 @@
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.1",
-    "uid-safe": "~2.1.2",
+    "uid-safe": "~2.1.3",
     "utils-merge": "1.0.0"
   },
   "devDependencies": {

From 087a0a40d689c8b4885d20f60addbb71c6881f65 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 31 Oct 2016 00:59:40 -0400
Subject: [PATCH 126/529] build: support Node.js 7.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index fa13448d..237d447a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,6 +9,7 @@ node_js:
   - "4.6"
   - "5.12"
   - "6.9"
+  - "7.0"
 sudo: false
 cache:
   directories:

From 1a61416bdaae56fc4a2a3af708f992d4dd2885c9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 31 Oct 2016 01:07:18 -0400
Subject: [PATCH 127/529] 1.14.2

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index aac80fbd..fd15864d 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.14.2 / 2016-10-30
+===================
 
   * deps: crc@3.4.1
     - Fix deprecation warning in Node.js 7.x
diff --git a/package.json b/package.json
index 7bcab08c..4adeb4f4 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.14.1",
+  "version": "1.14.2",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From ef30faf8040068c25bef3d9ae13ccbe354d1e812 Mon Sep 17 00:00:00 2001
From: Alice Klipper <alice.klipper@yandex.com>
Date: Tue, 1 Nov 2016 23:31:40 +0300
Subject: [PATCH 128/529] docs: add fortune-session to the list of session
 stores

closes #386
---
 README.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/README.md b/README.md
index 2062421b..cc3bc8fa 100644
--- a/README.md
+++ b/README.md
@@ -614,6 +614,12 @@ and other multi-core embedded devices).
 [express-etcd-url]: https://www.npmjs.com/package/express-etcd
 [express-etcd-image]: https://img.shields.io/github/stars/gildean/express-etcd.svg?label=%E2%98%85
 
+[![★][fortune-session-image] fortune-session][fortune-session-url] A [Fortune.js](https://github.com/fortunejs/fortune)
+based session store. Supports all backends supported by Fortune (MongoDB, Redis, Postgres, NeDB).
+
+[fortune-session-url]: https://www.npmjs.com/package/fortune-session
+[fortune-session-image]: https://img.shields.io/github/stars/aliceklipper/fortune-session.svg?label=%E2%98%85
+
 [![★][hazelcast-store-image] hazelcast-store][hazelcast-store-url] A Hazelcast-based session store built on the [Hazelcast Node Client](https://www.npmjs.com/package/hazelcast-client).
 
 [hazelcast-store-url]: https://www.npmjs.com/package/hazelcast-store

From ce2de6b30ff061cbb84fbc0634342f19a8128342 Mon Sep 17 00:00:00 2001
From: Peter Dotchev <dotchev@gmail.com>
Date: Sun, 30 Oct 2016 17:29:45 +0200
Subject: [PATCH 129/529] Fix resaving already-saved reloaded session at end of
 request

fixes #383
closes #384
---
 HISTORY.md      |  5 +++++
 index.js        | 16 ++++++++++++++++
 test/session.js | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 57 insertions(+)

diff --git a/HISTORY.md b/HISTORY.md
index fd15864d..9d4761a3 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix resaving already-saved reloaded session at end of request
+
 1.14.2 / 2016-10-30
 ===================
 
diff --git a/index.js b/index.js
index 2241d974..90aa52c7 100644
--- a/index.js
+++ b/index.js
@@ -364,14 +364,30 @@ function session(options) {
 
     // wrap session methods
     function wrapmethods(sess) {
+      var _reload = sess.reload
       var _save = sess.save;
 
+      function reload(callback) {
+        debug('reloading %s', this.id)
+        _reload.call(this, function () {
+          wrapmethods(req.session)
+          callback.apply(this, arguments)
+        })
+      }
+
       function save() {
         debug('saving %s', this.id);
         savedHash = hash(this);
         _save.apply(this, arguments);
       }
 
+      Object.defineProperty(sess, 'reload', {
+        configurable: true,
+        enumerable: false,
+        value: reload,
+        writable: true
+      })
+
       Object.defineProperty(sess, 'save', {
         configurable: true,
         enumerable: false,
diff --git a/test/session.js b/test/session.js
index 9eb3d38e..9cfb6ef9 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1714,6 +1714,42 @@ describe('session()', function(){
           })
         })
       })
+
+      it('should prevent end-of-request save on reloaded session', function (done) {
+        var count = 0
+        var store = new session.MemoryStore()
+        var server = createServer({ store: store }, function (req, res) {
+          req.session.hit = true
+          req.session.reload(function () {
+            req.session.save(function (err) {
+              if (err) return res.end(err.message)
+              res.end('saved')
+            })
+          })
+        })
+
+        var _set = store.set
+        store.set = function set(sid, sess, callback) {
+          count++
+          _set.call(store, sid, sess, callback)
+        }
+
+        request(server)
+        .get('/')
+        .expect(200, 'saved', function (err, res) {
+          if (err) return done(err)
+          assert.equal(count, 1)
+          count = 0
+          request(server)
+          .get('/')
+          .set('Cookie', cookie(res))
+          .expect(200, 'saved', function (err) {
+            if (err) return done(err)
+            assert.equal(count, 1)
+            done()
+          })
+        })
+      })
     })
 
     describe('.touch()', function () {

From bab6e228187958b40fa91e1e5e23171121866c16 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Nov 2016 22:09:42 -0500
Subject: [PATCH 130/529] deps: debug@2.3.2

---
 HISTORY.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 9d4761a3..b99a2fe0 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -2,6 +2,9 @@ unreleased
 ==========
 
   * Fix resaving already-saved reloaded session at end of request
+  * deps: debug@2.3.2
+    - Fix error when running under React Native
+    - deps: ms@0.7.2
 
 1.14.2 / 2016-10-30
 ===================
diff --git a/package.json b/package.json
index 4adeb4f4..5b0d8c9e 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "crc": "3.4.1",
-    "debug": "~2.2.0",
+    "debug": "2.3.2",
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.1",

From a8f367c1e397b0b0d0079d452522cc0662c8963c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Nov 2016 22:10:08 -0500
Subject: [PATCH 131/529] build: Node.js@7.1

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 237d447a..6525236c 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "4.6"
   - "5.12"
   - "6.9"
-  - "7.0"
+  - "7.1"
 sudo: false
 cache:
   directories:

From 588d09900c0ee4796ba78f3d51c690de6b77dd50 Mon Sep 17 00:00:00 2001
From: OlegTsyba <oleg.tsyba.ua@gmail.com>
Date: Sat, 8 Oct 2016 21:16:10 +0300
Subject: [PATCH 132/529] perf: remove unreachable branch in set-cookie method

closes #369
---
 HISTORY.md | 1 +
 index.js   | 4 +---
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index b99a2fe0..f1a72f57 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -5,6 +5,7 @@ unreleased
   * deps: debug@2.3.2
     - Fix error when running under React Native
     - deps: ms@0.7.2
+  * perf: remove unreachable branch in set-cookie method
 
 1.14.2 / 2016-10-30
 ===================
diff --git a/index.js b/index.js
index 90aa52c7..01752a12 100644
--- a/index.js
+++ b/index.js
@@ -635,9 +635,7 @@ function setcookie(res, name, val, secret, options) {
   debug('set-cookie %s', data);
 
   var prev = res.getHeader('set-cookie') || [];
-  var header = Array.isArray(prev) ? prev.concat(data)
-    : Array.isArray(data) ? [prev].concat(data)
-    : [prev, data];
+  var header = Array.isArray(prev) ? prev.concat(data) : [prev, data];
 
   res.setHeader('set-cookie', header)
 }

From f21f95668986b8a99957598b1e3bbb54b720fdbf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Nov 2016 22:23:48 -0500
Subject: [PATCH 133/529] docs: add preamble to install section

---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index cc3bc8fa..261600f7 100644
--- a/README.md
+++ b/README.md
@@ -8,6 +8,10 @@
 
 ## Installation
 
+This is a [Node.js](https://nodejs.org/en/) module available through the
+[npm registry](https://www.npmjs.com/). Installation is done using the
+[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
+
 ```bash
 $ npm install express-session
 ```

From 583ee482cf8a23e9e22c475902f4de8dbf49d0fb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Nov 2016 23:43:36 -0500
Subject: [PATCH 134/529] deps: debug@2.3.3

---
 HISTORY.md   | 2 +-
 package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index f1a72f57..b09a6ec8 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -2,7 +2,7 @@ unreleased
 ==========
 
   * Fix resaving already-saved reloaded session at end of request
-  * deps: debug@2.3.2
+  * deps: debug@2.3.3
     - Fix error when running under React Native
     - deps: ms@0.7.2
   * perf: remove unreachable branch in set-cookie method
diff --git a/package.json b/package.json
index 5b0d8c9e..3a088c52 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "crc": "3.4.1",
-    "debug": "2.3.2",
+    "debug": "2.3.3",
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.1",

From 534ae1e6f536960e8f4c1cb10b66256a1b1c500a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 7 Dec 2016 23:54:32 -0500
Subject: [PATCH 135/529] build: Node.js@4.7

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 6525236c..0e5953d3 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -6,7 +6,7 @@ node_js:
   - "1.8"
   - "2.5"
   - "3.3"
-  - "4.6"
+  - "4.7"
   - "5.12"
   - "6.9"
   - "7.1"

From 899c27fca1e8b5cc203810e7a55b61b9a0569453 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 7 Dec 2016 23:56:33 -0500
Subject: [PATCH 136/529] build: Node.js@7.2

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 0e5953d3..c285293f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "4.7"
   - "5.12"
   - "6.9"
-  - "7.1"
+  - "7.2"
 sudo: false
 cache:
   directories:

From 0b4c0eddb22232e881303f6c05c52fc188a32cf7 Mon Sep 17 00:00:00 2001
From: Cong Do <citium@gmail.com>
Date: Mon, 28 Nov 2016 11:09:59 +0700
Subject: [PATCH 137/529] deps: crc@3.4.3

closes #390
---
 HISTORY.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index b09a6ec8..183026fa 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -2,6 +2,8 @@ unreleased
 ==========
 
   * Fix resaving already-saved reloaded session at end of request
+  * deps: crc@3.4.3
+    - perf: use `Buffer.from` when available
   * deps: debug@2.3.3
     - Fix error when running under React Native
     - deps: ms@0.7.2
diff --git a/package.json b/package.json
index 3a088c52..b71e0d63 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,7 @@
   "dependencies": {
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
-    "crc": "3.4.1",
+    "crc": "3.4.3",
     "debug": "2.3.3",
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",

From e01ce259d2ae50c2aa8dc294ee1d1f1ac7e47e10 Mon Sep 17 00:00:00 2001
From: Gabriel D <delucaga@kean.edu>
Date: Sat, 31 Dec 2016 23:17:18 -0500
Subject: [PATCH 138/529] build: Node.js@7.3

closes #408
---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index c285293f..ecf24c60 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "4.7"
   - "5.12"
   - "6.9"
-  - "7.2"
+  - "7.3"
 sudo: false
 cache:
   directories:

From c935f7636696d85cbc530890574ca899f306590f Mon Sep 17 00:00:00 2001
From: Agostino Marzotta <ago1986@gmail.com>
Date: Thu, 29 Dec 2016 16:16:18 +0100
Subject: [PATCH 139/529] docs: add express-oracle-session to the list of
 session stores

closes #405
---
 README.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/README.md b/README.md
index 261600f7..70f8f2be 100644
--- a/README.md
+++ b/README.md
@@ -589,6 +589,12 @@ and other multi-core embedded devices).
 [express-mysql-session-url]: https://www.npmjs.com/package/express-mysql-session
 [express-mysql-session-image]: https://img.shields.io/github/stars/chill117/express-mysql-session.svg?label=%E2%98%85
 
+[![★][express-oracle-session-image] express-oracle-session][express-oracle-session-url] A session store using native
+[oracle](https://www.oracle.com/) via the [node-oracledb](https://www.npmjs.com/package/oracledb) module.
+
+[express-oracle-session-url]: https://www.npmjs.com/package/express-oracle-session
+[express-oracle-session-image]: https://img.shields.io/github/stars/slumber86/express-oracle-session.svg?label=%E2%98%85
+
 [![★][express-sessions-image] express-sessions][express-sessions-url]: A session store supporting both MongoDB and Redis.
 [express-sessions-url]: https://www.npmjs.com/package/express-sessions
 [express-sessions-image]: https://img.shields.io/github/stars/konteck/express-sessions.svg?label=%E2%98%85

From aa6336f4a71dcde9a65eac6d718402081ae3460f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 31 Dec 2016 23:34:09 -0500
Subject: [PATCH 140/529] deps: crc@3.4.4

---
 HISTORY.md   | 2 +-
 package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 183026fa..7ce29147 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -2,7 +2,7 @@ unreleased
 ==========
 
   * Fix resaving already-saved reloaded session at end of request
-  * deps: crc@3.4.3
+  * deps: crc@3.4.4
     - perf: use `Buffer.from` when available
   * deps: debug@2.3.3
     - Fix error when running under React Native
diff --git a/package.json b/package.json
index b71e0d63..eac99644 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,7 @@
   "dependencies": {
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
-    "crc": "3.4.3",
+    "crc": "3.4.4",
     "debug": "2.3.3",
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",

From 61290c79fe076cfbb5b7f209b19df84d7867c782 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 31 Dec 2016 23:40:12 -0500
Subject: [PATCH 141/529] deps: debug@2.6.0

---
 HISTORY.md   | 5 ++++-
 package.json | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 7ce29147..3d4a6129 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -4,7 +4,10 @@ unreleased
   * Fix resaving already-saved reloaded session at end of request
   * deps: crc@3.4.4
     - perf: use `Buffer.from` when available
-  * deps: debug@2.3.3
+  * deps: debug@2.6.0
+    - Allow colors in workers
+    - Deprecated `DEBUG_FD` environment variable
+    - Use same color for same namespace
     - Fix error when running under React Native
     - deps: ms@0.7.2
   * perf: remove unreachable branch in set-cookie method
diff --git a/package.json b/package.json
index eac99644..276327f6 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "crc": "3.4.4",
-    "debug": "2.3.3",
+    "debug": "2.6.0",
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.1",

From 7073cafb36161257b57533cfca7a932fe0669137 Mon Sep 17 00:00:00 2001
From: Gustavo Henke <guhenke@gmail.com>
Date: Fri, 16 Dec 2016 09:20:24 -0200
Subject: [PATCH 142/529] Fix detecting modified session when session contains
 "cookie" property

fixes #398
closes #400
---
 HISTORY.md      |  1 +
 index.js        |  9 ++++++---
 test/session.js | 30 ++++++++++++++++++++++++++++++
 3 files changed, 37 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 3d4a6129..fe154656 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix detecting modified session when session contains "cookie" property
   * Fix resaving already-saved reloaded session at end of request
   * deps: crc@3.4.4
     - perf: use `Buffer.from` when available
diff --git a/index.js b/index.js
index 01752a12..68ccf533 100644
--- a/index.js
+++ b/index.js
@@ -578,10 +578,13 @@ function getcookie(req, name, secrets) {
 
 function hash(sess) {
   return crc(JSON.stringify(sess, function (key, val) {
-    if (key !== 'cookie') {
-      return val;
+    // ignore sess.cookie property
+    if (this === sess && key === 'cookie') {
+      return
     }
-  }));
+
+    return val
+  }))
 }
 
 /**
diff --git a/test/session.js b/test/session.js
index 9cfb6ef9..c00a07bf 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1044,6 +1044,36 @@ describe('session()', function(){
       });
     });
 
+    it('should detect a "cookie" property as modified', function (done) {
+      var count = 0
+      var app = express()
+      app.use(session({ resave: false, secret: 'keyboard cat', cookie: { maxAge: min }}))
+      app.use(function (req, res, next) {
+        var save = req.session.save
+        res.setHeader('x-count', count)
+        req.session.user = req.session.user || {}
+        req.session.user.name = 'bob'
+        req.session.user.cookie = count
+        req.session.save = function (fn) {
+          res.setHeader('x-count', ++count)
+          return save.call(this, fn)
+        }
+        res.end()
+      })
+
+      request(app)
+      .get('/')
+      .expect('x-count', '1')
+      .expect(200, function (err, res) {
+        if (err) return done(err)
+        request(app)
+        .get('/')
+        .set('Cookie', cookie(res))
+        .expect('x-count', '2')
+        .expect(200, done)
+      })
+    })
+
     it('should pass session touch error', function (done) {
       var cb = after(2, done)
       var store = new session.MemoryStore()

From 17aa1de223862d10a8dec38aaa73dece5d47dbe8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 21 Jan 2017 22:25:12 -0500
Subject: [PATCH 143/529] build: Node.js@7.4

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index ecf24c60..d6aabe0b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "4.7"
   - "5.12"
   - "6.9"
-  - "7.3"
+  - "7.4"
 sudo: false
 cache:
   directories:

From 1896dd12e025076bd7ec929ab15f8e79b00fec5c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 22 Jan 2017 00:11:44 -0500
Subject: [PATCH 144/529] tests: fix tests checking store set not to rely on
 header update

---
 test/session.js | 294 ++++++++++++++++++------------------------------
 1 file changed, 108 insertions(+), 186 deletions(-)

diff --git a/test/session.js b/test/session.js
index c00a07bf..fc9120f8 100644
--- a/test/session.js
+++ b/test/session.js
@@ -865,66 +865,37 @@ describe('session()', function(){
     });
 
     it('should not force cookie on uninitialized session if saveUninitialized option is set to false', function(done){
-      var count = 0;
-      var app = express();
-      app.use(session({ rolling: true, saveUninitialized: false, secret: 'keyboard cat', cookie: { maxAge: min }}));
-      app.use(function(req, res, next){
-        var save = req.session.save;
-        res.setHeader('x-count', count);
-        req.session.save = function(fn){
-          res.setHeader('x-count', ++count);
-          return save.call(this, fn);
-        };
-        res.end();
-      });
+      var store = new session.MemoryStore()
+      var server = createServer({ store: store, rolling: true, saveUninitialized: false })
 
-      request(app)
+      request(server)
       .get('/')
-      .expect('x-count', '0')
+      .expect(shouldNotSetSessionInStore(store))
       .expect(shouldNotHaveHeader('Set-Cookie'))
       .expect(200, done)
     });
 
     it('should force cookie and save uninitialized session if saveUninitialized option is set to true', function(done){
-      var count = 0;
-      var app = express();
-      app.use(session({ rolling: true, saveUninitialized: true, secret: 'keyboard cat', cookie: { maxAge: min }}));
-      app.use(function(req, res, next){
-        var save = req.session.save;
-        res.setHeader('x-count', count);
-        req.session.save = function(fn){
-          res.setHeader('x-count', ++count);
-          return save.call(this, fn);
-        };
-        res.end();
-      });
+      var store = new session.MemoryStore()
+      var server = createServer({ store: store, rolling: true, saveUninitialized: true })
 
-      request(app)
+      request(server)
       .get('/')
-      .expect('x-count', '1')
+      .expect(shouldSetSessionInStore(store))
       .expect(shouldSetCookie('connect.sid'))
       .expect(200, done)
     });
 
     it('should force cookie and save modified session even if saveUninitialized option is set to false', function(done){
-      var count = 0;
-      var app = express();
-      app.use(session({ rolling: true, saveUninitialized: false, secret: 'keyboard cat', cookie: { maxAge: min }}));
-      app.use(function(req, res, next){
-        var save = req.session.save;
-        res.setHeader('x-count', count);
-        req.session.count = count;
-        req.session.user = 'bob';
-        req.session.save = function(fn){
-          res.setHeader('x-count', ++count);
-          return save.call(this, fn);
-        };
-        res.end();
-      });
+      var store = new session.MemoryStore()
+      var server = createServer({ store: store, rolling: true, saveUninitialized: false }, function (req, res) {
+        req.session.user = 'bob'
+        res.end()
+      })
 
-      request(app)
+      request(server)
       .get('/')
-      .expect('x-count', '1')
+      .expect(shouldSetSessionInStore(store))
       .expect(shouldSetCookie('connect.sid'))
       .expect(200, done);
     });
@@ -932,144 +903,105 @@ describe('session()', function(){
 
   describe('resave option', function(){
     it('should default to true', function(done){
-      var count = 0;
-      var app = express();
-      app.use(session({ secret: 'keyboard cat', cookie: { maxAge: min }}));
-      app.use(function(req, res, next){
-        var save = req.session.save;
-        res.setHeader('x-count', count);
-        req.session.user = 'bob';
-        req.session.save = function(fn){
-          res.setHeader('x-count', ++count);
-          return save.call(this, fn);
-        };
-        res.end();
-      });
+      var store = new session.MemoryStore()
+      var server = createServer({ store: store }, function (req, res) {
+        req.session.user = 'bob'
+        res.end()
+      })
 
-      request(app)
+      request(server)
       .get('/')
-      .expect('x-count', '1')
+      .expect(shouldSetSessionInStore(store))
       .expect(200, function(err, res){
         if (err) return done(err);
-        request(app)
+        request(server)
         .get('/')
         .set('Cookie', cookie(res))
-        .expect('x-count', '2')
+        .expect(shouldSetSessionInStore(store))
         .expect(200, done);
       });
     });
 
     it('should force save on unmodified session', function(done){
-      var count = 0;
-      var app = express();
-      app.use(session({ resave: true, secret: 'keyboard cat', cookie: { maxAge: min }}));
-      app.use(function(req, res, next){
-        var save = req.session.save;
-        res.setHeader('x-count', count);
-        req.session.user = 'bob';
-        req.session.save = function(fn){
-          res.setHeader('x-count', ++count);
-          return save.call(this, fn);
-        };
-        res.end();
-      });
+      var store = new session.MemoryStore()
+      var server = createServer({ store: store, resave: true }, function (req, res) {
+        req.session.user = 'bob'
+        res.end()
+      })
 
-      request(app)
+      request(server)
       .get('/')
-      .expect('x-count', '1')
+      .expect(shouldSetSessionInStore(store))
       .expect(200, function(err, res){
         if (err) return done(err);
-        request(app)
+        request(server)
         .get('/')
         .set('Cookie', cookie(res))
-        .expect('x-count', '2')
+        .expect(shouldSetSessionInStore(store))
         .expect(200, done);
       });
     });
 
     it('should prevent save on unmodified session', function(done){
-      var count = 0;
-      var app = express();
-      app.use(session({ resave: false, secret: 'keyboard cat', cookie: { maxAge: min }}));
-      app.use(function(req, res, next){
-        var save = req.session.save;
-        res.setHeader('x-count', count);
-        req.session.user = 'bob';
-        req.session.save = function(fn){
-          res.setHeader('x-count', ++count);
-          return save.call(this, fn);
-        };
-        res.end();
-      });
+      var store = new session.MemoryStore()
+      var server = createServer({ store: store, resave: false }, function (req, res) {
+        req.session.user = 'bob'
+        res.end()
+      })
 
-      request(app)
+      request(server)
       .get('/')
-      .expect('x-count', '1')
+      .expect(shouldSetSessionInStore(store))
       .expect(200, function(err, res){
         if (err) return done(err);
-        request(app)
+        request(server)
         .get('/')
         .set('Cookie', cookie(res))
-        .expect('x-count', '1')
+        .expect(shouldNotSetSessionInStore(store))
         .expect(200, done);
       });
     });
 
     it('should still save modified session', function(done){
-      var count = 0;
-      var app = express();
-      app.use(session({ resave: false, secret: 'keyboard cat', cookie: { maxAge: min }}));
-      app.use(function(req, res, next){
-        var save = req.session.save;
-        res.setHeader('x-count', count);
-        req.session.count = count;
-        req.session.user = 'bob';
-        req.session.save = function(fn){
-          res.setHeader('x-count', ++count);
-          return save.call(this, fn);
-        };
-        res.end();
-      });
+      var store = new session.MemoryStore()
+      var server = createServer({ store: store, resave: false }, function (req, res) {
+        req.session.count = req.session.count || 0
+        req.session.count++
+        res.end()
+      })
 
-      request(app)
+      request(server)
       .get('/')
-      .expect('x-count', '1')
+      .expect(shouldSetSessionInStore(store))
       .expect(200, function(err, res){
         if (err) return done(err);
-        request(app)
+        request(server)
         .get('/')
         .set('Cookie', cookie(res))
-        .expect('x-count', '2')
+        .expect(shouldSetSessionInStore(store))
         .expect(200, done);
       });
     });
 
     it('should detect a "cookie" property as modified', function (done) {
-      var count = 0
-      var app = express()
-      app.use(session({ resave: false, secret: 'keyboard cat', cookie: { maxAge: min }}))
-      app.use(function (req, res, next) {
-        var save = req.session.save
-        res.setHeader('x-count', count)
+      var store = new session.MemoryStore()
+      var server = createServer({ store: store, resave: false }, function (req, res) {
         req.session.user = req.session.user || {}
         req.session.user.name = 'bob'
-        req.session.user.cookie = count
-        req.session.save = function (fn) {
-          res.setHeader('x-count', ++count)
-          return save.call(this, fn)
-        }
+        req.session.user.cookie = req.session.user.cookie || 0
+        req.session.user.cookie++
         res.end()
       })
 
-      request(app)
+      request(server)
       .get('/')
-      .expect('x-count', '1')
+      .expect(shouldSetSessionInStore(store))
       .expect(200, function (err, res) {
         if (err) return done(err)
-        request(app)
+        request(server)
         .get('/')
         .set('Cookie', cookie(res))
-        .expect('x-count', '2')
+        .expect(shouldSetSessionInStore(store))
         .expect(200, done)
       })
     })
@@ -1106,87 +1038,49 @@ describe('session()', function(){
 
   describe('saveUninitialized option', function(){
     it('should default to true', function(done){
-      var count = 0;
-      var app = express();
-      app.use(session({ secret: 'keyboard cat', cookie: { maxAge: min }}));
-      app.use(function(req, res, next){
-        var save = req.session.save;
-        res.setHeader('x-count', count);
-        req.session.save = function(fn){
-          res.setHeader('x-count', ++count);
-          return save.call(this, fn);
-        };
-        res.end();
-      });
+      var store = new session.MemoryStore()
+      var server = createServer({ store: store })
 
-      request(app)
+      request(server)
       .get('/')
-      .expect('x-count', '1')
+      .expect(shouldSetSessionInStore(store))
       .expect(shouldSetCookie('connect.sid'))
       .expect(200, done);
     });
 
     it('should force save of uninitialized session', function(done){
-      var count = 0;
-      var app = express();
-      app.use(session({ saveUninitialized: true, secret: 'keyboard cat', cookie: { maxAge: min }}));
-      app.use(function(req, res, next){
-        var save = req.session.save;
-        res.setHeader('x-count', count);
-        req.session.save = function(fn){
-          res.setHeader('x-count', ++count);
-          return save.call(this, fn);
-        };
-        res.end();
-      });
+      var store = new session.MemoryStore()
+      var server = createServer({ store: store, saveUninitialized: true })
 
-      request(app)
+      request(server)
       .get('/')
-      .expect('x-count', '1')
+      .expect(shouldSetSessionInStore(store))
       .expect(shouldSetCookie('connect.sid'))
       .expect(200, done);
     });
 
     it('should prevent save of uninitialized session', function(done){
-      var count = 0;
-      var app = express();
-      app.use(session({ saveUninitialized: false, secret: 'keyboard cat', cookie: { maxAge: min }}));
-      app.use(function(req, res, next){
-        var save = req.session.save;
-        res.setHeader('x-count', count);
-        req.session.save = function(fn){
-          res.setHeader('x-count', ++count);
-          return save.call(this, fn);
-        };
-        res.end();
-      });
+      var store = new session.MemoryStore()
+      var server = createServer({ store: store, saveUninitialized: false })
 
-      request(app)
+      request(server)
       .get('/')
-      .expect('x-count', '0')
+      .expect(shouldNotSetSessionInStore(store))
       .expect(shouldNotHaveHeader('Set-Cookie'))
       .expect(200, done)
     });
 
     it('should still save modified session', function(done){
-      var count = 0;
-      var app = express();
-      app.use(session({ saveUninitialized: false, secret: 'keyboard cat', cookie: { maxAge: min }}));
-      app.use(function(req, res, next){
-        var save = req.session.save;
-        res.setHeader('x-count', count);
-        req.session.count = count;
-        req.session.user = 'bob';
-        req.session.save = function(fn){
-          res.setHeader('x-count', ++count);
-          return save.call(this, fn);
-        };
-        res.end();
-      });
+      var store = new session.MemoryStore()
+      var server = createServer({ store: store, saveUninitialized: false }, function (req, res) {
+        req.session.count = req.session.count || 0
+        req.session.count++
+        res.end()
+      })
 
-      request(app)
+      request(server)
       .get('/')
-      .expect('x-count', '1')
+      .expect(shouldSetSessionInStore(store))
       .expect(shouldSetCookie('connect.sid'))
       .expect(200, done);
     });
@@ -2368,6 +2262,20 @@ function shouldNotHaveHeader(header) {
   }
 }
 
+function shouldNotSetSessionInStore(store) {
+  var _set = store.set
+  var count = 0
+
+  store.set = function set () {
+    count++
+    return _set.apply(this, arguments)
+  }
+
+  return function () {
+    assert.ok(count === 0, 'should not set session in store')
+  }
+}
+
 function shouldNotSetSecureCookie(name) {
   return function (res) {
     var header = cookie(res)
@@ -2403,6 +2311,20 @@ function shouldSetSecureCookie(name) {
   }
 }
 
+function shouldSetSessionInStore(store) {
+  var _set = store.set
+  var count = 0
+
+  store.set = function set () {
+    count++
+    return _set.apply(this, arguments)
+  }
+
+  return function () {
+    assert.ok(count === 1, 'should set session in store')
+  }
+}
+
 function sid(res) {
   var match = /^[^=]+=s%3A([^;\.]+)[\.;]/.exec(cookie(res))
   var val = match ? match[1] : undefined

From 75b29129840e9b342b954fc5a39cf8a80abdc39c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 22 Jan 2017 00:38:11 -0500
Subject: [PATCH 145/529] tests: change more tests to use createServer() helper

---
 test/session.js | 293 ++++++++++++++++++++----------------------------
 1 file changed, 119 insertions(+), 174 deletions(-)

diff --git a/test/session.js b/test/session.js
index fc9120f8..089066f9 100644
--- a/test/session.js
+++ b/test/session.js
@@ -168,16 +168,13 @@ describe('session()', function(){
   })
 
   it('should handle multiple res.end calls', function(done){
-    var app = express()
-      .use(session({ secret: 'keyboard cat', cookie: { maxAge: min }}))
-      .use(function(req, res){
-        res.setHeader('Content-Type', 'text/plain');
-        res.end('Hello, world!');
-        res.end();
-      });
-    app.set('env', 'test');
+    var server = createServer(null, function (req, res) {
+      res.setHeader('Content-Type', 'text/plain')
+      res.end('Hello, world!')
+      res.end()
+    })
 
-    request(app)
+    request(server)
     .get('/')
     .expect('Content-Type', 'text/plain')
     .expect(200, 'Hello, world!', done);
@@ -257,24 +254,22 @@ describe('session()', function(){
   })
 
   it('should update cookie expiration when slow write', function (done) {
-    var app = express();
-    app.use(session({ rolling: true, secret: 'keyboard cat', cookie: { maxAge: min }}));
-    app.use(function (req, res, next) {
-      req.session.user = 'bob';
-      res.write('hello, ');
+    var server = createServer({ rolling: true }, function (req, res) {
+      req.session.user = 'bob'
+      res.write('hello, ')
       setTimeout(function () {
-        res.end('world!');
-      }, 200);
-    });
+        res.end('world!')
+      }, 200)
+    })
 
-    request(app)
+    request(server)
     .get('/')
     .expect(shouldSetCookie('connect.sid'))
     .expect(200, function (err, res) {
       if (err) return done(err);
       var originalExpires = expires(res);
       setTimeout(function () {
-        request(app)
+        request(server)
         .get('/')
         .set('Cookie', cookie(res))
         .expect(shouldSetCookie('connect.sid'))
@@ -823,19 +818,17 @@ describe('session()', function(){
 
   describe('rolling option', function(){
     it('should default to false', function(done){
-      var app = express();
-      app.use(session({ secret: 'keyboard cat', cookie: { maxAge: min }}));
-      app.use(function(req, res, next){
-        req.session.user = 'bob';
-        res.end();
-      });
+      var server = createServer(null, function (req, res) {
+        req.session.user = 'bob'
+        res.end()
+      })
 
-      request(app)
+      request(server)
       .get('/')
       .expect(shouldSetCookie('connect.sid'))
       .expect(200, function(err, res){
         if (err) return done(err);
-        request(app)
+        request(server)
         .get('/')
         .set('Cookie', cookie(res))
         .expect(shouldNotHaveHeader('Set-Cookie'))
@@ -844,19 +837,17 @@ describe('session()', function(){
     });
 
     it('should force cookie on unmodified session', function(done){
-      var app = express();
-      app.use(session({ rolling: true, secret: 'keyboard cat', cookie: { maxAge: min }}));
-      app.use(function(req, res, next){
-        req.session.user = 'bob';
-        res.end();
-      });
+      var server = createServer({ rolling: true }, function (req, res) {
+        req.session.user = 'bob'
+        res.end()
+      })
 
-      request(app)
+      request(server)
       .get('/')
       .expect(shouldSetCookie('connect.sid'))
       .expect(200, function(err, res){
         if (err) return done(err);
-        request(app)
+        request(server)
         .get('/')
         .set('Cookie', cookie(res))
         .expect(shouldSetCookie('connect.sid'))
@@ -1199,23 +1190,21 @@ describe('session()', function(){
 
     it('should default to keep', function(done){
       var store = new session.MemoryStore();
-      var app = express()
-        .use(session({ store: store, secret: 'keyboard cat' }))
-        .use(function(req, res, next){
-          req.session.count = req.session.count || 0;
-          req.session.count++;
-          if (req.session.count === 2) req.session = null;
-          res.end();
-        });
+      var server = createServer({ store: store }, function (req, res) {
+        req.session.count = req.session.count || 0
+        req.session.count++
+        if (req.session.count === 2) req.session = null
+        res.end()
+      })
 
-      request(app)
+      request(server)
       .get('/')
       .expect(200, function(err, res){
         if (err) return done(err);
         store.length(function(err, len){
           if (err) return done(err);
           assert.equal(len, 1)
-          request(app)
+          request(server)
           .get('/')
           .set('Cookie', cookie(res))
           .expect(200, function(err, res){
@@ -1232,23 +1221,21 @@ describe('session()', function(){
 
     it('should allow destroy on req.session = null', function(done){
       var store = new session.MemoryStore();
-      var app = express()
-        .use(session({ store: store, unset: 'destroy', secret: 'keyboard cat' }))
-        .use(function(req, res, next){
-          req.session.count = req.session.count || 0;
-          req.session.count++;
-          if (req.session.count === 2) req.session = null;
-          res.end();
-        });
+      var server = createServer({ store: store, unset: 'destroy' }, function (req, res) {
+        req.session.count = req.session.count || 0
+        req.session.count++
+        if (req.session.count === 2) req.session = null
+        res.end()
+      })
 
-      request(app)
+      request(server)
       .get('/')
       .expect(200, function(err, res){
         if (err) return done(err);
         store.length(function(err, len){
           if (err) return done(err);
           assert.equal(len, 1)
-          request(app)
+          request(server)
           .get('/')
           .set('Cookie', cookie(res))
           .expect(200, function(err, res){
@@ -1265,14 +1252,12 @@ describe('session()', function(){
 
     it('should not set cookie if initial session destroyed', function(done){
       var store = new session.MemoryStore();
-      var app = express()
-        .use(session({ store: store, unset: 'destroy', secret: 'keyboard cat' }))
-        .use(function(req, res, next){
-          req.session = null;
-          res.end();
-        });
+      var server = createServer({ store: store, unset: 'destroy' }, function (req, res) {
+        req.session = null
+        res.end()
+      })
 
-      request(app)
+      request(server)
       .get('/')
       .expect(shouldNotHaveHeader('Set-Cookie'))
       .expect(200, function(err, res){
@@ -1369,22 +1354,19 @@ describe('session()', function(){
 
     it('should only set-cookie when modified', function(done){
       var modify = true;
+      var server = createServer(null, function (req, res) {
+        if (modify) {
+          req.session.count = req.session.count || 0
+          req.session.count++
+        }
+        res.end(req.session.count.toString())
+      })
 
-      var app = express()
-        .use(session({ secret: 'keyboard cat', cookie: { maxAge: min }}))
-        .use(function(req, res, next){
-          if (modify) {
-            req.session.count = req.session.count || 0;
-            req.session.count++;
-          }
-          res.end(req.session.count.toString());
-        });
-
-      request(app)
+      request(server)
       .get('/')
       .expect(200, '1', function (err, res) {
         if (err) return done(err)
-        request(app)
+        request(server)
         .get('/')
         .set('Cookie', cookie(res))
         .expect(200, '2', function (err, res) {
@@ -1392,7 +1374,7 @@ describe('session()', function(){
           var val = cookie(res);
           modify = false;
 
-          request(app)
+          request(server)
           .get('/')
           .set('Cookie', val)
           .expect(shouldNotHaveHeader('Set-Cookie'))
@@ -1400,7 +1382,7 @@ describe('session()', function(){
             if (err) return done(err)
             modify = true;
 
-            request(app)
+            request(server)
             .get('/')
             .set('Cookie', val)
             .expect(shouldSetCookie('connect.sid'))
@@ -1411,19 +1393,17 @@ describe('session()', function(){
     })
 
     it('should not have enumerable methods', function (done) {
-      var app = express()
-        .use(session({ secret: 'keyboard cat', cookie: { maxAge: min }}))
-        .use(function(req, res, next) {
-          req.session.foo = 'foo';
-          req.session.bar = 'bar';
-          var keys = [];
-          for (var key in req.session) {
-            keys.push(key);
-          }
-          res.end(keys.sort().join(','));
-        });
+      var server = createServer(null, function (req, res) {
+        req.session.foo = 'foo'
+        req.session.bar = 'bar'
+        var keys = []
+        for (var key in req.session) {
+          keys.push(key)
+        }
+        res.end(keys.sort().join(','))
+      })
 
-      request(app)
+      request(server)
       .get('/')
       .expect(200, 'bar,cookie,foo', done);
     });
@@ -1714,15 +1694,13 @@ describe('session()', function(){
     describe('.cookie', function(){
       describe('.*', function(){
         it('should serialize as parameters', function(done){
-          var app = express()
-            .use(session({ secret: 'keyboard cat', proxy: true, cookie: { maxAge: min }}))
-            .use(function(req, res, next){
-              req.session.cookie.httpOnly = false;
-              req.session.cookie.secure = true;
-              res.end();
-            });
+          var server = createServer({ proxy: true }, function (req, res) {
+            req.session.cookie.httpOnly = false
+            req.session.cookie.secure = true
+            res.end()
+          })
 
-          request(app)
+          request(server)
           .get('/')
           .set('X-Forwarded-Proto', 'https')
           .expect(200, function(err, res){
@@ -1735,13 +1713,7 @@ describe('session()', function(){
         })
 
         it('should default to a browser-session length cookie', function(done){
-          var app = express()
-            .use(session({ secret: 'keyboard cat', cookie: { path: '/admin' }}))
-            .use(function(req, res, next){
-              res.end();
-            });
-
-          request(app)
+          request(createServer({ cookie: { path: '/admin' } }))
           .get('/admin')
           .expect(200, function(err, res){
             if (err) return done(err);
@@ -1752,18 +1724,14 @@ describe('session()', function(){
         })
 
         it('should Set-Cookie only once for browser-session cookies', function(done){
-          var app = express()
-            .use(session({ secret: 'keyboard cat', cookie: { path: '/admin' }}))
-            .use(function(req, res, next){
-              res.end();
-            });
+          var server = createServer({ cookie: { path: '/admin' } })
 
-          request(app)
+          request(server)
           .get('/admin/foo')
           .expect(shouldSetCookie('connect.sid'))
           .expect(200, function (err, res) {
             if (err) return done(err)
-            request(app)
+            request(server)
             .get('/admin')
             .set('Cookie', cookie(res))
             .expect(shouldNotHaveHeader('Set-Cookie'))
@@ -1772,14 +1740,12 @@ describe('session()', function(){
         })
 
         it('should override defaults', function(done){
-          var app = express()
-            .use(session({ secret: 'keyboard cat', cookie: { path: '/admin', httpOnly: false, secure: true, maxAge: 5000 }}))
-            .use(function(req, res, next){
-              req.session.cookie.secure = false;
-              res.end();
-            });
+          var server = createServer({ cookie: { path: '/admin', httpOnly: false, secure: true, maxAge: 5000 } }, function (req, res) {
+            req.session.cookie.secure = false
+            res.end()
+          })
 
-          request(app)
+          request(server)
           .get('/admin')
           .expect(200, function(err, res){
             if (err) return done(err);
@@ -1793,15 +1759,13 @@ describe('session()', function(){
         })
 
         it('should preserve cookies set before writeHead is called', function(done){
-          var app = express()
-            .use(session({ secret: 'keyboard cat' }))
-            .use(function(req, res, next){
-              var cookie = new Cookie();
-              res.setHeader('Set-Cookie', cookie.serialize('previous', 'cookieValue'));
-              res.end();
-            });
+          var server = createServer(null, function (req, res) {
+            var cookie = new Cookie()
+            res.setHeader('Set-Cookie', cookie.serialize('previous', 'cookieValue'))
+            res.end()
+          })
 
-          request(app)
+          request(server)
           .get('/')
           .expect(shouldSetCookieToValue('previous', 'cookieValue'))
           .expect(200, done)
@@ -1850,35 +1814,24 @@ describe('session()', function(){
 
       describe('when the pathname does not match cookie.path', function(){
         it('should not set-cookie', function(done){
-          var app = express()
-            .use(session({ secret: 'keyboard cat', cookie: { path: '/foo/bar' }}))
-            .use(function(req, res, next){
-              if (!req.session) {
-                return res.end();
-              }
-              req.session.foo = Math.random();
-              res.end();
-            });
+          var server = createServer({ cookie: { path: '/foo/bar' } }, function (req, res) {
+            if (req.session) req.session.foo = Math.random()
+            res.end()
+          })
 
-          request(app)
+          request(server)
           .get('/')
           .expect(shouldNotHaveHeader('Set-Cookie'))
           .expect(200, done)
         })
 
         it('should not set-cookie even for FQDN', function(done){
-          var app = express()
-            .use(session({ secret: 'keyboard cat', cookie: { path: '/foo/bar' }}))
-            .use(function(req, res, next){
-              if (!req.session) {
-                return res.end();
-              }
-
-              req.session.foo = Math.random();
-              res.end();
-            });
+          var server = createServer({ cookie: { path: '/foo/bar' } }, function (req, res) {
+            if (req.session) req.session.foo = Math.random()
+            res.end()
+          })
 
-          request(app)
+          request(server)
           .get('/')
           .set('host', 'http://foo/bar')
           .expect(shouldNotHaveHeader('Set-Cookie'))
@@ -1888,28 +1841,24 @@ describe('session()', function(){
 
       describe('when the pathname does match cookie.path', function(){
         it('should set-cookie', function(done){
-          var app = express()
-            .use(session({ secret: 'keyboard cat', cookie: { path: '/foo/bar' }}))
-            .use(function(req, res, next){
-              req.session.foo = Math.random();
-              res.end();
-            });
+          var server = createServer({ cookie: { path: '/foo/bar' } }, function (req, res) {
+            req.session.foo = Math.random()
+            res.end()
+          })
 
-          request(app)
+          request(server)
           .get('/foo/bar/baz')
           .expect(shouldSetCookie('connect.sid'))
           .expect(200, done)
         })
 
         it('should set-cookie even for FQDN', function(done){
-          var app = express()
-            .use(session({ secret: 'keyboard cat', cookie: { path: '/foo/bar' }}))
-            .use(function(req, res, next){
-              req.session.foo = Math.random();
-              res.end();
-            });
+          var server = createServer({ cookie: { path: '/foo/bar' } }, function (req, res) {
+            req.session.foo = Math.random()
+            res.end()
+          })
 
-          request(app)
+          request(server)
           .get('/foo/bar/baz')
           .set('host', 'http://example.com')
           .expect(shouldSetCookie('connect.sid'))
@@ -1983,14 +1932,12 @@ describe('session()', function(){
       describe('.expires', function(){
         describe('when given a Date', function(){
           it('should set absolute', function(done){
-            var app = express()
-              .use(session({ secret: 'keyboard cat' }))
-              .use(function(req, res, next){
-                req.session.cookie.expires = new Date(0);
-                res.end();
-              });
+            var server = createServer(null, function (req, res) {
+              req.session.cookie.expires = new Date(0)
+              res.end()
+            })
 
-            request(app)
+            request(server)
             .get('/')
             .end(function(err, res){
               if (err) return done(err)
@@ -2002,14 +1949,12 @@ describe('session()', function(){
 
         describe('when null', function(){
           it('should be a browser-session cookie', function(done){
-            var app = express()
-              .use(session({ secret: 'keyboard cat' }))
-              .use(function(req, res, next){
-                req.session.cookie.expires = null;
-                res.end();
-              });
+            var server = createServer(null, function (req, res) {
+              req.session.cookie.expires = null
+              res.end()
+            })
 
-            request(app)
+            request(server)
             .get('/')
             .expect(200, function(err, res){
               if (err) return done(err);

From 1c9a60606bd755d8194776f846ac1abae3467fd9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 22 Jan 2017 01:06:35 -0500
Subject: [PATCH 146/529] tests: use createSession() helper for less verbosity

---
 test/session.js | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/test/session.js b/test/session.js
index 089066f9..188d43d1 100644
--- a/test/session.js
+++ b/test/session.js
@@ -25,7 +25,7 @@ describe('session()', function(){
   it('should do nothing if req.session exists', function(done){
     var app = express()
       .use(function(req, res, next){ req.session = {}; next(); })
-      .use(session({ secret: 'keyboard cat', cookie: { maxAge: min }}))
+      .use(createSession())
       .use(end);
 
       request(app)
@@ -43,7 +43,7 @@ describe('session()', function(){
   it('should get secret from req.secret', function(done){
     var app = express()
       .use(function(req, res, next){ req.secret = 'keyboard cat'; next(); })
-      .use(session({ cookie: { maxAge: min }}))
+      .use(createSession())
       .use(end);
     app.set('env', 'test');
 
@@ -658,7 +658,7 @@ describe('session()', function(){
 
       it('should ignore req.secure from express', function(done){
         var app = express()
-          .use(session({ secret: 'keyboard cat', proxy: false, cookie: { secure: true, maxAge: min }}))
+          .use(createSession({ proxy: false, cookie: { secure: true } }))
           .use(function(req, res) { res.json(req.secure); });
         app.enable('trust proxy');
 
@@ -686,7 +686,7 @@ describe('session()', function(){
 
       it('should use req.secure from express', function(done){
         var app = express()
-          .use(session({ secret: 'keyboard cat', cookie: { secure: true, maxAge: min }}))
+          .use(createSession({ cookie: { secure: true } }))
           .use(function(req, res) { res.json(req.secure); });
         app.enable('trust proxy');
 
@@ -735,7 +735,7 @@ describe('session()', function(){
         before(function () {
           this.app = express()
             .use(function(req, res, next) { Object.defineProperty(req, 'secure', { value: JSON.parse(req.headers['x-secure']) }); next(); })
-            .use(session({ secret: 'keyboard cat', cookie: { maxAge: min, secure: 'auto' }}))
+            .use(createSession({ cookie: { secure: 'auto' } }))
             .use(function(req, res) { res.json(req.secure); });
         })
 
@@ -1447,7 +1447,7 @@ describe('session()', function(){
     describe('.destroy()', function(){
       it('should destroy the previous session', function(done){
         var app = express()
-          .use(session({ secret: 'keyboard cat' }))
+          .use(createSession())
           .use(function(req, res, next){
             req.session.destroy(function(err){
               if (err) return next(err)
@@ -1466,7 +1466,7 @@ describe('session()', function(){
     describe('.regenerate()', function(){
       it('should destroy/replace the previous session', function(done){
         var app = express()
-          .use(session({ secret: 'keyboard cat', cookie: { maxAge: min }}))
+          .use(createSession())
           .use(function(req, res, next){
             var id = req.session.id;
             req.session.regenerate(function(err){
@@ -1869,7 +1869,7 @@ describe('session()', function(){
       describe('.maxAge', function(){
         var val;
         var app = express()
-          .use(session({ secret: 'keyboard cat', cookie: { maxAge: 2000 }}))
+          .use(createSession({ cookie: { maxAge: 2000 } }))
           .use(function(req, res, next){
             req.session.count = req.session.count || 0;
             req.session.count++;
@@ -2058,7 +2058,7 @@ describe('session()', function(){
       var app = express()
         .use(cookieParser())
         .use(function(req, res, next){ req.headers.cookie = 'foo=bar'; next() })
-        .use(session({ secret: 'keyboard cat' }))
+        .use(createSession())
         .use(function(req, res, next){
           req.session.count = req.session.count || 0
           req.session.count++
@@ -2080,7 +2080,7 @@ describe('session()', function(){
       var app = express()
         .use(cookieParser())
         .use(function(req, res, next){ req.headers.cookie = 'foo=bar'; next() })
-        .use(session({ secret: 'keyboard cat', key: 'sessid' }))
+        .use(createSession({ key: 'sessid' }))
         .use(function(req, res, next){
           req.session.count = req.session.count || 0
           req.session.count++
@@ -2102,7 +2102,7 @@ describe('session()', function(){
       var app = express()
         .use(cookieParser())
         .use(function(req, res, next){ req.headers.cookie = 'foo=bar'; next() })
-        .use(session({ secret: 'keyboard cat', key: 'sessid' }))
+        .use(createSession({ key: 'sessid' }))
         .use(function(req, res, next){
           req.session.count = req.session.count || 0
           req.session.count++
@@ -2125,7 +2125,7 @@ describe('session()', function(){
       var app = express()
         .use(cookieParser('keyboard cat'))
         .use(function(req, res, next){ delete req.headers.cookie; next() })
-        .use(session())
+        .use(createSession())
         .use(function(req, res, next){
           req.session.count = req.session.count || 0
           req.session.count++

From 4f261d0d5f78887954773c226a920517df02e6bc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 22 Jan 2017 17:14:07 -0500
Subject: [PATCH 147/529] tests: change more tests to use should set in store
 helpers

---
 test/session.js | 34 ++++++----------------------------
 1 file changed, 6 insertions(+), 28 deletions(-)

diff --git a/test/session.js b/test/session.js
index 188d43d1..610a427b 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1586,7 +1586,6 @@ describe('session()', function(){
       })
 
       it('should prevent end-of-request save', function (done) {
-        var count = 0
         var store = new session.MemoryStore()
         var server = createServer({ store: store }, function (req, res) {
           req.session.hit = true
@@ -1596,31 +1595,20 @@ describe('session()', function(){
           })
         })
 
-        var _set = store.set
-        store.set = function set(sid, sess, callback) {
-          count++
-          _set.call(store, sid, sess, callback)
-        }
-
         request(server)
         .get('/')
+        .expect(shouldSetSessionInStore(store))
         .expect(200, 'saved', function (err, res) {
           if (err) return done(err)
-          assert.equal(count, 1)
-          count = 0
           request(server)
           .get('/')
           .set('Cookie', cookie(res))
-          .expect(200, 'saved', function (err) {
-            if (err) return done(err)
-            assert.equal(count, 1)
-            done()
-          })
+          .expect(shouldSetSessionInStore(store))
+          .expect(200, 'saved', done)
         })
       })
 
       it('should prevent end-of-request save on reloaded session', function (done) {
-        var count = 0
         var store = new session.MemoryStore()
         var server = createServer({ store: store }, function (req, res) {
           req.session.hit = true
@@ -1632,26 +1620,16 @@ describe('session()', function(){
           })
         })
 
-        var _set = store.set
-        store.set = function set(sid, sess, callback) {
-          count++
-          _set.call(store, sid, sess, callback)
-        }
-
         request(server)
         .get('/')
+        .expect(shouldSetSessionInStore(store))
         .expect(200, 'saved', function (err, res) {
           if (err) return done(err)
-          assert.equal(count, 1)
-          count = 0
           request(server)
           .get('/')
           .set('Cookie', cookie(res))
-          .expect(200, 'saved', function (err) {
-            if (err) return done(err)
-            assert.equal(count, 1)
-            done()
-          })
+          .expect(shouldSetSessionInStore(store))
+          .expect(200, 'saved', done)
         })
       })
     })

From fe324f2c2dead9d6d68a3ffeac96cef6a109bd5e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 22 Jan 2017 17:54:16 -0500
Subject: [PATCH 148/529] tests: add simple set-cookie parser for accuracy

---
 test/session.js | 51 +++++++++++++++++++++++++++++++++++--------------
 1 file changed, 37 insertions(+), 14 deletions(-)

diff --git a/test/session.js b/test/session.js
index 610a427b..49eeb5d5 100644
--- a/test/session.js
+++ b/test/session.js
@@ -2174,9 +2174,28 @@ function end(req, res) {
   res.end()
 }
 
-function expires(res) {
-  var match = /Expires=([^;]+)/.exec(cookie(res));
-  return match ? match[1] : undefined;
+function expires (res) {
+  var header = cookie(res)
+  return header && parseSetCookie(header).expires
+}
+
+function parseSetCookie (header) {
+  var match
+  var pairs = []
+  var pattern = /\s*([^=;]+)(?:=([^;]*);?|;|$)/g
+
+  while ((match = pattern.exec(header))) {
+    pairs.push({ name: match[1], value: match[2] })
+  }
+
+  var cookie = pairs.shift()
+
+  for (var i = 0; i < pairs.length; i++) {
+    match = pairs[i]
+    cookie[match.name.toLowerCase()] = (match.value || true)
+  }
+
+  return cookie
 }
 
 function shouldNotHaveHeader(header) {
@@ -2202,35 +2221,39 @@ function shouldNotSetSessionInStore(store) {
 function shouldNotSetSecureCookie(name) {
   return function (res) {
     var header = cookie(res)
+    var data = header && parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
-    assert.equal(header.split('=')[0], name, 'should set cookie ' + name)
-    assert.ok(header.toLowerCase().split(/; */).every(function (k) { return k !== 'secure'; }), 'should not set secure cookie')
+    assert.equal(data.name, name, 'should set cookie ' + name)
+    assert.ok(!data.secure, 'should not set secure cookie')
   }
 }
 
-function shouldSetCookie(name) {
+function shouldSetCookie (name) {
   return function (res) {
     var header = cookie(res)
+    var data = header && parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
-    assert.equal(header.split('=')[0], name, 'should set cookie ' + name)
+    assert.equal(data.name, name, 'should set cookie ' + name)
   }
 }
 
-function shouldSetCookieToValue(name, val) {
+function shouldSetCookieToValue (name, val) {
   return function (res) {
-    var header = cookie(res);
+    var header = cookie(res)
+    var data = header && parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
-    assert.equal(header.split('=')[0], name, 'should set cookie ' + name)
-    assert.equal(header.split('=')[1].split(';')[0], val, 'should set cookie ' + name + ' to ' + val)
+    assert.equal(data.name, name, 'should set cookie ' + name)
+    assert.equal(data.value, val, 'should set cookie ' + name + ' to ' + val)
   }
 }
 
-function shouldSetSecureCookie(name) {
+function shouldSetSecureCookie (name) {
   return function (res) {
     var header = cookie(res)
+    var data = header && parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
-    assert.equal(header.split('=')[0], name, 'should set cookie ' + name)
-    assert.ok(header.toLowerCase().split(/; */).some(function (k) { return k === 'secure'; }), 'should set secure cookie')
+    assert.equal(data.name, name, 'should set cookie ' + name)
+    assert.ok(data.secure, 'should set secure cookie')
   }
 }
 

From 42007efe9559b2f6f80f1ed587a2284b2df1dba1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 22 Jan 2017 18:49:19 -0500
Subject: [PATCH 149/529] tests: add helpers to validate set-cookie attributes

---
 test/session.js | 108 ++++++++++++++++++++----------------------------
 1 file changed, 44 insertions(+), 64 deletions(-)

diff --git a/test/session.js b/test/session.js
index 49eeb5d5..87e48334 100644
--- a/test/session.js
+++ b/test/session.js
@@ -710,8 +710,7 @@ describe('session()', function(){
           request(this.server)
           .get('/')
           .set('X-Forwarded-Proto', 'https')
-          .expect(shouldSetCookie('connect.sid'))
-          .expect(shouldSetSecureCookie('connect.sid'))
+          .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
           .expect(200, done)
         })
       })
@@ -725,8 +724,7 @@ describe('session()', function(){
           request(this.server)
           .get('/')
           .set('X-Forwarded-Proto', 'https')
-          .expect(shouldSetCookie('connect.sid'))
-          .expect(shouldNotSetSecureCookie('connect.sid'))
+          .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
           .expect(200, done)
         })
       })
@@ -743,8 +741,7 @@ describe('session()', function(){
           request(this.app)
           .get('/')
           .set('X-Secure', 'true')
-          .expect(shouldSetCookie('connect.sid'))
-          .expect(shouldSetSecureCookie('connect.sid'))
+          .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
           .expect(200, 'true', done)
         })
 
@@ -752,8 +749,7 @@ describe('session()', function(){
           request(this.app)
           .get('/')
           .set('X-Secure', 'false')
-          .expect(shouldSetCookie('connect.sid'))
-          .expect(shouldNotSetSecureCookie('connect.sid'))
+          .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
           .expect(200, 'false', done)
         })
       })
@@ -1681,24 +1677,16 @@ describe('session()', function(){
           request(server)
           .get('/')
           .set('X-Forwarded-Proto', 'https')
-          .expect(200, function(err, res){
-            if (err) return done(err);
-            var val = cookie(res);
-            assert.equal(val.indexOf('HttpOnly'), -1, 'should not be HttpOnly cookie')
-            assert.notEqual(val.indexOf('Secure'), -1, 'should be Secure cookie')
-            done();
-          });
+          .expect(shouldSetCookieWithoutAttribute('connect.sid', 'HttpOnly'))
+          .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
+          .expect(200, done)
         })
 
         it('should default to a browser-session length cookie', function(done){
           request(createServer({ cookie: { path: '/admin' } }))
           .get('/admin')
-          .expect(200, function(err, res){
-            if (err) return done(err);
-            var val = cookie(res);
-            assert.equal(val.indexOf('Expires'), -1, 'should be not have cookie Expires')
-            done();
-          });
+          .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Expires'))
+          .expect(200, done)
         })
 
         it('should Set-Cookie only once for browser-session cookies', function(done){
@@ -1725,15 +1713,11 @@ describe('session()', function(){
 
           request(server)
           .get('/admin')
-          .expect(200, function(err, res){
-            if (err) return done(err);
-            var val = cookie(res);
-            assert.equal(val.indexOf('HttpOnly'), -1, 'should not be HttpOnly cookie')
-            assert.equal(val.indexOf('Secure'), -1, 'should not be Secure cookie')
-            assert.notEqual(val.indexOf('Path=/admin'), -1, 'should have cookie path /admin')
-            assert.notEqual(val.indexOf('Expires'), -1, 'should have cookie Expires')
-            done();
-          });
+          .expect(shouldSetCookieWithAttribute('connect.sid', 'Expires'))
+          .expect(shouldSetCookieWithoutAttribute('connect.sid', 'HttpOnly'))
+          .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', '/admin'))
+          .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+          .expect(200, done)
         })
 
         it('should preserve cookies set before writeHead is called', function(done){
@@ -1917,11 +1901,8 @@ describe('session()', function(){
 
             request(server)
             .get('/')
-            .end(function(err, res){
-              if (err) return done(err)
-              assert.equal(expires(res), 'Thu, 01 Jan 1970 00:00:00 GMT')
-              done();
-            });
+            .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'Expires', 'Thu, 01 Jan 1970 00:00:00 GMT'))
+            .expect(200, done)
           })
         })
 
@@ -1934,12 +1915,8 @@ describe('session()', function(){
 
             request(server)
             .get('/')
-            .expect(200, function(err, res){
-              if (err) return done(err);
-              var val = cookie(res);
-              assert.equal(val.indexOf('Expires'), -1, 'should be not have cookie Expires')
-              done();
-            });
+            .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Expires'))
+            .expect(200, done)
           })
 
           it('should not reset cookie', function (done) {
@@ -1950,18 +1927,14 @@ describe('session()', function(){
 
             request(server)
             .get('/')
+            .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Expires'))
             .expect(200, function (err, res) {
               if (err) return done(err);
-              var val = cookie(res);
-              assert.equal(val.indexOf('Expires'), -1, 'should be not have cookie Expires')
               request(server)
               .get('/')
-              .set('Cookie', val)
-              .expect(200, function (err, res) {
-                if (err) return done(err);
-                assert.ok(!cookie(res));
-                done();
-              });
+              .set('Cookie', cookie(res))
+              .expect(shouldNotHaveHeader('Set-Cookie'))
+              .expect(200, done)
             });
           })
 
@@ -1974,18 +1947,14 @@ describe('session()', function(){
 
             request(server)
             .get('/')
+            .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Expires'))
             .expect(200, function (err, res) {
               if (err) return done(err);
-              var val = cookie(res);
-              assert.equal(val.indexOf('Expires'), -1, 'should be not have cookie Expires')
               request(server)
               .get('/')
-              .set('Cookie', val)
-              .expect(200, function (err, res) {
-                if (err) return done(err);
-                assert.ok(!cookie(res));
-                done();
-              });
+              .set('Cookie', cookie(res))
+              .expect(shouldNotHaveHeader('Set-Cookie'))
+              .expect(200, done)
             });
           })
         })
@@ -2218,42 +2187,53 @@ function shouldNotSetSessionInStore(store) {
   }
 }
 
-function shouldNotSetSecureCookie(name) {
+function shouldSetCookie (name) {
   return function (res) {
     var header = cookie(res)
     var data = header && parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
     assert.equal(data.name, name, 'should set cookie ' + name)
-    assert.ok(!data.secure, 'should not set secure cookie')
   }
 }
 
-function shouldSetCookie (name) {
+function shouldSetCookieToValue (name, val) {
   return function (res) {
     var header = cookie(res)
     var data = header && parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
     assert.equal(data.name, name, 'should set cookie ' + name)
+    assert.equal(data.value, val, 'should set cookie ' + name + ' to ' + val)
   }
 }
 
-function shouldSetCookieToValue (name, val) {
+function shouldSetCookieWithAttribute (name, attrib) {
   return function (res) {
     var header = cookie(res)
     var data = header && parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
     assert.equal(data.name, name, 'should set cookie ' + name)
-    assert.equal(data.value, val, 'should set cookie ' + name + ' to ' + val)
+    assert.ok((attrib.toLowerCase() in data), 'should set cookie with attribute ' + attrib)
+  }
+}
+
+function shouldSetCookieWithAttributeAndValue (name, attrib, value) {
+  return function (res) {
+    var header = cookie(res)
+    var data = header && parseSetCookie(header)
+    assert.ok(header, 'should have a cookie header')
+    assert.equal(data.name, name, 'should set cookie ' + name)
+    assert.ok((attrib.toLowerCase() in data), 'should set cookie with attribute ' + attrib)
+    assert.equal(data[attrib.toLowerCase()], value, 'should set cookie with attribute ' + attrib + ' set to ' + value)
   }
 }
 
-function shouldSetSecureCookie (name) {
+function shouldSetCookieWithoutAttribute (name, attrib) {
   return function (res) {
     var header = cookie(res)
     var data = header && parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
     assert.equal(data.name, name, 'should set cookie ' + name)
-    assert.ok(data.secure, 'should set secure cookie')
+    assert.ok(!(attrib.toLowerCase() in data), 'should set cookie without attribute ' + attrib)
   }
 }
 

From 28d5332c9d799b063046c2ea8054fc5eb799c974 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 22 Jan 2017 21:18:34 -0500
Subject: [PATCH 150/529] tests: improve accuracy of maxAge cookie tests

---
 test/session.js | 112 +++++++++++++++++++++++++-----------------------
 1 file changed, 58 insertions(+), 54 deletions(-)

diff --git a/test/session.js b/test/session.js
index 87e48334..e0c97d60 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1828,67 +1828,59 @@ describe('session()', function(){
         })
       })
 
-      describe('.maxAge', function(){
-        var val;
-        var app = express()
-          .use(createSession({ cookie: { maxAge: 2000 } }))
-          .use(function(req, res, next){
-            req.session.count = req.session.count || 0;
-            req.session.count++;
-            if (req.session.count == 2) req.session.cookie.maxAge = 5000;
-            if (req.session.count == 3) req.session.cookie.maxAge = 3000000000;
-            res.end(req.session.count.toString());
-          });
+      describe('.maxAge', function () {
+        before(function (done) {
+          var ctx = this
+
+          ctx.cookie = ''
+          ctx.server = createServer({ cookie: { maxAge: 2000 } }, function (req, res) {
+            switch (++req.session.count) {
+              case 1:
+                break
+              case 2:
+                req.session.cookie.maxAge = 5000
+                break
+              case 3:
+                req.session.cookie.maxAge = 3000000000
+                break
+              default:
+                req.session.count = 0
+                break
+            }
+            res.end(req.session.count.toString())
+          })
 
-        it('should set relative in milliseconds', function(done){
-          request(app)
+          request(ctx.server)
           .get('/')
-          .expect(200, '1', function (err, res) {
-            if (err) return done(err)
-            var a = new Date(expires(res))
-            var b = new Date
-            var delta = a.valueOf() - b.valueOf()
-
-            val = cookie(res);
-
-            assert.ok(delta > 1000 && delta <= 2000)
-            done();
-          });
-        });
+          .end(function (err, res) {
+            ctx.cookie = res && cookie(res)
+            done(err)
+          })
+        })
 
-        it('should modify cookie when changed', function(done){
-          request(app)
+        it('should set cookie expires relative to maxAge', function (done) {
+          request(this.server)
           .get('/')
-          .set('Cookie', val)
-          .expect(200, '2', function (err, res) {
-            if (err) return done(err)
-            var a = new Date(expires(res))
-            var b = new Date
-            var delta = a.valueOf() - b.valueOf()
-
-            val = cookie(res);
-
-            assert.ok(delta > 4000 && delta <= 5000)
-            done();
-          });
-        });
+          .set('Cookie', this.cookie)
+          .expect(shouldSetCookieToExpireIn('connect.sid', 2000))
+          .expect(200, '1', done)
+        })
 
-        it('should modify cookie when changed to large value', function(done){
-          request(app)
+        it('should modify cookie expires when changed', function (done) {
+          request(this.server)
           .get('/')
-          .set('Cookie', val)
-          .expect(200, '3', function (err, res) {
-            if (err) return done(err)
-            var a = new Date(expires(res))
-            var b = new Date
-            var delta = a.valueOf() - b.valueOf()
-
-            val = cookie(res);
+          .set('Cookie', this.cookie)
+          .expect(shouldSetCookieToExpireIn('connect.sid', 5000))
+          .expect(200, '2', done)
+        })
 
-            assert.ok(delta > 2999999000 && delta <= 3000000000)
-            done();
-          });
-        });
+        it('should modify cookie expires when changed to large value', function (done) {
+          request(this.server)
+          .get('/')
+          .set('Cookie', this.cookie)
+          .expect(shouldSetCookieToExpireIn('connect.sid', 3000000000))
+          .expect(200, '3', done)
+        })
       })
 
       describe('.expires', function(){
@@ -2196,6 +2188,18 @@ function shouldSetCookie (name) {
   }
 }
 
+function shouldSetCookieToExpireIn (name, delta) {
+  return function (res) {
+    var header = cookie(res)
+    var data = header && parseSetCookie(header)
+    assert.ok(header, 'should have a cookie header')
+    assert.equal(data.name, name, 'should set cookie ' + name)
+    assert.ok(('expires' in data), 'should set cookie with attribute Expires')
+    assert.ok(('date' in res.headers), 'should have a date header')
+    assert.equal((Date.parse(data.expires) - Date.parse(res.headers.date)), delta, 'should set cookie ' + name + ' to expire in ' + delta + ' ms')
+  }
+}
+
 function shouldSetCookieToValue (name, val) {
   return function (res) {
     var header = cookie(res)

From dc8481c152b162c119d1faa8e9edf505dc22cbb3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 22 Jan 2017 21:21:14 -0500
Subject: [PATCH 151/529] 1.15.0

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index fe154656..68807acb 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.15.0 / 2017-01-22
+===================
 
   * Fix detecting modified session when session contains "cookie" property
   * Fix resaving already-saved reloaded session at end of request
diff --git a/package.json b/package.json
index 276327f6..badf81cb 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.14.2",
+  "version": "1.15.0",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From eba25212170401cb259ebe3d713c2e377fedefcd Mon Sep 17 00:00:00 2001
From: Bram Borggreve <borggreve@gmail.com>
Date: Fri, 10 Feb 2017 15:50:26 -0500
Subject: [PATCH 152/529] deps: debug@2.6.1

closes #426
closes #427
---
 HISTORY.md   | 7 +++++++
 package.json | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 68807acb..0c8229fd 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,10 @@
+unreleased
+==========
+
+  * deps: debug@2.6.1
+    - Fix deprecation messages in WebStorm and other editors
+    - Undeprecate `DEBUG_FD` set to `1` or `2`
+
 1.15.0 / 2017-01-22
 ===================
 
diff --git a/package.json b/package.json
index badf81cb..bab5a2e3 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "crc": "3.4.4",
-    "debug": "2.6.0",
+    "debug": "2.6.1",
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.1",

From f8550538f6e821037b33fc0d59748ddd54781164 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 10 Feb 2017 20:58:00 -0500
Subject: [PATCH 153/529] build: Node.js@7.5

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index d6aabe0b..d0b78b78 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "4.7"
   - "5.12"
   - "6.9"
-  - "7.4"
+  - "7.5"
 sudo: false
 cache:
   directories:

From 8e56128d8ba014ab586521247977b0d4e67340f9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 10 Feb 2017 21:01:08 -0500
Subject: [PATCH 154/529] 1.15.1

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 0c8229fd..023a8213 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.15.1 / 2017-02-10
+===================
 
   * deps: debug@2.6.1
     - Fix deprecation messages in WebStorm and other editors
diff --git a/package.json b/package.json
index bab5a2e3..3f4d17ad 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.15.0",
+  "version": "1.15.1",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 599595495a4907f02ee98d601e91c9cf20057e72 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 28 Feb 2017 22:28:47 -0500
Subject: [PATCH 155/529] build: express@4.14.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 3f4d17ad..bd98956a 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.3",
-    "express": "4.14.0",
+    "express": "4.14.1",
     "istanbul": "0.4.5",
     "mocha": "2.5.3",
     "supertest": "1.1.0"

From c4b2fb95584aeec1527b649b14e8bab64a7ca5f3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 28 Feb 2017 22:29:30 -0500
Subject: [PATCH 156/529] build: Node.js@4.8

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index d0b78b78..d1f33819 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -6,7 +6,7 @@ node_js:
   - "1.8"
   - "2.5"
   - "3.3"
-  - "4.7"
+  - "4.8"
   - "5.12"
   - "6.9"
   - "7.5"

From edfe52ddf7891a8da9cd654f85b4d6cded9f50e2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 28 Feb 2017 22:29:38 -0500
Subject: [PATCH 157/529] build: Node.js@6.10

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index d1f33819..5ce3c81d 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "3.3"
   - "4.8"
   - "5.12"
-  - "6.9"
+  - "6.10"
   - "7.5"
 sudo: false
 cache:

From 14b5480a4d19649846c903cc6b6b41f7217db29f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 28 Feb 2017 22:30:30 -0500
Subject: [PATCH 158/529] build: Node.js@7.7

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 5ce3c81d..83b36bb4 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "4.8"
   - "5.12"
   - "6.10"
-  - "7.5"
+  - "7.7"
 sudo: false
 cache:
   directories:

From 27f6489b78467e281716440d125822ce4373a940 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 28 Feb 2017 22:34:51 -0500
Subject: [PATCH 159/529] docs: update install code block style

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 70f8f2be..10d2f49d 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@ This is a [Node.js](https://nodejs.org/en/) module available through the
 [npm registry](https://www.npmjs.com/). Installation is done using the
 [`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
 
-```bash
+```sh
 $ npm install express-session
 ```
 

From 304678b8f8e0d8061a05fb5e2c3d38d765c49c95 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 28 Feb 2017 22:36:45 -0500
Subject: [PATCH 160/529] build: test on Node.js 8.x nightly

---
 .travis.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 83b36bb4..e62ed128 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,6 +10,13 @@ node_js:
   - "5.12"
   - "6.10"
   - "7.7"
+matrix:
+  include:
+    - node_js: "8.0"
+      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
+  allow_failures:
+    # Allow the nightly installs to fail
+    - env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
 sudo: false
 cache:
   directories:

From fff51d6ff087d53250b7c6752253dc4ca30664c9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 Mar 2017 23:00:48 -0500
Subject: [PATCH 161/529] deps: uid-safe@~2.1.4

---
 HISTORY.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 023a8213..ea881415 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: uid-safe@~2.1.4
+    - Remove `base64-url` dependency
+
 1.15.1 / 2017-02-10
 ===================
 
diff --git a/package.json b/package.json
index bd98956a..c23e31f1 100644
--- a/package.json
+++ b/package.json
@@ -17,7 +17,7 @@
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.1",
-    "uid-safe": "~2.1.3",
+    "uid-safe": "~2.1.4",
     "utils-merge": "1.0.0"
   },
   "devDependencies": {

From 2604a6cbac9a77b4e06959e8aebe65b50ccb9491 Mon Sep 17 00:00:00 2001
From: Adrian <adrian_tanasa@yahoo.com>
Date: Wed, 8 Mar 2017 09:26:44 +0000
Subject: [PATCH 162/529] docs: add connect-cloudant-store to the list of
 session stores

closes #436
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 10d2f49d..206ed11a 100644
--- a/README.md
+++ b/README.md
@@ -506,6 +506,11 @@ and other multi-core embedded devices).
 [connect-azuretables-url]: https://www.npmjs.com/package/connect-azuretables
 [connect-azuretables-image]: https://img.shields.io/github/stars/mike-goodwin/connect-azuretables.svg?label=%E2%98%85
 
+[![★][connect-cloudant-store-image] connect-cloudant-store][connect-cloudant-store-url] An [IBM Cloudant](https://cloudant.com/)-based session store.
+
+[connect-cloudant-store-url]: https://www.npmjs.com/package/connect-cloudant-store
+[connect-cloudant-store-image]: https://img.shields.io/github/stars/adriantanasa/connect-cloudant-store.svg?label=%E2%98%85
+
 [![★][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store.
 
 [connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase

From 9a014fd9b07ab56f57e1f9759e4e247a65cd21dc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 9 Mar 2017 23:31:14 -0500
Subject: [PATCH 163/529] build: express@4.15.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index c23e31f1..91fe07b7 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.3",
-    "express": "4.14.1",
+    "express": "4.15.2",
     "istanbul": "0.4.5",
     "mocha": "2.5.3",
     "supertest": "1.1.0"

From 66e518be96df608eaf73c97d29735688efa61270 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 10 Mar 2017 20:58:03 -0500
Subject: [PATCH 164/529] tests: fix req.secret test

---
 test/session.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/session.js b/test/session.js
index e0c97d60..94812b91 100644
--- a/test/session.js
+++ b/test/session.js
@@ -43,7 +43,7 @@ describe('session()', function(){
   it('should get secret from req.secret', function(done){
     var app = express()
       .use(function(req, res, next){ req.secret = 'keyboard cat'; next(); })
-      .use(createSession())
+      .use(createSession({ secret: undefined }))
       .use(end);
     app.set('env', 'test');
 

From 4a4c2efa194009e1cdfa9bafb2412e5ab315234f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 10 Mar 2017 21:28:53 -0500
Subject: [PATCH 165/529] tests: remove express from more tests

---
 test/session.js | 199 +++++++++++++++++++++++++-----------------------
 1 file changed, 105 insertions(+), 94 deletions(-)

diff --git a/test/session.js b/test/session.js
index 94812b91..6711df98 100644
--- a/test/session.js
+++ b/test/session.js
@@ -23,15 +23,14 @@ describe('session()', function(){
   })
 
   it('should do nothing if req.session exists', function(done){
-    var app = express()
-      .use(function(req, res, next){ req.session = {}; next(); })
-      .use(createSession())
-      .use(end);
+    function setup (req) {
+      req.session = {}
+    }
 
-      request(app)
-      .get('/')
-      .expect(shouldNotHaveHeader('Set-Cookie'))
-      .expect(200, done)
+    request(createServer(setup))
+    .get('/')
+    .expect(shouldNotHaveHeader('Set-Cookie'))
+    .expect(200, done)
   })
 
   it('should error without secret', function(done){
@@ -41,13 +40,11 @@ describe('session()', function(){
   })
 
   it('should get secret from req.secret', function(done){
-    var app = express()
-      .use(function(req, res, next){ req.secret = 'keyboard cat'; next(); })
-      .use(createSession({ secret: undefined }))
-      .use(end);
-    app.set('env', 'test');
+    function setup (req) {
+      req.secret = 'keyboard cat'
+    }
 
-    request(app)
+    request(createServer(setup, { secret: undefined }))
     .get('/')
     .expect(200, '', done)
   })
@@ -643,56 +640,66 @@ describe('session()', function(){
     })
 
     describe('when disabled', function(){
-      var server
       before(function () {
-        server = createServer({ proxy: false, cookie: { secure: true, maxAge: 5 }})
+          function setup (req) {
+            req.secure = req.headers['x-secure']
+              ? JSON.parse(req.headers['x-secure'])
+              : undefined
+          }
+
+          function respond (req, res) {
+            res.end(String(req.secure))
+          }
+
+          this.server = createServer(setup, { proxy: false, cookie: { secure: true }}, respond)
       })
 
       it('should not trust X-Forwarded-Proto', function(done){
-        request(server)
+        request(this.server)
         .get('/')
         .set('X-Forwarded-Proto', 'https')
         .expect(shouldNotHaveHeader('Set-Cookie'))
         .expect(200, done)
       })
 
-      it('should ignore req.secure from express', function(done){
-        var app = express()
-          .use(createSession({ proxy: false, cookie: { secure: true } }))
-          .use(function(req, res) { res.json(req.secure); });
-        app.enable('trust proxy');
-
-        request(app)
+      it('should ignore req.secure', function (done) {
+        request(this.server)
         .get('/')
         .set('X-Forwarded-Proto', 'https')
+        .set('X-Secure', 'true')
         .expect(shouldNotHaveHeader('Set-Cookie'))
         .expect(200, 'true', done)
       })
     })
 
     describe('when unspecified', function(){
-      var server
       before(function () {
-        server = createServer({ cookie: { secure: true, maxAge: 5 }})
+          function setup (req) {
+            req.secure = req.headers['x-secure']
+              ? JSON.parse(req.headers['x-secure'])
+              : undefined
+          }
+
+          function respond (req, res) {
+            res.end(String(req.secure))
+          }
+
+          this.server = createServer(setup, { cookie: { secure: true }}, respond)
       })
 
       it('should not trust X-Forwarded-Proto', function(done){
-        request(server)
+        request(this.server)
         .get('/')
         .set('X-Forwarded-Proto', 'https')
         .expect(shouldNotHaveHeader('Set-Cookie'))
         .expect(200, done)
       })
 
-      it('should use req.secure from express', function(done){
-        var app = express()
-          .use(createSession({ cookie: { secure: true } }))
-          .use(function(req, res) { res.json(req.secure); });
-        app.enable('trust proxy');
-
-        request(app)
+      it('should use req.secure', function (done) {
+        request(this.server)
         .get('/')
         .set('X-Forwarded-Proto', 'https')
+        .set('X-Secure', 'true')
         .expect(shouldSetCookie('connect.sid'))
         .expect(200, 'true', done)
       })
@@ -731,14 +738,19 @@ describe('session()', function(){
 
       describe('when "proxy" is undefined', function() {
         before(function () {
-          this.app = express()
-            .use(function(req, res, next) { Object.defineProperty(req, 'secure', { value: JSON.parse(req.headers['x-secure']) }); next(); })
-            .use(createSession({ cookie: { secure: 'auto' } }))
-            .use(function(req, res) { res.json(req.secure); });
+          function setup (req) {
+            req.secure = JSON.parse(req.headers['x-secure'])
+          }
+
+          function respond (req, res) {
+            res.end(String(req.secure))
+          }
+
+          this.server = createServer(setup, { cookie: { secure: 'auto' } }, respond)
         })
 
         it('should set secure if req.secure = true', function (done) {
-          request(this.app)
+          request(this.server)
           .get('/')
           .set('X-Secure', 'true')
           .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
@@ -746,7 +758,7 @@ describe('session()', function(){
         })
 
         it('should not set secure if req.secure = false', function (done) {
-          request(this.app)
+          request(this.server)
           .get('/')
           .set('X-Secure', 'false')
           .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
@@ -1292,33 +1304,30 @@ describe('session()', function(){
 
   describe('res.end patch', function () {
     it('should correctly handle res.end/res.write patched prior', function (done) {
-      var app = express()
+      function setup (req, res) {
+        writePatch(res)
+      }
 
-      app.use(writePatch())
-      app.use(createSession())
-      app.use(function (req, res) {
+      function respond (req, res) {
         req.session.hit = true
         res.write('hello, ')
         res.end('world')
-      })
+      }
 
-      request(app)
+      request(createServer(setup, null, respond))
       .get('/')
       .expect(200, 'hello, world', done)
     })
 
     it('should correctly handle res.end/res.write patched after', function (done) {
-      var app = express()
-
-      app.use(createSession())
-      app.use(writePatch())
-      app.use(function (req, res) {
+      function respond (req, res) {
+        writePatch(res)
         req.session.hit = true
         res.write('hello, ')
         res.end('world')
-      })
+      }
 
-      request(app)
+      request(createServer(null, respond))
       .get('/')
       .expect(200, 'hello, world', done)
     })
@@ -1442,47 +1451,41 @@ describe('session()', function(){
 
     describe('.destroy()', function(){
       it('should destroy the previous session', function(done){
-        var app = express()
-          .use(createSession())
-          .use(function(req, res, next){
-            req.session.destroy(function(err){
-              if (err) return next(err)
-              assert(!req.session, 'req.session after destroy');
-              res.end();
-            });
-          });
+        var server = createServer(null, function (req, res) {
+          req.session.destroy(function (err) {
+            if (err) res.statusCode = 500
+            res.end(String(req.session))
+          })
+        })
 
-        request(app)
+        request(server)
         .get('/')
         .expect(shouldNotHaveHeader('Set-Cookie'))
-        .expect(200, done)
+        .expect(200, 'undefined', done)
       })
     })
 
     describe('.regenerate()', function(){
       it('should destroy/replace the previous session', function(done){
-        var app = express()
-          .use(createSession())
-          .use(function(req, res, next){
-            var id = req.session.id;
-            req.session.regenerate(function(err){
-              if (err) return next(err)
-              assert.notEqual(id, req.session.id)
-              res.end();
-            });
-          });
+        var server = createServer(null, function (req, res) {
+          var id = req.session.id
+          req.session.regenerate(function (err) {
+            if (err) res.statusCode = 500
+            res.end(String(req.session.id === id))
+          })
+        })
 
-        request(app)
+        request(server)
         .get('/')
         .expect(shouldSetCookie('connect.sid'))
         .expect(200, function (err, res) {
           if (err) return done(err)
           var id = sid(res)
-          request(app)
+          request(server)
           .get('/')
           .set('Cookie', cookie(res))
           .expect(shouldSetCookie('connect.sid'))
-          .expect(200, function (err, res) {
+          .expect(200, 'false', function (err, res) {
             if (err) return done(err)
             assert.notEqual(sid(res), id)
             done();
@@ -2089,8 +2092,20 @@ function cookie(res) {
   return (setCookie && setCookie[0]) || undefined;
 }
 
-function createServer(opts, fn) {
-  return http.createServer(createRequestListener(opts, fn))
+function createServer (options, respond) {
+  var fn = respond
+  var opts = options
+  var server = http.createServer()
+
+  // setup, options, respond
+  if (typeof arguments[0] === 'function') {
+    opts = arguments[1]
+    fn = arguments[2]
+
+    server.on('request', arguments[0])
+  }
+
+  return server.on('request', createRequestListener(opts, fn))
 }
 
 function createRequestListener(opts, fn) {
@@ -2261,26 +2276,22 @@ function sid(res) {
   return val
 }
 
-function writePatch() {
+function writePatch (res) {
+  var _end = res.end
+  var _write = res.write
   var ended = false
-  return function addWritePatch(req, res, next) {
-    var _end = res.end
-    var _write = res.write
 
-    res.end = function end() {
-      ended = true
-      return _end.apply(this, arguments)
-    }
-
-    res.write = function write() {
-      if (ended) {
-        throw new Error('write after end')
-      }
+  res.end = function end() {
+    ended = true
+    return _end.apply(this, arguments)
+  }
 
-      return _write.apply(this, arguments)
+  res.write = function write() {
+    if (ended) {
+      throw new Error('write after end')
     }
 
-    next()
+    return _write.apply(this, arguments)
   }
 }
 

From 3a7e3d2734ef088c25550453652937a8c3cc37a5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 10 Mar 2017 21:33:53 -0500
Subject: [PATCH 166/529] deps: debug@2.6.2

---
 HISTORY.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index ea881415..7e89a695 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,8 @@
 unreleased
 ==========
 
+  * deps: debug@2.6.2
+    - Fix `DEBUG_MAX_ARRAY_LENGTH`
   * deps: uid-safe@~2.1.4
     - Remove `base64-url` dependency
 
diff --git a/package.json b/package.json
index 91fe07b7..77c6cb76 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "crc": "3.4.4",
-    "debug": "2.6.1",
+    "debug": "2.6.2",
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.1",

From 5fd74d2601aafe43c7697a1bd2dab0add6d71010 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Mar 2017 23:04:42 -0400
Subject: [PATCH 167/529] build: fix istanbul ignore scope

---
 index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/index.js b/index.js
index 68ccf533..8db4eca3 100644
--- a/index.js
+++ b/index.js
@@ -148,8 +148,8 @@ function session(options) {
 
   // notify user that this store is not
   // meant for a production environment
+  /* istanbul ignore next: not tested */
   if ('production' == env && store instanceof MemoryStore) {
-    /* istanbul ignore next: not tested */
     console.warn(warning);
   }
 

From b5a0437373862e2e0303cfca67e2736d2fcbf586 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Mar 2017 23:12:18 -0400
Subject: [PATCH 168/529] deps: debug@2.6.3

---
 HISTORY.md   | 2 +-
 package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 7e89a695..7a280573 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,7 +1,7 @@
 unreleased
 ==========
 
-  * deps: debug@2.6.2
+  * deps: debug@2.6.3
     - Fix `DEBUG_MAX_ARRAY_LENGTH`
   * deps: uid-safe@~2.1.4
     - Remove `base64-url` dependency
diff --git a/package.json b/package.json
index 77c6cb76..56fdf0c3 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "crc": "3.4.4",
-    "debug": "2.6.2",
+    "debug": "2.6.3",
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.1",

From 4b033b32c667dead3e1e25c871c72c66f9d7241b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 26 Mar 2017 19:35:40 -0400
Subject: [PATCH 169/529] docs: fix rendering of express-sessions store in list

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 206ed11a..a2b96bcd 100644
--- a/README.md
+++ b/README.md
@@ -601,6 +601,7 @@ and other multi-core embedded devices).
 [express-oracle-session-image]: https://img.shields.io/github/stars/slumber86/express-oracle-session.svg?label=%E2%98%85
 
 [![★][express-sessions-image] express-sessions][express-sessions-url]: A session store supporting both MongoDB and Redis.
+
 [express-sessions-url]: https://www.npmjs.com/package/express-sessions
 [express-sessions-image]: https://img.shields.io/github/stars/konteck/express-sessions.svg?label=%E2%98%85
 

From d051890724e0cf10d51cc310f3f07517c9b724a2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 26 Mar 2017 19:52:50 -0400
Subject: [PATCH 170/529] 1.15.2

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 7a280573..5fc286b3 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.15.2 / 2017-03-26
+===================
 
   * deps: debug@2.6.3
     - Fix `DEBUG_MAX_ARRAY_LENGTH`
diff --git a/package.json b/package.json
index 56fdf0c3..24de3879 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.15.1",
+  "version": "1.15.2",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 4aa57a0c24c8f5bb1a287722d0444374820d8f10 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 1 May 2017 22:34:25 -0400
Subject: [PATCH 171/529] deps: debug@2.6.6

---
 HISTORY.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 5fc286b3..6994c4ea 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: debug@2.6.6
+    - deps: ms@0.7.3
+
 1.15.2 / 2017-03-26
 ===================
 
diff --git a/package.json b/package.json
index 24de3879..74d15f5c 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "crc": "3.4.4",
-    "debug": "2.6.3",
+    "debug": "2.6.6",
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.1",

From 32c2b107291e1271f8ae3319ade479b567193453 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 1 May 2017 22:39:04 -0400
Subject: [PATCH 172/529] build: Node.js@7.9

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index e62ed128..0cd03d33 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "4.8"
   - "5.12"
   - "6.10"
-  - "7.7"
+  - "7.9"
 matrix:
   include:
     - node_js: "8.0"

From e01ca868bc3fc7861aab9556942cd89eb0fcb50f Mon Sep 17 00:00:00 2001
From: Jorrit Schippers <jorrit@ncode.nl>
Date: Mon, 1 May 2017 12:08:28 +0200
Subject: [PATCH 173/529] docs: add connect-memjs to the list of session stores

closes #455
---
 README.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/README.md b/README.md
index a2b96bcd..3530d7cd 100644
--- a/README.md
+++ b/README.md
@@ -576,6 +576,12 @@ and other multi-core embedded devices).
 [connect-memcached-url]: https://www.npmjs.com/package/connect-memcached
 [connect-memcached-image]: https://img.shields.io/github/stars/balor/connect-memcached.svg?label=%E2%98%85
 
+[![★][connect-memjs-image] connect-memjs][connect-memjs-url] A memcached-based session store using
+[memjs](https://www.npmjs.com/package/memjs) as the memcached client.
+
+[connect-memjs-url]: https://www.npmjs.com/package/connect-memjs
+[connect-memjs-image]: https://img.shields.io/github/stars/liamdon/connect-memjs.svg?label=%E2%98%85
+
 [![★][connect-session-knex-image] connect-session-knex][connect-session-knex-url] A session store using
 [Knex.js](http://knexjs.org/), which is a SQL query builder for PostgreSQL, MySQL, MariaDB, SQLite3, and Oracle.
 

From d0df7abdfbdb77c221bc173ae3a480afcc5247a8 Mon Sep 17 00:00:00 2001
From: Gajus Kuizinas <gajus@gajus.com>
Date: Mon, 1 May 2017 21:10:57 +0100
Subject: [PATCH 174/529] docs: add note that req.session.id is alias of
 req.sessionID

closes #456
closes #457
---
 README.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 3530d7cd..96106cdf 100644
--- a/README.md
+++ b/README.md
@@ -367,8 +367,10 @@ not necessary to call, as the session middleware does this for you.
 
 ### req.session.id
 
-Each session has a unique ID associated with it. This property will
-contain the session ID and cannot be modified.
+Each session has a unique ID associated with it. This property is an
+alias of [`req.sessionID`](#reqsessionid-1) and cannot be modified.
+It has been added to make the session ID accessible from the `session`
+object.
 
 ### req.session.cookie
 

From 762c041e26c27a9e3332325fd000345929782260 Mon Sep 17 00:00:00 2001
From: Theo Gravity <tgravity@viv.ai>
Date: Mon, 1 May 2017 21:40:35 -0700
Subject: [PATCH 175/529] docs: add express-session-cache-manager to the list
 of session stores

closes #454
closes #458
---
 README.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/README.md b/README.md
index 96106cdf..df8dc5b7 100644
--- a/README.md
+++ b/README.md
@@ -628,6 +628,13 @@ and other multi-core embedded devices).
 [express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session
 [express-nedb-session-image]: https://img.shields.io/github/stars/louischatriot/express-nedb-session.svg?label=%E2%98%85
 
+[![★][express-session-cache-manager-image] express-session-cache-manager][express-session-cache-manager-url] 
+A store that implements [cache-manager](https://www.npmjs.com/package/cache-manager), which supports
+a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-engines).
+
+[express-session-cache-manager-url]: https://www.npmjs.com/package/express-session-cache-manager
+[express-session-cache-manager-image]: https://img.shields.io/github/stars/theogravity/express-session-cache-manager.svg?label=%E2%98%85
+
 [![★][express-session-level-image] express-session-level][express-session-level-url] A [LevelDB](https://github.com/Level/levelup) based session store.
 
 [express-session-level-url]: https://www.npmjs.com/package/express-session-level

From 98b90053bcc21e7ce9a40cd5d3fc27412e2b1a01 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 May 2017 01:02:50 -0400
Subject: [PATCH 176/529] deps: debug@2.6.7

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 6994c4ea..493f0916 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,8 +1,8 @@
 unreleased
 ==========
 
-  * deps: debug@2.6.6
-    - deps: ms@0.7.3
+  * deps: debug@2.6.7
+    - deps: ms@2.0.0
 
 1.15.2 / 2017-03-26
 ===================
diff --git a/package.json b/package.json
index 74d15f5c..fe196bbc 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "crc": "3.4.4",
-    "debug": "2.6.6",
+    "debug": "2.6.7",
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.1",

From 4866502dba022c5134cc819d8d7ace1707a2695d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 May 2017 01:03:27 -0400
Subject: [PATCH 177/529] build: express@4.15.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index fe196bbc..bc2be3d5 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.3",
-    "express": "4.15.2",
+    "express": "4.15.3",
     "istanbul": "0.4.5",
     "mocha": "2.5.3",
     "supertest": "1.1.0"

From 0595f890bede6bca4040a2f412157c61fe81b1f8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 May 2017 01:03:55 -0400
Subject: [PATCH 178/529] build: Node.js@7.10

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 0cd03d33..43adb0db 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,7 +9,7 @@ node_js:
   - "4.8"
   - "5.12"
   - "6.10"
-  - "7.9"
+  - "7.10"
 matrix:
   include:
     - node_js: "8.0"

From ff4c5117d4c7f93f375610b76494e47cdd7d1aaa Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 18 May 2017 01:14:05 -0400
Subject: [PATCH 179/529] 1.15.3

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 493f0916..21ca5aca 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.15.3 / 2017-05-17
+===================
 
   * deps: debug@2.6.7
     - deps: ms@2.0.0
diff --git a/package.json b/package.json
index bc2be3d5..f8d1eae7 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.15.2",
+  "version": "1.15.3",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 3a7fbaa6b3a239e7afd73f76dababf53a0c148ac Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 5 Jun 2017 19:00:35 -0400
Subject: [PATCH 180/529] build: support Node.js 8.x

---
 .gitignore  |  1 +
 .travis.yml | 10 +++-------
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/.gitignore b/.gitignore
index df9af16b..84a48637 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 coverage
 node_modules
 npm-debug.log
+package-lock.json
diff --git a/.travis.yml b/.travis.yml
index 43adb0db..6844810b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,18 +10,14 @@ node_js:
   - "5.12"
   - "6.10"
   - "7.10"
-matrix:
-  include:
-    - node_js: "8.0"
-      env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
-  allow_failures:
-    # Allow the nightly installs to fail
-    - env: "NVM_NODEJS_ORG_MIRROR=https://nodejs.org/download/nightly"
+  - "8.0"
 sudo: false
 cache:
   directories:
     - node_modules
 before_install:
+  # Skip updating shrinkwrap / lock
+  - "npm config set shrinkwrap false"
   # Setup Node.js version-specific dependencies
   - "test $TRAVIS_NODE_VERSION != '0.8' || npm rm --save-dev istanbul"
   # Update Node.js modules

From 501b31f7a09c9d7f9b4953c4f5a9a3099c5b8937 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 5 Jun 2017 19:04:09 -0400
Subject: [PATCH 181/529] deps: debug@2.6.8

---
 HISTORY.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 21ca5aca..832925cb 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * deps: debug@2.6.8
+
 1.15.3 / 2017-05-17
 ===================
 
diff --git a/package.json b/package.json
index f8d1eae7..8f1c9022 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "crc": "3.4.4",
-    "debug": "2.6.7",
+    "debug": "2.6.8",
     "depd": "~1.1.0",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.1",

From 239e1b9b7a59bbb71d2a2a7e90f64d3ca2435145 Mon Sep 17 00:00:00 2001
From: Steven Vachon <contact@svachon.com>
Date: Tue, 18 Jul 2017 11:05:09 -0400
Subject: [PATCH 182/529] docs: mention redirects in for session.save() use

closes #484
---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index df8dc5b7..9a9be6e1 100644
--- a/README.md
+++ b/README.md
@@ -351,8 +351,8 @@ session data has been altered (though this behavior can be altered with various
 options in the middleware constructor). Because of this, typically this method
 does not need to be called.
 
-There are some cases where it is useful to call this method, for example, long-
-lived requests or in WebSockets.
+There are some cases where it is useful to call this method, for example,
+redirects, long-lived requests or in WebSockets.
 
 ```js
 req.session.save(function(err) {

From 5a227d658152f165689f6f3763759a0c9068e987 Mon Sep 17 00:00:00 2001
From: Rafael Pinto <raprp@posteo.de>
Date: Wed, 19 Jul 2017 00:10:58 +0100
Subject: [PATCH 183/529] docs: add dynamodb-store to the list of session
 stores

closes #485
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 9a9be6e1..351cd1ba 100644
--- a/README.md
+++ b/README.md
@@ -596,6 +596,11 @@ and other multi-core embedded devices).
 [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize
 [connect-session-sequelize-image]: https://img.shields.io/github/stars/mweibel/connect-session-sequelize.svg?label=%E2%98%85
 
+[![★][dynamodb-store-image] dynamodb-store][dynamodb-store-url] A DynamoDB-based session store.
+
+[dynamodb-store-url]: https://www.npmjs.com/package/dynamodb-store
+[dynamodb-store-image]: https://img.shields.io/github/stars/rafaelrpinto/dynamodb-store.svg?label=%E2%98%85
+
 [![★][express-mysql-session-image] express-mysql-session][express-mysql-session-url] A session store using native
 [MySQL](https://www.mysql.com/) via the [node-mysql](https://github.com/felixge/node-mysql) module.
 

From d367b335cc2146e673b6eff106929979b39fc757 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 18 Jul 2017 23:00:45 -0400
Subject: [PATCH 184/529] build: Node.js@6.11

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 6844810b..da95e861 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "3.3"
   - "4.8"
   - "5.12"
-  - "6.10"
+  - "6.11"
   - "7.10"
   - "8.0"
 sudo: false

From fc9d474e034f1f9545f0e7e1f180d50ea39389e5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 18 Jul 2017 23:00:53 -0400
Subject: [PATCH 185/529] build: Node.js@8.1

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index da95e861..ebf941a0 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ node_js:
   - "5.12"
   - "6.11"
   - "7.10"
-  - "8.0"
+  - "8.1"
 sudo: false
 cache:
   directories:

From 7b26d57bb766b416a81f4a70f3da22d4bbbfb0e1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 18 Jul 2017 23:47:37 -0400
Subject: [PATCH 186/529] 1.15.4

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 832925cb..c4daf96c 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.15.4 / 2017-07-18
+===================
 
   * deps: debug@2.6.8
 
diff --git a/package.json b/package.json
index 8f1c9022..21afdb65 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.15.3",
+  "version": "1.15.4",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 521e6bd965fb425e1ece42fd68fbff4b524c4636 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 Jul 2017 13:49:11 -0400
Subject: [PATCH 187/529] tests: add leak checking for variables and handles

---
 package.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index 21afdb65..dab9bc91 100644
--- a/package.json
+++ b/package.json
@@ -38,8 +38,8 @@
     "node": ">= 0.8.0"
   },
   "scripts": {
-    "test": "mocha --bail --reporter spec test/",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot test/",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec test/"
+    "test": "mocha --check-leaks --bail --no-exit --reporter spec test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --check-leaks --no-exit --reporter dot test/",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --check-leaks --no-exit --reporter spec test/"
   }
 }

From fc60bb63cec5f62810f61c16a81e682213cdfad3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 30 Jul 2017 22:34:12 -0400
Subject: [PATCH 188/529] build: Node.js@8.2

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index ebf941a0..47a26ad2 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ node_js:
   - "5.12"
   - "6.11"
   - "7.10"
-  - "8.1"
+  - "8.2"
 sudo: false
 cache:
   directories:

From 310d288819175424b57a5689a4a8bc4cfb387ae5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 30 Jul 2017 22:38:02 -0400
Subject: [PATCH 189/529] deps: depd@~1.1.1

---
 HISTORY.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index c4daf96c..b2bdf23a 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: depd@~1.1.1
+   - Remove unnecessary `Buffer` loading
+
 1.15.4 / 2017-07-18
 ===================
 
diff --git a/package.json b/package.json
index dab9bc91..ec4c2a25 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,7 @@
     "cookie-signature": "1.0.6",
     "crc": "3.4.4",
     "debug": "2.6.8",
-    "depd": "~1.1.0",
+    "depd": "~1.1.1",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.1",
     "uid-safe": "~2.1.4",

From 2b08370431bef47dd58b8567006c3d94b4ec2c45 Mon Sep 17 00:00:00 2001
From: ralvarezo123 <gurdopobando@gmail.com>
Date: Fri, 21 Jul 2017 18:43:48 -0600
Subject: [PATCH 190/529] docs: improve code readability

closes #488
---
 README.md | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/README.md b/README.md
index 351cd1ba..939b0c0e 100644
--- a/README.md
+++ b/README.md
@@ -292,15 +292,14 @@ app.use(session({ secret: 'keyboard cat', cookie: { maxAge: 60000 }}))
 
 // Access the session as req.session
 app.get('/', function(req, res, next) {
-  var sess = req.session
-  if (sess.views) {
-    sess.views++
+  if (req.session.views) {
+    req.session.views++
     res.setHeader('Content-Type', 'text/html')
-    res.write('<p>views: ' + sess.views + '</p>')
-    res.write('<p>expires in: ' + (sess.cookie.maxAge / 1000) + 's</p>')
+    res.write('<p>views: ' + req.session.views + '</p>')
+    res.write('<p>expires in: ' + (req.session.cookie.maxAge / 1000) + 's</p>')
     res.end()
   } else {
-    sess.views = 1
+    req.session.views = 1
     res.end('welcome to the session demo. refresh!')
   }
 })
@@ -714,17 +713,15 @@ app.use(session({
 }))
 
 app.use(function (req, res, next) {
-  var views = req.session.views
-
-  if (!views) {
-    views = req.session.views = {}
+  if (!req.session.views) {
+    req.session.views = {}
   }
 
   // get the url pathname
   var pathname = parseurl(req).pathname
 
   // count the views
-  views[pathname] = (views[pathname] || 0) + 1
+  req.session.views[pathname] = (req.session.views[pathname] || 0) + 1
 
   next()
 })

From 8518200db49aff3b2e3f079679459aa7d400976c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Aug 2017 21:11:11 -0400
Subject: [PATCH 191/529] tests: move the cookie path tests

---
 test/session.js | 89 +++++++++++++++++++------------------------------
 1 file changed, 35 insertions(+), 54 deletions(-)

diff --git a/test/session.js b/test/session.js
index 6711df98..8e0f986a 100644
--- a/test/session.js
+++ b/test/session.js
@@ -707,6 +707,41 @@ describe('session()', function(){
   })
 
   describe('cookie option', function () {
+    describe('when "path" set to "/foo/bar"', function () {
+      before(function () {
+        this.server = createServer({ cookie: { path: '/foo/bar' } })
+      })
+
+      it('should not set cookie for "/" request', function (done) {
+        request(this.server)
+        .get('/')
+        .expect(shouldNotHaveHeader('Set-Cookie'))
+        .expect(200, done)
+      })
+
+      it('should not set cookie for "http://foo/bar" request', function (done) {
+        request(this.server)
+        .get('/')
+        .set('host', 'http://foo/bar')
+        .expect(shouldNotHaveHeader('Set-Cookie'))
+        .expect(200, done)
+      })
+
+      it('should set cookie for "/foo/bar" request', function (done) {
+        request(this.server)
+        .get('/foo/bar/baz')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, done)
+      })
+
+      it('should set cookie for "/foo/bar/baz" request', function (done) {
+        request(this.server)
+        .get('/foo/bar/baz')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, done)
+      })
+    })
+
     describe('when "secure" set to "auto"', function () {
       describe('when "proxy" is "true"', function () {
         before(function () {
@@ -1777,60 +1812,6 @@ describe('session()', function(){
         })
       })
 
-      describe('when the pathname does not match cookie.path', function(){
-        it('should not set-cookie', function(done){
-          var server = createServer({ cookie: { path: '/foo/bar' } }, function (req, res) {
-            if (req.session) req.session.foo = Math.random()
-            res.end()
-          })
-
-          request(server)
-          .get('/')
-          .expect(shouldNotHaveHeader('Set-Cookie'))
-          .expect(200, done)
-        })
-
-        it('should not set-cookie even for FQDN', function(done){
-          var server = createServer({ cookie: { path: '/foo/bar' } }, function (req, res) {
-            if (req.session) req.session.foo = Math.random()
-            res.end()
-          })
-
-          request(server)
-          .get('/')
-          .set('host', 'http://foo/bar')
-          .expect(shouldNotHaveHeader('Set-Cookie'))
-          .expect(200, done)
-        })
-      })
-
-      describe('when the pathname does match cookie.path', function(){
-        it('should set-cookie', function(done){
-          var server = createServer({ cookie: { path: '/foo/bar' } }, function (req, res) {
-            req.session.foo = Math.random()
-            res.end()
-          })
-
-          request(server)
-          .get('/foo/bar/baz')
-          .expect(shouldSetCookie('connect.sid'))
-          .expect(200, done)
-        })
-
-        it('should set-cookie even for FQDN', function(done){
-          var server = createServer({ cookie: { path: '/foo/bar' } }, function (req, res) {
-            req.session.foo = Math.random()
-            res.end()
-          })
-
-          request(server)
-          .get('/foo/bar/baz')
-          .set('host', 'http://example.com')
-          .expect(shouldSetCookie('connect.sid'))
-          .expect(200, done)
-        })
-      })
-
       describe('.maxAge', function () {
         before(function (done) {
           var ctx = this

From 62c4d15c71bf92063d3bed9fc8684914d08ee1aa Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Aug 2017 21:48:45 -0400
Subject: [PATCH 192/529] tests: add test for mounted middleware

---
 test/session.js | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/test/session.js b/test/session.js
index 8e0f986a..4a7a2263 100644
--- a/test/session.js
+++ b/test/session.js
@@ -740,6 +740,26 @@ describe('session()', function(){
         .expect(shouldSetCookie('connect.sid'))
         .expect(200, done)
       })
+
+      describe('when mounted at "/foo"', function () {
+        before(function () {
+          this.server = createServer(mountAt('/foo'), { cookie: { path: '/foo/bar' } })
+        })
+
+        it('should set cookie for "/foo/bar" request', function (done) {
+          request(this.server)
+          .get('/foo/bar')
+          .expect(shouldSetCookie('connect.sid'))
+          .expect(200, done)
+        })
+
+        it('should not set cookie for "/foo/foo/bar" request', function (done) {
+          request(this.server)
+          .get('/foo/foo/bar')
+          .expect(shouldNotHaveHeader('Set-Cookie'))
+          .expect(200, done)
+        })
+      })
     })
 
     describe('when "secure" set to "auto"', function () {
@@ -2136,6 +2156,15 @@ function expires (res) {
   return header && parseSetCookie(header).expires
 }
 
+function mountAt (path) {
+  return function (req, res) {
+    if (req.url.indexOf(path) === 0) {
+      req.originalUrl = req.url
+      req.url = req.url.slice(path.length)
+    }
+  }
+}
+
 function parseSetCookie (header) {
   var match
   var pairs = []

From c22630155f697eed9043c85eded6d3fa7e9212ff Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Aug 2017 22:33:19 -0400
Subject: [PATCH 193/529] Fix TypeError when req.url is an empty string

fixes #495
---
 HISTORY.md      |  1 +
 index.js        |  2 +-
 test/session.js | 11 +++++++++++
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index b2bdf23a..79f07def 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix `TypeError` when `req.url` is an empty string
   * deps: depd@~1.1.1
    - Remove unnecessary `Buffer` loading
 
diff --git a/index.js b/index.js
index 8db4eca3..175fb234 100644
--- a/index.js
+++ b/index.js
@@ -191,7 +191,7 @@ function session(options) {
     }
 
     // pathname mismatch
-    var originalPath = parseUrl.original(req).pathname;
+    var originalPath = parseUrl.original(req).pathname || '/'
     if (originalPath.indexOf(cookieOptions.path || '/') !== 0) return next();
 
     // ensure a secret is available or bail
diff --git a/test/session.js b/test/session.js
index 4a7a2263..241eb5f6 100644
--- a/test/session.js
+++ b/test/session.js
@@ -164,6 +164,17 @@ describe('session()', function(){
     .expect(200, 'session created', cb)
   })
 
+  it('should handle empty req.url', function (done) {
+    function setup (req) {
+      req.url = ''
+    }
+
+    request(createServer(setup))
+    .get('/')
+    .expect(shouldSetCookie('connect.sid'))
+    .expect(200, done)
+  })
+
   it('should handle multiple res.end calls', function(done){
     var server = createServer(null, function (req, res) {
       res.setHeader('Content-Type', 'text/plain')

From d63a3e9c270271ec899db9e35824a3eb9ab2d0d2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Aug 2017 23:17:40 -0400
Subject: [PATCH 194/529] 1.15.5

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 79f07def..64cb57ba 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.15.5 / 2017-08-02
+===================
 
   * Fix `TypeError` when `req.url` is an empty string
   * deps: depd@~1.1.1
diff --git a/package.json b/package.json
index ec4c2a25..cd999a00 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.15.4",
+  "version": "1.15.5",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 0e97d6f02743d76c82d652d4b56cb2bc95618b31 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 2 Aug 2017 23:31:31 -0400
Subject: [PATCH 195/529] docs: fix formatting in history

---
 HISTORY.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 64cb57ba..de3f083e 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -3,7 +3,7 @@
 
   * Fix `TypeError` when `req.url` is an empty string
   * deps: depd@~1.1.1
-   - Remove unnecessary `Buffer` loading
+    - Remove unnecessary `Buffer` loading
 
 1.15.4 / 2017-07-18
 ===================

From 11b3e97a4881fc4eacac6cf2236e1e50a2121e17 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 14 Aug 2017 19:09:35 -0400
Subject: [PATCH 196/529] deps: uid-safe@~2.1.5

---
 HISTORY.md   | 6 ++++++
 package.json | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index de3f083e..10f83635 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: uid-safe@~2.1.5
+    - perf: remove only trailing `=`
+
 1.15.5 / 2017-08-02
 ===================
 
diff --git a/package.json b/package.json
index cd999a00..c8253b5d 100644
--- a/package.json
+++ b/package.json
@@ -17,7 +17,7 @@
     "depd": "~1.1.1",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.1",
-    "uid-safe": "~2.1.4",
+    "uid-safe": "~2.1.5",
     "utils-merge": "1.0.0"
   },
   "devDependencies": {

From 71c9d7c994086b73f92569cf5ef0a2b108096812 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 14 Aug 2017 19:17:54 -0400
Subject: [PATCH 197/529] build: express@4.15.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index c8253b5d..0983b1b6 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.3",
-    "express": "4.15.3",
+    "express": "4.15.4",
     "istanbul": "0.4.5",
     "mocha": "2.5.3",
     "supertest": "1.1.0"

From 65781dd935126d8df0fd4b104a4c7b8ea82f0a21 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 24 Aug 2017 20:09:36 -0400
Subject: [PATCH 198/529] build: Node.js@8.4

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 47a26ad2..d343742f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ node_js:
   - "5.12"
   - "6.11"
   - "7.10"
-  - "8.2"
+  - "8.4"
 sudo: false
 cache:
   directories:

From 917b03d0db98e0e433f10e3d69875eabb0fa97f0 Mon Sep 17 00:00:00 2001
From: Rocco Musolino <rocco@hackerstribe.com>
Date: Wed, 19 Jul 2017 19:17:26 +0200
Subject: [PATCH 199/529] docs: add memorystore to the list of session stores

closes #487
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 939b0c0e..1708a938 100644
--- a/README.md
+++ b/README.md
@@ -670,6 +670,11 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [medea-session-store-url]: https://www.npmjs.com/package/medea-session-store
 [medea-session-store-image]: https://img.shields.io/github/stars/BenjaminVadant/medea-session-store.svg?label=%E2%98%85
 
+[![★][memorystore-image] memorystore][memorystore-url] A memory session store made for production.
+
+[memorystore-url]: https://www.npmjs.com/package/memorystore
+[memorystore-image]: https://img.shields.io/github/stars/roccomuso/memorystore.svg?label=%E2%98%85
+
 [![★][mssql-session-store-image] mssql-session-store][mssql-session-store-url] A SQL Server-based session store.
 
 [mssql-session-store-url]: https://www.npmjs.com/package/mssql-session-store

From 8b4f668dba2221acd1e218fa0bca9a504e256090 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 27 Aug 2017 22:08:20 -0400
Subject: [PATCH 200/529] lint: add editorconfig and eslint to enforce

---
 .editorconfig     | 11 +++++++++++
 .eslintignore     |  2 ++
 .eslintrc         |  7 +++++++
 .travis.yml       |  2 ++
 package.json      |  2 ++
 session/cookie.js |  2 +-
 test/session.js   | 28 ++++++++++++++--------------
 7 files changed, 39 insertions(+), 15 deletions(-)
 create mode 100644 .editorconfig
 create mode 100644 .eslintignore
 create mode 100644 .eslintrc

diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 00000000..cdb36c1b
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,11 @@
+# http://editorconfig.org
+root = true
+
+[*]
+charset = utf-8
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[{*.js,*.json,*.yml}]
+indent_size = 2
+indent_style = space
diff --git a/.eslintignore b/.eslintignore
new file mode 100644
index 00000000..62562b74
--- /dev/null
+++ b/.eslintignore
@@ -0,0 +1,2 @@
+coverage
+node_modules
diff --git a/.eslintrc b/.eslintrc
new file mode 100644
index 00000000..8f51db36
--- /dev/null
+++ b/.eslintrc
@@ -0,0 +1,7 @@
+{
+  "rules": {
+    "eol-last": "error",
+    "indent": ["error", 2, { "SwitchCase": 1 }],
+    "no-trailing-spaces": "error"
+  }
+}
diff --git a/.travis.yml b/.travis.yml
index d343742f..0835c242 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -20,6 +20,7 @@ before_install:
   - "npm config set shrinkwrap false"
   # Setup Node.js version-specific dependencies
   - "test $TRAVIS_NODE_VERSION != '0.8' || npm rm --save-dev istanbul"
+  - "test $(echo $TRAVIS_NODE_VERSION | cut -d. -f1) -ge 4 || npm rm --save-dev eslint"
   # Update Node.js modules
   - "test ! -d node_modules || npm prune"
   - "test ! -d node_modules || npm rebuild"
@@ -27,5 +28,6 @@ script:
   # Run test script, depending on istanbul install
   - "test ! -z $(npm -ps ls istanbul) || npm test"
   - "test   -z $(npm -ps ls istanbul) || npm run-script test-travis"
+  - "test   -z $(npm -ps ls eslint) || npm run-script lint"
 after_script:
   - "test -e ./coverage/lcov.info && npm install coveralls@2 && cat ./coverage/lcov.info | coveralls"
diff --git a/package.json b/package.json
index 0983b1b6..7e8527d8 100644
--- a/package.json
+++ b/package.json
@@ -23,6 +23,7 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.3",
+    "eslint": "3.19.0",
     "express": "4.15.4",
     "istanbul": "0.4.5",
     "mocha": "2.5.3",
@@ -38,6 +39,7 @@
     "node": ">= 0.8.0"
   },
   "scripts": {
+    "lint": "eslint .",
     "test": "mocha --check-leaks --bail --no-exit --reporter spec test/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --check-leaks --no-exit --reporter dot test/",
     "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --check-leaks --no-exit --reporter spec test/"
diff --git a/session/cookie.js b/session/cookie.js
index 60ef22af..13142ccc 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -96,7 +96,7 @@ Cookie.prototype = {
 
   get data() {
     return {
-        originalMaxAge: this.originalMaxAge
+      originalMaxAge: this.originalMaxAge
       , expires: this._expires
       , secure: this.secure
       , httpOnly: this.httpOnly
diff --git a/test/session.js b/test/session.js
index 241eb5f6..5f49e352 100644
--- a/test/session.js
+++ b/test/session.js
@@ -652,17 +652,17 @@ describe('session()', function(){
 
     describe('when disabled', function(){
       before(function () {
-          function setup (req) {
-            req.secure = req.headers['x-secure']
+        function setup (req) {
+          req.secure = req.headers['x-secure']
               ? JSON.parse(req.headers['x-secure'])
               : undefined
-          }
+        }
 
-          function respond (req, res) {
-            res.end(String(req.secure))
-          }
+        function respond (req, res) {
+          res.end(String(req.secure))
+        }
 
-          this.server = createServer(setup, { proxy: false, cookie: { secure: true }}, respond)
+        this.server = createServer(setup, { proxy: false, cookie: { secure: true }}, respond)
       })
 
       it('should not trust X-Forwarded-Proto', function(done){
@@ -685,17 +685,17 @@ describe('session()', function(){
 
     describe('when unspecified', function(){
       before(function () {
-          function setup (req) {
-            req.secure = req.headers['x-secure']
+        function setup (req) {
+          req.secure = req.headers['x-secure']
               ? JSON.parse(req.headers['x-secure'])
               : undefined
-          }
+        }
 
-          function respond (req, res) {
-            res.end(String(req.secure))
-          }
+        function respond (req, res) {
+          res.end(String(req.secure))
+        }
 
-          this.server = createServer(setup, { cookie: { secure: true }}, respond)
+        this.server = createServer(setup, { cookie: { secure: true }}, respond)
       })
 
       it('should not trust X-Forwarded-Proto', function(done){

From 68e210d1c5f21bd7469d0792e6cd67a6235b358b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 19 Sep 2017 01:03:44 -0400
Subject: [PATCH 201/529] deps: parseurl@~1.3.2

---
 HISTORY.md   | 3 +++
 package.json | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 10f83635..ac479a6c 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,9 @@
 unreleased
 ==========
 
+  * deps: parseurl@~1.3.2
+    - perf: reduce overhead for full URLs
+    - perf: unroll the "fast-path" `RegExp`
   * deps: uid-safe@~2.1.5
     - perf: remove only trailing `=`
 
diff --git a/package.json b/package.json
index 7e8527d8..bc33066b 100644
--- a/package.json
+++ b/package.json
@@ -16,7 +16,7 @@
     "debug": "2.6.8",
     "depd": "~1.1.1",
     "on-headers": "~1.0.1",
-    "parseurl": "~1.3.1",
+    "parseurl": "~1.3.2",
     "uid-safe": "~2.1.5",
     "utils-merge": "1.0.0"
   },

From 44ee0467e3de21b2666d41682543cf384282224a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 19 Sep 2017 01:08:06 -0400
Subject: [PATCH 202/529] docs: remove trailing newline in README

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 1708a938..aa947c61 100644
--- a/README.md
+++ b/README.md
@@ -632,7 +632,7 @@ and other multi-core embedded devices).
 [express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session
 [express-nedb-session-image]: https://img.shields.io/github/stars/louischatriot/express-nedb-session.svg?label=%E2%98%85
 
-[![★][express-session-cache-manager-image] express-session-cache-manager][express-session-cache-manager-url] 
+[![★][express-session-cache-manager-image] express-session-cache-manager][express-session-cache-manager-url]
 A store that implements [cache-manager](https://www.npmjs.com/package/cache-manager), which supports
 a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-engines).
 

From f24d228cbc3b86de661c23cd268276309bf370a2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 19 Sep 2017 01:12:33 -0400
Subject: [PATCH 203/529] lint: run eslint against README

---
 .travis.yml  | 2 +-
 package.json | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 0835c242..fb3f15d4 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -20,7 +20,7 @@ before_install:
   - "npm config set shrinkwrap false"
   # Setup Node.js version-specific dependencies
   - "test $TRAVIS_NODE_VERSION != '0.8' || npm rm --save-dev istanbul"
-  - "test $(echo $TRAVIS_NODE_VERSION | cut -d. -f1) -ge 4 || npm rm --save-dev eslint"
+  - "test $(echo $TRAVIS_NODE_VERSION | cut -d. -f1) -ge 4 || npm rm --save-dev eslint eslint-plugin-markdown"
   # Update Node.js modules
   - "test ! -d node_modules || npm prune"
   - "test ! -d node_modules || npm rebuild"
diff --git a/package.json b/package.json
index bc33066b..81e76f6f 100644
--- a/package.json
+++ b/package.json
@@ -24,6 +24,7 @@
     "after": "0.8.2",
     "cookie-parser": "1.4.3",
     "eslint": "3.19.0",
+    "eslint-plugin-markdown": "1.0.0-beta.6",
     "express": "4.15.4",
     "istanbul": "0.4.5",
     "mocha": "2.5.3",
@@ -39,7 +40,7 @@
     "node": ">= 0.8.0"
   },
   "scripts": {
-    "lint": "eslint .",
+    "lint": "eslint --plugin markdown --ext js,md .",
     "test": "mocha --check-leaks --bail --no-exit --reporter spec test/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --check-leaks --no-exit --reporter dot test/",
     "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --check-leaks --no-exit --reporter spec test/"

From d190faac7e428e5e735187b48b940efbb312aa93 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 23 Sep 2017 22:08:48 -0400
Subject: [PATCH 204/529] deps: utils-merge@1.0.1

---
 HISTORY.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index ac479a6c..c8c432e2 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -6,6 +6,7 @@ unreleased
     - perf: unroll the "fast-path" `RegExp`
   * deps: uid-safe@~2.1.5
     - perf: remove only trailing `=`
+  * deps: utils-merge@1.0.1
 
 1.15.5 / 2017-08-02
 ===================
diff --git a/package.json b/package.json
index 81e76f6f..b23fc5f2 100644
--- a/package.json
+++ b/package.json
@@ -18,7 +18,7 @@
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.2",
     "uid-safe": "~2.1.5",
-    "utils-merge": "1.0.0"
+    "utils-merge": "1.0.1"
   },
   "devDependencies": {
     "after": "0.8.2",

From 6cf886d080b3fe5b114951fca1711fccf891a715 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 23 Sep 2017 22:10:30 -0400
Subject: [PATCH 205/529] deps: debug@2.6.9

---
 HISTORY.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index c8c432e2..9af687ac 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * deps: debug@2.6.9
   * deps: parseurl@~1.3.2
     - perf: reduce overhead for full URLs
     - perf: unroll the "fast-path" `RegExp`
diff --git a/package.json b/package.json
index b23fc5f2..07a6617c 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "crc": "3.4.4",
-    "debug": "2.6.8",
+    "debug": "2.6.9",
     "depd": "~1.1.1",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.2",

From d4344fb0ca1839f0585723942516981415b07c9c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 26 Sep 2017 14:59:57 -0400
Subject: [PATCH 206/529] build: express@4.15.5

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 07a6617c..7132ef8f 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "cookie-parser": "1.4.3",
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.0-beta.6",
-    "express": "4.15.4",
+    "express": "4.15.5",
     "istanbul": "0.4.5",
     "mocha": "2.5.3",
     "supertest": "1.1.0"

From 89fd7156129210f2b0c350afcbdf226665a8328c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 26 Sep 2017 15:02:08 -0400
Subject: [PATCH 207/529] 1.15.6

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 9af687ac..a82e8395 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.15.6 / 2017-09-26
+===================
 
   * deps: debug@2.6.9
   * deps: parseurl@~1.3.2
diff --git a/package.json b/package.json
index 7132ef8f..58b89282 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.15.5",
+  "version": "1.15.6",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 1bcf69ee657d8c24d1a7b3064f406f4977434e6c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 19 Dec 2017 18:08:25 -0500
Subject: [PATCH 208/529] build: Node.js@6.12

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index fb3f15d4..518ec0db 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "3.3"
   - "4.8"
   - "5.12"
-  - "6.11"
+  - "6.12"
   - "7.10"
   - "8.4"
 sudo: false

From 5bf7287982e4370f8b91f62a4ab989d1b5a3742a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 19 Dec 2017 18:09:02 -0500
Subject: [PATCH 209/529] build: Node.js@8.9

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 518ec0db..843dce60 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ node_js:
   - "5.12"
   - "6.12"
   - "7.10"
-  - "8.4"
+  - "8.9"
 sudo: false
 cache:
   directories:

From 2afda1118f514cc954685a80853b059d6374f234 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 19 Dec 2017 18:10:28 -0500
Subject: [PATCH 210/529] build: express@4.16.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 58b89282..c4a2f129 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "cookie-parser": "1.4.3",
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.0-beta.6",
-    "express": "4.15.5",
+    "express": "4.16.2",
     "istanbul": "0.4.5",
     "mocha": "2.5.3",
     "supertest": "1.1.0"

From 5c04910e1a10a7ca4cdeb05f4e4d5d43e9533e0c Mon Sep 17 00:00:00 2001
From: Nfer Zhuang <nfer.zhuang@gmail.com>
Date: Fri, 8 Dec 2017 20:17:55 -0600
Subject: [PATCH 211/529] lint: simplify ternary secure check

closes #528
closes #530
---
 index.js | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/index.js b/index.js
index 175fb234..3c2a5df9 100644
--- a/index.js
+++ b/index.js
@@ -609,10 +609,7 @@ function issecure(req, trustProxy) {
 
   // no explicit trust; try req.secure from express
   if (trustProxy !== true) {
-    var secure = req.secure;
-    return typeof secure === 'boolean'
-      ? secure
-      : false;
+    return req.secure === true
   }
 
   // read the proto from x-forwarded-proto header

From 881f2874931e9ad6084081ecdb6a791a456e4c6b Mon Sep 17 00:00:00 2001
From: Saurabh <unknown7bolt@gmail.com>
Date: Wed, 11 Oct 2017 20:56:40 +0530
Subject: [PATCH 212/529] docs: add couchdb-expression to the list of session
 stores

closes #514
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index aa947c61..c526f51f 100644
--- a/README.md
+++ b/README.md
@@ -595,6 +595,11 @@ and other multi-core embedded devices).
 [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize
 [connect-session-sequelize-image]: https://img.shields.io/github/stars/mweibel/connect-session-sequelize.svg?label=%E2%98%85
 
+[![★][couchdb-expression-image] couchdb-expression][couchdb-expression-url] A [CouchDB](https://couchdb.apache.org/)-based session store.
+
+[couchdb-expression-url]: https://www.npmjs.com/package/couchdb-expression
+[couchdb-expression-image]: https://img.shields.io/github/stars/tkshnwesper/couchdb-expression.svg?label=%E2%98%85
+
 [![★][dynamodb-store-image] dynamodb-store][dynamodb-store-url] A DynamoDB-based session store.
 
 [dynamodb-store-url]: https://www.npmjs.com/package/dynamodb-store

From 36eaf353e86510c402a345b9608a562796a551a2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 19 Dec 2017 18:49:00 -0500
Subject: [PATCH 213/529] deps: crc@3.5.0

---
 HISTORY.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index a82e8395..dfdb26db 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * deps: crc@3.5.0
+
 1.15.6 / 2017-09-26
 ===================
 
diff --git a/package.json b/package.json
index c4a2f129..fdaae0db 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,7 @@
   "dependencies": {
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
-    "crc": "3.4.4",
+    "crc": "3.5.0",
     "debug": "2.6.9",
     "depd": "~1.1.1",
     "on-headers": "~1.0.1",

From a432c82804fadeb3f6a3137a536ce71d36e496db Mon Sep 17 00:00:00 2001
From: Alexander Jank <himself@alexanderjank.de>
Date: Mon, 25 Dec 2017 19:20:21 +0100
Subject: [PATCH 214/529] docs: add restsession to the list of session stores

closes #536
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index c526f51f..2a3102cf 100644
--- a/README.md
+++ b/README.md
@@ -690,6 +690,11 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [nedb-session-store-url]: https://www.npmjs.com/package/nedb-session-store
 [nedb-session-store-image]: https://img.shields.io/github/stars/JamesMGreene/nedb-session-store.svg?label=%E2%98%85
 
+[![★][restsession-image] restsession][restsession-url] Store sessions utilizing a RESTful API
+
+[restsession-url]: https://www.npmjs.com/package/restsession
+[restsession-image]: https://img.shields.io/github/stars/jankal/restsession.svg?label=%E2%98%85
+
 [![★][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](http://sequelizejs.com/).
 
 [sequelstore-connect-url]: https://www.npmjs.com/package/sequelstore-connect

From 251d1b4094fb8b773221b2a92b581242b1c8e598 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 4 Jan 2018 18:51:11 -0500
Subject: [PATCH 215/529] docs: remove gratipay badge

---
 README.md | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/README.md b/README.md
index 2a3102cf..22c10da1 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,6 @@
 [![NPM Downloads][downloads-image]][downloads-url]
 [![Build Status][travis-image]][travis-url]
 [![Test Coverage][coveralls-image]][coveralls-url]
-[![Gratipay][gratipay-image]][gratipay-url]
 
 ## Installation
 
@@ -762,5 +761,3 @@ app.get('/bar', function (req, res, next) {
 [coveralls-url]: https://coveralls.io/r/expressjs/session?branch=master
 [downloads-image]: https://img.shields.io/npm/dm/express-session.svg
 [downloads-url]: https://npmjs.org/package/express-session
-[gratipay-image]: https://img.shields.io/gratipay/dougwilson.svg
-[gratipay-url]: https://gratipay.com/dougwilson/

From cf15ee924e5f06d33895e49f6e338abfa4e4df80 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C4=B0smail=20Ar=C4=B1l=C4=B1k?= <arilik.ismail@gmail.com>
Date: Wed, 20 Dec 2017 09:20:10 +0300
Subject: [PATCH 216/529] docs: add sessionstore to the list of session stores

closes #532
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 22c10da1..deac6026 100644
--- a/README.md
+++ b/README.md
@@ -709,6 +709,11 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [session-rethinkdb-url]: https://www.npmjs.com/package/session-rethinkdb
 [session-rethinkdb-image]: https://img.shields.io/github/stars/llambda/session-rethinkdb.svg?label=%E2%98%85
 
+[![★][sessionstore-image] sessionstore][sessionstore-url] A session store that works with various databases.
+
+[sessionstore-url]: https://www.npmjs.com/package/sessionstore
+[sessionstore-image]: https://img.shields.io/github/stars/adrai/sessionstore.svg?label=%E2%98%85
+
 ## Example
 
 A simple example using `express-session` to store page views for a user.

From 70f3c2bd45dfbae7351088bcd64aaed07eb1965d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 4 Jan 2018 18:55:10 -0500
Subject: [PATCH 217/529] build: support Node.js 9.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 843dce60..2c39382e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,6 +11,7 @@ node_js:
   - "6.12"
   - "7.10"
   - "8.9"
+  - "9.3"
 sudo: false
 cache:
   directories:

From c720066af13d1719609096f7a24d850de9b39550 Mon Sep 17 00:00:00 2001
From: GochoMugo <mugo@forfuture.co.ke>
Date: Sun, 22 Oct 2017 20:30:39 +0300
Subject: [PATCH 218/529] docs: document req.session.cookie.originalMaxAge

closes #516
closes #517
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index deac6026..ff64240f 100644
--- a/README.md
+++ b/README.md
@@ -399,6 +399,11 @@ to its original value.
 req.session.cookie.maxAge // => 30000
 ```
 
+#### Cookie.originalMaxAge
+
+The `req.session.cookie.originalMaxAge` property returns the original
+`maxAge` (time-to-live), in milliseconds, of the session cookie.
+
 ### req.sessionID
 
 To get the ID of the loaded session, access the request property

From 2bb2860794a8516cb4f223119588afd8d29fe13d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 7 Jan 2018 22:09:36 -0500
Subject: [PATCH 219/529] lint: only declare one variable per var

---
 .eslintrc          |  3 ++-
 index.js           | 10 +++++-----
 session/cookie.js  |  2 +-
 session/session.js |  3 ++-
 session/store.js   |  3 ++-
 test/session.js    |  9 +++++----
 6 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/.eslintrc b/.eslintrc
index 8f51db36..bca8da4b 100644
--- a/.eslintrc
+++ b/.eslintrc
@@ -2,6 +2,7 @@
   "rules": {
     "eol-last": "error",
     "indent": ["error", 2, { "SwitchCase": 1 }],
-    "no-trailing-spaces": "error"
+    "no-trailing-spaces": "error",
+    "one-var": ["error", { "initialized": "never" }]
   }
 }
diff --git a/index.js b/index.js
index 3c2a5df9..ca4bc635 100644
--- a/index.js
+++ b/index.js
@@ -17,15 +17,15 @@ var cookie = require('cookie');
 var crc = require('crc').crc32;
 var debug = require('debug')('express-session');
 var deprecate = require('depd')('express-session');
+var onHeaders = require('on-headers')
 var parseUrl = require('parseurl');
+var signature = require('cookie-signature')
 var uid = require('uid-safe').sync
-  , onHeaders = require('on-headers')
-  , signature = require('cookie-signature')
 
+var Cookie = require('./session/cookie')
+var MemoryStore = require('./session/memory')
 var Session = require('./session/session')
-  , MemoryStore = require('./session/memory')
-  , Cookie = require('./session/cookie')
-  , Store = require('./session/store')
+var Store = require('./session/store')
 
 // environment
 
diff --git a/session/cookie.js b/session/cookie.js
index 13142ccc..05183294 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -11,8 +11,8 @@
  * Module dependencies.
  */
 
+var cookie = require('cookie')
 var merge = require('utils-merge')
-  , cookie = require('cookie');
 
 /**
  * Initialize a new `Cookie` with the given `options`.
diff --git a/session/session.js b/session/session.js
index 2eacde60..fee7608c 100644
--- a/session/session.js
+++ b/session/session.js
@@ -87,7 +87,8 @@ defineMethod(Session.prototype, 'save', function save(fn) {
 
 defineMethod(Session.prototype, 'reload', function reload(fn) {
   var req = this.req
-    , store = this.req.sessionStore;
+  var store = this.req.sessionStore
+
   store.get(this.id, function(err, sess){
     if (err) return fn(err);
     if (!sess) return fn(new Error('failed to load session'));
diff --git a/session/store.js b/session/store.js
index 387469c5..00f3ac41 100644
--- a/session/store.js
+++ b/session/store.js
@@ -85,7 +85,8 @@ Store.prototype.load = function(sid, fn){
 
 Store.prototype.createSession = function(req, sess){
   var expires = sess.cookie.expires
-    , orig = sess.cookie.originalMaxAge;
+  var orig = sess.cookie.originalMaxAge
+
   sess.cookie = new Cookie(sess.cookie);
   if ('string' == typeof expires) sess.cookie.expires = new Date(expires);
   sess.cookie.originalMaxAge = orig;
diff --git a/test/session.js b/test/session.js
index 5f49e352..44d0a868 100644
--- a/test/session.js
+++ b/test/session.js
@@ -3,16 +3,17 @@ process.env.NO_DEPRECATION = 'express-session';
 
 var after = require('after')
 var assert = require('assert')
+var cookieParser = require('cookie-parser')
 var express = require('express')
-  , request = require('supertest')
-  , cookieParser = require('cookie-parser')
-  , session = require('../')
-  , Cookie = require('../session/cookie')
 var fs = require('fs')
 var http = require('http')
 var https = require('https')
+var request = require('supertest')
+var session = require('../')
 var util = require('util')
 
+var Cookie = require('../session/cookie')
+
 var min = 60 * 1000;
 
 describe('session()', function(){

From 112efaf885bacdfaaa19a2e8c2338beeec519471 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 7 Jan 2018 22:30:47 -0500
Subject: [PATCH 220/529] Use safe-buffer for improved Buffer API

---
 HISTORY.md   | 1 +
 index.js     | 3 ++-
 package.json | 1 +
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index dfdb26db..153bc6e0 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Use `safe-buffer` for improved Buffer API
   * deps: crc@3.5.0
 
 1.15.6 / 2017-09-26
diff --git a/index.js b/index.js
index ca4bc635..f3dfcfd0 100644
--- a/index.js
+++ b/index.js
@@ -13,6 +13,7 @@
  * @private
  */
 
+var Buffer = require('safe-buffer').Buffer
 var cookie = require('cookie');
 var crc = require('crc').crc32;
 var debug = require('debug')('express-session');
@@ -281,7 +282,7 @@ function session(options) {
         if (!isNaN(contentLength) && contentLength > 0) {
           // measure chunk
           chunk = !Buffer.isBuffer(chunk)
-            ? new Buffer(chunk, encoding)
+            ? Buffer.from(chunk, encoding)
             : chunk;
           encoding = undefined;
 
diff --git a/package.json b/package.json
index fdaae0db..6c1d8633 100644
--- a/package.json
+++ b/package.json
@@ -17,6 +17,7 @@
     "depd": "~1.1.1",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.2",
+    "safe-buffer": "5.1.1",
     "uid-safe": "~2.1.5",
     "utils-merge": "1.0.1"
   },

From 7ff103893a3e26ae0e8c478bbab8c4919fd78855 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 25 Jan 2018 19:09:36 -0500
Subject: [PATCH 221/529] deps: depd@~1.1.2

---
 HISTORY.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 153bc6e0..5655351f 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -3,6 +3,8 @@ unreleased
 
   * Use `safe-buffer` for improved Buffer API
   * deps: crc@3.5.0
+  * deps: depd@~1.1.2
+    - perf: remove argument reassignment
 
 1.15.6 / 2017-09-26
 ===================
diff --git a/package.json b/package.json
index 6c1d8633..8aa22424 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,7 @@
     "cookie-signature": "1.0.6",
     "crc": "3.5.0",
     "debug": "2.6.9",
-    "depd": "~1.1.1",
+    "depd": "~1.1.2",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.2",
     "safe-buffer": "5.1.1",

From 336ad96e34cca1e38a01fe9ca13f3e4523acfc06 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20G=C3=B3mez=20Matarrodona?= <solzimer@gmail.com>
Date: Sun, 21 Jan 2018 19:58:32 +0100
Subject: [PATCH 222/529] docs: add session-pouchdb-store to the list of
 session stores

closes #542
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index ff64240f..086e8157 100644
--- a/README.md
+++ b/README.md
@@ -709,6 +709,11 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [session-file-store-url]: https://www.npmjs.com/package/session-file-store
 [session-file-store-image]: https://img.shields.io/github/stars/valery-barysok/session-file-store.svg?label=%E2%98%85
 
+[![★][session-pouchdb-store-image] session-pouchdb-store][session-pouchdb-store-url] Session store for PouchDB / CouchDB. Accepts embedded, custom, or remote PouchDB instance and realtime synchronization.
+
+[session-pouchdb-store-url]: https://www.npmjs.com/package/session-pouchdb-store
+[session-pouchdb-store-image]: https://img.shields.io/github/stars/solzimer/session-pouchdb-store.svg?label=%E2%98%85
+
 [![★][session-rethinkdb-image] session-rethinkdb][session-rethinkdb-url] A [RethinkDB](http://rethinkdb.com/)-based session store.
 
 [session-rethinkdb-url]: https://www.npmjs.com/package/session-rethinkdb

From 7068f9416c8ca7631b34547a23c10c1cd270eb7f Mon Sep 17 00:00:00 2001
From: Matthew Canham <mdcanham@me.com>
Date: Sun, 4 Feb 2018 15:24:05 +1300
Subject: [PATCH 223/529] docs: add @google-cloud/connect-datastore to the list
 of session stores

closes #552
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 086e8157..2c290ce8 100644
--- a/README.md
+++ b/README.md
@@ -526,6 +526,11 @@ and other multi-core embedded devices).
 [connect-datacache-url]: https://www.npmjs.com/package/connect-datacache
 [connect-datacache-image]: https://img.shields.io/github/stars/adriantanasa/connect-datacache.svg?label=%E2%98%85
 
+[![★][@google-cloud/connect-datastore-image] @google-cloud/connect-datastore][@google-cloud/connect-datastore-url] A [Google Cloud Datastore](https://cloud.google.com/datastore/docs/concepts/overview)-based session store.
+
+[@google-cloud/connect-datastore-url]: https://www.npmjs.com/package/@google-cloud/connect-datastore
+[@google-cloud/connect-datastore-image]: https://img.shields.io/github/stars/GoogleCloudPlatform/cloud-datastore-session-node.svg?label=%E2%98%85
+
 [![★][connect-db2-image] connect-db2][connect-db2-url] An IBM DB2-based session store built using [ibm_db](https://www.npmjs.com/package/ibm_db) module.
 
 [connect-db2-url]: https://www.npmjs.com/package/connect-db2

From 4b32125c5c655a612cda5518f9a604ac55b990c8 Mon Sep 17 00:00:00 2001
From: William Grasel <d.rufos@gmail.com>
Date: Fri, 9 Mar 2018 18:43:31 -0300
Subject: [PATCH 224/529] docs: add express-session-etcd3 to the list of
 session stores

closes #562
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 2c290ce8..f8ecf179 100644
--- a/README.md
+++ b/README.md
@@ -663,6 +663,11 @@ a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-e
 [express-etcd-url]: https://www.npmjs.com/package/express-etcd
 [express-etcd-image]: https://img.shields.io/github/stars/gildean/express-etcd.svg?label=%E2%98%85
 
+[![★][express-session-etcd3-image] express-session-etcd3][express-session-etcd3-url] An [etcd3](https://github.com/mixer/etcd3) based session store.
+
+[express-session-etcd3-url]: https://www.npmjs.com/package/express-session-etcd3
+[express-session-etcd3-image]: https://img.shields.io/github/stars/willgm/express-session-etcd3.svg?label=%E2%98%85
+
 [![★][fortune-session-image] fortune-session][fortune-session-url] A [Fortune.js](https://github.com/fortunejs/fortune)
 based session store. Supports all backends supported by Fortune (MongoDB, Redis, Postgres, NeDB).
 

From 0c605637ef051ec4d77f0a4fa4fac4cae9483c06 Mon Sep 17 00:00:00 2001
From: Hendry Sadrak <hendry.sadrak@outlook.com>
Date: Wed, 14 Mar 2018 13:08:10 +0200
Subject: [PATCH 225/529] docs: add firestore-store to the list of session
 stores

closes #566
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index f8ecf179..a316a018 100644
--- a/README.md
+++ b/README.md
@@ -668,6 +668,11 @@ a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-e
 [express-session-etcd3-url]: https://www.npmjs.com/package/express-session-etcd3
 [express-session-etcd3-image]: https://img.shields.io/github/stars/willgm/express-session-etcd3.svg?label=%E2%98%85
 
+[![★][firestore-store-image] firestore-store][firestore-store-url] A [Firestore](https://github.com/hendrysadrak/firestore-store)-based session store.
+
+[firestore-store-url]: https://github.com/hendrysadrak/firestore-store
+[firestore-store-image]: https://img.shields.io/github/stars/hendrysadrak/firestore-store.svg?label=%E2%98%85
+
 [![★][fortune-session-image] fortune-session][fortune-session-url] A [Fortune.js](https://github.com/fortunejs/fortune)
 based session store. Supports all backends supported by Fortune (MongoDB, Redis, Postgres, NeDB).
 

From f8d3dec04c679abefd6e5e65196c15e125494d13 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 14 Mar 2018 12:20:26 -0400
Subject: [PATCH 226/529] build: Node.js@6.13

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 2c39382e..f1de0a43 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "3.3"
   - "4.8"
   - "5.12"
-  - "6.12"
+  - "6.13"
   - "7.10"
   - "8.9"
   - "9.3"

From ce2b702abc1b2b64731cba8a9519d86a35631ab6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 14 Mar 2018 12:20:52 -0400
Subject: [PATCH 227/529] build: Node.js@8.10

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index f1de0a43..84af9959 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ node_js:
   - "5.12"
   - "6.13"
   - "7.10"
-  - "8.9"
+  - "8.10"
   - "9.3"
 sudo: false
 cache:

From 979ab16c44233558849ac3b17599aa819854efe2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 14 Mar 2018 12:21:00 -0400
Subject: [PATCH 228/529] build: Node.js@9.8

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 84af9959..cb7fd1d0 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,7 @@ node_js:
   - "6.13"
   - "7.10"
   - "8.10"
-  - "9.3"
+  - "9.8"
 sudo: false
 cache:
   directories:

From 6b6816443feaf93a5b94bd710de50298b5c815d3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 14 Mar 2018 15:05:55 -0400
Subject: [PATCH 229/529] build: express@4.16.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 8aa22424..d4a7da50 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "cookie-parser": "1.4.3",
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.0-beta.6",
-    "express": "4.16.2",
+    "express": "4.16.3",
     "istanbul": "0.4.5",
     "mocha": "2.5.3",
     "supertest": "1.1.0"

From 082e56effc5dca4834a23a659a99ae71e234748f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 14 Mar 2018 15:25:45 -0400
Subject: [PATCH 230/529] tests: add basic tests for Cookie object

---
 package.json        |  6 ++---
 test/cookie.js      | 55 +++++++++++++++++++++++++++++++++++++++++++++
 test/session.js     |  2 --
 test/support/env.js |  2 ++
 4 files changed, 60 insertions(+), 5 deletions(-)
 create mode 100644 test/cookie.js
 create mode 100644 test/support/env.js

diff --git a/package.json b/package.json
index d4a7da50..2407632d 100644
--- a/package.json
+++ b/package.json
@@ -42,8 +42,8 @@
   },
   "scripts": {
     "lint": "eslint --plugin markdown --ext js,md .",
-    "test": "mocha --check-leaks --bail --no-exit --reporter spec test/",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --check-leaks --no-exit --reporter dot test/",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --check-leaks --no-exit --reporter spec test/"
+    "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --check-leaks --no-exit --reporter dot test/",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --check-leaks --no-exit --reporter spec test/"
   }
 }
diff --git a/test/cookie.js b/test/cookie.js
new file mode 100644
index 00000000..51b248bc
--- /dev/null
+++ b/test/cookie.js
@@ -0,0 +1,55 @@
+
+var assert = require('assert')
+var Cookie = require('../session/cookie')
+
+describe('new Cookie()', function () {
+  it('should create a new cookie object', function () {
+    assert.equal(typeof new Cookie(), 'object')
+  })
+
+  it('should default expires to null', function () {
+    var cookie = new Cookie()
+    assert.strictEqual(cookie.expires, null)
+  })
+
+  it('should default httpOnly to true', function () {
+    var cookie = new Cookie()
+    assert.strictEqual(cookie.httpOnly, true)
+  })
+
+  it('should default path to "/"', function () {
+    var cookie = new Cookie()
+    assert.strictEqual(cookie.path, '/')
+  })
+
+  it('should default maxAge to null', function () {
+    var cookie = new Cookie()
+    assert.strictEqual(cookie.maxAge, null)
+  })
+
+  describe('with options', function () {
+    it('should create a new cookie object', function () {
+      assert.equal(typeof new Cookie({}), 'object')
+    })
+
+    it('should set expires', function () {
+      var expires = new Date()
+      var cookie = new Cookie({ expires: expires })
+
+      assert.strictEqual(cookie.expires, expires)
+      assert.notStrictEqual(cookie.maxAge, null)
+    })
+
+    it('should set httpOnly', function () {
+      var cookie = new Cookie({ httpOnly: false })
+
+      assert.strictEqual(cookie.httpOnly, false)
+    })
+
+    it('should set path', function () {
+      var cookie = new Cookie({ path: '/foo' })
+
+      assert.strictEqual(cookie.path, '/foo')
+    })
+  })
+})
diff --git a/test/session.js b/test/session.js
index 44d0a868..a6e0e5cc 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1,6 +1,4 @@
 
-process.env.NO_DEPRECATION = 'express-session';
-
 var after = require('after')
 var assert = require('assert')
 var cookieParser = require('cookie-parser')
diff --git a/test/support/env.js b/test/support/env.js
new file mode 100644
index 00000000..fba1bd89
--- /dev/null
+++ b/test/support/env.js
@@ -0,0 +1,2 @@
+
+process.env.NO_DEPRECATION = 'express-session';

From efdde800ef78e1880f14106f2b54d84521d407bc Mon Sep 17 00:00:00 2001
From: Void <thevoidf@gmail.com>
Date: Wed, 24 Jan 2018 03:45:11 +0400
Subject: [PATCH 231/529] Add type check to new Cookie(options)

closes #544
---
 session/cookie.js | 10 +++++++++-
 test/cookie.js    |  7 +++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/session/cookie.js b/session/cookie.js
index 05183294..edac988f 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -26,7 +26,15 @@ var Cookie = module.exports = function Cookie(options) {
   this.path = '/';
   this.maxAge = null;
   this.httpOnly = true;
-  if (options) merge(this, options);
+
+  if (options) {
+    if (typeof options !== 'object') {
+      throw new TypeError('argument options must be a object')
+    }
+
+    merge(this, options)
+  }
+
   this.originalMaxAge = undefined == this.originalMaxAge
     ? this.maxAge
     : this.originalMaxAge;
diff --git a/test/cookie.js b/test/cookie.js
index 51b248bc..ee1df956 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -32,6 +32,13 @@ describe('new Cookie()', function () {
       assert.equal(typeof new Cookie({}), 'object')
     })
 
+    it('should reject non-objects', function () {
+      assert.throws(function () { new Cookie(42) }, /argument options/)
+      assert.throws(function () { new Cookie('foo') }, /argument options/)
+      assert.throws(function () { new Cookie(true) }, /argument options/)
+      assert.throws(function () { new Cookie(function () {}) }, /argument options/)
+    })
+
     it('should set expires', function () {
       var expires = new Date()
       var cookie = new Cookie({ expires: expires })

From befa6b5c8869d90362485b62cd5815afc1bc330a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 14 Mar 2018 16:17:13 -0400
Subject: [PATCH 232/529] tests: add additional supertest helper

---
 test/session.js | 43 +++++++++++++++++++------------------------
 1 file changed, 19 insertions(+), 24 deletions(-)

diff --git a/test/session.js b/test/session.js
index a6e0e5cc..2555e4a6 100644
--- a/test/session.js
+++ b/test/session.js
@@ -474,19 +474,14 @@ describe('session()', function(){
       .expect(shouldSetCookie('connect.sid'))
       .expect(200, 'session 1', function (err, res) {
         if (err) return done(err)
-        var val = sid(res)
-        assert.ok(val)
         store.clear(function (err) {
           if (err) return done(err)
           request(server)
           .get('/')
           .set('Cookie', cookie(res))
           .expect(shouldSetCookie('connect.sid'))
-          .expect(200, 'session 2', function (err, res) {
-            if (err) return done(err)
-            assert.notEqual(sid(res), val)
-            done()
-          })
+          .expect(shouldSetCookieToDifferentSessionId(res))
+          .expect(200, 'session 2', done)
         })
       })
     })
@@ -512,6 +507,7 @@ describe('session()', function(){
         .get('/')
         .set('Cookie', 'sessid=' + val)
         .expect(shouldSetCookie('sessid'))
+        .expect(shouldSetCookieToDifferentSessionId(val))
         .expect(200, 'session created', done)
       })
     })
@@ -578,18 +574,13 @@ describe('session()', function(){
       .expect(shouldSetCookie('connect.sid'))
       .expect(200, 'session 1', function (err, res) {
         if (err) return done(err)
-        var val = sid(res)
-        assert.ok(val)
         setTimeout(function () {
           request(server)
           .get('/')
           .set('Cookie', cookie(res))
           .expect(shouldSetCookie('connect.sid'))
-          .expect(200, 'session 2', function (err, res) {
-            if (err) return done(err)
-            assert.notEqual(sid(res), val)
-            done()
-          })
+          .expect(shouldSetCookieToDifferentSessionId(sid(res)))
+          .expect(200, 'session 2', done)
         }, 15)
       })
     })
@@ -1545,16 +1536,12 @@ describe('session()', function(){
         .expect(shouldSetCookie('connect.sid'))
         .expect(200, function (err, res) {
           if (err) return done(err)
-          var id = sid(res)
           request(server)
           .get('/')
           .set('Cookie', cookie(res))
           .expect(shouldSetCookie('connect.sid'))
-          .expect(200, 'false', function (err, res) {
-            if (err) return done(err)
-            assert.notEqual(sid(res), id)
-            done();
-          });
+          .expect(shouldSetCookieToDifferentSessionId(sid(res)))
+          .expect(200, 'false', done)
         });
       })
     })
@@ -2223,6 +2210,12 @@ function shouldSetCookie (name) {
   }
 }
 
+function shouldSetCookieToDifferentSessionId (id) {
+  return function (res) {
+    assert.notEqual(sid(res), id)
+  }
+}
+
 function shouldSetCookieToExpireIn (name, delta) {
   return function (res) {
     var header = cookie(res)
@@ -2290,10 +2283,12 @@ function shouldSetSessionInStore(store) {
   }
 }
 
-function sid(res) {
-  var match = /^[^=]+=s%3A([^;\.]+)[\.;]/.exec(cookie(res))
-  var val = match ? match[1] : undefined
-  return val
+function sid (res) {
+  var header = cookie(res)
+  var data = header && parseSetCookie(header)
+  var value = data && unescape(data.value)
+  var sid = value && value.substring(2, value.indexOf('.'))
+  return sid || undefined
 }
 
 function writePatch (res) {

From a8f3e459adfa0e798b9d68a3d43eb30ca95d2693 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 14 Mar 2018 20:58:04 -0400
Subject: [PATCH 233/529] Use "Set-Cookie" as cookie header name for
 compatibility

fixes #449
---
 HISTORY.md | 1 +
 index.js   | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 5655351f..996baae3 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Use `safe-buffer` for improved Buffer API
+  * Use `Set-Cookie` as cookie header name for compatibility
   * deps: crc@3.5.0
   * deps: depd@~1.1.2
     - perf: remove argument reassignment
diff --git a/index.js b/index.js
index f3dfcfd0..d547e504 100644
--- a/index.js
+++ b/index.js
@@ -635,10 +635,10 @@ function setcookie(res, name, val, secret, options) {
 
   debug('set-cookie %s', data);
 
-  var prev = res.getHeader('set-cookie') || [];
+  var prev = res.getHeader('Set-Cookie') || []
   var header = Array.isArray(prev) ? prev.concat(data) : [prev, data];
 
-  res.setHeader('set-cookie', header)
+  res.setHeader('Set-Cookie', header)
 }
 
 /**

From 73e9c4f1ac5000fedc15708f54971a463473b052 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 29 Mar 2018 11:54:50 -0400
Subject: [PATCH 234/529] build: Node.js@4.9

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index cb7fd1d0..59d34a8a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -6,7 +6,7 @@ node_js:
   - "1.8"
   - "2.5"
   - "3.3"
-  - "4.8"
+  - "4.9"
   - "5.12"
   - "6.13"
   - "7.10"

From 82a5ffbc15b5590117fc4a4949d68d5a904d541b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 29 Mar 2018 11:55:01 -0400
Subject: [PATCH 235/529] build: Node.js@6.14

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 59d34a8a..95cc19d0 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "3.3"
   - "4.9"
   - "5.12"
-  - "6.13"
+  - "6.14"
   - "7.10"
   - "8.10"
   - "9.8"

From efcec428ff641256beea0619459fddde287f5c48 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 29 Mar 2018 11:55:11 -0400
Subject: [PATCH 236/529] build: Node.js@8.11

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 95cc19d0..94865ec7 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ node_js:
   - "5.12"
   - "6.14"
   - "7.10"
-  - "8.10"
+  - "8.11"
   - "9.8"
 sudo: false
 cache:

From 4f6198f19081f7c0765d1f4542118fde64cde3cb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 29 Mar 2018 11:55:17 -0400
Subject: [PATCH 237/529] build: Node.js@9.10

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 94865ec7..21f2fe73 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,7 @@ node_js:
   - "6.14"
   - "7.10"
   - "8.11"
-  - "9.8"
+  - "9.10"
 sudo: false
 cache:
   directories:

From 71230d637b12d7c197ac899c2189731650cba89d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 1 Apr 2018 14:25:14 -0400
Subject: [PATCH 238/529] lint: catch mixed tabs and spaces

---
 .eslintrc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.eslintrc b/.eslintrc
index bca8da4b..6c53531a 100644
--- a/.eslintrc
+++ b/.eslintrc
@@ -2,6 +2,7 @@
   "rules": {
     "eol-last": "error",
     "indent": ["error", 2, { "SwitchCase": 1 }],
+    "no-mixed-spaces-and-tabs": "error",
     "no-trailing-spaces": "error",
     "one-var": ["error", { "initialized": "never" }]
   }

From 104725ebcb1c8ef9a242ea18577d1f34885974a0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 1 Apr 2018 14:33:45 -0400
Subject: [PATCH 239/529] tests: add missing tests for "name" option

---
 test/session.js | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/test/session.js b/test/session.js
index 2555e4a6..560be20b 100644
--- a/test/session.js
+++ b/test/session.js
@@ -880,6 +880,22 @@ describe('session()', function(){
     })
   })
 
+  describe('name option', function () {
+    it('should default to "connect.sid"', function (done) {
+      request(createServer())
+      .get('/')
+      .expect(shouldSetCookie('connect.sid'))
+      .expect(200, done)
+    })
+
+    it('should set the cookie name', function (done) {
+      request(createServer({ name: 'session_id' }))
+      .get('/')
+      .expect(shouldSetCookie('session_id'))
+      .expect(200, done)
+    })
+  })
+
   describe('rolling option', function(){
     it('should default to false', function(done){
       var server = createServer(null, function (req, res) {

From 7af7dfafc8203c5dabfa51c1a89d4a7c80b627b0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 15 Jun 2018 23:40:02 -0400
Subject: [PATCH 240/529] deps: safe-buffer@5.1.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 2407632d..5affdc34 100644
--- a/package.json
+++ b/package.json
@@ -17,7 +17,7 @@
     "depd": "~1.1.2",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.2",
-    "safe-buffer": "5.1.1",
+    "safe-buffer": "5.1.2",
     "uid-safe": "~2.1.5",
     "utils-merge": "1.0.1"
   },

From b33dad018e462ad386aa6db678bc5da2df3d423f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 16 Jun 2018 00:10:02 -0400
Subject: [PATCH 241/529] build: use yaml eslint configuration

---
 .eslintrc     | 9 ---------
 .eslintrc.yml | 7 +++++++
 2 files changed, 7 insertions(+), 9 deletions(-)
 delete mode 100644 .eslintrc
 create mode 100644 .eslintrc.yml

diff --git a/.eslintrc b/.eslintrc
deleted file mode 100644
index 6c53531a..00000000
--- a/.eslintrc
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "rules": {
-    "eol-last": "error",
-    "indent": ["error", 2, { "SwitchCase": 1 }],
-    "no-mixed-spaces-and-tabs": "error",
-    "no-trailing-spaces": "error",
-    "one-var": ["error", { "initialized": "never" }]
-  }
-}
diff --git a/.eslintrc.yml b/.eslintrc.yml
new file mode 100644
index 00000000..e48de5ea
--- /dev/null
+++ b/.eslintrc.yml
@@ -0,0 +1,7 @@
+root: true
+rules:
+  eol-last: error
+  indent: ["error", 2, { "SwitchCase": 1 }]
+  no-mixed-spaces-and-tabs: error
+  no-trailing-spaces: error
+  one-var: ["error", { "initialized": "never" }]

From 513f6b94943c8a8af5d540d4e831e996892ab074 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 16 Jun 2018 00:14:10 -0400
Subject: [PATCH 242/529] build: Node.js@9.11

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 21f2fe73..b0ed83c6 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,7 @@ node_js:
   - "6.14"
   - "7.10"
   - "8.11"
-  - "9.10"
+  - "9.11"
 sudo: false
 cache:
   directories:

From 32e10cf331a8f7f9c277175d383e70e935a3330c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 16 Jun 2018 00:19:01 -0400
Subject: [PATCH 243/529] build: support Node.js 10.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index b0ed83c6..36ea4cd4 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,6 +12,7 @@ node_js:
   - "7.10"
   - "8.11"
   - "9.11"
+  - "10.4"
 sudo: false
 cache:
   directories:

From ee11428d487439fb68a906b26c5f6f32370a57cf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 21 Sep 2018 10:02:11 -0400
Subject: [PATCH 244/529] build: restructure Travis CI build steps

---
 .travis.yml | 54 ++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 43 insertions(+), 11 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 36ea4cd4..b7d031b9 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -18,18 +18,50 @@ cache:
   directories:
     - node_modules
 before_install:
-  # Skip updating shrinkwrap / lock
-  - "npm config set shrinkwrap false"
+  # Configure npm
+  - |
+    # Skip updating shrinkwrap / lock
+    npm config set shrinkwrap false
   # Setup Node.js version-specific dependencies
-  - "test $TRAVIS_NODE_VERSION != '0.8' || npm rm --save-dev istanbul"
-  - "test $(echo $TRAVIS_NODE_VERSION | cut -d. -f1) -ge 4 || npm rm --save-dev eslint eslint-plugin-markdown"
+  - |
+    # eslint for linting
+    # - remove on Node.js < 4
+    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 4 ]]; then
+      node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
+        grep -E '^eslint(-|$)' | \
+        xargs npm rm --save-dev
+    fi
+  - |
+    # istanbul for coverage
+    # - remove on Node.js < 0.10
+    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -eq 0 && "$(cut -d. -f2 <<< "$TRAVIS_NODE_VERSION")" -lt 10 ]]; then
+      npm rm --save-dev istanbul
+    fi
   # Update Node.js modules
-  - "test ! -d node_modules || npm prune"
-  - "test ! -d node_modules || npm rebuild"
+  - |
+    # Prune & rebuild node_modules
+    if [[ -d node_modules ]]; then
+      npm prune
+      npm rebuild
+    fi
+
 script:
-  # Run test script, depending on istanbul install
-  - "test ! -z $(npm -ps ls istanbul) || npm test"
-  - "test   -z $(npm -ps ls istanbul) || npm run-script test-travis"
-  - "test   -z $(npm -ps ls eslint) || npm run-script lint"
+  - |
+    # Run test script, depending on istanbul install
+    if [[ -n "$(npm -ps ls istanbul)" ]]; then
+      npm run-script test-travis
+    else
+      npm test
+    fi
+  - |
+    # Run linting, depending on eslint install
+    if [[ -n "$(npm -ps ls eslint)" ]]; then
+      npm run-script lint
+    fi
 after_script:
-  - "test -e ./coverage/lcov.info && npm install coveralls@2 && cat ./coverage/lcov.info | coveralls"
+  - |
+    # Upload coverage to coveralls, if exists
+    if [[ -f ./coverage/lcov.info ]]; then
+      npm install --save-dev coveralls@2
+      coveralls < ./coverage/lcov.info
+    fi

From d1dd3664096d4b0755be30943897daee333a36fc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 21 Sep 2018 18:02:21 -0400
Subject: [PATCH 245/529] build: mocha@5.2.0

---
 .travis.yml  | 9 +++++++++
 package.json | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index b7d031b9..111c4d37 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -37,6 +37,15 @@ before_install:
     if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -eq 0 && "$(cut -d. -f2 <<< "$TRAVIS_NODE_VERSION")" -lt 10 ]]; then
       npm rm --save-dev istanbul
     fi
+  - |
+    # mocha for testing
+    # - use 2.x for Node.js < 0.10
+    # - use 3.x for Node.js < 6
+    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -eq 0 && "$(cut -d. -f2 <<< "$TRAVIS_NODE_VERSION")" -lt 10 ]]; then
+      npm install --save-dev mocha@2.5.3
+    elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 6 ]]; then
+      npm install --save-dev mocha@3.5.3
+    fi
   # Update Node.js modules
   - |
     # Prune & rebuild node_modules
diff --git a/package.json b/package.json
index 5affdc34..efe989af 100644
--- a/package.json
+++ b/package.json
@@ -28,7 +28,7 @@
     "eslint-plugin-markdown": "1.0.0-beta.6",
     "express": "4.16.3",
     "istanbul": "0.4.5",
-    "mocha": "2.5.3",
+    "mocha": "5.2.0",
     "supertest": "1.1.0"
   },
   "files": [

From 66cfdf163ca021fd1f985d87180ba355f18c7b0f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 21 Sep 2018 18:40:02 -0400
Subject: [PATCH 246/529] build: supertest@3.3.0

---
 .travis.yml  | 9 +++++++++
 package.json | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 111c4d37..f97db6fa 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -46,6 +46,15 @@ before_install:
     elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 6 ]]; then
       npm install --save-dev mocha@3.5.3
     fi
+  - |
+    # supertest for http calls
+    # - use 1.1.0 for Node.js < 0.10
+    # - use 2.0.0 for Node.js < 4
+    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -eq 0 && "$(cut -d. -f2 <<< "$TRAVIS_NODE_VERSION")" -lt 10 ]]; then
+      npm install --save-dev supertest@1.1.0
+    elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 4 ]]; then
+      npm install --save-dev supertest@2.0.0
+    fi
   # Update Node.js modules
   - |
     # Prune & rebuild node_modules
diff --git a/package.json b/package.json
index efe989af..bb4f41a2 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
     "express": "4.16.3",
     "istanbul": "0.4.5",
     "mocha": "5.2.0",
-    "supertest": "1.1.0"
+    "supertest": "3.3.0"
   },
   "files": [
     "session/",

From 57d8e81f1a486d9a1817f6295e422c85e2e18c34 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 21 Sep 2018 18:47:01 -0400
Subject: [PATCH 247/529] build: Node.js@8.12

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index f97db6fa..26fc35ee 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ node_js:
   - "5.12"
   - "6.14"
   - "7.10"
-  - "8.11"
+  - "8.12"
   - "9.11"
   - "10.4"
 sudo: false

From 45176f870965505f2715f3e534720a3fce4a1fe2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 21 Sep 2018 18:50:21 -0400
Subject: [PATCH 248/529] build: Node.js@10.11

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 26fc35ee..ee15ba74 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.12"
   - "9.11"
-  - "10.4"
+  - "10.11"
 sudo: false
 cache:
   directories:

From 1ab3e637d6599d45546eaf642aa6c21480b62b29 Mon Sep 17 00:00:00 2001
From: Felix Wu <david10608@gmail.com>
Date: Sun, 2 Sep 2018 00:58:00 +0200
Subject: [PATCH 249/529] docs: add connect-session-firebase to the list of
 session stores

closes #609
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index a316a018..3aa26b22 100644
--- a/README.md
+++ b/README.md
@@ -592,6 +592,11 @@ and other multi-core embedded devices).
 [connect-memjs-url]: https://www.npmjs.com/package/connect-memjs
 [connect-memjs-image]: https://img.shields.io/github/stars/liamdon/connect-memjs.svg?label=%E2%98%85
 
+[![★][connect-session-firebase-image] connect-session-firebase][connect-session-firebase-url] A session store based on the [Firebase Realtime Database](https://firebase.google.com/docs/database/)
+
+[connect-session-firebase-url]: https://www.npmjs.com/package/connect-session-firebase
+[connect-session-firebase-image]: https://img.shields.io/github/stars/benweier/connect-session-firebase.svg?label=%E2%98%85
+
 [![★][connect-session-knex-image] connect-session-knex][connect-session-knex-url] A session store using
 [Knex.js](http://knexjs.org/), which is a SQL query builder for PostgreSQL, MySQL, MariaDB, SQLite3, and Oracle.
 

From c846e3e906c85b82e7fedaa82c4f05b605954a4c Mon Sep 17 00:00:00 2001
From: Jonathan Price <jon.mark.price@gmail.com>
Date: Wed, 29 Aug 2018 16:20:16 -0700
Subject: [PATCH 250/529] docs: dix typo in readme about
 "req.session.cookie.maxAge"

closes #608
---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 3aa26b22..fbe3be92 100644
--- a/README.md
+++ b/README.md
@@ -392,8 +392,8 @@ req.session.cookie.maxAge = hour
 
 For example when `maxAge` is set to `60000` (one minute), and 30 seconds
 has elapsed it will return `30000` until the current request has completed,
-at which time `req.session.touch()` is called to reset `req.session.maxAge`
-to its original value.
+at which time `req.session.touch()` is called to reset
+`req.session.cookie.maxAge` to its original value.
 
 ```js
 req.session.cookie.maxAge // => 30000

From 785d094705b4e0a1b9f93c50a3ba7c8f5b32efb6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 24 Sep 2018 10:23:33 -0400
Subject: [PATCH 251/529] tests: use strict equality

---
 test/cookie.js  |  4 ++--
 test/session.js | 60 ++++++++++++++++++++++++-------------------------
 2 files changed, 32 insertions(+), 32 deletions(-)

diff --git a/test/cookie.js b/test/cookie.js
index ee1df956..6f6992c3 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -4,7 +4,7 @@ var Cookie = require('../session/cookie')
 
 describe('new Cookie()', function () {
   it('should create a new cookie object', function () {
-    assert.equal(typeof new Cookie(), 'object')
+    assert.strictEqual(typeof new Cookie(), 'object')
   })
 
   it('should default expires to null', function () {
@@ -29,7 +29,7 @@ describe('new Cookie()', function () {
 
   describe('with options', function () {
     it('should create a new cookie object', function () {
-      assert.equal(typeof new Cookie({}), 'object')
+      assert.strictEqual(typeof new Cookie({}), 'object')
     })
 
     it('should reject non-objects', function () {
diff --git a/test/session.js b/test/session.js
index 560be20b..7435b196 100644
--- a/test/session.js
+++ b/test/session.js
@@ -16,9 +16,9 @@ var min = 60 * 1000;
 
 describe('session()', function(){
   it('should export constructors', function(){
-    assert.equal(typeof session.Session, 'function')
-    assert.equal(typeof session.Store, 'function')
-    assert.equal(typeof session.MemoryStore, 'function')
+    assert.strictEqual(typeof session.Session, 'function')
+    assert.strictEqual(typeof session.Store, 'function')
+    assert.strictEqual(typeof session.MemoryStore, 'function')
   })
 
   it('should do nothing if req.session exists', function(done){
@@ -62,7 +62,7 @@ describe('session()', function(){
       if (err) return done(err)
       store.length(function (err, len) {
         if (err) return done(err)
-        assert.equal(len, 1)
+        assert.strictEqual(len, 1)
         done()
       })
     })
@@ -149,7 +149,7 @@ describe('session()', function(){
       if (err) return done(err)
       store.all(function (err, sess) {
         if (err) return done(err)
-        assert.equal(Object.keys(sess).length, 2)
+        assert.strictEqual(Object.keys(sess).length, 2)
         done()
       })
     }
@@ -254,7 +254,7 @@ describe('session()', function(){
       if (err) return done(err)
       store.length(function (err, length) {
         if (err) return done(err)
-        assert.equal(length, 0)
+        assert.strictEqual(length, 0)
         done()
       })
     })
@@ -280,7 +280,7 @@ describe('session()', function(){
         .get('/')
         .set('Cookie', cookie(res))
         .expect(shouldSetCookie('connect.sid'))
-        .expect(function (res) { assert.notEqual(originalExpires, expires(res)); })
+        .expect(function (res) { assert.notStrictEqual(originalExpires, expires(res)); })
         .expect(200, done);
       }, (1000 - (Date.now() % 1000) + 200));
     });
@@ -416,7 +416,7 @@ describe('session()', function(){
           if (err) return done(err)
           assert.ok(sess, 'session saved to store')
           var exp = new Date(sess.cookie.expires)
-          assert.equal(exp.toUTCString(), expires(res))
+          assert.strictEqual(exp.toUTCString(), expires(res))
           setTimeout(function () {
             request(server)
             .get('/')
@@ -425,9 +425,9 @@ describe('session()', function(){
               if (err) return done(err)
               store.get(id, function (err, sess) {
                 if (err) return done(err)
-                assert.equal(res.text, id)
+                assert.strictEqual(res.text, id)
                 assert.ok(sess, 'session still in store')
-                assert.notEqual(new Date(sess.cookie.expires).toUTCString(), exp.toUTCString(), 'session cookie expiration updated')
+                assert.notStrictEqual(new Date(sess.cookie.expires).toUTCString(), exp.toUTCString(), 'session cookie expiration updated')
                 done()
               })
             })
@@ -601,7 +601,7 @@ describe('session()', function(){
         setTimeout(function () {
           store.all(function (err, sess) {
             if (err) return done(err)
-            assert.equal(Object.keys(sess).length, 0)
+            assert.strictEqual(Object.keys(sess).length, 0)
             done()
           })
         }, 10)
@@ -1091,7 +1091,7 @@ describe('session()', function(){
 
       server.on('error', function onerror(err) {
         assert.ok(err)
-        assert.equal(err.message, 'boom!')
+        assert.strictEqual(err.message, 'boom!')
         cb()
       })
 
@@ -1169,7 +1169,7 @@ describe('session()', function(){
 
       server.on('error', function onerror(err) {
         assert.ok(err)
-        assert.equal(err.message, 'boom!')
+        assert.strictEqual(err.message, 'boom!')
         cb()
       })
 
@@ -1283,7 +1283,7 @@ describe('session()', function(){
         if (err) return done(err);
         store.length(function(err, len){
           if (err) return done(err);
-          assert.equal(len, 1)
+          assert.strictEqual(len, 1)
           request(server)
           .get('/')
           .set('Cookie', cookie(res))
@@ -1291,7 +1291,7 @@ describe('session()', function(){
             if (err) return done(err);
             store.length(function(err, len){
               if (err) return done(err);
-              assert.equal(len, 1)
+              assert.strictEqual(len, 1)
               done();
             });
           });
@@ -1314,7 +1314,7 @@ describe('session()', function(){
         if (err) return done(err);
         store.length(function(err, len){
           if (err) return done(err);
-          assert.equal(len, 1)
+          assert.strictEqual(len, 1)
           request(server)
           .get('/')
           .set('Cookie', cookie(res))
@@ -1322,7 +1322,7 @@ describe('session()', function(){
             if (err) return done(err);
             store.length(function(err, len){
               if (err) return done(err);
-              assert.equal(len, 0)
+              assert.strictEqual(len, 0)
               done();
             });
           });
@@ -1344,7 +1344,7 @@ describe('session()', function(){
         if (err) return done(err);
         store.length(function(err, len){
           if (err) return done(err);
-          assert.equal(len, 0)
+          assert.strictEqual(len, 0)
           done();
         });
       });
@@ -1364,7 +1364,7 @@ describe('session()', function(){
 
       server.on('error', function onerror(err) {
         assert.ok(err)
-        assert.equal(err.message, 'boom!')
+        assert.strictEqual(err.message, 'boom!')
         cb()
       })
 
@@ -1726,7 +1726,7 @@ describe('session()', function(){
                 if (err) return done(err);
                 store.get(id, function (err, sess) {
                   if (err) return done(err)
-                  assert.notEqual(new Date(sess.cookie.expires).getTime(), exp.getTime())
+                  assert.notStrictEqual(new Date(sess.cookie.expires).getTime(), exp.getTime())
                   done()
                 })
               })
@@ -2222,13 +2222,13 @@ function shouldSetCookie (name) {
     var header = cookie(res)
     var data = header && parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
-    assert.equal(data.name, name, 'should set cookie ' + name)
+    assert.strictEqual(data.name, name, 'should set cookie ' + name)
   }
 }
 
 function shouldSetCookieToDifferentSessionId (id) {
   return function (res) {
-    assert.notEqual(sid(res), id)
+    assert.notStrictEqual(sid(res), id)
   }
 }
 
@@ -2237,10 +2237,10 @@ function shouldSetCookieToExpireIn (name, delta) {
     var header = cookie(res)
     var data = header && parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
-    assert.equal(data.name, name, 'should set cookie ' + name)
+    assert.strictEqual(data.name, name, 'should set cookie ' + name)
     assert.ok(('expires' in data), 'should set cookie with attribute Expires')
     assert.ok(('date' in res.headers), 'should have a date header')
-    assert.equal((Date.parse(data.expires) - Date.parse(res.headers.date)), delta, 'should set cookie ' + name + ' to expire in ' + delta + ' ms')
+    assert.strictEqual((Date.parse(data.expires) - Date.parse(res.headers.date)), delta, 'should set cookie ' + name + ' to expire in ' + delta + ' ms')
   }
 }
 
@@ -2249,8 +2249,8 @@ function shouldSetCookieToValue (name, val) {
     var header = cookie(res)
     var data = header && parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
-    assert.equal(data.name, name, 'should set cookie ' + name)
-    assert.equal(data.value, val, 'should set cookie ' + name + ' to ' + val)
+    assert.strictEqual(data.name, name, 'should set cookie ' + name)
+    assert.strictEqual(data.value, val, 'should set cookie ' + name + ' to ' + val)
   }
 }
 
@@ -2259,7 +2259,7 @@ function shouldSetCookieWithAttribute (name, attrib) {
     var header = cookie(res)
     var data = header && parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
-    assert.equal(data.name, name, 'should set cookie ' + name)
+    assert.strictEqual(data.name, name, 'should set cookie ' + name)
     assert.ok((attrib.toLowerCase() in data), 'should set cookie with attribute ' + attrib)
   }
 }
@@ -2269,9 +2269,9 @@ function shouldSetCookieWithAttributeAndValue (name, attrib, value) {
     var header = cookie(res)
     var data = header && parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
-    assert.equal(data.name, name, 'should set cookie ' + name)
+    assert.strictEqual(data.name, name, 'should set cookie ' + name)
     assert.ok((attrib.toLowerCase() in data), 'should set cookie with attribute ' + attrib)
-    assert.equal(data[attrib.toLowerCase()], value, 'should set cookie with attribute ' + attrib + ' set to ' + value)
+    assert.strictEqual(data[attrib.toLowerCase()], value, 'should set cookie with attribute ' + attrib + ' set to ' + value)
   }
 }
 
@@ -2280,7 +2280,7 @@ function shouldSetCookieWithoutAttribute (name, attrib) {
     var header = cookie(res)
     var data = header && parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
-    assert.equal(data.name, name, 'should set cookie ' + name)
+    assert.strictEqual(data.name, name, 'should set cookie ' + name)
     assert.ok(!(attrib.toLowerCase() in data), 'should set cookie without attribute ' + attrib)
   }
 }

From a6402811c135ad59f75c2e0e365234ccfb25c0b5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 24 Sep 2018 14:13:14 -0400
Subject: [PATCH 252/529] tests: add describe level in "resave option" tests

---
 test/session.js | 174 +++++++++++++++++++++++++-----------------------
 1 file changed, 89 insertions(+), 85 deletions(-)

diff --git a/test/session.js b/test/session.js
index 7435b196..11607df6 100644
--- a/test/session.js
+++ b/test/session.js
@@ -993,116 +993,120 @@ describe('session()', function(){
       });
     });
 
-    it('should force save on unmodified session', function(done){
-      var store = new session.MemoryStore()
-      var server = createServer({ store: store, resave: true }, function (req, res) {
-        req.session.user = 'bob'
-        res.end()
-      })
+    describe('when true', function () {
+      it('should force save on unmodified session', function (done) {
+        var store = new session.MemoryStore()
+        var server = createServer({ store: store, resave: true }, function (req, res) {
+          req.session.user = 'bob'
+          res.end()
+        })
 
-      request(server)
-      .get('/')
-      .expect(shouldSetSessionInStore(store))
-      .expect(200, function(err, res){
-        if (err) return done(err);
         request(server)
         .get('/')
-        .set('Cookie', cookie(res))
         .expect(shouldSetSessionInStore(store))
-        .expect(200, done);
-      });
-    });
-
-    it('should prevent save on unmodified session', function(done){
-      var store = new session.MemoryStore()
-      var server = createServer({ store: store, resave: false }, function (req, res) {
-        req.session.user = 'bob'
-        res.end()
+        .expect(200, function (err, res) {
+          if (err) return done(err)
+          request(server)
+          .get('/')
+          .set('Cookie', cookie(res))
+          .expect(shouldSetSessionInStore(store))
+          .expect(200, done)
+        })
       })
+    })
+
+    describe('when false', function () {
+      it('should prevent save on unmodified session', function (done) {
+        var store = new session.MemoryStore()
+        var server = createServer({ store: store, resave: false }, function (req, res) {
+          req.session.user = 'bob'
+          res.end()
+        })
 
-      request(server)
-      .get('/')
-      .expect(shouldSetSessionInStore(store))
-      .expect(200, function(err, res){
-        if (err) return done(err);
         request(server)
         .get('/')
-        .set('Cookie', cookie(res))
-        .expect(shouldNotSetSessionInStore(store))
-        .expect(200, done);
-      });
-    });
-
-    it('should still save modified session', function(done){
-      var store = new session.MemoryStore()
-      var server = createServer({ store: store, resave: false }, function (req, res) {
-        req.session.count = req.session.count || 0
-        req.session.count++
-        res.end()
+        .expect(shouldSetSessionInStore(store))
+        .expect(200, function (err, res) {
+          if (err) return done(err)
+          request(server)
+          .get('/')
+          .set('Cookie', cookie(res))
+          .expect(shouldNotSetSessionInStore(store))
+          .expect(200, done)
+        })
       })
 
-      request(server)
-      .get('/')
-      .expect(shouldSetSessionInStore(store))
-      .expect(200, function(err, res){
-        if (err) return done(err);
+      it('should still save modified session', function (done) {
+        var store = new session.MemoryStore()
+        var server = createServer({ store: store, resave: false }, function (req, res) {
+          req.session.count = req.session.count || 0
+          req.session.count++
+          res.end()
+        })
+
         request(server)
         .get('/')
-        .set('Cookie', cookie(res))
         .expect(shouldSetSessionInStore(store))
-        .expect(200, done);
-      });
-    });
-
-    it('should detect a "cookie" property as modified', function (done) {
-      var store = new session.MemoryStore()
-      var server = createServer({ store: store, resave: false }, function (req, res) {
-        req.session.user = req.session.user || {}
-        req.session.user.name = 'bob'
-        req.session.user.cookie = req.session.user.cookie || 0
-        req.session.user.cookie++
-        res.end()
+        .expect(200, function (err, res) {
+          if (err) return done(err)
+          request(server)
+          .get('/')
+          .set('Cookie', cookie(res))
+          .expect(shouldSetSessionInStore(store))
+          .expect(200, done)
+        })
       })
 
-      request(server)
-      .get('/')
-      .expect(shouldSetSessionInStore(store))
-      .expect(200, function (err, res) {
-        if (err) return done(err)
+      it('should detect a "cookie" property as modified', function (done) {
+        var store = new session.MemoryStore()
+        var server = createServer({ store: store, resave: false }, function (req, res) {
+          req.session.user = req.session.user || {}
+          req.session.user.name = 'bob'
+          req.session.user.cookie = req.session.user.cookie || 0
+          req.session.user.cookie++
+          res.end()
+        })
+
         request(server)
         .get('/')
-        .set('Cookie', cookie(res))
         .expect(shouldSetSessionInStore(store))
-        .expect(200, done)
+        .expect(200, function (err, res) {
+          if (err) return done(err)
+          request(server)
+          .get('/')
+          .set('Cookie', cookie(res))
+          .expect(shouldSetSessionInStore(store))
+          .expect(200, done)
+        })
       })
-    })
 
-    it('should pass session touch error', function (done) {
-      var cb = after(2, done)
-      var store = new session.MemoryStore()
-      var server = createServer({ store: store, resave: false }, function (req, res) {
-        req.session.hit = true
-        res.end('session saved')
-      })
+      it('should pass session touch error', function (done) {
+        var cb = after(2, done)
+        var store = new session.MemoryStore()
+        var server = createServer({ store: store, resave: false }, function (req, res) {
+          req.session.hit = true
+          res.end('session saved')
+        })
 
-      store.touch = function touch(sid, sess, callback) {
-        callback(new Error('boom!'))
-      }
+        store.touch = function touch (sid, sess, callback) {
+          callback(new Error('boom!'))
+        }
 
-      server.on('error', function onerror(err) {
-        assert.ok(err)
-        assert.strictEqual(err.message, 'boom!')
-        cb()
-      })
+        server.on('error', function onerror (err) {
+          assert.ok(err)
+          assert.strictEqual(err.message, 'boom!')
+          cb()
+        })
 
-      request(server)
-      .get('/')
-      .expect(200, 'session saved', function (err, res) {
-        if (err) return cb(err)
         request(server)
         .get('/')
-        .set('Cookie', cookie(res))
-        .end(cb)
+        .expect(200, 'session saved', function (err, res) {
+          if (err) return cb(err)
+          request(server)
+          .get('/')
+          .set('Cookie', cookie(res))
+          .end(cb)
+        })
       })
     })
   });

From bcad89859fffe5e379dfa56d4ef82e19ca187111 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 24 Sep 2018 22:18:56 -0400
Subject: [PATCH 253/529] Fix issue where "resave: false" may not save altered
 sessions

---
 HISTORY.md      |  2 +-
 index.js        | 13 ++++++++++---
 package.json    |  1 -
 test/session.js | 33 ++++++++++++++++++++++++---------
 4 files changed, 35 insertions(+), 14 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 996baae3..b490c4ef 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,9 +1,9 @@
 unreleased
 ==========
 
+  * Fix issue where `resave: false` may not save altered sessions
   * Use `safe-buffer` for improved Buffer API
   * Use `Set-Cookie` as cookie header name for compatibility
-  * deps: crc@3.5.0
   * deps: depd@~1.1.2
     - perf: remove argument reassignment
 
diff --git a/index.js b/index.js
index d547e504..42639913 100644
--- a/index.js
+++ b/index.js
@@ -15,7 +15,7 @@
 
 var Buffer = require('safe-buffer').Buffer
 var cookie = require('cookie');
-var crc = require('crc').crc32;
+var crypto = require('crypto')
 var debug = require('debug')('express-session');
 var deprecate = require('depd')('express-session');
 var onHeaders = require('on-headers')
@@ -578,14 +578,21 @@ function getcookie(req, name, secrets) {
  */
 
 function hash(sess) {
-  return crc(JSON.stringify(sess, function (key, val) {
+  // serialize
+  var str = JSON.stringify(sess, function (key, val) {
     // ignore sess.cookie property
     if (this === sess && key === 'cookie') {
       return
     }
 
     return val
-  }))
+  })
+
+  // hash
+  return crypto
+    .createHash('sha1')
+    .update(str, 'utf8')
+    .digest('hex')
 }
 
 /**
diff --git a/package.json b/package.json
index bb4f41a2..c20cde2e 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,6 @@
   "dependencies": {
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
-    "crc": "3.5.0",
     "debug": "2.6.9",
     "depd": "~1.1.2",
     "on-headers": "~1.0.1",
diff --git a/test/session.js b/test/session.js
index 11607df6..6862ccc4 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1038,22 +1038,37 @@ describe('session()', function(){
 
       it('should still save modified session', function (done) {
         var store = new session.MemoryStore()
-        var server = createServer({ store: store, resave: false }, function (req, res) {
-          req.session.count = req.session.count || 0
-          req.session.count++
-          res.end()
+        var server = createServer({ resave: false, store: store }, function (req, res) {
+          if (req.method === 'PUT') {
+            req.session.token = req.url.substr(1)
+          }
+          res.end('token=' + (req.session.token || ''))
         })
 
         request(server)
-        .get('/')
+        .put('/w6RHhwaA')
+        .expect(200)
         .expect(shouldSetSessionInStore(store))
-        .expect(200, function (err, res) {
+        .expect('token=w6RHhwaA')
+        .end(function (err, res) {
           if (err) return done(err)
+          var sess = cookie(res)
           request(server)
           .get('/')
-          .set('Cookie', cookie(res))
-          .expect(shouldSetSessionInStore(store))
-          .expect(200, done)
+          .set('Cookie', sess)
+          .expect(200)
+          .expect(shouldNotSetSessionInStore(store))
+          .expect('token=w6RHhwaA')
+          .end(function (err) {
+            if (err) return done(err)
+            request(server)
+            .put('/zfQ3rzM3')
+            .set('Cookie', sess)
+            .expect(200)
+            .expect(shouldSetSessionInStore(store))
+            .expect('token=zfQ3rzM3')
+            .end(done)
+          })
         })
       })
 

From 582fa28d431d310b091ae452b90d3796c87f2da1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Oct 2018 23:02:21 -0400
Subject: [PATCH 254/529] build: express@4.16.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index c20cde2e..3a22636b 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "cookie-parser": "1.4.3",
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.0-beta.6",
-    "express": "4.16.3",
+    "express": "4.16.4",
     "istanbul": "0.4.5",
     "mocha": "5.2.0",
     "supertest": "3.3.0"

From 88a45366996a7a8481e1f3a94355104b1f910efa Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 17 Oct 2018 23:09:11 -0400
Subject: [PATCH 255/529] build: Node.js@10.12

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index ee15ba74..5a16d310 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.12"
   - "9.11"
-  - "10.11"
+  - "10.12"
 sudo: false
 cache:
   directories:

From df72a66a0e2ee18b76821ed99233b4acc7b4e462 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 27 Oct 2018 13:03:28 -0400
Subject: [PATCH 256/529] deps: depd@~2.0.0

---
 HISTORY.md   | 4 +++-
 package.json | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index b490c4ef..c91d901a 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -4,7 +4,9 @@ unreleased
   * Fix issue where `resave: false` may not save altered sessions
   * Use `safe-buffer` for improved Buffer API
   * Use `Set-Cookie` as cookie header name for compatibility
-  * deps: depd@~1.1.2
+  * deps: depd@~2.0.0
+    - Replace internal `eval` usage with `Function` constructor
+    - Use instance methods on `process` to check for listeners
     - perf: remove argument reassignment
 
 1.15.6 / 2017-09-26
diff --git a/package.json b/package.json
index 3a22636b..6c8ac6b9 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "cookie": "0.3.1",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
-    "depd": "~1.1.2",
+    "depd": "~2.0.0",
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.2",
     "safe-buffer": "5.1.2",

From 5fcc3e91591783cfadfe682c3adc1ce5b9d782d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Chyl=C3=BD?= <chyly@tomas-chyly.com>
Date: Mon, 8 Oct 2018 21:11:03 +0200
Subject: [PATCH 257/529] docs: add tch-nedb-session to the list of session
 stores

closes #617
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index fbe3be92..cd52f9b9 100644
--- a/README.md
+++ b/README.md
@@ -744,6 +744,11 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [sessionstore-url]: https://www.npmjs.com/package/sessionstore
 [sessionstore-image]: https://img.shields.io/github/stars/adrai/sessionstore.svg?label=%E2%98%85
 
+[![★][tch-nedb-session-image] tch-nedb-session][tch-nedb-session-url] A file system session store based on NeDB.
+
+[tch-nedb-session-url]: https://www.npmjs.com/package/tch-nedb-session
+[tch-nedb-session-image]: https://img.shields.io/github/stars/tomaschyly/NeDBSession.svg?label=%E2%98%85
+
 ## Example
 
 A simple example using `express-session` to store page views for a user.

From d943e3764aaf037aeb3c5e6abd3657a8977fa36d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 5 Nov 2018 00:12:30 -0500
Subject: [PATCH 258/529] build: Node.js@10.13

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 5a16d310..e84788db 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.12"
   - "9.11"
-  - "10.12"
+  - "10.13"
 sudo: false
 cache:
   directories:

From 2f971f95ca087e2fe4670aa3c6a35a94108f1cd0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 5 Nov 2018 00:43:11 -0500
Subject: [PATCH 259/529] docs: switch badges to badgen

---
 README.md | 116 +++++++++++++++++++++++++++---------------------------
 1 file changed, 58 insertions(+), 58 deletions(-)

diff --git a/README.md b/README.md
index cd52f9b9..2be21d2c 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # express-session
 
-[![NPM Version][npm-image]][npm-url]
-[![NPM Downloads][downloads-image]][downloads-url]
+[![NPM Version][npm-version-image]][npm-url]
+[![NPM Downloads][npm-downloads-image]][node-url]
 [![Build Status][travis-image]][travis-url]
 [![Test Coverage][coveralls-image]][coveralls-url]
 
@@ -492,262 +492,262 @@ module. Please make a PR to add additional modules :)
 [![★][aerospike-session-store-image] aerospike-session-store][aerospike-session-store-url] A session store using [Aerospike](http://www.aerospike.com/).
 
 [aerospike-session-store-url]: https://www.npmjs.com/package/aerospike-session-store
-[aerospike-session-store-image]: https://img.shields.io/github/stars/aerospike/aerospike-session-store-expressjs.svg?label=%E2%98%85
+[aerospike-session-store-image]: https://badgen.net/github/stars/aerospike/aerospike-session-store-expressjs?label=%E2%98%85
 
 [![★][cassandra-store-image] cassandra-store][cassandra-store-url] An Apache Cassandra-based session store.
 
 [cassandra-store-url]: https://www.npmjs.com/package/cassandra-store
-[cassandra-store-image]: https://img.shields.io/github/stars/webcc/cassandra-store.svg?label=%E2%98%85
+[cassandra-store-image]: https://badgen.net/github/stars/webcc/cassandra-store?label=%E2%98%85
 
 [![★][cluster-store-image] cluster-store][cluster-store-url] A wrapper for using in-process / embedded
 stores - such as SQLite (via knex), leveldb, files, or memory - with node cluster (desirable for Raspberry Pi 2
 and other multi-core embedded devices).
 
 [cluster-store-url]: https://www.npmjs.com/package/cluster-store
-[cluster-store-image]: https://img.shields.io/github/stars/coolaj86/cluster-store.svg?label=%E2%98%85
+[cluster-store-image]: https://badgen.net/github/stars/coolaj86/cluster-store?label=%E2%98%85
 
 [![★][connect-azuretables-image] connect-azuretables][connect-azuretables-url] An [Azure Table Storage](https://azure.microsoft.com/en-gb/services/storage/tables/)-based session store.
 
 [connect-azuretables-url]: https://www.npmjs.com/package/connect-azuretables
-[connect-azuretables-image]: https://img.shields.io/github/stars/mike-goodwin/connect-azuretables.svg?label=%E2%98%85
+[connect-azuretables-image]: https://badgen.net/github/stars/mike-goodwin/connect-azuretables?label=%E2%98%85
 
 [![★][connect-cloudant-store-image] connect-cloudant-store][connect-cloudant-store-url] An [IBM Cloudant](https://cloudant.com/)-based session store.
 
 [connect-cloudant-store-url]: https://www.npmjs.com/package/connect-cloudant-store
-[connect-cloudant-store-image]: https://img.shields.io/github/stars/adriantanasa/connect-cloudant-store.svg?label=%E2%98%85
+[connect-cloudant-store-image]: https://badgen.net/github/stars/adriantanasa/connect-cloudant-store?label=%E2%98%85
 
 [![★][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store.
 
 [connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase
-[connect-couchbase-image]: https://img.shields.io/github/stars/christophermina/connect-couchbase.svg?label=%E2%98%85
+[connect-couchbase-image]: https://badgen.net/github/stars/christophermina/connect-couchbase?label=%E2%98%85
 
 [![★][connect-datacache-image] connect-datacache][connect-datacache-url] An [IBM Bluemix Data Cache](http://www.ibm.com/cloud-computing/bluemix/)-based session store.
 
 [connect-datacache-url]: https://www.npmjs.com/package/connect-datacache
-[connect-datacache-image]: https://img.shields.io/github/stars/adriantanasa/connect-datacache.svg?label=%E2%98%85
+[connect-datacache-image]: https://badgen.net/github/stars/adriantanasa/connect-datacache?label=%E2%98%85
 
 [![★][@google-cloud/connect-datastore-image] @google-cloud/connect-datastore][@google-cloud/connect-datastore-url] A [Google Cloud Datastore](https://cloud.google.com/datastore/docs/concepts/overview)-based session store.
 
 [@google-cloud/connect-datastore-url]: https://www.npmjs.com/package/@google-cloud/connect-datastore
-[@google-cloud/connect-datastore-image]: https://img.shields.io/github/stars/GoogleCloudPlatform/cloud-datastore-session-node.svg?label=%E2%98%85
+[@google-cloud/connect-datastore-image]: https://badgen.net/github/stars/GoogleCloudPlatform/cloud-datastore-session-node?label=%E2%98%85
 
 [![★][connect-db2-image] connect-db2][connect-db2-url] An IBM DB2-based session store built using [ibm_db](https://www.npmjs.com/package/ibm_db) module.
 
 [connect-db2-url]: https://www.npmjs.com/package/connect-db2
-[connect-db2-image]: https://img.shields.io/github/stars/wallali/connect-db2.svg?label=%E2%98%85
+[connect-db2-image]: https://badgen.net/github/stars/wallali/connect-db2?label=%E2%98%85
 
 [![★][connect-dynamodb-image] connect-dynamodb][connect-dynamodb-url] A DynamoDB-based session store.
 
 [connect-dynamodb-url]: https://github.com/ca98am79/connect-dynamodb
-[connect-dynamodb-image]: https://img.shields.io/github/stars/ca98am79/connect-dynamodb.svg?label=%E2%98%85
+[connect-dynamodb-image]: https://badgen.net/github/stars/ca98am79/connect-dynamodb?label=%E2%98%85
 
 [![★][connect-loki-image] connect-loki][connect-loki-url] A Loki.js-based session store.
 
 [connect-loki-url]: https://www.npmjs.com/package/connect-loki
-[connect-loki-image]: https://img.shields.io/github/stars/Requarks/connect-loki.svg?label=%E2%98%85
+[connect-loki-image]: https://badgen.net/github/stars/Requarks/connect-loki?label=%E2%98%85
 
 [![★][connect-ml-image] connect-ml][connect-ml-url] A MarkLogic Server-based session store.
 
 [connect-ml-url]: https://www.npmjs.com/package/connect-ml
-[connect-ml-image]: https://img.shields.io/github/stars/bluetorch/connect-ml.svg?label=%E2%98%85
+[connect-ml-image]: https://badgen.net/github/stars/bluetorch/connect-ml?label=%E2%98%85
 
 [![★][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
 
 [connect-mssql-url]: https://www.npmjs.com/package/connect-mssql
-[connect-mssql-image]: https://img.shields.io/github/stars/patriksimek/connect-mssql.svg?label=%E2%98%85
+[connect-mssql-image]: https://badgen.net/github/stars/patriksimek/connect-mssql?label=%E2%98%85
 
 [![★][connect-monetdb-image] connect-monetdb][connect-monetdb-url] A MonetDB-based session store.
 
 [connect-monetdb-url]: https://www.npmjs.com/package/connect-monetdb
-[connect-monetdb-image]: https://img.shields.io/github/stars/MonetDB/npm-connect-monetdb.svg?label=%E2%98%85
+[connect-monetdb-image]: https://badgen.net/github/stars/MonetDB/npm-connect-monetdb?label=%E2%98%85
 
 [![★][connect-mongo-image] connect-mongo][connect-mongo-url] A MongoDB-based session store.
 
 [connect-mongo-url]: https://www.npmjs.com/package/connect-mongo
-[connect-mongo-image]: https://img.shields.io/github/stars/kcbanner/connect-mongo.svg?label=%E2%98%85
+[connect-mongo-image]: https://badgen.net/github/stars/kcbanner/connect-mongo?label=%E2%98%85
 
 [![★][connect-mongodb-session-image] connect-mongodb-session][connect-mongodb-session-url] Lightweight MongoDB-based session store built and maintained by MongoDB.
 
 [connect-mongodb-session-url]: https://www.npmjs.com/package/connect-mongodb-session
-[connect-mongodb-session-image]: https://img.shields.io/github/stars/mongodb-js/connect-mongodb-session.svg?label=%E2%98%85
+[connect-mongodb-session-image]: https://badgen.net/github/stars/mongodb-js/connect-mongodb-session?label=%E2%98%85
 
 [![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
 
 [connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple
-[connect-pg-simple-image]: https://img.shields.io/github/stars/voxpelli/node-connect-pg-simple.svg?label=%E2%98%85
+[connect-pg-simple-image]: https://badgen.net/github/stars/voxpelli/node-connect-pg-simple?label=%E2%98%85
 
 [![★][connect-redis-image] connect-redis][connect-redis-url] A Redis-based session store.
 
 [connect-redis-url]: https://www.npmjs.com/package/connect-redis
-[connect-redis-image]: https://img.shields.io/github/stars/tj/connect-redis.svg?label=%E2%98%85
+[connect-redis-image]: https://badgen.net/github/stars/tj/connect-redis?label=%E2%98%85
 
 [![★][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store.
 
 [connect-memcached-url]: https://www.npmjs.com/package/connect-memcached
-[connect-memcached-image]: https://img.shields.io/github/stars/balor/connect-memcached.svg?label=%E2%98%85
+[connect-memcached-image]: https://badgen.net/github/stars/balor/connect-memcached?label=%E2%98%85
 
 [![★][connect-memjs-image] connect-memjs][connect-memjs-url] A memcached-based session store using
 [memjs](https://www.npmjs.com/package/memjs) as the memcached client.
 
 [connect-memjs-url]: https://www.npmjs.com/package/connect-memjs
-[connect-memjs-image]: https://img.shields.io/github/stars/liamdon/connect-memjs.svg?label=%E2%98%85
+[connect-memjs-image]: https://badgen.net/github/stars/liamdon/connect-memjs?label=%E2%98%85
 
 [![★][connect-session-firebase-image] connect-session-firebase][connect-session-firebase-url] A session store based on the [Firebase Realtime Database](https://firebase.google.com/docs/database/)
 
 [connect-session-firebase-url]: https://www.npmjs.com/package/connect-session-firebase
-[connect-session-firebase-image]: https://img.shields.io/github/stars/benweier/connect-session-firebase.svg?label=%E2%98%85
+[connect-session-firebase-image]: https://badgen.net/github/stars/benweier/connect-session-firebase?label=%E2%98%85
 
 [![★][connect-session-knex-image] connect-session-knex][connect-session-knex-url] A session store using
 [Knex.js](http://knexjs.org/), which is a SQL query builder for PostgreSQL, MySQL, MariaDB, SQLite3, and Oracle.
 
 [connect-session-knex-url]: https://www.npmjs.com/package/connect-session-knex
-[connect-session-knex-image]: https://img.shields.io/github/stars/llambda/connect-session-knex.svg?label=%E2%98%85
+[connect-session-knex-image]: https://badgen.net/github/stars/llambda/connect-session-knex?label=%E2%98%85
 
 [![★][connect-session-sequelize-image] connect-session-sequelize][connect-session-sequelize-url] A session store using
 [Sequelize.js](http://sequelizejs.com/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL.
 
 [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize
-[connect-session-sequelize-image]: https://img.shields.io/github/stars/mweibel/connect-session-sequelize.svg?label=%E2%98%85
+[connect-session-sequelize-image]: https://badgen.net/github/stars/mweibel/connect-session-sequelize?label=%E2%98%85
 
 [![★][couchdb-expression-image] couchdb-expression][couchdb-expression-url] A [CouchDB](https://couchdb.apache.org/)-based session store.
 
 [couchdb-expression-url]: https://www.npmjs.com/package/couchdb-expression
-[couchdb-expression-image]: https://img.shields.io/github/stars/tkshnwesper/couchdb-expression.svg?label=%E2%98%85
+[couchdb-expression-image]: https://badgen.net/github/stars/tkshnwesper/couchdb-expression?label=%E2%98%85
 
 [![★][dynamodb-store-image] dynamodb-store][dynamodb-store-url] A DynamoDB-based session store.
 
 [dynamodb-store-url]: https://www.npmjs.com/package/dynamodb-store
-[dynamodb-store-image]: https://img.shields.io/github/stars/rafaelrpinto/dynamodb-store.svg?label=%E2%98%85
+[dynamodb-store-image]: https://badgen.net/github/stars/rafaelrpinto/dynamodb-store?label=%E2%98%85
 
 [![★][express-mysql-session-image] express-mysql-session][express-mysql-session-url] A session store using native
 [MySQL](https://www.mysql.com/) via the [node-mysql](https://github.com/felixge/node-mysql) module.
 
 [express-mysql-session-url]: https://www.npmjs.com/package/express-mysql-session
-[express-mysql-session-image]: https://img.shields.io/github/stars/chill117/express-mysql-session.svg?label=%E2%98%85
+[express-mysql-session-image]: https://badgen.net/github/stars/chill117/express-mysql-session?label=%E2%98%85
 
 [![★][express-oracle-session-image] express-oracle-session][express-oracle-session-url] A session store using native
 [oracle](https://www.oracle.com/) via the [node-oracledb](https://www.npmjs.com/package/oracledb) module.
 
 [express-oracle-session-url]: https://www.npmjs.com/package/express-oracle-session
-[express-oracle-session-image]: https://img.shields.io/github/stars/slumber86/express-oracle-session.svg?label=%E2%98%85
+[express-oracle-session-image]: https://badgen.net/github/stars/slumber86/express-oracle-session?label=%E2%98%85
 
 [![★][express-sessions-image] express-sessions][express-sessions-url]: A session store supporting both MongoDB and Redis.
 
 [express-sessions-url]: https://www.npmjs.com/package/express-sessions
-[express-sessions-image]: https://img.shields.io/github/stars/konteck/express-sessions.svg?label=%E2%98%85
+[express-sessions-image]: https://badgen.net/github/stars/konteck/express-sessions?label=%E2%98%85
 
 [![★][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store.
 
 [connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3
-[connect-sqlite3-image]: https://img.shields.io/github/stars/rawberg/connect-sqlite3.svg?label=%E2%98%85
+[connect-sqlite3-image]: https://badgen.net/github/stars/rawberg/connect-sqlite3?label=%E2%98%85
 
 [![★][documentdb-session-image] documentdb-session][documentdb-session-url] A session store for Microsoft Azure's [DocumentDB](https://azure.microsoft.com/en-us/services/documentdb/) NoSQL database service.
 
 [documentdb-session-url]: https://www.npmjs.com/package/documentdb-session
-[documentdb-session-image]: https://img.shields.io/github/stars/dwhieb/documentdb-session.svg?label=%E2%98%85
+[documentdb-session-image]: https://badgen.net/github/stars/dwhieb/documentdb-session?label=%E2%98%85
 
 [![★][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store.
 
 [express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session
-[express-nedb-session-image]: https://img.shields.io/github/stars/louischatriot/express-nedb-session.svg?label=%E2%98%85
+[express-nedb-session-image]: https://badgen.net/github/stars/louischatriot/express-nedb-session?label=%E2%98%85
 
 [![★][express-session-cache-manager-image] express-session-cache-manager][express-session-cache-manager-url]
 A store that implements [cache-manager](https://www.npmjs.com/package/cache-manager), which supports
 a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-engines).
 
 [express-session-cache-manager-url]: https://www.npmjs.com/package/express-session-cache-manager
-[express-session-cache-manager-image]: https://img.shields.io/github/stars/theogravity/express-session-cache-manager.svg?label=%E2%98%85
+[express-session-cache-manager-image]: https://badgen.net/github/stars/theogravity/express-session-cache-manager?label=%E2%98%85
 
 [![★][express-session-level-image] express-session-level][express-session-level-url] A [LevelDB](https://github.com/Level/levelup) based session store.
 
 [express-session-level-url]: https://www.npmjs.com/package/express-session-level
-[express-session-level-image]: https://img.shields.io/github/stars/tgohn/express-session-level.svg?label=%E2%98%85
+[express-session-level-image]: https://badgen.net/github/stars/tgohn/express-session-level?label=%E2%98%85
 
 [![★][express-etcd-image] express-etcd][express-etcd-url] An [etcd](https://github.com/stianeikeland/node-etcd) based session store.
 
 [express-etcd-url]: https://www.npmjs.com/package/express-etcd
-[express-etcd-image]: https://img.shields.io/github/stars/gildean/express-etcd.svg?label=%E2%98%85
+[express-etcd-image]: https://badgen.net/github/stars/gildean/express-etcd?label=%E2%98%85
 
 [![★][express-session-etcd3-image] express-session-etcd3][express-session-etcd3-url] An [etcd3](https://github.com/mixer/etcd3) based session store.
 
 [express-session-etcd3-url]: https://www.npmjs.com/package/express-session-etcd3
-[express-session-etcd3-image]: https://img.shields.io/github/stars/willgm/express-session-etcd3.svg?label=%E2%98%85
+[express-session-etcd3-image]: https://badgen.net/github/stars/willgm/express-session-etcd3?label=%E2%98%85
 
 [![★][firestore-store-image] firestore-store][firestore-store-url] A [Firestore](https://github.com/hendrysadrak/firestore-store)-based session store.
 
 [firestore-store-url]: https://github.com/hendrysadrak/firestore-store
-[firestore-store-image]: https://img.shields.io/github/stars/hendrysadrak/firestore-store.svg?label=%E2%98%85
+[firestore-store-image]: https://badgen.net/github/stars/hendrysadrak/firestore-store?label=%E2%98%85
 
 [![★][fortune-session-image] fortune-session][fortune-session-url] A [Fortune.js](https://github.com/fortunejs/fortune)
 based session store. Supports all backends supported by Fortune (MongoDB, Redis, Postgres, NeDB).
 
 [fortune-session-url]: https://www.npmjs.com/package/fortune-session
-[fortune-session-image]: https://img.shields.io/github/stars/aliceklipper/fortune-session.svg?label=%E2%98%85
+[fortune-session-image]: https://badgen.net/github/stars/aliceklipper/fortune-session?label=%E2%98%85
 
 [![★][hazelcast-store-image] hazelcast-store][hazelcast-store-url] A Hazelcast-based session store built on the [Hazelcast Node Client](https://www.npmjs.com/package/hazelcast-client).
 
 [hazelcast-store-url]: https://www.npmjs.com/package/hazelcast-store
-[hazelcast-store-image]: https://img.shields.io/github/stars/jackspaniel/hazelcast-store.svg?label=%E2%98%85
+[hazelcast-store-image]: https://badgen.net/github/stars/jackspaniel/hazelcast-store?label=%E2%98%85
 
 [![★][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store.
 
 [level-session-store-url]: https://www.npmjs.com/package/level-session-store
-[level-session-store-image]: https://img.shields.io/github/stars/scriptollc/level-session-store.svg?label=%E2%98%85
+[level-session-store-image]: https://badgen.net/github/stars/scriptollc/level-session-store?label=%E2%98%85
 
 [![★][medea-session-store-image] medea-session-store][medea-session-store-url] A Medea-based session store.
 
 [medea-session-store-url]: https://www.npmjs.com/package/medea-session-store
-[medea-session-store-image]: https://img.shields.io/github/stars/BenjaminVadant/medea-session-store.svg?label=%E2%98%85
+[medea-session-store-image]: https://badgen.net/github/stars/BenjaminVadant/medea-session-store?label=%E2%98%85
 
 [![★][memorystore-image] memorystore][memorystore-url] A memory session store made for production.
 
 [memorystore-url]: https://www.npmjs.com/package/memorystore
-[memorystore-image]: https://img.shields.io/github/stars/roccomuso/memorystore.svg?label=%E2%98%85
+[memorystore-image]: https://badgen.net/github/stars/roccomuso/memorystore?label=%E2%98%85
 
 [![★][mssql-session-store-image] mssql-session-store][mssql-session-store-url] A SQL Server-based session store.
 
 [mssql-session-store-url]: https://www.npmjs.com/package/mssql-session-store
-[mssql-session-store-image]: https://img.shields.io/github/stars/jwathen/mssql-session-store.svg?label=%E2%98%85
+[mssql-session-store-image]: https://badgen.net/github/stars/jwathen/mssql-session-store?label=%E2%98%85
 
 [![★][nedb-session-store-image] nedb-session-store][nedb-session-store-url] An alternate NeDB-based (either in-memory or file-persisted) session store.
 
 [nedb-session-store-url]: https://www.npmjs.com/package/nedb-session-store
-[nedb-session-store-image]: https://img.shields.io/github/stars/JamesMGreene/nedb-session-store.svg?label=%E2%98%85
+[nedb-session-store-image]: https://badgen.net/github/stars/JamesMGreene/nedb-session-store?label=%E2%98%85
 
 [![★][restsession-image] restsession][restsession-url] Store sessions utilizing a RESTful API
 
 [restsession-url]: https://www.npmjs.com/package/restsession
-[restsession-image]: https://img.shields.io/github/stars/jankal/restsession.svg?label=%E2%98%85
+[restsession-image]: https://badgen.net/github/stars/jankal/restsession?label=%E2%98%85
 
 [![★][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](http://sequelizejs.com/).
 
 [sequelstore-connect-url]: https://www.npmjs.com/package/sequelstore-connect
-[sequelstore-connect-image]: https://img.shields.io/github/stars/MattMcFarland/sequelstore-connect.svg?label=%E2%98%85
+[sequelstore-connect-image]: https://badgen.net/github/stars/MattMcFarland/sequelstore-connect?label=%E2%98%85
 
 [![★][session-file-store-image] session-file-store][session-file-store-url] A file system-based session store.
 
 [session-file-store-url]: https://www.npmjs.com/package/session-file-store
-[session-file-store-image]: https://img.shields.io/github/stars/valery-barysok/session-file-store.svg?label=%E2%98%85
+[session-file-store-image]: https://badgen.net/github/stars/valery-barysok/session-file-store?label=%E2%98%85
 
 [![★][session-pouchdb-store-image] session-pouchdb-store][session-pouchdb-store-url] Session store for PouchDB / CouchDB. Accepts embedded, custom, or remote PouchDB instance and realtime synchronization.
 
 [session-pouchdb-store-url]: https://www.npmjs.com/package/session-pouchdb-store
-[session-pouchdb-store-image]: https://img.shields.io/github/stars/solzimer/session-pouchdb-store.svg?label=%E2%98%85
+[session-pouchdb-store-image]: https://badgen.net/github/stars/solzimer/session-pouchdb-store?label=%E2%98%85
 
 [![★][session-rethinkdb-image] session-rethinkdb][session-rethinkdb-url] A [RethinkDB](http://rethinkdb.com/)-based session store.
 
 [session-rethinkdb-url]: https://www.npmjs.com/package/session-rethinkdb
-[session-rethinkdb-image]: https://img.shields.io/github/stars/llambda/session-rethinkdb.svg?label=%E2%98%85
+[session-rethinkdb-image]: https://badgen.net/github/stars/llambda/session-rethinkdb?label=%E2%98%85
 
 [![★][sessionstore-image] sessionstore][sessionstore-url] A session store that works with various databases.
 
 [sessionstore-url]: https://www.npmjs.com/package/sessionstore
-[sessionstore-image]: https://img.shields.io/github/stars/adrai/sessionstore.svg?label=%E2%98%85
+[sessionstore-image]: https://badgen.net/github/stars/adrai/sessionstore?label=%E2%98%85
 
 [![★][tch-nedb-session-image] tch-nedb-session][tch-nedb-session-url] A file system session store based on NeDB.
 
 [tch-nedb-session-url]: https://www.npmjs.com/package/tch-nedb-session
-[tch-nedb-session-image]: https://img.shields.io/github/stars/tomaschyly/NeDBSession.svg?label=%E2%98%85
+[tch-nedb-session-image]: https://badgen.net/github/stars/tomaschyly/NeDBSession?label=%E2%98%85
 
 ## Example
 
@@ -793,11 +793,11 @@ app.get('/bar', function (req, res, next) {
 
 [MIT](LICENSE)
 
-[npm-image]: https://img.shields.io/npm/v/express-session.svg
+[coveralls-image]: https://badgen.net/coveralls/c/github/expressjs/session/master
+[coveralls-url]: https://coveralls.io/r/expressjs/session?branch=master
+[node-url]: https://nodejs.org/en/download
+[npm-downloads-image]: https://badgen.net/npm/dm/express-session
 [npm-url]: https://npmjs.org/package/express-session
-[travis-image]: https://img.shields.io/travis/expressjs/session/master.svg
+[npm-version-image]: https://badgen.net/npm/v/express-session
+[travis-image]: https://badgen.net/travis/expressjs/session/master
 [travis-url]: https://travis-ci.org/expressjs/session
-[coveralls-image]: https://img.shields.io/coveralls/expressjs/session/master.svg
-[coveralls-url]: https://coveralls.io/r/expressjs/session?branch=master
-[downloads-image]: https://img.shields.io/npm/dm/express-session.svg
-[downloads-url]: https://npmjs.org/package/express-session

From 868c5fb9adc37dd6b2db4520c6c1c60c5875207d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 5 Nov 2018 13:09:27 -0500
Subject: [PATCH 260/529] tests: add maxAge to new Cookie tests

---
 test/cookie.js | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/test/cookie.js b/test/cookie.js
index 6f6992c3..dc083e85 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -12,6 +12,11 @@ describe('new Cookie()', function () {
     assert.strictEqual(cookie.expires, null)
   })
 
+  it('should default maxAge to null', function () {
+    var cookie = new Cookie()
+    assert.strictEqual(cookie.maxAge, null)
+  })
+
   it('should default httpOnly to true', function () {
     var cookie = new Cookie()
     assert.strictEqual(cookie.httpOnly, true)
@@ -53,6 +58,15 @@ describe('new Cookie()', function () {
       assert.strictEqual(cookie.httpOnly, false)
     })
 
+    it('should set maxAge', function () {
+      var maxAge = 60000
+      var cookie = new Cookie({ maxAge: maxAge })
+
+      assert.ok(cookie.expires.getTime() - Date.now() - 1000 <= maxAge)
+      assert.ok(cookie.expires.getTime() - Date.now() + 1000 >= maxAge)
+      assert.strictEqual(cookie.maxAge, maxAge)
+    })
+
     it('should set path', function () {
       var cookie = new Cookie({ path: '/foo' })
 

From 19b4f4ed410b3d045c634a37a218efd843ad4e09 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 5 Nov 2018 13:14:30 -0500
Subject: [PATCH 261/529] tests: reorganize new Cookie options tests

---
 test/cookie.js | 55 ++++++++++++++++++++++++++++++++++----------------
 1 file changed, 38 insertions(+), 17 deletions(-)

diff --git a/test/cookie.js b/test/cookie.js
index dc083e85..cac5ef6f 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -44,33 +44,54 @@ describe('new Cookie()', function () {
       assert.throws(function () { new Cookie(function () {}) }, /argument options/)
     })
 
-    it('should set expires', function () {
-      var expires = new Date()
-      var cookie = new Cookie({ expires: expires })
+    describe('expires', function () {
+      it('should set expires', function () {
+        var expires = new Date(Date.now() + 60000)
+        var cookie = new Cookie({ expires: expires })
 
-      assert.strictEqual(cookie.expires, expires)
-      assert.notStrictEqual(cookie.maxAge, null)
+        assert.strictEqual(cookie.expires, expires)
+      })
+
+      it('should set maxAge', function () {
+        var expires = new Date(Date.now() + 60000)
+        var cookie = new Cookie({ expires: expires })
+
+        assert.ok(expires.getTime() - Date.now() - 1000 <= cookie.maxAge)
+        assert.ok(expires.getTime() - Date.now() + 1000 >= cookie.maxAge)
+      })
     })
 
-    it('should set httpOnly', function () {
-      var cookie = new Cookie({ httpOnly: false })
+    describe('httpOnly', function () {
+      it('should set httpOnly', function () {
+        var cookie = new Cookie({ httpOnly: false })
 
-      assert.strictEqual(cookie.httpOnly, false)
+        assert.strictEqual(cookie.httpOnly, false)
+      })
     })
 
-    it('should set maxAge', function () {
-      var maxAge = 60000
-      var cookie = new Cookie({ maxAge: maxAge })
+    describe('maxAge', function () {
+      it('should set expires', function () {
+        var maxAge = 60000
+        var cookie = new Cookie({ maxAge: maxAge })
+
+        assert.ok(cookie.expires.getTime() - Date.now() - 1000 <= maxAge)
+        assert.ok(cookie.expires.getTime() - Date.now() + 1000 >= maxAge)
+      })
+
+      it('should set maxAge', function () {
+        var maxAge = 60000
+        var cookie = new Cookie({ maxAge: maxAge })
 
-      assert.ok(cookie.expires.getTime() - Date.now() - 1000 <= maxAge)
-      assert.ok(cookie.expires.getTime() - Date.now() + 1000 >= maxAge)
-      assert.strictEqual(cookie.maxAge, maxAge)
+        assert.strictEqual(cookie.maxAge, maxAge)
+      })
     })
 
-    it('should set path', function () {
-      var cookie = new Cookie({ path: '/foo' })
+    describe('path', function () {
+      it('should set path', function () {
+        var cookie = new Cookie({ path: '/foo' })
 
-      assert.strictEqual(cookie.path, '/foo')
+        assert.strictEqual(cookie.path, '/foo')
+      })
     })
   })
 })

From 2cf079688afcce6824da8345935bc20fdb96c5ae Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 5 Nov 2018 13:27:09 -0500
Subject: [PATCH 262/529] tests: add tests for Date as maxAge

---
 test/cookie.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/test/cookie.js b/test/cookie.js
index cac5ef6f..80409876 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -84,6 +84,15 @@ describe('new Cookie()', function () {
 
         assert.strictEqual(cookie.maxAge, maxAge)
       })
+
+      it('should accept Date object', function () {
+        var maxAge = new Date(Date.now() + 60000)
+        var cookie = new Cookie({ maxAge: maxAge })
+
+        assert.strictEqual(cookie.expires.getTime(), maxAge.getTime())
+        assert.ok(maxAge.getTime() - Date.now() - 1000 <= cookie.maxAge)
+        assert.ok(maxAge.getTime() - Date.now() + 1000 >= cookie.maxAge)
+      })
     })
 
     describe('path', function () {

From 784d7434da9a34a44c7d93959e4b18bf8285d9f1 Mon Sep 17 00:00:00 2001
From: Paul Berg <hello@paulrberg.com>
Date: Sat, 31 Mar 2018 20:15:52 +0100
Subject: [PATCH 263/529] Catch invalid cookie.maxAge value earlier

closes #432
closes #574
---
 HISTORY.md        | 1 +
 session/cookie.js | 4 ++++
 test/cookie.js    | 6 ++++++
 3 files changed, 11 insertions(+)

diff --git a/HISTORY.md b/HISTORY.md
index c91d901a..6a775a6c 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Catch invalid `cookie.maxAge` value earlier
   * Fix issue where `resave: false` may not save altered sessions
   * Use `safe-buffer` for improved Buffer API
   * Use `Set-Cookie` as cookie header name for compatibility
diff --git a/session/cookie.js b/session/cookie.js
index edac988f..bf8ee33b 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -77,6 +77,10 @@ Cookie.prototype = {
    */
 
   set maxAge(ms) {
+    if (ms && typeof ms !== 'number' && !(ms instanceof Date)) {
+      throw new TypeError('maxAge must be a number or Date')
+    }
+
     this.expires = 'number' == typeof ms
       ? new Date(Date.now() + ms)
       : ms;
diff --git a/test/cookie.js b/test/cookie.js
index 80409876..4cca87bb 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -93,6 +93,12 @@ describe('new Cookie()', function () {
         assert.ok(maxAge.getTime() - Date.now() - 1000 <= cookie.maxAge)
         assert.ok(maxAge.getTime() - Date.now() + 1000 >= cookie.maxAge)
       })
+
+      it('should reject invalid types', function() {
+        assert.throws(function() { new Cookie({ maxAge: '42' }) }, /maxAge/)
+        assert.throws(function() { new Cookie({ maxAge: true }) }, /maxAge/)
+        assert.throws(function() { new Cookie({ maxAge: function () {} }) }, /maxAge/)
+      })
     })
 
     describe('path', function () {

From ad717fe9aeaf9af016ab72cdaf25b490ebde8591 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 20 Nov 2018 15:05:13 -0500
Subject: [PATCH 264/529] Remove utils-merge dependency

---
 HISTORY.md        | 1 +
 package.json      | 3 +--
 session/cookie.js | 5 +++--
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 6a775a6c..1e5a3a40 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -3,6 +3,7 @@ unreleased
 
   * Catch invalid `cookie.maxAge` value earlier
   * Fix issue where `resave: false` may not save altered sessions
+  * Remove `utils-merge` dependency
   * Use `safe-buffer` for improved Buffer API
   * Use `Set-Cookie` as cookie header name for compatibility
   * deps: depd@~2.0.0
diff --git a/package.json b/package.json
index 6c8ac6b9..03d016eb 100644
--- a/package.json
+++ b/package.json
@@ -17,8 +17,7 @@
     "on-headers": "~1.0.1",
     "parseurl": "~1.3.2",
     "safe-buffer": "5.1.2",
-    "uid-safe": "~2.1.5",
-    "utils-merge": "1.0.1"
+    "uid-safe": "~2.1.5"
   },
   "devDependencies": {
     "after": "0.8.2",
diff --git a/session/cookie.js b/session/cookie.js
index bf8ee33b..ae7e7d7a 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -12,7 +12,6 @@
  */
 
 var cookie = require('cookie')
-var merge = require('utils-merge')
 
 /**
  * Initialize a new `Cookie` with the given `options`.
@@ -32,7 +31,9 @@ var Cookie = module.exports = function Cookie(options) {
       throw new TypeError('argument options must be a object')
     }
 
-    merge(this, options)
+    for (var key in options) {
+      this[key] = options[key]
+    }
   }
 
   this.originalMaxAge = undefined == this.originalMaxAge

From 15fe12144527ed3ca60781f7993e446e74b5c3e6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 20 Nov 2018 15:33:24 -0500
Subject: [PATCH 265/529] Deprecate setting cookie.maxAge to a Date object

---
 HISTORY.md        | 1 +
 session/cookie.js | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/HISTORY.md b/HISTORY.md
index 1e5a3a40..d9ca7e60 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Catch invalid `cookie.maxAge` value earlier
+  * Deprecate setting `cookie.maxAge` to a `Date` object
   * Fix issue where `resave: false` may not save altered sessions
   * Remove `utils-merge` dependency
   * Use `safe-buffer` for improved Buffer API
diff --git a/session/cookie.js b/session/cookie.js
index ae7e7d7a..1dd9bf95 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -12,6 +12,7 @@
  */
 
 var cookie = require('cookie')
+var deprecate = require('depd')('express-session')
 
 /**
  * Initialize a new `Cookie` with the given `options`.
@@ -82,6 +83,10 @@ Cookie.prototype = {
       throw new TypeError('maxAge must be a number or Date')
     }
 
+    if (ms instanceof Date) {
+      deprecate('maxAge as Date; pass number of milliseconds instead')
+    }
+
     this.expires = 'number' == typeof ms
       ? new Date(Date.now() + ms)
       : ms;

From a856618f4d7d3f88f1620608acda46485a939f9e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Nov 2018 00:30:28 -0500
Subject: [PATCH 266/529] build: eslint-plugin-markdown@1.0.0-rc.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 03d016eb..eed1ff33 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
     "after": "0.8.2",
     "cookie-parser": "1.4.3",
     "eslint": "3.19.0",
-    "eslint-plugin-markdown": "1.0.0-beta.6",
+    "eslint-plugin-markdown": "1.0.0-rc.1",
     "express": "4.16.4",
     "istanbul": "0.4.5",
     "mocha": "5.2.0",

From 0f5913ceb5812f6f24738a776d3502797388e0b7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Nov 2018 00:37:22 -0500
Subject: [PATCH 267/529] build: Node.js@8.13

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index e84788db..361d170e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ node_js:
   - "5.12"
   - "6.14"
   - "7.10"
-  - "8.12"
+  - "8.13"
   - "9.11"
   - "10.13"
 sudo: false

From 6a3cf0ec90261faeec48854ceb91be6aced00a4f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 21 Nov 2018 00:56:21 -0500
Subject: [PATCH 268/529] build: support Node.js 11.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 361d170e..0cd58dbe 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,6 +13,7 @@ node_js:
   - "8.13"
   - "9.11"
   - "10.13"
+  - "11.2"
 sudo: false
 cache:
   directories:

From 5508375d95796b402b6c32d710911a86a559ea10 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 22 Jan 2019 23:41:20 -0500
Subject: [PATCH 269/529] build: Node.js@6.16

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 0cd58dbe..22cb8b69 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "3.3"
   - "4.9"
   - "5.12"
-  - "6.14"
+  - "6.16"
   - "7.10"
   - "8.13"
   - "9.11"

From 80bf8b28c2f86c560a7840a251635f95ff35f668 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Jan 2019 01:27:10 -0500
Subject: [PATCH 270/529] build: Node.js@8.15

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 22cb8b69..5b2ebd48 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ node_js:
   - "5.12"
   - "6.16"
   - "7.10"
-  - "8.13"
+  - "8.15"
   - "9.11"
   - "10.13"
   - "11.2"

From dd21b1401eb570514495e8d64ce1c5c371d405da Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Jan 2019 01:32:33 -0500
Subject: [PATCH 271/529] build: Node.js@10.15

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 5b2ebd48..7950bb88 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.15"
   - "9.11"
-  - "10.13"
+  - "10.15"
   - "11.2"
 sudo: false
 cache:

From 73cbcb01162abdb2b4de43bd6390f8c9b6ebf78e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Jan 2019 01:39:03 -0500
Subject: [PATCH 272/529] build: Node.js@11.7

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 7950bb88..33ce5cfd 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "8.15"
   - "9.11"
   - "10.15"
-  - "11.2"
+  - "11.7"
 sudo: false
 cache:
   directories:

From 787721123331bdf122e895762676043aee2386fc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 1 Feb 2019 12:09:28 -0500
Subject: [PATCH 273/529] build: supertest@3.4.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index eed1ff33..f8e53c81 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.16.4",
     "istanbul": "0.4.5",
     "mocha": "5.2.0",
-    "supertest": "3.3.0"
+    "supertest": "3.4.2"
   },
   "files": [
     "session/",

From a7b66fb94d09fd9f701c836c7af05b0dc711dfb7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 14 Feb 2019 12:50:13 -0500
Subject: [PATCH 274/529] build: Node.js@11.9

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 33ce5cfd..2a828984 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "8.15"
   - "9.11"
   - "10.15"
-  - "11.7"
+  - "11.9"
 sudo: false
 cache:
   directories:

From 85c0ff56b71a691d422353b7e46d8dd9c4fd6a68 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 14 Feb 2019 12:54:10 -0500
Subject: [PATCH 275/529] build: fix istanbul/eslint detection in Travis CI

---
 .travis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 2a828984..0eba9a47 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -67,14 +67,14 @@ before_install:
 script:
   - |
     # Run test script, depending on istanbul install
-    if [[ -n "$(npm -ps ls istanbul)" ]]; then
+    if npm -ps ls istanbul | grep -q istanbul; then
       npm run-script test-travis
     else
       npm test
     fi
   - |
     # Run linting, depending on eslint install
-    if [[ -n "$(npm -ps ls eslint)" ]]; then
+    if npm -ps ls eslint | grep -q eslint; then
       npm run-script lint
     fi
 after_script:

From 6e3ff5dffe4ce26c239cb7b5da1d1c797306bdca Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 14 Feb 2019 13:31:54 -0500
Subject: [PATCH 276/529] build: make Travis CI version compare readable

---
 .travis.yml | 30 ++++++++++++++++++------------
 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 0eba9a47..7f60f4e3 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -19,6 +19,12 @@ cache:
   directories:
     - node_modules
 before_install:
+  - |
+    function v () {
+      tr '.' '\n' <<< "${1}" \
+        | awk '{ printf "%03d", $0 }' \
+        | sed 's/^0*//'
+    }
   # Configure npm
   - |
     # Skip updating shrinkwrap / lock
@@ -26,34 +32,34 @@ before_install:
   # Setup Node.js version-specific dependencies
   - |
     # eslint for linting
-    # - remove on Node.js < 4
-    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 4 ]]; then
+    if [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '4.0')" ]]; then
+      # - remove on Node.js < 4
       node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
         grep -E '^eslint(-|$)' | \
         xargs npm rm --save-dev
     fi
   - |
     # istanbul for coverage
-    # - remove on Node.js < 0.10
-    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -eq 0 && "$(cut -d. -f2 <<< "$TRAVIS_NODE_VERSION")" -lt 10 ]]; then
+    if [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '0.10')" ]]; then
+      # - remove on Node.js < 0.10
       npm rm --save-dev istanbul
     fi
   - |
     # mocha for testing
-    # - use 2.x for Node.js < 0.10
-    # - use 3.x for Node.js < 6
-    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -eq 0 && "$(cut -d. -f2 <<< "$TRAVIS_NODE_VERSION")" -lt 10 ]]; then
+    if [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '0.10')" ]]; then
+      # - use 2.x for Node.js < 0.10
       npm install --save-dev mocha@2.5.3
-    elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 6 ]]; then
+    elif [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '6.0')" ]]; then
+      # - use 3.x for Node.js < 6
       npm install --save-dev mocha@3.5.3
     fi
   - |
     # supertest for http calls
-    # - use 1.1.0 for Node.js < 0.10
-    # - use 2.0.0 for Node.js < 4
-    if [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -eq 0 && "$(cut -d. -f2 <<< "$TRAVIS_NODE_VERSION")" -lt 10 ]]; then
+    if [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '0.10')" ]]; then
+      # - use 1.1.0 for Node.js < 0.10
       npm install --save-dev supertest@1.1.0
-    elif [[ "$(cut -d. -f1 <<< "$TRAVIS_NODE_VERSION")" -lt 4 ]]; then
+    elif [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '4.0')" ]]; then
+      # - use 2.0.0 for Node.js < 4
       npm install --save-dev supertest@2.0.0
     fi
   # Update Node.js modules

From fee8e68b1d77bf7cf3cba1b588a5cfdd8ccc7656 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 15 Feb 2019 11:49:53 -0500
Subject: [PATCH 277/529] build: eslint-plugin-markdown@1.0.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f8e53c81..d473f546 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
     "after": "0.8.2",
     "cookie-parser": "1.4.3",
     "eslint": "3.19.0",
-    "eslint-plugin-markdown": "1.0.0-rc.1",
+    "eslint-plugin-markdown": "1.0.0",
     "express": "4.16.4",
     "istanbul": "0.4.5",
     "mocha": "5.2.0",

From 99288b44c2a1f5057cdd44eb8fb116c41361407c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 15 Feb 2019 11:50:30 -0500
Subject: [PATCH 278/529] build: cookie-parser@1.4.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index d473f546..158f6310 100644
--- a/package.json
+++ b/package.json
@@ -21,7 +21,7 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "cookie-parser": "1.4.3",
+    "cookie-parser": "1.4.4",
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.0",
     "express": "4.16.4",

From 3602d293b51cf81bf02742b764e32426a0384a56 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 23 Feb 2019 20:03:39 -0500
Subject: [PATCH 279/529] build: Node.js@11.10

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 7f60f4e3..aa29ae70 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "8.15"
   - "9.11"
   - "10.15"
-  - "11.9"
+  - "11.10"
 sudo: false
 cache:
   directories:

From eda02b213370399e0ec21fd141399252075f7ff9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 23 Feb 2019 20:18:02 -0500
Subject: [PATCH 280/529] deps: on-headers@~1.0.2

---
 HISTORY.md   | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index d9ca7e60..b21a4b41 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -11,6 +11,8 @@ unreleased
     - Replace internal `eval` usage with `Function` constructor
     - Use instance methods on `process` to check for listeners
     - perf: remove argument reassignment
+  * deps: on-headers@~1.0.2
+    - Fix `res.writeHead` patch missing return value
 
 1.15.6 / 2017-09-26
 ===================
diff --git a/package.json b/package.json
index 158f6310..fc58c2bf 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,7 @@
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "~2.0.0",
-    "on-headers": "~1.0.1",
+    "on-headers": "~1.0.2",
     "parseurl": "~1.3.2",
     "safe-buffer": "5.1.2",
     "uid-safe": "~2.1.5"

From 4cbb93f6138c3c6219144637ca648b8580945755 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Feb 2019 22:09:18 -0500
Subject: [PATCH 281/529] build: simplify & speed up logic in Travis CI build
 steps

---
 .travis.yml | 69 ++++++++++++++++++++++++++++++-----------------------
 1 file changed, 39 insertions(+), 30 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index aa29ae70..4a1fd41d 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -20,6 +20,32 @@ cache:
     - node_modules
 before_install:
   - |
+    # Setup utility functions
+    function node_version_lt () {
+      [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v "${1}")" ]]
+    }
+    function npm_module_installed () {
+      npm -lsp ls | grep -Fq "$(pwd)/node_modules/${1}:${1}@"
+    }
+    function npm_remove_module_re () {
+      node -e '
+        fs = require("fs");
+        p = JSON.parse(fs.readFileSync("package.json", "utf8"));
+        r = RegExp(process.argv[1]);
+        for (k in p.devDependencies) {
+          if (r.test(k)) delete p.devDependencies[k];
+        }
+        fs.writeFileSync("package.json", JSON.stringify(p, null, 2) + "\n");
+      ' "$@"
+    }
+    function npm_use_module () {
+      node -e '
+        fs = require("fs");
+        p = JSON.parse(fs.readFileSync("package.json", "utf8"));
+        p.devDependencies[process.argv[1]] = process.argv[2];
+        fs.writeFileSync("package.json", JSON.stringify(p, null, 2) + "\n");
+      ' "$@"
+    }
     function v () {
       tr '.' '\n' <<< "${1}" \
         | awk '{ printf "%03d", $0 }' \
@@ -31,36 +57,22 @@ before_install:
     npm config set shrinkwrap false
   # Setup Node.js version-specific dependencies
   - |
-    # eslint for linting
-    if [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '4.0')" ]]; then
-      # - remove on Node.js < 4
-      node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
-        grep -E '^eslint(-|$)' | \
-        xargs npm rm --save-dev
+    # Configure eslint for linting
+    if node_version_lt '4.0'; then npm_remove_module_re '^eslint(-|$)'
     fi
   - |
-    # istanbul for coverage
-    if [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '0.10')" ]]; then
-      # - remove on Node.js < 0.10
-      npm rm --save-dev istanbul
+    # Configure istanbul for coverage
+    if node_version_lt '0.10'; then npm_remove_module_re '^istanbul$'
     fi
   - |
-    # mocha for testing
-    if [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '0.10')" ]]; then
-      # - use 2.x for Node.js < 0.10
-      npm install --save-dev mocha@2.5.3
-    elif [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '6.0')" ]]; then
-      # - use 3.x for Node.js < 6
-      npm install --save-dev mocha@3.5.3
+    # Configure mocha for testing
+    if   node_version_lt '0.10'; then npm_use_module 'mocha' '2.5.3'
+    elif node_version_lt '4.0' ; then npm_use_module 'mocha' '3.5.3'
     fi
   - |
-    # supertest for http calls
-    if [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '0.10')" ]]; then
-      # - use 1.1.0 for Node.js < 0.10
-      npm install --save-dev supertest@1.1.0
-    elif [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v '4.0')" ]]; then
-      # - use 2.0.0 for Node.js < 4
-      npm install --save-dev supertest@2.0.0
+    # Configure supertest for http calls
+    if   node_version_lt '0.10'; then npm_use_module 'supertest' '1.1.0'
+    elif node_version_lt '4.0' ; then npm_use_module 'supertest' '2.0.0'
     fi
   # Update Node.js modules
   - |
@@ -73,15 +85,12 @@ before_install:
 script:
   - |
     # Run test script, depending on istanbul install
-    if npm -ps ls istanbul | grep -q istanbul; then
-      npm run-script test-travis
-    else
-      npm test
+    if npm_module_installed 'istanbul'; then npm run-script test-travis
+    else npm test
     fi
   - |
     # Run linting, depending on eslint install
-    if npm -ps ls eslint | grep -q eslint; then
-      npm run-script lint
+    if npm_module_installed 'eslint'; then npm run-script lint
     fi
 after_script:
   - |

From 2f0759cfcb7b6f828754c6cd3983fee06cfe8028 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 28 Feb 2019 22:14:40 -0500
Subject: [PATCH 282/529] build: mocha@6.0.2

---
 .travis.yml  | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 4a1fd41d..09447479 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -68,6 +68,7 @@ before_install:
     # Configure mocha for testing
     if   node_version_lt '0.10'; then npm_use_module 'mocha' '2.5.3'
     elif node_version_lt '4.0' ; then npm_use_module 'mocha' '3.5.3'
+    elif node_version_lt '6.0' ; then npm_use_module 'mocha' '5.2.0'
     fi
   - |
     # Configure supertest for http calls
diff --git a/package.json b/package.json
index fc58c2bf..5473f28b 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "eslint-plugin-markdown": "1.0.0",
     "express": "4.16.4",
     "istanbul": "0.4.5",
-    "mocha": "5.2.0",
+    "mocha": "6.0.2",
     "supertest": "3.4.2"
   },
   "files": [

From 3e0d5489f53763899a91395b26b57f1e8f54a8d3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 2 Mar 2019 13:09:20 -0500
Subject: [PATCH 283/529] tests: move some code into support/

---
 test/session.js            | 82 ++++++--------------------------------
 test/support/sync-store.js | 27 +++++++++++++
 test/support/utils.js      | 42 +++++++++++++++++++
 3 files changed, 81 insertions(+), 70 deletions(-)
 create mode 100644 test/support/sync-store.js
 create mode 100644 test/support/utils.js

diff --git a/test/session.js b/test/session.js
index 6862ccc4..383a3024 100644
--- a/test/session.js
+++ b/test/session.js
@@ -8,7 +8,8 @@ var http = require('http')
 var https = require('https')
 var request = require('supertest')
 var session = require('../')
-var util = require('util')
+var SyncStore = require('./support/sync-store')
+var utils = require('./support/utils')
 
 var Cookie = require('../session/cookie')
 
@@ -1396,7 +1397,7 @@ describe('session()', function(){
   describe('res.end patch', function () {
     it('should correctly handle res.end/res.write patched prior', function (done) {
       function setup (req, res) {
-        writePatch(res)
+        utils.writePatch(res)
       }
 
       function respond (req, res) {
@@ -1412,7 +1413,7 @@ describe('session()', function(){
 
     it('should correctly handle res.end/res.write patched after', function (done) {
       function respond (req, res) {
-        writePatch(res)
+        utils.writePatch(res)
         req.session.hit = true
         res.write('hello, ')
         res.end('world')
@@ -2185,7 +2186,7 @@ function end(req, res) {
 
 function expires (res) {
   var header = cookie(res)
-  return header && parseSetCookie(header).expires
+  return header && utils.parseSetCookie(header).expires
 }
 
 function mountAt (path) {
@@ -2197,25 +2198,6 @@ function mountAt (path) {
   }
 }
 
-function parseSetCookie (header) {
-  var match
-  var pairs = []
-  var pattern = /\s*([^=;]+)(?:=([^;]*);?|;|$)/g
-
-  while ((match = pattern.exec(header))) {
-    pairs.push({ name: match[1], value: match[2] })
-  }
-
-  var cookie = pairs.shift()
-
-  for (var i = 0; i < pairs.length; i++) {
-    match = pairs[i]
-    cookie[match.name.toLowerCase()] = (match.value || true)
-  }
-
-  return cookie
-}
-
 function shouldNotHaveHeader(header) {
   return function (res) {
     assert.ok(!(header.toLowerCase() in res.headers), 'should not have ' + header + ' header')
@@ -2239,7 +2221,7 @@ function shouldNotSetSessionInStore(store) {
 function shouldSetCookie (name) {
   return function (res) {
     var header = cookie(res)
-    var data = header && parseSetCookie(header)
+    var data = header && utils.parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
     assert.strictEqual(data.name, name, 'should set cookie ' + name)
   }
@@ -2254,7 +2236,7 @@ function shouldSetCookieToDifferentSessionId (id) {
 function shouldSetCookieToExpireIn (name, delta) {
   return function (res) {
     var header = cookie(res)
-    var data = header && parseSetCookie(header)
+    var data = header && utils.parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
     assert.strictEqual(data.name, name, 'should set cookie ' + name)
     assert.ok(('expires' in data), 'should set cookie with attribute Expires')
@@ -2266,7 +2248,7 @@ function shouldSetCookieToExpireIn (name, delta) {
 function shouldSetCookieToValue (name, val) {
   return function (res) {
     var header = cookie(res)
-    var data = header && parseSetCookie(header)
+    var data = header && utils.parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
     assert.strictEqual(data.name, name, 'should set cookie ' + name)
     assert.strictEqual(data.value, val, 'should set cookie ' + name + ' to ' + val)
@@ -2276,7 +2258,7 @@ function shouldSetCookieToValue (name, val) {
 function shouldSetCookieWithAttribute (name, attrib) {
   return function (res) {
     var header = cookie(res)
-    var data = header && parseSetCookie(header)
+    var data = header && utils.parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
     assert.strictEqual(data.name, name, 'should set cookie ' + name)
     assert.ok((attrib.toLowerCase() in data), 'should set cookie with attribute ' + attrib)
@@ -2286,7 +2268,7 @@ function shouldSetCookieWithAttribute (name, attrib) {
 function shouldSetCookieWithAttributeAndValue (name, attrib, value) {
   return function (res) {
     var header = cookie(res)
-    var data = header && parseSetCookie(header)
+    var data = header && utils.parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
     assert.strictEqual(data.name, name, 'should set cookie ' + name)
     assert.ok((attrib.toLowerCase() in data), 'should set cookie with attribute ' + attrib)
@@ -2297,7 +2279,7 @@ function shouldSetCookieWithAttributeAndValue (name, attrib, value) {
 function shouldSetCookieWithoutAttribute (name, attrib) {
   return function (res) {
     var header = cookie(res)
-    var data = header && parseSetCookie(header)
+    var data = header && utils.parseSetCookie(header)
     assert.ok(header, 'should have a cookie header')
     assert.strictEqual(data.name, name, 'should set cookie ' + name)
     assert.ok(!(attrib.toLowerCase() in data), 'should set cookie without attribute ' + attrib)
@@ -2320,48 +2302,8 @@ function shouldSetSessionInStore(store) {
 
 function sid (res) {
   var header = cookie(res)
-  var data = header && parseSetCookie(header)
+  var data = header && utils.parseSetCookie(header)
   var value = data && unescape(data.value)
   var sid = value && value.substring(2, value.indexOf('.'))
   return sid || undefined
 }
-
-function writePatch (res) {
-  var _end = res.end
-  var _write = res.write
-  var ended = false
-
-  res.end = function end() {
-    ended = true
-    return _end.apply(this, arguments)
-  }
-
-  res.write = function write() {
-    if (ended) {
-      throw new Error('write after end')
-    }
-
-    return _write.apply(this, arguments)
-  }
-}
-
-function SyncStore () {
-  session.Store.call(this)
-  this.sessions = Object.create(null)
-}
-
-util.inherits(SyncStore, session.Store)
-
-SyncStore.prototype.destroy = function destroy(sid, callback) {
-  delete this.sessions[sid];
-  callback();
-};
-
-SyncStore.prototype.get = function get(sid, callback) {
-  callback(null, JSON.parse(this.sessions[sid]));
-};
-
-SyncStore.prototype.set = function set(sid, sess, callback) {
-  this.sessions[sid] = JSON.stringify(sess);
-  callback();
-};
diff --git a/test/support/sync-store.js b/test/support/sync-store.js
new file mode 100644
index 00000000..b45dc9a8
--- /dev/null
+++ b/test/support/sync-store.js
@@ -0,0 +1,27 @@
+'use strict'
+
+var session = require('../../')
+var util = require('util')
+
+module.exports = SyncStore
+
+function SyncStore () {
+  session.Store.call(this)
+  this.sessions = Object.create(null)
+}
+
+util.inherits(SyncStore, session.Store)
+
+SyncStore.prototype.destroy = function destroy (sid, callback) {
+  delete this.sessions[sid]
+  callback()
+}
+
+SyncStore.prototype.get = function get (sid, callback) {
+  callback(null, JSON.parse(this.sessions[sid]))
+}
+
+SyncStore.prototype.set = function set (sid, sess, callback) {
+  this.sessions[sid] = JSON.stringify(sess)
+  callback()
+}
diff --git a/test/support/utils.js b/test/support/utils.js
new file mode 100644
index 00000000..0f13ba6a
--- /dev/null
+++ b/test/support/utils.js
@@ -0,0 +1,42 @@
+'use strict'
+
+module.exports.parseSetCookie = parseSetCookie
+module.exports.writePatch = writePatch
+
+function parseSetCookie (header) {
+  var match
+  var pairs = []
+  var pattern = /\s*([^=;]+)(?:=([^;]*);?|;|$)/g
+
+  while ((match = pattern.exec(header))) {
+    pairs.push({ name: match[1], value: match[2] })
+  }
+
+  var cookie = pairs.shift()
+
+  for (var i = 0; i < pairs.length; i++) {
+    match = pairs[i]
+    cookie[match.name.toLowerCase()] = (match.value || true)
+  }
+
+  return cookie
+}
+
+function writePatch (res) {
+  var _end = res.end
+  var _write = res.write
+  var ended = false
+
+  res.end = function end () {
+    ended = true
+    return _end.apply(this, arguments)
+  }
+
+  res.write = function write () {
+    if (ended) {
+      throw new Error('write after end')
+    }
+
+    return _write.apply(this, arguments)
+  }
+}

From ed8a50f725b2b4a5837b868cae524c424cb4d49b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 5 Mar 2019 23:09:17 -0500
Subject: [PATCH 284/529] build: supertest@4.0.2

---
 .travis.yml  | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 09447479..eef1707b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -74,6 +74,7 @@ before_install:
     # Configure supertest for http calls
     if   node_version_lt '0.10'; then npm_use_module 'supertest' '1.1.0'
     elif node_version_lt '4.0' ; then npm_use_module 'supertest' '2.0.0'
+    elif node_version_lt '6.0' ; then npm_use_module 'supertest' '3.4.2'
     fi
   # Update Node.js modules
   - |
diff --git a/package.json b/package.json
index 5473f28b..e8f866c5 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.16.4",
     "istanbul": "0.4.5",
     "mocha": "6.0.2",
-    "supertest": "3.4.2"
+    "supertest": "4.0.2"
   },
   "files": [
     "session/",

From cc5c83abf710c6e9e4d0bb887777b44faefd2251 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Mar 2019 22:08:17 -0500
Subject: [PATCH 285/529] lint: ensure strict equality checks

---
 .eslintrc.yml     |  1 +
 index.js          |  4 ++--
 session/cookie.js |  8 ++++----
 session/store.js  | 12 +++++++++---
 4 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/.eslintrc.yml b/.eslintrc.yml
index e48de5ea..0740b11f 100644
--- a/.eslintrc.yml
+++ b/.eslintrc.yml
@@ -1,6 +1,7 @@
 root: true
 rules:
   eol-last: error
+  eqeqeq: ["error", "always", { "null": "ignore" }]
   indent: ["error", 2, { "SwitchCase": 1 }]
   no-mixed-spaces-and-tabs: error
   no-trailing-spaces: error
diff --git a/index.js b/index.js
index 42639913..1cd02f6e 100644
--- a/index.js
+++ b/index.js
@@ -150,7 +150,7 @@ function session(options) {
   // notify user that this store is not
   // meant for a production environment
   /* istanbul ignore next: not tested */
-  if ('production' == env && store instanceof MemoryStore) {
+  if (env === 'production' && store instanceof MemoryStore) {
     console.warn(warning);
   }
 
@@ -443,7 +443,7 @@ function session(options) {
         return false;
       }
 
-      return cookieId != req.sessionID
+      return cookieId !== req.sessionID
         ? saveUninitializedSession || isModified(req.session)
         : rollingSessions || req.session.cookie.expires != null && isModified(req.session);
     }
diff --git a/session/cookie.js b/session/cookie.js
index 1dd9bf95..3197d272 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -37,9 +37,9 @@ var Cookie = module.exports = function Cookie(options) {
     }
   }
 
-  this.originalMaxAge = undefined == this.originalMaxAge
-    ? this.maxAge
-    : this.originalMaxAge;
+  if (this.originalMaxAge === undefined || this.originalMaxAge === null) {
+    this.originalMaxAge = this.maxAge
+  }
 };
 
 /*!
@@ -87,7 +87,7 @@ Cookie.prototype = {
       deprecate('maxAge as Date; pass number of milliseconds instead')
     }
 
-    this.expires = 'number' == typeof ms
+    this.expires = typeof ms === 'number'
       ? new Date(Date.now() + ms)
       : ms;
   },
diff --git a/session/store.js b/session/store.js
index 00f3ac41..baefbf8d 100644
--- a/session/store.js
+++ b/session/store.js
@@ -85,11 +85,17 @@ Store.prototype.load = function(sid, fn){
 
 Store.prototype.createSession = function(req, sess){
   var expires = sess.cookie.expires
-  var orig = sess.cookie.originalMaxAge
+  var originalMaxAge = sess.cookie.originalMaxAge
 
   sess.cookie = new Cookie(sess.cookie);
-  if ('string' == typeof expires) sess.cookie.expires = new Date(expires);
-  sess.cookie.originalMaxAge = orig;
+
+  if (typeof expires === 'string') {
+    // convert expires to a Date object,
+    // keeping originalMaxAge intact
+    sess.cookie.expires = new Date(expires)
+    sess.cookie.originalMaxAge = originalMaxAge
+  }
+
   req.session = new Session(req, sess);
   return req.session;
 };

From 03aa560b17e0e038050d379b8d0b040ee5255011 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Mar 2019 22:14:43 -0500
Subject: [PATCH 286/529] build: Node.js@6.17

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index eef1707b..99eddf67 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -8,7 +8,7 @@ node_js:
   - "3.3"
   - "4.9"
   - "5.12"
-  - "6.16"
+  - "6.17"
   - "7.10"
   - "8.15"
   - "9.11"

From a7cf57f56bd60878e0067d8c507415e356e36e94 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 6 Mar 2019 22:18:11 -0500
Subject: [PATCH 287/529] build: Node.js@11.11

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 99eddf67..bcebedef 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "8.15"
   - "9.11"
   - "10.15"
-  - "11.10"
+  - "11.11"
 sudo: false
 cache:
   directories:

From e926b8846d9cfbf092a626dcc866b8055d99cf73 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Apr 2019 18:09:22 -0400
Subject: [PATCH 288/529] build: mocha@6.1.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e8f866c5..0117e2e2 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "eslint-plugin-markdown": "1.0.0",
     "express": "4.16.4",
     "istanbul": "0.4.5",
-    "mocha": "6.0.2",
+    "mocha": "6.1.2",
     "supertest": "4.0.2"
   },
   "files": [

From dc5262a2c83759d54325ab62c2cd657d7d8eb8ec Mon Sep 17 00:00:00 2001
From: ich <me89@users.noreply.github.com>
Date: Sun, 10 Mar 2019 17:01:35 +1000
Subject: [PATCH 289/529] docs: add connect-arango to the list of session
 stores

closes #642
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 2be21d2c..5f96d794 100644
--- a/README.md
+++ b/README.md
@@ -506,6 +506,11 @@ and other multi-core embedded devices).
 [cluster-store-url]: https://www.npmjs.com/package/cluster-store
 [cluster-store-image]: https://badgen.net/github/stars/coolaj86/cluster-store?label=%E2%98%85
 
+[![★][connect-arango-image] connect-arango][connect-arango-url] An ArangoDB-based session store.
+
+[connect-arango-url]: https://www.npmjs.com/package/connect-arango
+[connect-arango-image]: https://badgen.net/github/stars/AlexanderArvidsson/connect-arango?label=%E2%98%85
+
 [![★][connect-azuretables-image] connect-azuretables][connect-azuretables-url] An [Azure Table Storage](https://azure.microsoft.com/en-gb/services/storage/tables/)-based session store.
 
 [connect-azuretables-url]: https://www.npmjs.com/package/connect-azuretables

From 6e514a4cc9cb5a683af6f0b75439e5546f7b3dcd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Apr 2019 23:57:02 -0400
Subject: [PATCH 290/529] build: Node.js@11.13

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index bcebedef..c2fd08f1 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "8.15"
   - "9.11"
   - "10.15"
-  - "11.11"
+  - "11.13"
 sudo: false
 cache:
   directories:

From 9495367f7cfd750a48cf99b74370d18c1f8930e9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 11 Apr 2019 00:00:37 -0400
Subject: [PATCH 291/529] docs: update badge for level-session-store store

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 5f96d794..48c1ab1e 100644
--- a/README.md
+++ b/README.md
@@ -697,7 +697,7 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [![★][level-session-store-image] level-session-store][level-session-store-url] A LevelDB-based session store.
 
 [level-session-store-url]: https://www.npmjs.com/package/level-session-store
-[level-session-store-image]: https://badgen.net/github/stars/scriptollc/level-session-store?label=%E2%98%85
+[level-session-store-image]: https://badgen.net/github/stars/toddself/level-session-store?label=%E2%98%85
 
 [![★][medea-session-store-image] medea-session-store][medea-session-store-url] A Medea-based session store.
 

From e77cbfa93fb083209c4973c2bc6113b86bc32dc2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 11 Apr 2019 00:04:56 -0400
Subject: [PATCH 292/529] build: add version script for npm version releases

---
 package.json               |  3 +-
 scripts/version-history.js | 63 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 scripts/version-history.js

diff --git a/package.json b/package.json
index 0117e2e2..5d243086 100644
--- a/package.json
+++ b/package.json
@@ -42,6 +42,7 @@
     "lint": "eslint --plugin markdown --ext js,md .",
     "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --check-leaks --no-exit --reporter dot test/",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --check-leaks --no-exit --reporter spec test/"
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --check-leaks --no-exit --reporter spec test/",
+    "version": "node scripts/version-history.js && git add HISTORY.md"
   }
 }
diff --git a/scripts/version-history.js b/scripts/version-history.js
new file mode 100644
index 00000000..b8a2b0e8
--- /dev/null
+++ b/scripts/version-history.js
@@ -0,0 +1,63 @@
+'use strict'
+
+var fs = require('fs')
+var path = require('path')
+
+var HISTORY_FILE_PATH = path.join(__dirname, '..', 'HISTORY.md')
+var MD_HEADER_REGEXP = /^====*$/
+var VERSION = process.env.npm_package_version
+var VERSION_PLACEHOLDER_REGEXP = /^(?:unreleased|(\d+\.)+x)$/
+
+var historyFileLines = fs.readFileSync(HISTORY_FILE_PATH, 'utf-8').split('\n')
+
+if (!MD_HEADER_REGEXP.test(historyFileLines[1])) {
+  console.error('Missing header in HISTORY.md')
+  process.exit(1)
+}
+
+if (!VERSION_PLACEHOLDER_REGEXP.test(historyFileLines[0])) {
+  console.error('Missing placegolder version in HISTORY.md')
+  process.exit(1)
+}
+
+if (historyFileLines[0].indexOf('x') !== -1) {
+  var versionCheckRegExp = new RegExp('^' + historyFileLines[0].replace('x', '.+') + '$')
+
+  if (!versionCheckRegExp.test(VERSION)) {
+    console.error('Version %s does not match placeholder %s', VERSION, historyFileLines[0])
+    process.exit(1)
+  }
+}
+
+historyFileLines[0] = VERSION + ' / ' + getLocaleDate()
+historyFileLines[1] = repeat('=', historyFileLines[0].length)
+
+fs.writeFileSync(HISTORY_FILE_PATH, historyFileLines.join('\n'))
+
+function getLocaleDate () {
+  var now = new Date()
+
+  return zeroPad(now.getFullYear(), 4) + '-' +
+    zeroPad(now.getMonth() + 1, 2) + '-' +
+    zeroPad(now.getDate(), 2)
+}
+
+function repeat (str, length) {
+  var out = ''
+
+  for (var i = 0; i < length; i++) {
+    out += str
+  }
+
+  return out
+}
+
+function zeroPad (number, length) {
+  var num = number.toString()
+
+  while (num.length < length) {
+    num = '0' + num
+  }
+
+  return num
+}

From b1f0984086c8ed15162aa6ce22562ff829bf5ba7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 11 Apr 2019 00:09:18 -0400
Subject: [PATCH 293/529] 1.16.0

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index b21a4b41..aca5825e 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.16.0 / 2019-04-10
+===================
 
   * Catch invalid `cookie.maxAge` value earlier
   * Deprecate setting `cookie.maxAge` to a `Date` object
diff --git a/package.json b/package.json
index 5d243086..c0787d66 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.15.6",
+  "version": "1.16.0",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 1e3fc39a3fc3810772dfa00a7535a710042c42aa Mon Sep 17 00:00:00 2001
From: eol95 <bragin.egor.95@gmail.com>
Date: Thu, 11 Apr 2019 16:35:27 +0500
Subject: [PATCH 294/529] Fix error passing "data" option to Cookie constructor

fixes #648
closes #649
---
 HISTORY.md        | 5 +++++
 session/cookie.js | 4 +++-
 test/cookie.js    | 9 +++++++++
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index aca5825e..9eee06f9 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix error passing `data` option to `Cookie` constructor
+
 1.16.0 / 2019-04-10
 ===================
 
diff --git a/session/cookie.js b/session/cookie.js
index 3197d272..a8b4e570 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -33,7 +33,9 @@ var Cookie = module.exports = function Cookie(options) {
     }
 
     for (var key in options) {
-      this[key] = options[key]
+      if (key !== 'data') {
+        this[key] = options[key]
+      }
     }
   }
 
diff --git a/test/cookie.js b/test/cookie.js
index 4cca87bb..b280dff1 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -44,6 +44,15 @@ describe('new Cookie()', function () {
       assert.throws(function () { new Cookie(function () {}) }, /argument options/)
     })
 
+    it('should ignore "data" option', function () {
+      var cookie = new Cookie({ data: { foo: 'bar' }, path: '/foo' })
+
+      assert.strictEqual(typeof cookie, 'object')
+      assert.strictEqual(typeof cookie.data, 'object')
+      assert.strictEqual(cookie.data.path, '/foo')
+      assert.notStrictEqual(cookie.data.foo, 'bar')
+    })
+
     describe('expires', function () {
       it('should set expires', function () {
         var expires = new Date(Date.now() + 60000)

From 85682a2a56c5bdbed8d7e7cd2cc5e1343c951af6 Mon Sep 17 00:00:00 2001
From: geekjob-ru <47718537+geekjob-ru@users.noreply.github.com>
Date: Thu, 21 Feb 2019 22:34:20 +0300
Subject: [PATCH 295/529] Fix uncaught error from bad session data

closes #634
---
 HISTORY.md        |  1 +
 index.js          | 51 ++++++++++++++++++++++++++---------------------
 session/memory.js | 18 +++++++++--------
 test/session.js   | 25 +++++++++++++++++++++++
 4 files changed, 64 insertions(+), 31 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 9eee06f9..e58674b8 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Fix error passing `data` option to `Cookie` constructor
+  * Fix uncaught error from bad session data
 
 1.16.0 / 2019-04-10
 ===================
diff --git a/index.js b/index.js
index 1cd02f6e..24221b48 100644
--- a/index.js
+++ b/index.js
@@ -363,6 +363,19 @@ function session(options) {
       wrapmethods(req.session);
     }
 
+    // inflate the session
+    function inflate (req, sess) {
+      store.createSession(req, sess)
+      originalId = req.sessionID
+      originalHash = hash(sess)
+
+      if (!resaveSession) {
+        savedHash = originalHash
+      }
+
+      wrapmethods(req.session)
+    }
+
     // wrap session methods
     function wrapmethods(sess) {
       var _reload = sess.reload
@@ -460,34 +473,26 @@ function session(options) {
     debug('fetching %s', req.sessionID);
     store.get(req.sessionID, function(err, sess){
       // error handling
-      if (err) {
+      if (err && err.code !== 'ENOENT') {
         debug('error %j', err);
+        next(err)
+        return
+      }
 
-        if (err.code !== 'ENOENT') {
-          next(err);
-          return;
-        }
-
-        generate();
-      // no session
-      } else if (!sess) {
-        debug('no session found');
-        generate();
-      // populate req.session
-      } else {
-        debug('session found');
-        store.createSession(req, sess);
-        originalId = req.sessionID;
-        originalHash = hash(sess);
-
-        if (!resaveSession) {
-          savedHash = originalHash
+      try {
+        if (err || !sess) {
+          debug('no session found')
+          generate()
+        } else {
+          debug('session found')
+          inflate(req, sess)
         }
-
-        wrapmethods(req.session);
+      } catch (e) {
+        next(e)
+        return
       }
 
-      next();
+      next()
     });
   };
 };
diff --git a/session/memory.js b/session/memory.js
index 25252b6c..11ed686c 100644
--- a/session/memory.js
+++ b/session/memory.js
@@ -171,14 +171,16 @@ function getSession(sessionId) {
   // parse
   sess = JSON.parse(sess)
 
-  var expires = typeof sess.cookie.expires === 'string'
-    ? new Date(sess.cookie.expires)
-    : sess.cookie.expires
-
-  // destroy expired session
-  if (expires && expires <= Date.now()) {
-    delete this.sessions[sessionId]
-    return
+  if (sess.cookie) {
+    var expires = typeof sess.cookie.expires === 'string'
+      ? new Date(sess.cookie.expires)
+      : sess.cookie.expires
+
+    // destroy expired session
+    if (expires && expires <= Date.now()) {
+      delete this.sessions[sessionId]
+      return
+    }
   }
 
   return sess
diff --git a/test/session.js b/test/session.js
index 383a3024..437baf0e 100644
--- a/test/session.js
+++ b/test/session.js
@@ -610,6 +610,31 @@ describe('session()', function(){
     })
   })
 
+  describe('when session without cookie property in store', function () {
+    it('should pass error from inflate', function (done) {
+      var count = 0
+      var store = new session.MemoryStore()
+      var server = createServer({ store: store }, function (req, res) {
+        req.session.num = req.session.num || ++count
+        res.end('session ' + req.session.num)
+      })
+
+      request(server)
+      .get('/')
+      .expect(shouldSetCookie('connect.sid'))
+      .expect(200, 'session 1', function (err, res) {
+        if (err) return done(err)
+        store.set(sid(res), { foo: 'bar' }, function (err) {
+          if (err) return done(err)
+          request(server)
+          .get('/')
+          .set('Cookie', cookie(res))
+          .expect(500, /Cannot read property/, done)
+        })
+      })
+    })
+  })
+
   describe('proxy option', function(){
     describe('when enabled', function(){
       var server

From 421bb3f320b2bbbb6f5ff386666ecd574a53fec6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 11 Apr 2019 12:14:05 -0400
Subject: [PATCH 296/529] 1.16.1

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index e58674b8..b842fbe3 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.16.1 / 2019-04-11
+===================
 
   * Fix error passing `data` option to `Cookie` constructor
   * Fix uncaught error from bad session data
diff --git a/package.json b/package.json
index c0787d66..6e1ef2b9 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.16.0",
+  "version": "1.16.1",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 5d2e4ec6a9241f634e629e0ff4cf5765236ed24d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 21 Apr 2019 18:04:22 -0400
Subject: [PATCH 297/529] build: mocha@6.1.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 6e1ef2b9..8cc2d597 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "eslint-plugin-markdown": "1.0.0",
     "express": "4.16.4",
     "istanbul": "0.4.5",
-    "mocha": "6.1.2",
+    "mocha": "6.1.4",
     "supertest": "4.0.2"
   },
   "files": [

From 072f0b11834186791a303d0cb7392d9fc53f7e3d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 21 Apr 2019 18:09:19 -0400
Subject: [PATCH 298/529] deps: parseurl@~1.3.3

---
 HISTORY.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index b842fbe3..a5cd3507 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * deps: parseurl@~1.3.3
+
 1.16.1 / 2019-04-11
 ===================
 
diff --git a/package.json b/package.json
index 8cc2d597..60b3df93 100644
--- a/package.json
+++ b/package.json
@@ -15,7 +15,7 @@
     "debug": "2.6.9",
     "depd": "~2.0.0",
     "on-headers": "~1.0.2",
-    "parseurl": "~1.3.2",
+    "parseurl": "~1.3.3",
     "safe-buffer": "5.1.2",
     "uid-safe": "~2.1.5"
   },

From cc3d51bd87566b4d7dd85fe46537957c9b618608 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Apr 2019 11:47:51 -0400
Subject: [PATCH 299/529] lint: add linter for session store readme list

---
 README.md              | 92 ++++++++++++++++++++---------------------
 package.json           |  2 +-
 scripts/lint-readme.js | 93 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 140 insertions(+), 47 deletions(-)
 create mode 100644 scripts/lint-readme.js

diff --git a/README.md b/README.md
index 48c1ab1e..7b39aafb 100644
--- a/README.md
+++ b/README.md
@@ -543,7 +543,7 @@ and other multi-core embedded devices).
 
 [![★][connect-dynamodb-image] connect-dynamodb][connect-dynamodb-url] A DynamoDB-based session store.
 
-[connect-dynamodb-url]: https://github.com/ca98am79/connect-dynamodb
+[connect-dynamodb-url]: https://www.npmjs.com/package/connect-dynamodb
 [connect-dynamodb-image]: https://badgen.net/github/stars/ca98am79/connect-dynamodb?label=%E2%98%85
 
 [![★][connect-loki-image] connect-loki][connect-loki-url] A Loki.js-based session store.
@@ -551,16 +551,22 @@ and other multi-core embedded devices).
 [connect-loki-url]: https://www.npmjs.com/package/connect-loki
 [connect-loki-image]: https://badgen.net/github/stars/Requarks/connect-loki?label=%E2%98%85
 
+[![★][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store.
+
+[connect-memcached-url]: https://www.npmjs.com/package/connect-memcached
+[connect-memcached-image]: https://badgen.net/github/stars/balor/connect-memcached?label=%E2%98%85
+
+[![★][connect-memjs-image] connect-memjs][connect-memjs-url] A memcached-based session store using
+[memjs](https://www.npmjs.com/package/memjs) as the memcached client.
+
+[connect-memjs-url]: https://www.npmjs.com/package/connect-memjs
+[connect-memjs-image]: https://badgen.net/github/stars/liamdon/connect-memjs?label=%E2%98%85
+
 [![★][connect-ml-image] connect-ml][connect-ml-url] A MarkLogic Server-based session store.
 
 [connect-ml-url]: https://www.npmjs.com/package/connect-ml
 [connect-ml-image]: https://badgen.net/github/stars/bluetorch/connect-ml?label=%E2%98%85
 
-[![★][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
-
-[connect-mssql-url]: https://www.npmjs.com/package/connect-mssql
-[connect-mssql-image]: https://badgen.net/github/stars/patriksimek/connect-mssql?label=%E2%98%85
-
 [![★][connect-monetdb-image] connect-monetdb][connect-monetdb-url] A MonetDB-based session store.
 
 [connect-monetdb-url]: https://www.npmjs.com/package/connect-monetdb
@@ -576,6 +582,11 @@ and other multi-core embedded devices).
 [connect-mongodb-session-url]: https://www.npmjs.com/package/connect-mongodb-session
 [connect-mongodb-session-image]: https://badgen.net/github/stars/mongodb-js/connect-mongodb-session?label=%E2%98%85
 
+[![★][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
+
+[connect-mssql-url]: https://www.npmjs.com/package/connect-mssql
+[connect-mssql-image]: https://badgen.net/github/stars/patriksimek/connect-mssql?label=%E2%98%85
+
 [![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
 
 [connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple
@@ -586,17 +597,6 @@ and other multi-core embedded devices).
 [connect-redis-url]: https://www.npmjs.com/package/connect-redis
 [connect-redis-image]: https://badgen.net/github/stars/tj/connect-redis?label=%E2%98%85
 
-[![★][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store.
-
-[connect-memcached-url]: https://www.npmjs.com/package/connect-memcached
-[connect-memcached-image]: https://badgen.net/github/stars/balor/connect-memcached?label=%E2%98%85
-
-[![★][connect-memjs-image] connect-memjs][connect-memjs-url] A memcached-based session store using
-[memjs](https://www.npmjs.com/package/memjs) as the memcached client.
-
-[connect-memjs-url]: https://www.npmjs.com/package/connect-memjs
-[connect-memjs-image]: https://badgen.net/github/stars/liamdon/connect-memjs?label=%E2%98%85
-
 [![★][connect-session-firebase-image] connect-session-firebase][connect-session-firebase-url] A session store based on the [Firebase Realtime Database](https://firebase.google.com/docs/database/)
 
 [connect-session-firebase-url]: https://www.npmjs.com/package/connect-session-firebase
@@ -614,48 +614,48 @@ and other multi-core embedded devices).
 [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize
 [connect-session-sequelize-image]: https://badgen.net/github/stars/mweibel/connect-session-sequelize?label=%E2%98%85
 
+[![★][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store.
+
+[connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3
+[connect-sqlite3-image]: https://badgen.net/github/stars/rawberg/connect-sqlite3?label=%E2%98%85
+
 [![★][couchdb-expression-image] couchdb-expression][couchdb-expression-url] A [CouchDB](https://couchdb.apache.org/)-based session store.
 
 [couchdb-expression-url]: https://www.npmjs.com/package/couchdb-expression
 [couchdb-expression-image]: https://badgen.net/github/stars/tkshnwesper/couchdb-expression?label=%E2%98%85
 
+[![★][documentdb-session-image] documentdb-session][documentdb-session-url] A session store for Microsoft Azure's [DocumentDB](https://azure.microsoft.com/en-us/services/documentdb/) NoSQL database service.
+
+[documentdb-session-url]: https://www.npmjs.com/package/documentdb-session
+[documentdb-session-image]: https://badgen.net/github/stars/dwhieb/documentdb-session?label=%E2%98%85
+
 [![★][dynamodb-store-image] dynamodb-store][dynamodb-store-url] A DynamoDB-based session store.
 
 [dynamodb-store-url]: https://www.npmjs.com/package/dynamodb-store
 [dynamodb-store-image]: https://badgen.net/github/stars/rafaelrpinto/dynamodb-store?label=%E2%98%85
 
+[![★][express-etcd-image] express-etcd][express-etcd-url] An [etcd](https://github.com/stianeikeland/node-etcd) based session store.
+
+[express-etcd-url]: https://www.npmjs.com/package/express-etcd
+[express-etcd-image]: https://badgen.net/github/stars/gildean/express-etcd?label=%E2%98%85
+
 [![★][express-mysql-session-image] express-mysql-session][express-mysql-session-url] A session store using native
 [MySQL](https://www.mysql.com/) via the [node-mysql](https://github.com/felixge/node-mysql) module.
 
 [express-mysql-session-url]: https://www.npmjs.com/package/express-mysql-session
 [express-mysql-session-image]: https://badgen.net/github/stars/chill117/express-mysql-session?label=%E2%98%85
 
+[![★][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store.
+
+[express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session
+[express-nedb-session-image]: https://badgen.net/github/stars/louischatriot/express-nedb-session?label=%E2%98%85
+
 [![★][express-oracle-session-image] express-oracle-session][express-oracle-session-url] A session store using native
 [oracle](https://www.oracle.com/) via the [node-oracledb](https://www.npmjs.com/package/oracledb) module.
 
 [express-oracle-session-url]: https://www.npmjs.com/package/express-oracle-session
 [express-oracle-session-image]: https://badgen.net/github/stars/slumber86/express-oracle-session?label=%E2%98%85
 
-[![★][express-sessions-image] express-sessions][express-sessions-url]: A session store supporting both MongoDB and Redis.
-
-[express-sessions-url]: https://www.npmjs.com/package/express-sessions
-[express-sessions-image]: https://badgen.net/github/stars/konteck/express-sessions?label=%E2%98%85
-
-[![★][connect-sqlite3-image] connect-sqlite3][connect-sqlite3-url] A [SQLite3](https://github.com/mapbox/node-sqlite3) session store modeled after the TJ's `connect-redis` store.
-
-[connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3
-[connect-sqlite3-image]: https://badgen.net/github/stars/rawberg/connect-sqlite3?label=%E2%98%85
-
-[![★][documentdb-session-image] documentdb-session][documentdb-session-url] A session store for Microsoft Azure's [DocumentDB](https://azure.microsoft.com/en-us/services/documentdb/) NoSQL database service.
-
-[documentdb-session-url]: https://www.npmjs.com/package/documentdb-session
-[documentdb-session-image]: https://badgen.net/github/stars/dwhieb/documentdb-session?label=%E2%98%85
-
-[![★][express-nedb-session-image] express-nedb-session][express-nedb-session-url] A NeDB-based session store.
-
-[express-nedb-session-url]: https://www.npmjs.com/package/express-nedb-session
-[express-nedb-session-image]: https://badgen.net/github/stars/louischatriot/express-nedb-session?label=%E2%98%85
-
 [![★][express-session-cache-manager-image] express-session-cache-manager][express-session-cache-manager-url]
 A store that implements [cache-manager](https://www.npmjs.com/package/cache-manager), which supports
 a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-engines).
@@ -663,24 +663,24 @@ a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-e
 [express-session-cache-manager-url]: https://www.npmjs.com/package/express-session-cache-manager
 [express-session-cache-manager-image]: https://badgen.net/github/stars/theogravity/express-session-cache-manager?label=%E2%98%85
 
+[![★][express-session-etcd3-image] express-session-etcd3][express-session-etcd3-url] An [etcd3](https://github.com/mixer/etcd3) based session store.
+
+[express-session-etcd3-url]: https://www.npmjs.com/package/express-session-etcd3
+[express-session-etcd3-image]: https://badgen.net/github/stars/willgm/express-session-etcd3?label=%E2%98%85
+
 [![★][express-session-level-image] express-session-level][express-session-level-url] A [LevelDB](https://github.com/Level/levelup) based session store.
 
 [express-session-level-url]: https://www.npmjs.com/package/express-session-level
 [express-session-level-image]: https://badgen.net/github/stars/tgohn/express-session-level?label=%E2%98%85
 
-[![★][express-etcd-image] express-etcd][express-etcd-url] An [etcd](https://github.com/stianeikeland/node-etcd) based session store.
-
-[express-etcd-url]: https://www.npmjs.com/package/express-etcd
-[express-etcd-image]: https://badgen.net/github/stars/gildean/express-etcd?label=%E2%98%85
-
-[![★][express-session-etcd3-image] express-session-etcd3][express-session-etcd3-url] An [etcd3](https://github.com/mixer/etcd3) based session store.
+[![★][express-sessions-image] express-sessions][express-sessions-url] A session store supporting both MongoDB and Redis.
 
-[express-session-etcd3-url]: https://www.npmjs.com/package/express-session-etcd3
-[express-session-etcd3-image]: https://badgen.net/github/stars/willgm/express-session-etcd3?label=%E2%98%85
+[express-sessions-url]: https://www.npmjs.com/package/express-sessions
+[express-sessions-image]: https://badgen.net/github/stars/konteck/express-sessions?label=%E2%98%85
 
 [![★][firestore-store-image] firestore-store][firestore-store-url] A [Firestore](https://github.com/hendrysadrak/firestore-store)-based session store.
 
-[firestore-store-url]: https://github.com/hendrysadrak/firestore-store
+[firestore-store-url]: https://www.npmjs.com/package/firestore-store
 [firestore-store-image]: https://badgen.net/github/stars/hendrysadrak/firestore-store?label=%E2%98%85
 
 [![★][fortune-session-image] fortune-session][fortune-session-url] A [Fortune.js](https://github.com/fortunejs/fortune)
diff --git a/package.json b/package.json
index 60b3df93..c6543b84 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "node": ">= 0.8.0"
   },
   "scripts": {
-    "lint": "eslint --plugin markdown --ext js,md .",
+    "lint": "eslint --plugin markdown --ext js,md . && node ./scripts/lint-readme.js",
     "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
     "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --check-leaks --no-exit --reporter dot test/",
     "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --check-leaks --no-exit --reporter spec test/",
diff --git a/scripts/lint-readme.js b/scripts/lint-readme.js
new file mode 100644
index 00000000..a93129e2
--- /dev/null
+++ b/scripts/lint-readme.js
@@ -0,0 +1,93 @@
+var assert = require('assert')
+var fs = require('fs')
+var path = require('path')
+
+var BADGE_STAR_LINK_REGEXP = /^https:\/\/badgen.net\/github\/stars\/[^/]+\/[^/]+?label=%E2%98%85$/
+var MARKDOWN_LINK_REGEXP = /^\[([^ \]]+)\]: ([^ ]+)$/
+var MARKDOWN_SECTION_REGEXP = /^#+ (.+)$/
+var NEWLINE_REGEXP = /\r?\n/
+var README_PATH = path.join(__dirname, '..', 'README.md')
+var README_CONTENTS = fs.readFileSync(README_PATH, 'utf-8')
+var STORE_HEADER_REGEXP = /^\[!\[★\]\[([^ \]]+)\] ([^ \]]+)\]\[([^ \]]+)\](?: .+)?$/
+
+var header = null
+var lintedStores = false
+var section = null
+var state = 0
+
+README_CONTENTS.split(NEWLINE_REGEXP).forEach(function (line, lineidx) {
+  section = (MARKDOWN_SECTION_REGEXP.exec(line) || [])[1] || section
+
+  if (section === 'Compatible Session Stores') {
+    lintedStores = true
+
+    switch (state) {
+      case 0: // premble
+        if (line[0] !== '[') break
+        state = 1
+      case 1: // header
+        var prev = header
+
+        if (!(header = STORE_HEADER_REGEXP.exec(line))) {
+          expect(lineidx, 'session store header', line)
+        } else if (prev && prev[2].replace(/^[^/]+\//, '').localeCompare(header[2].replace(/^[^/]+\//, '')) > 0) {
+          expect(lineidx, (header[2] + ' to be alphabetically after ' + prev[2]), line)
+          state = 2
+        } else {
+          state = 2
+        }
+
+        break
+      case 2: // blank line
+        if (line && MARKDOWN_LINK_REGEXP.test(line)) {
+          expect(lineidx, 'blank line or wrapped description', line)
+        } else if (line === '') {
+          state = 3
+        }
+        break
+      case 3: // url link
+        var urlLink = MARKDOWN_LINK_REGEXP.exec(line)
+
+        if (!urlLink) {
+          expect(lineidx, 'link reference', line)
+        } else if (urlLink[1] !== header[3]) {
+          expect(lineidx, ('link name of ' + header[3]), line)
+        } else if (urlLink[2] !== ('https://www.npmjs.com/package/' + header[2])) {
+          expect(lineidx, ('link url of https://www.npmjs.com/package/' + header[2]), line)
+        } else {
+          state = 4
+        }
+
+        break
+      case 4: // image link
+        var imageLink = MARKDOWN_LINK_REGEXP.exec(line)
+
+        if (!imageLink) {
+          expect(lineidx, 'link reference', line)
+        } else if (imageLink[1] !== header[1]) {
+          expect(lineidx, ('link name of ' + header[1]), line)
+        } else if (!BADGE_STAR_LINK_REGEXP.test(imageLink[2])) {
+          expect(lineidx, ('link url to github stars badge'), line)
+        } else {
+          state = 5
+        }
+
+        break
+      case 5: // blank line
+        if (line !== '') {
+          expect(lineidx, 'blank line after links', line)
+        } else {
+          state = 1
+        }
+        break
+    }
+  }
+})
+
+assert.ok(lintedStores, 'Compatible Session Stores section linted')
+
+function expect (lineidx, message, line) {
+  console.log('Expected %s on line %d', message, (lineidx + 1))
+  console.log('  Got: %s', line)
+  process.exitCode = 1
+}

From 1588ef6c0903469c48355f7a3a867591b7864357 Mon Sep 17 00:00:00 2001
From: Huseyin BABAL <huseyinbabal88@gmail.com>
Date: Tue, 23 Apr 2019 12:59:55 +0300
Subject: [PATCH 300/529] docs: add connect-hazelcast to the list of session
 stores

closes #654
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 7b39aafb..f89453ae 100644
--- a/README.md
+++ b/README.md
@@ -546,6 +546,11 @@ and other multi-core embedded devices).
 [connect-dynamodb-url]: https://www.npmjs.com/package/connect-dynamodb
 [connect-dynamodb-image]: https://badgen.net/github/stars/ca98am79/connect-dynamodb?label=%E2%98%85
 
+[![★][connect-hazelcast-image] connect-hazelcast][connect-hazelcast-url] Hazelcast session store for Connect and Express.
+
+[connect-hazelcast-url]: https://www.npmjs.com/package/connect-hazelcast
+[connect-hazelcast-image]: https://badgen.net/github/stars/huseyinbabal/connect-hazelcast?label=%E2%98%85
+
 [![★][connect-loki-image] connect-loki][connect-loki-url] A Loki.js-based session store.
 
 [connect-loki-url]: https://www.npmjs.com/package/connect-loki

From 3d5fa06375ea649e37b63dd0202c85e112db4f98 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Apr 2019 14:29:49 -0400
Subject: [PATCH 301/529] build: use nyc for coverage testing

---
 .eslintignore |  1 +
 .gitignore    |  1 +
 .travis.yml   | 14 ++++++++------
 package.json  |  6 +++---
 4 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/.eslintignore b/.eslintignore
index 62562b74..76b1021d 100644
--- a/.eslintignore
+++ b/.eslintignore
@@ -1,2 +1,3 @@
+.nyc_output
 coverage
 node_modules
diff --git a/.gitignore b/.gitignore
index 84a48637..207febba 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
+.nyc_output
 coverage
 node_modules
 npm-debug.log
diff --git a/.travis.yml b/.travis.yml
index c2fd08f1..531f9a6a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -60,16 +60,18 @@ before_install:
     # Configure eslint for linting
     if node_version_lt '4.0'; then npm_remove_module_re '^eslint(-|$)'
     fi
-  - |
-    # Configure istanbul for coverage
-    if node_version_lt '0.10'; then npm_remove_module_re '^istanbul$'
-    fi
   - |
     # Configure mocha for testing
     if   node_version_lt '0.10'; then npm_use_module 'mocha' '2.5.3'
     elif node_version_lt '4.0' ; then npm_use_module 'mocha' '3.5.3'
     elif node_version_lt '6.0' ; then npm_use_module 'mocha' '5.2.0'
     fi
+  - |
+    # Configure nyc for coverage
+    if   node_version_lt '0.10'; then npm_remove_module_re '^nyc$'
+    elif node_version_lt '4.0' ; then npm_use_module 'nyc' '10.3.2'
+    elif node_version_lt '6.0' ; then npm_use_module 'nyc' '11.9.0'
+    fi
   - |
     # Configure supertest for http calls
     if   node_version_lt '0.10'; then npm_use_module 'supertest' '1.1.0'
@@ -97,7 +99,7 @@ script:
 after_script:
   - |
     # Upload coverage to coveralls, if exists
-    if [[ -f ./coverage/lcov.info ]]; then
+    if [[ -d .nyc_output ]]; then
       npm install --save-dev coveralls@2
-      coveralls < ./coverage/lcov.info
+      nyc report --reporter=text-lcov | coveralls
     fi
diff --git a/package.json b/package.json
index c6543b84..a40271ee 100644
--- a/package.json
+++ b/package.json
@@ -25,8 +25,8 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.0",
     "express": "4.16.4",
-    "istanbul": "0.4.5",
     "mocha": "6.1.4",
+    "nyc": "14.0.0",
     "supertest": "4.0.2"
   },
   "files": [
@@ -41,8 +41,8 @@
   "scripts": {
     "lint": "eslint --plugin markdown --ext js,md . && node ./scripts/lint-readme.js",
     "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --check-leaks --no-exit --reporter dot test/",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --check-leaks --no-exit --reporter spec test/",
+    "test-cov": "nyc npm test",
+    "test-travis": "nyc npm test -- --no-exit",
     "version": "node scripts/version-history.js && git add HISTORY.md"
   }
 }

From 268c929fb598a21dc5e4806c310d14039bcacf73 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Apr 2019 14:58:58 -0400
Subject: [PATCH 302/529] build: Node.js@8.16

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 531f9a6a..13c8fdb2 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ node_js:
   - "5.12"
   - "6.17"
   - "7.10"
-  - "8.15"
+  - "8.16"
   - "9.11"
   - "10.15"
   - "11.13"

From 327695e3d1dd4d7a5d3857f2afbb5852b7710213 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Apr 2019 14:59:24 -0400
Subject: [PATCH 303/529] build: Node.js@11.14

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 13c8fdb2..5cc7b7fb 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "8.16"
   - "9.11"
   - "10.15"
-  - "11.13"
+  - "11.14"
 sudo: false
 cache:
   directories:

From e0feb046108642d190facf18e59e05ab80213419 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 May 2019 18:30:53 -0400
Subject: [PATCH 304/529] build: support Node.js 12.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 5cc7b7fb..e483a9a0 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,6 +14,7 @@ node_js:
   - "9.11"
   - "10.15"
   - "11.14"
+  - "12.2"
 sudo: false
 cache:
   directories:

From 8d6430e7df82a7b9bd29ca100bbfacc0ed530b67 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 13 May 2019 18:38:08 -0400
Subject: [PATCH 305/529] build: nyc@14.1.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index a40271ee..b03fe961 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "eslint-plugin-markdown": "1.0.0",
     "express": "4.16.4",
     "mocha": "6.1.4",
-    "nyc": "14.0.0",
+    "nyc": "14.1.1",
     "supertest": "4.0.2"
   },
   "files": [

From 969e4c19d8439f2c6a73a9793a8bb08a84c246a3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 4 Jun 2019 19:03:22 -0400
Subject: [PATCH 306/529] build: express@4.17.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index b03fe961..19488f15 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "cookie-parser": "1.4.4",
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.0",
-    "express": "4.16.4",
+    "express": "4.17.1",
     "mocha": "6.1.4",
     "nyc": "14.1.1",
     "supertest": "4.0.2"

From ad90250d77685890b422990cb274544a3655815f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 4 Jun 2019 19:09:58 -0400
Subject: [PATCH 307/529] build: Node.js@10.16

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index e483a9a0..069b7d5b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.16"
   - "9.11"
-  - "10.15"
+  - "10.16"
   - "11.14"
   - "12.2"
 sudo: false

From 1c75fa049e363449cb52b4aacfed83b95e375356 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 5 Jun 2019 00:01:28 -0400
Subject: [PATCH 308/529] build: Node.js@11.15

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 069b7d5b..485800b5 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,7 +13,7 @@ node_js:
   - "8.16"
   - "9.11"
   - "10.16"
-  - "11.14"
+  - "11.15"
   - "12.2"
 sudo: false
 cache:

From fb498ace8946307decc5da5f564cc09ba8227fef Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 5 Jun 2019 00:05:58 -0400
Subject: [PATCH 309/529] build: Node.js@12.4

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 485800b5..8c857819 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.16"
   - "11.15"
-  - "12.2"
+  - "12.4"
 sudo: false
 cache:
   directories:

From bff097ef16ef02bebe0862ac1508c98e2da012e3 Mon Sep 17 00:00:00 2001
From: Ravi van Rooijen <ravivanrooijen@live.nl>
Date: Sat, 4 May 2019 02:14:12 +0200
Subject: [PATCH 310/529] docs: add connect-typeorm to the list of session
 stores

closes #658
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index f89453ae..97c9bd2f 100644
--- a/README.md
+++ b/README.md
@@ -624,6 +624,11 @@ and other multi-core embedded devices).
 [connect-sqlite3-url]: https://www.npmjs.com/package/connect-sqlite3
 [connect-sqlite3-image]: https://badgen.net/github/stars/rawberg/connect-sqlite3?label=%E2%98%85
 
+[![★][connect-typeorm-image] connect-typeorm][connect-typeorm-url] A [TypeORM](https://github.com/typeorm/typeorm)-based session store.
+
+[connect-typeorm-url]: https://www.npmjs.com/package/connect-typeorm
+[connect-typeorm-image]: https://badgen.net/github/stars/makepost/connect-typeorm?label=%E2%98%85
+
 [![★][couchdb-expression-image] couchdb-expression][couchdb-expression-url] A [CouchDB](https://couchdb.apache.org/)-based session store.
 
 [couchdb-expression-url]: https://www.npmjs.com/package/couchdb-expression

From 97fe63cd024e9227f05923d1f65d3c48f6bffdad Mon Sep 17 00:00:00 2001
From: "F. Hinkelmann" <franziska.hinkelmann@gmail.com>
Date: Thu, 30 May 2019 04:47:49 -0400
Subject: [PATCH 311/529] docs: add @google-cloud/connect-firestore to the list
 of session stores

closes #665
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 97c9bd2f..60163a70 100644
--- a/README.md
+++ b/README.md
@@ -546,6 +546,11 @@ and other multi-core embedded devices).
 [connect-dynamodb-url]: https://www.npmjs.com/package/connect-dynamodb
 [connect-dynamodb-image]: https://badgen.net/github/stars/ca98am79/connect-dynamodb?label=%E2%98%85
 
+[![★][@google-cloud/connect-firestore-image] @google-cloud/connect-firestore][@google-cloud/connect-firestore-url] A [Google Cloud Firestore](https://cloud.google.com/firestore/docs/overview)-based session store.
+
+[@google-cloud/connect-firestore-url]: https://www.npmjs.com/package/@google-cloud/connect-firestore
+[@google-cloud/connect-firestore-image]: https://badgen.net/github/stars/googleapis/nodejs-firestore-session?label=%E2%98%85
+
 [![★][connect-hazelcast-image] connect-hazelcast][connect-hazelcast-url] Hazelcast session store for Connect and Express.
 
 [connect-hazelcast-url]: https://www.npmjs.com/package/connect-hazelcast

From 479940afd22a0b939eaee3997f883408d2e41bec Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 12 Jun 2019 00:07:59 -0400
Subject: [PATCH 312/529] tests: add cookie.originalMaxAge tests

---
 test/session.js | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/test/session.js b/test/session.js
index 437baf0e..fe503c0a 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1850,6 +1850,37 @@ describe('session()', function(){
         })
       })
 
+      describe('.originalMaxAge', function () {
+        before(function () {
+          this.server = createServer({ cookie: { maxAge: 2000 } }, function (req, res) {
+            req.session.hits = (req.session.hits || 0) + 1
+            res.end(JSON.stringify(req.session.cookie.originalMaxAge))
+          })
+        })
+
+        it('should equal original maxAge', function (done) {
+          request(this.server)
+            .get('/')
+            .expect(200, '2000', done)
+        })
+
+        it('should equal original maxAge for all requests', function (done) {
+          var server = this.server
+
+          request(server)
+            .get('/')
+            .expect(200, '2000', function (err, res) {
+              if (err) return done(err)
+              setTimeout(function () {
+                request(server)
+                  .get('/')
+                  .set('Cookie', cookie(res))
+                  .expect(200, '2000', done)
+              }, 100)
+            })
+        })
+      })
+
       describe('.secure', function(){
         var app
 

From 30e23f1343d3912bc3e3715792ee8ddca694e9b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Janusz=20Bia=C5=82obrzewski?= <jbialobr@o2.pl>
Date: Thu, 30 May 2019 09:58:08 +0200
Subject: [PATCH 313/529] Fix restoring cookie.originalMaxAge when store
 returns Date

fixes #664
---
 HISTORY.md                  |  1 +
 session/store.js            |  7 ++---
 test/session.js             | 33 ++++++++++++++++++-----
 test/support/smart-store.js | 54 +++++++++++++++++++++++++++++++++++++
 4 files changed, 85 insertions(+), 10 deletions(-)
 create mode 100644 test/support/smart-store.js

diff --git a/HISTORY.md b/HISTORY.md
index a5cd3507..3d1533ee 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix restoring `cookie.originalMaxAge` when store returns `Date`
   * deps: parseurl@~1.3.3
 
 1.16.1 / 2019-04-11
diff --git a/session/store.js b/session/store.js
index baefbf8d..3793877e 100644
--- a/session/store.js
+++ b/session/store.js
@@ -90,12 +90,13 @@ Store.prototype.createSession = function(req, sess){
   sess.cookie = new Cookie(sess.cookie);
 
   if (typeof expires === 'string') {
-    // convert expires to a Date object,
-    // keeping originalMaxAge intact
+    // convert expires to a Date object
     sess.cookie.expires = new Date(expires)
-    sess.cookie.originalMaxAge = originalMaxAge
   }
 
+  // keep originalMaxAge intact
+  sess.cookie.originalMaxAge = originalMaxAge
+
   req.session = new Session(req, sess);
   return req.session;
 };
diff --git a/test/session.js b/test/session.js
index fe503c0a..1e3b7124 100644
--- a/test/session.js
+++ b/test/session.js
@@ -8,6 +8,7 @@ var http = require('http')
 var https = require('https')
 var request = require('supertest')
 var session = require('../')
+var SmartStore = require('./support/smart-store')
 var SyncStore = require('./support/sync-store')
 var utils = require('./support/utils')
 
@@ -1851,21 +1852,39 @@ describe('session()', function(){
       })
 
       describe('.originalMaxAge', function () {
-        before(function () {
-          this.server = createServer({ cookie: { maxAge: 2000 } }, function (req, res) {
-            req.session.hits = (req.session.hits || 0) + 1
+        it('should equal original maxAge', function (done) {
+          var server = createServer({ cookie: { maxAge: 2000 } }, function (req, res) {
             res.end(JSON.stringify(req.session.cookie.originalMaxAge))
           })
-        })
 
-        it('should equal original maxAge', function (done) {
-          request(this.server)
+          request(server)
             .get('/')
             .expect(200, '2000', done)
         })
 
         it('should equal original maxAge for all requests', function (done) {
-          var server = this.server
+          var server = createServer({ cookie: { maxAge: 2000 } }, function (req, res) {
+            res.end(JSON.stringify(req.session.cookie.originalMaxAge))
+          })
+
+          request(server)
+            .get('/')
+            .expect(200, '2000', function (err, res) {
+              if (err) return done(err)
+              setTimeout(function () {
+                request(server)
+                  .get('/')
+                  .set('Cookie', cookie(res))
+                  .expect(200, '2000', done)
+              }, 100)
+            })
+        })
+
+        it('should equal original maxAge for all requests', function (done) {
+          var store = new SmartStore()
+          var server = createServer({ cookie: { maxAge: 2000 }, store: store }, function (req, res) {
+            res.end(JSON.stringify(req.session.cookie.originalMaxAge))
+          })
 
           request(server)
             .get('/')
diff --git a/test/support/smart-store.js b/test/support/smart-store.js
new file mode 100644
index 00000000..8b224fdd
--- /dev/null
+++ b/test/support/smart-store.js
@@ -0,0 +1,54 @@
+'use strict'
+
+var session = require('../../')
+var util = require('util')
+
+/* istanbul ignore next */
+var defer = typeof setImmediate === 'function'
+  ? setImmediate
+  : function(fn){ process.nextTick(fn.bind.apply(fn, arguments)) }
+
+module.exports = SmartStore
+
+function SmartStore () {
+  session.Store.call(this)
+  this.sessions = Object.create(null)
+}
+
+util.inherits(SmartStore, session.Store)
+
+SmartStore.prototype.destroy = function destroy (sid, callback) {
+  delete this.sessions[sid]
+  defer(callback, null)
+}
+
+SmartStore.prototype.get = function get (sid, callback) {
+  var sess = this.sessions[sid]
+
+  if (!sess) {
+    return
+  }
+
+  // parse
+  sess = JSON.parse(sess)
+
+  if (sess.cookie) {
+    // expand expires into Date object
+    sess.cookie.expires = typeof sess.cookie.expires === 'string'
+      ? new Date(sess.cookie.expires)
+      : sess.cookie.expires
+
+    // destroy expired session
+    if (sess.cookie.expires && sess.cookie.expires <= Date.now()) {
+      delete this.sessions[sid]
+      sess = null
+    }
+  }
+
+  defer(callback, null, sess)
+}
+
+SmartStore.prototype.set = function set (sid, sess, callback) {
+  this.sessions[sid] = JSON.stringify(sess)
+  defer(callback, null)
+}

From 2d54f0dca1506883bebc634fcb7135c2f02c47cd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 12 Jun 2019 01:01:41 -0400
Subject: [PATCH 314/529] 1.16.2

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 3d1533ee..f12dc39f 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.16.2 / 2019-06-12
+===================
 
   * Fix restoring `cookie.originalMaxAge` when store returns `Date`
   * deps: parseurl@~1.3.3
diff --git a/package.json b/package.json
index 19488f15..fffbd49f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.16.1",
+  "version": "1.16.2",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 6db8e04b92e18107c59f6eaf4e162bdaabd64f6a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Aug 2019 20:03:10 -0400
Subject: [PATCH 315/529] build: mocha@6.2.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index fffbd49f..6e2af8b8 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.0",
     "express": "4.17.1",
-    "mocha": "6.1.4",
+    "mocha": "6.2.0",
     "nyc": "14.1.1",
     "supertest": "4.0.2"
   },

From 2719bef016b4ab5e8013402a5c0c2b13b188c6a2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Aug 2019 20:09:09 -0400
Subject: [PATCH 316/529] build: Node.js@12.8

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 8c857819..afa837b3 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.16"
   - "11.15"
-  - "12.4"
+  - "12.8"
 sudo: false
 cache:
   directories:

From f75ed7eb6ce16426162d53ae8b588a999d589758 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Aug 2019 20:13:09 -0400
Subject: [PATCH 317/529] build: fix readme lint out of order message

---
 scripts/lint-readme.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/lint-readme.js b/scripts/lint-readme.js
index a93129e2..f4c50d76 100644
--- a/scripts/lint-readme.js
+++ b/scripts/lint-readme.js
@@ -31,7 +31,7 @@ README_CONTENTS.split(NEWLINE_REGEXP).forEach(function (line, lineidx) {
         if (!(header = STORE_HEADER_REGEXP.exec(line))) {
           expect(lineidx, 'session store header', line)
         } else if (prev && prev[2].replace(/^[^/]+\//, '').localeCompare(header[2].replace(/^[^/]+\//, '')) > 0) {
-          expect(lineidx, (header[2] + ' to be alphabetically after ' + prev[2]), line)
+          expect(lineidx, (header[2] + ' to be alphabetically before ' + prev[2]), line)
           state = 2
         } else {
           state = 2

From 8de786571771d465a607f1b421b27dbbf566bbd0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Simon=20Rig=C3=A9t?= <simon.riget@gmail.com>
Date: Wed, 26 Jun 2019 23:13:01 +0200
Subject: [PATCH 318/529] docs: add express-session-rsdb to the list of session
 stores

closes #670
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 60163a70..959287c9 100644
--- a/README.md
+++ b/README.md
@@ -688,6 +688,11 @@ a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-e
 [express-session-level-url]: https://www.npmjs.com/package/express-session-level
 [express-session-level-image]: https://badgen.net/github/stars/tgohn/express-session-level?label=%E2%98%85
 
+[![★][express-session-rsdb-image] express-session-rsdb][express-session-rsdb-url] Session store based on Rocket-Store: A very simple, super fast and yet powerfull, flat file database.
+
+[express-session-rsdb-url]: https://www.npmjs.com/package/express-session-rsdb
+[express-session-rsdb-image]: https://badgen.net/github/stars/paragi/express-session-rsdb?label=%E2%98%85
+
 [![★][express-sessions-image] express-sessions][express-sessions-url] A session store supporting both MongoDB and Redis.
 
 [express-sessions-url]: https://www.npmjs.com/package/express-sessions

From 1684c548b2dcb54c8c38474eae729c7edc54866c Mon Sep 17 00:00:00 2001
From: Scott MacLellan <scott.maclellan@vidyard.com>
Date: Tue, 16 Jul 2019 10:15:53 -0400
Subject: [PATCH 319/529] deps: cookie@0.4.0

closes #674
---
 HISTORY.md   | 6 ++++++
 README.md    | 6 ++++--
 package.json | 2 +-
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index f12dc39f..1bcd0a17 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * deps: cookie@0.4.0
+    - Add `SameSite=None` support
+
 1.16.2 / 2019-06-12
 ===================
 
diff --git a/README.md b/README.md
index 959287c9..19047d58 100644
--- a/README.md
+++ b/README.md
@@ -101,10 +101,11 @@ Specifies the `boolean` or `string` to be the value for the `SameSite` `Set-Cook
   - `true` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
   - `false` will not set the `SameSite` attribute.
   - `'lax'` will set the `SameSite` attribute to `Lax` for lax same site enforcement.
+  - `'none'` will set the `SameSite` attribute to `None` for an explicit cross-site cookie.
   - `'strict'` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
 
-More information about the different enforcement levels can be found in the specification
-https://tools.ietf.org/html/draft-west-first-party-cookies-07#section-4.1.1
+More information about the different enforcement levels can be found in
+[the specification][rfc-6265bis-03-4.1.2.7].
 
 **Note** This is an attribute that has not yet been fully standardized, and may change in
 the future. This also means many clients may ignore this attribute until they understand it.
@@ -818,6 +819,7 @@ app.get('/bar', function (req, res, next) {
 
 [MIT](LICENSE)
 
+[rfc-6265bis-03-4.1.2.7]: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.2.7
 [coveralls-image]: https://badgen.net/coveralls/c/github/expressjs/session/master
 [coveralls-url]: https://coveralls.io/r/expressjs/session?branch=master
 [node-url]: https://nodejs.org/en/download
diff --git a/package.json b/package.json
index 6e2af8b8..1fad0d98 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   "repository": "expressjs/session",
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.3.1",
+    "cookie": "0.4.0",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "~2.0.0",

From 10607bdb780204b91a8cf90e4ce27726619b8285 Mon Sep 17 00:00:00 2001
From: Justin Nahin <justin@indospace.io>
Date: Wed, 10 Jul 2019 03:56:45 -0700
Subject: [PATCH 320/529] deps: safe-buffer@5.2.0

closes #672
---
 HISTORY.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 1bcd0a17..559e362c 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -3,6 +3,7 @@ unreleased
 
   * deps: cookie@0.4.0
     - Add `SameSite=None` support
+  * deps: safe-buffer@5.2.0
 
 1.16.2 / 2019-06-12
 ===================
diff --git a/package.json b/package.json
index 1fad0d98..a8f34e4e 100644
--- a/package.json
+++ b/package.json
@@ -16,7 +16,7 @@
     "depd": "~2.0.0",
     "on-headers": "~1.0.2",
     "parseurl": "~1.3.3",
-    "safe-buffer": "5.1.2",
+    "safe-buffer": "5.2.0",
     "uid-safe": "~2.1.5"
   },
   "devDependencies": {

From 8731d7bdd9c4f0e455bd594cd16c075d993e4401 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 7 Oct 2019 22:41:19 -0400
Subject: [PATCH 321/529] build: Node.js@12.11

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index afa837b3..6eec393b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.16"
   - "11.15"
-  - "12.8"
+  - "12.11"
 sudo: false
 cache:
   directories:

From 9c065098eb51a2a540c2f3d744a84b0941b70a56 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 7 Oct 2019 22:43:57 -0400
Subject: [PATCH 322/529] build: mocha@6.2.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index a8f34e4e..6d173184 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.0",
     "express": "4.17.1",
-    "mocha": "6.2.0",
+    "mocha": "6.2.1",
     "nyc": "14.1.1",
     "supertest": "4.0.2"
   },

From 9a5e31349e4274487d7f75ebe53fa78b3462894b Mon Sep 17 00:00:00 2001
From: fhellwig <frank@hellwig.org>
Date: Tue, 17 Sep 2019 09:36:58 -0400
Subject: [PATCH 323/529] docs: add lowdb-session-store to the list of session
 stores

closes #690
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 19047d58..c9eb012b 100644
--- a/README.md
+++ b/README.md
@@ -720,6 +720,11 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [level-session-store-url]: https://www.npmjs.com/package/level-session-store
 [level-session-store-image]: https://badgen.net/github/stars/toddself/level-session-store?label=%E2%98%85
 
+[![★][lowdb-session-store-image] lowdb-session-store][lowdb-session-store-url] A [lowdb](https://www.npmjs.com/package/lowdb)-based session store.
+
+[lowdb-session-store-url]: https://www.npmjs.com/package/lowdb-session-store
+[lowdb-session-store-image]: https://badgen.net/github/stars/fhellwig/lowdb-session-store?label=%E2%98%85
+
 [![★][medea-session-store-image] medea-session-store][medea-session-store-url] A Medea-based session store.
 
 [medea-session-store-url]: https://www.npmjs.com/package/medea-session-store

From c32ad191da9abba58e539fe1ce164536c6d65f67 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Borntr=C3=A4ger?= <marc.borntraeger@gmail.com>
Date: Tue, 6 Aug 2019 13:07:17 +0200
Subject: [PATCH 324/529] docs: expand description of the rolling option

closes #677
---
 README.md | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index c9eb012b..a1ed3fa1 100644
--- a/README.md
+++ b/README.md
@@ -228,15 +228,24 @@ likely need `resave: true`.
 
 ##### rolling
 
-Force a session identifier cookie to be set on every response. The expiration
+Force the session identifier cookie to be set on every response. The expiration
 is reset to the original [`maxAge`](#cookiemaxage), resetting the expiration
 countdown.
 
 The default value is `false`.
 
+With this enabled, the session identifier cookie will expire in
+[`maxAge`](#cookiemaxage) since the last response was sent instead of in
+[`maxAge`](#cookiemaxage) since the session was last modified by the server.
+
+This is typically used in conjuction with short, non-session-length
+[`maxAge`](#cookiemaxage) values to provide a quick timeout of the session data
+with reduced potentional of it occurring during on going server interactions.
+
 **Note** When this option is set to `true` but the `saveUninitialized` option is
 set to `false`, the cookie will not be set on a response with an uninitialized
-session.
+session. This option only modifies the behavior when an existing session was
+loaded for the request.
 
 ##### saveUninitialized
 

From 4d253405aca773e3e994c0259a3bc658c22430e0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 8 Oct 2019 17:56:31 -0400
Subject: [PATCH 325/529] build: fix coverage reporting

---
 .travis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 6eec393b..08d2fea7 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -89,8 +89,8 @@ before_install:
 
 script:
   - |
-    # Run test script, depending on istanbul install
-    if npm_module_installed 'istanbul'; then npm run-script test-travis
+    # Run test script, depending on nyc install
+    if npm_module_installed 'nyc'; then npm run-script test-travis
     else npm test
     fi
   - |

From b22384b712fea118f1c3eb5b0d79312ebd25e97c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 10 Oct 2019 22:59:50 -0400
Subject: [PATCH 326/529] 1.17.0

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 559e362c..ccc03991 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.17.0 / 2019-10-10
+===================
 
   * deps: cookie@0.4.0
     - Add `SameSite=None` support
diff --git a/package.json b/package.json
index 6d173184..82ca06f3 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.16.2",
+  "version": "1.17.0",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 9e1943303b6f7cb2bf83b2d215036bfb12d48065 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 29 Oct 2019 20:03:58 -0400
Subject: [PATCH 327/529] build: eslint-plugin-markdown@1.0.1

---
 .travis.yml  | 2 +-
 package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 08d2fea7..d092ada1 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -59,7 +59,7 @@ before_install:
   # Setup Node.js version-specific dependencies
   - |
     # Configure eslint for linting
-    if node_version_lt '4.0'; then npm_remove_module_re '^eslint(-|$)'
+    if node_version_lt '6.0'; then npm_remove_module_re '^eslint(-|$)'
     fi
   - |
     # Configure mocha for testing
diff --git a/package.json b/package.json
index 82ca06f3..a652e78f 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
     "after": "0.8.2",
     "cookie-parser": "1.4.4",
     "eslint": "3.19.0",
-    "eslint-plugin-markdown": "1.0.0",
+    "eslint-plugin-markdown": "1.0.1",
     "express": "4.17.1",
     "mocha": "6.2.1",
     "nyc": "14.1.1",

From 3281442df86f6f26f5d2cf9d6038f2d845784585 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 29 Oct 2019 20:08:00 -0400
Subject: [PATCH 328/529] build: mocha@6.2.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index a652e78f..e41e71b1 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.1",
     "express": "4.17.1",
-    "mocha": "6.2.1",
+    "mocha": "6.2.2",
     "nyc": "14.1.1",
     "supertest": "4.0.2"
   },

From 77a3d192ba8303be57e0b5652ceb9516da92f772 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 30 Oct 2019 00:21:06 -0400
Subject: [PATCH 329/529] build: Node.js@10.17

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index d092ada1..078ab9a5 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.16"
   - "9.11"
-  - "10.16"
+  - "10.17"
   - "11.15"
   - "12.11"
 sudo: false

From 7d071562ee5db3e00a484b302af40873dbb8e22a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 30 Oct 2019 00:24:55 -0400
Subject: [PATCH 330/529] build: Node.js@12.13

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 078ab9a5..5b763e29 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.17"
   - "11.15"
-  - "12.11"
+  - "12.13"
 sudo: false
 cache:
   directories:

From e18fb51d2d403bf3b5bd4e498f621dee4a52db41 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 8 Jan 2020 22:10:48 -0500
Subject: [PATCH 331/529] build: nyc@15.0.0

---
 .travis.yml  | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 5b763e29..c1c97986 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -72,6 +72,7 @@ before_install:
     if   node_version_lt '0.10'; then npm_remove_module_re '^nyc$'
     elif node_version_lt '4.0' ; then npm_use_module 'nyc' '10.3.2'
     elif node_version_lt '6.0' ; then npm_use_module 'nyc' '11.9.0'
+    elif node_version_lt '8.0' ; then npm_use_module 'nyc' '14.1.1'
     fi
   - |
     # Configure supertest for http calls
diff --git a/package.json b/package.json
index e41e71b1..e650cdeb 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "eslint-plugin-markdown": "1.0.1",
     "express": "4.17.1",
     "mocha": "6.2.2",
-    "nyc": "14.1.1",
+    "nyc": "15.0.0",
     "supertest": "4.0.2"
   },
   "files": [

From 4ea1ba33bc29b159f03deece1c6489af28f6e901 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 28 Jan 2020 22:34:45 -0500
Subject: [PATCH 332/529] build: mocha@7.0.1

---
 .travis.yml  | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index c1c97986..947febeb 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -66,6 +66,7 @@ before_install:
     if   node_version_lt '0.10'; then npm_use_module 'mocha' '2.5.3'
     elif node_version_lt '4.0' ; then npm_use_module 'mocha' '3.5.3'
     elif node_version_lt '6.0' ; then npm_use_module 'mocha' '5.2.0'
+    elif node_version_lt '8.0' ; then npm_use_module 'mocha' '6.2.2'
     fi
   - |
     # Configure nyc for coverage
diff --git a/package.json b/package.json
index e650cdeb..44c692e9 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.1",
     "express": "4.17.1",
-    "mocha": "6.2.2",
+    "mocha": "7.0.1",
     "nyc": "15.0.0",
     "supertest": "4.0.2"
   },

From adb11406b7d292b38085879185878164ec201b58 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 28 Jan 2020 22:39:55 -0500
Subject: [PATCH 333/529] build: Node.js@8.17

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 947febeb..d60cfc1e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ node_js:
   - "5.12"
   - "6.17"
   - "7.10"
-  - "8.16"
+  - "8.17"
   - "9.11"
   - "10.17"
   - "11.15"

From c7849bcc3b4827f7749d722c05fd2157b739ec39 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 28 Jan 2020 22:43:44 -0500
Subject: [PATCH 334/529] build: Node.js@10.18

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index d60cfc1e..6f5f0169 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.17"
+  - "10.18"
   - "11.15"
   - "12.13"
 sudo: false

From dfee1fad24d7d837bd99fec181babc35d6b14ae7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 29 Jan 2020 00:03:57 -0500
Subject: [PATCH 335/529] build: Node.js@12.14

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 6f5f0169..69074cc7 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.18"
   - "11.15"
-  - "12.13"
+  - "12.14"
 sudo: false
 cache:
   directories:

From 40a64089f00330d8f3b2f3ca9c157df5b68f235b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 29 Jan 2020 00:09:26 -0500
Subject: [PATCH 336/529] build: remove deprecated Travis CI directive

---
 .travis.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 69074cc7..fff4bc40 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,7 +15,6 @@ node_js:
   - "10.18"
   - "11.15"
   - "12.14"
-sudo: false
 cache:
   directories:
     - node_modules

From 0461302973bce4aba82c44f5a15ab388584161a4 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 2 Feb 2020 21:49:02 -0500
Subject: [PATCH 337/529] build: support Node.js 13.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index fff4bc40..5ec6c661 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,6 +15,7 @@ node_js:
   - "10.18"
   - "11.15"
   - "12.14"
+  - "13.7"
 cache:
   directories:
     - node_modules

From 99d21d16c2b344a58b318a2190b2f68899e58c58 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 27 Feb 2020 19:20:24 -0500
Subject: [PATCH 338/529] build: mocha@7.1.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 44c692e9..6ca5d7da 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.1",
     "express": "4.17.1",
-    "mocha": "7.0.1",
+    "mocha": "7.1.0",
     "nyc": "15.0.0",
     "supertest": "4.0.2"
   },

From e3c04a2691595768b8925107458a158eafcdc2f1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 27 Feb 2020 19:24:44 -0500
Subject: [PATCH 339/529] build: Node.js@13.9

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 5ec6c661..b5855359 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,7 +15,7 @@ node_js:
   - "10.18"
   - "11.15"
   - "12.14"
-  - "13.7"
+  - "13.9"
 cache:
   directories:
     - node_modules

From a3c9dd39b96df5fd668403352a586b1b93e2d3ab Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 2 Mar 2020 20:04:24 -0500
Subject: [PATCH 340/529] build: eslint-plugin-markdown@1.0.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 6ca5d7da..c33d5f82 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
     "after": "0.8.2",
     "cookie-parser": "1.4.4",
     "eslint": "3.19.0",
-    "eslint-plugin-markdown": "1.0.1",
+    "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
     "mocha": "7.1.0",
     "nyc": "15.0.0",

From f927fc13e7fda51082990cb1e26c27d0022a1b12 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 2 Mar 2020 20:09:50 -0500
Subject: [PATCH 341/529] build: Node.js@10.19

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index b5855359..70e4577f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.18"
+  - "10.19"
   - "11.15"
   - "12.14"
   - "13.9"

From a2b27958a498340dcf0f87f69735aadf9f7a9adc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 5 Mar 2020 21:40:57 -0500
Subject: [PATCH 342/529] build: Node.js@12.16

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 70e4577f..427ff29f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.19"
   - "11.15"
-  - "12.14"
+  - "12.16"
   - "13.9"
 cache:
   directories:

From 95946e320b32c6756b532128d737c97ab21d3e6c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 4 Apr 2020 19:34:36 -0400
Subject: [PATCH 343/529] build: nyc@15.0.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index c33d5f82..8bf91ddc 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
     "mocha": "7.1.0",
-    "nyc": "15.0.0",
+    "nyc": "15.0.1",
     "supertest": "4.0.2"
   },
   "files": [

From 82cc88217c49f0549f84414b90c192f30a2ba109 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 4 Apr 2020 19:38:49 -0400
Subject: [PATCH 344/529] build: mocha@7.1.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 8bf91ddc..8369f6b6 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "7.1.0",
+    "mocha": "7.1.1",
     "nyc": "15.0.1",
     "supertest": "4.0.2"
   },

From 06e557911e22b748050db5b4cc9eb3e8b53b3979 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 4 Apr 2020 19:43:04 -0400
Subject: [PATCH 345/529] build: cookie-parser@1.4.5

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 8369f6b6..b8f44d24 100644
--- a/package.json
+++ b/package.json
@@ -21,7 +21,7 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "cookie-parser": "1.4.4",
+    "cookie-parser": "1.4.5",
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",

From bcf1f071235ad4ddb22a24179c3d5151bb41c901 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Apr 2020 23:01:31 -0400
Subject: [PATCH 346/529] build: Node.js@13.12

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 427ff29f..23e0c446 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,7 +15,7 @@ node_js:
   - "10.19"
   - "11.15"
   - "12.16"
-  - "13.9"
+  - "13.12"
 cache:
   directories:
     - node_modules

From 909d9e0a238795aa927fe45ded86669fd446f1fe Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Apr 2020 20:24:14 -0400
Subject: [PATCH 347/529] docs: add debugging section

closes #707
---
 README.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/README.md b/README.md
index a1ed3fa1..fe5076d8 100644
--- a/README.md
+++ b/README.md
@@ -829,6 +829,24 @@ app.get('/bar', function (req, res, next) {
 })
 ```
 
+## Debugging
+
+This module uses the [debug](https://www.npmjs.com/package/debug) module
+internally to log information about session operations.
+
+To see all the internal logs, set the `DEBUG` environment variable to
+`express-session` when launching your app (`npm start`, in this example):
+
+```sh
+$ DEBUG=express-session npm start
+```
+
+On Windows, use the corresponding command;
+
+```sh
+> set DEBUG=express-session & npm start
+```
+
 ## License
 
 [MIT](LICENSE)

From ac3f0a256ba376f3e760c83cfde87adf3706cd2e Mon Sep 17 00:00:00 2001
From: Zirak <zirakertan@gmail.com>
Date: Sun, 17 Nov 2019 22:36:19 +0000
Subject: [PATCH 348/529] Fix internal method wrapping error on failed reloads

closes #715
---
 HISTORY.md      |  5 +++++
 index.js        | 15 +++++++++++----
 test/session.js | 43 +++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 59 insertions(+), 4 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index ccc03991..99d0636a 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix internal method wrapping error on failed reloads
+
 1.17.0 / 2019-10-10
 ===================
 
diff --git a/index.js b/index.js
index 24221b48..9615346c 100644
--- a/index.js
+++ b/index.js
@@ -376,6 +376,16 @@ function session(options) {
       wrapmethods(req.session)
     }
 
+    function rewrapmethods (sess, callback) {
+      return function () {
+        if (req.session !== sess) {
+          wrapmethods(req.session)
+        }
+
+        callback.apply(this, arguments)
+      }
+    }
+
     // wrap session methods
     function wrapmethods(sess) {
       var _reload = sess.reload
@@ -383,10 +393,7 @@ function session(options) {
 
       function reload(callback) {
         debug('reloading %s', this.id)
-        _reload.call(this, function () {
-          wrapmethods(req.session)
-          callback.apply(this, arguments)
-        })
+        _reload.call(this, rewrapmethods(this, callback))
       }
 
       function save() {
diff --git a/test/session.js b/test/session.js
index 1e3b7124..c0f1716d 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1677,6 +1677,49 @@ describe('session()', function(){
           .expect(500, 'failed to load session', done)
         })
       })
+
+      it('should not override an overriden `reload` in case of errors',  function (done) {
+        var store = new session.MemoryStore()
+        var server = createServer({ store: store, resave: false }, function (req, res) {
+          if (req.url === '/') {
+            req.session.active = true
+            res.end('session created')
+            return
+          }
+
+          store.clear(function (err) {
+            if (err) return done(err)
+
+            // reload way too many times on top of each other,
+            // attempting to overflow the call stack
+            var iters = 20
+            reload()
+            function reload () {
+              if (!--iters) {
+                res.end('ok')
+                return
+              }
+
+              try {
+                req.session.reload(reload)
+              } catch (e) {
+                res.statusCode = 500
+                res.end(e.message)
+              }
+            }
+          })
+        })
+
+        request(server)
+          .get('/')
+          .expect(200, 'session created', function (err, res) {
+            if (err) return done(err)
+            request(server)
+              .get('/foo')
+              .set('Cookie', cookie(res))
+              .expect(200, 'ok', done)
+          })
+      })
     })
 
     describe('.save()', function () {

From 5d5b51ff220f0e0d2adca06b3fbffc3310e56975 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Apr 2020 20:48:21 -0400
Subject: [PATCH 349/529] tests: resolve originalMaxAge flaky tests

fixes #719
---
 test/session.js | 40 +++++++++++++++++++++++++++++++++++-----
 1 file changed, 35 insertions(+), 5 deletions(-)

diff --git a/test/session.js b/test/session.js
index c0f1716d..929d7c74 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1902,7 +1902,13 @@ describe('session()', function(){
 
           request(server)
             .get('/')
-            .expect(200, '2000', done)
+            .expect(200)
+            .expect(function (res) {
+              // account for 1ms latency
+              assert.ok(res.text === '2000' || res.text === '1999',
+                'expected 2000, got ' + res.text)
+            })
+            .end(done)
         })
 
         it('should equal original maxAge for all requests', function (done) {
@@ -1912,13 +1918,25 @@ describe('session()', function(){
 
           request(server)
             .get('/')
-            .expect(200, '2000', function (err, res) {
+            .expect(200)
+            .expect(function (res) {
+              // account for 1ms latency
+              assert.ok(res.text === '2000' || res.text === '1999',
+                'expected 2000, got ' + res.text)
+            })
+            .end(function (err, res) {
               if (err) return done(err)
               setTimeout(function () {
                 request(server)
                   .get('/')
                   .set('Cookie', cookie(res))
-                  .expect(200, '2000', done)
+                  .expect(200)
+                  .expect(function (res) {
+                    // account for 1ms latency
+                    assert.ok(res.text === '2000' || res.text === '1999',
+                      'expected 2000, got ' + res.text)
+                  })
+                  .end(done)
               }, 100)
             })
         })
@@ -1931,13 +1949,25 @@ describe('session()', function(){
 
           request(server)
             .get('/')
-            .expect(200, '2000', function (err, res) {
+            .expect(200)
+            .expect(function (res) {
+              // account for 1ms latency
+              assert.ok(res.text === '2000' || res.text === '1999',
+                'expected 2000, got ' + res.text)
+            })
+            .end(function (err, res) {
               if (err) return done(err)
               setTimeout(function () {
                 request(server)
                   .get('/')
                   .set('Cookie', cookie(res))
-                  .expect(200, '2000', done)
+                  .expect(200)
+                  .expect(function (res) {
+                    // account for 1ms latency
+                    assert.ok(res.text === '2000' || res.text === '1999',
+                      'expected 2000, got ' + res.text)
+                  })
+                  .end(done)
               }, 100)
             })
         })

From 4b40b2fb54cde1774e7810c42ca01fe5c971bcbf Mon Sep 17 00:00:00 2001
From: Gaby Baghdadi <gabybaghdadi@hotmail.com>
Date: Mon, 11 Nov 2019 15:31:14 -0500
Subject: [PATCH 350/529] tests: fix flaky cookie.maxAge test

closes #713
---
 test/cookie.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/test/cookie.js b/test/cookie.js
index b280dff1..36f0f5f5 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -91,7 +91,9 @@ describe('new Cookie()', function () {
         var maxAge = 60000
         var cookie = new Cookie({ maxAge: maxAge })
 
-        assert.strictEqual(cookie.maxAge, maxAge)
+        assert.strictEqual(typeof cookie.maxAge, 'number')
+        assert.ok(cookie.maxAge - 1000 <= maxAge)
+        assert.ok(cookie.maxAge + 1000 >= maxAge)
       })
 
       it('should accept Date object', function () {

From 80ae6a54107efd936c55bc4696fe8770cedbfd31 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 16 Apr 2020 22:43:02 -0400
Subject: [PATCH 351/529] 1.71.1

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 99d0636a..c5a97fd2 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.17.1 / 2020-04-16
+===================
 
   * Fix internal method wrapping error on failed reloads
 
diff --git a/package.json b/package.json
index b8f44d24..ba2adb65 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.17.0",
+  "version": "1.17.1",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 975924658fd94dd10a373272a5dc465622dc0e0b Mon Sep 17 00:00:00 2001
From: Glenn Hinks <ghinks@yahoo.com>
Date: Tue, 14 Apr 2020 15:35:04 -0400
Subject: [PATCH 352/529] tests: remove duplicate test

closes #741
---
 test/cookie.js | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/test/cookie.js b/test/cookie.js
index 36f0f5f5..65ae1fc3 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -12,11 +12,6 @@ describe('new Cookie()', function () {
     assert.strictEqual(cookie.expires, null)
   })
 
-  it('should default maxAge to null', function () {
-    var cookie = new Cookie()
-    assert.strictEqual(cookie.maxAge, null)
-  })
-
   it('should default httpOnly to true', function () {
     var cookie = new Cookie()
     assert.strictEqual(cookie.httpOnly, true)

From 3b08fc7a78fe7742d5a29c5a4ad999169adaf3cb Mon Sep 17 00:00:00 2001
From: Glenn Hinks <ghinks@yahoo.com>
Date: Tue, 14 Apr 2020 18:01:22 -0400
Subject: [PATCH 353/529] tests: fix test validation of session ID

closes #742
---
 test/session.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/session.js b/test/session.js
index 929d7c74..f0b60fdf 100644
--- a/test/session.js
+++ b/test/session.js
@@ -482,7 +482,7 @@ describe('session()', function(){
           .get('/')
           .set('Cookie', cookie(res))
           .expect(shouldSetCookie('connect.sid'))
-          .expect(shouldSetCookieToDifferentSessionId(res))
+          .expect(shouldSetCookieToDifferentSessionId(sid(res)))
           .expect(200, 'session 2', done)
         })
       })

From c3e784e1a736fb41fab3da682f63582c709d6da8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 26 Apr 2020 18:09:58 -0400
Subject: [PATCH 354/529] build: Node.js@10.20

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 23e0c446..347cf792 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.19"
+  - "10.20"
   - "11.15"
   - "12.16"
   - "13.12"

From fa4e23405bc2dcabfac12a8436dcab1f3a830801 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 26 Apr 2020 18:11:34 -0400
Subject: [PATCH 355/529] build: Node.js@13.13

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 347cf792..6c647735 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,7 +15,7 @@ node_js:
   - "10.20"
   - "11.15"
   - "12.16"
-  - "13.12"
+  - "13.13"
 cache:
   directories:
     - node_modules

From fbf7059e565064ce1efc63a3b7b8995a9024ae2d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 1 May 2020 20:03:52 -0400
Subject: [PATCH 356/529] build: mocha@7.1.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ba2adb65..209c6e46 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "7.1.1",
+    "mocha": "7.1.2",
     "nyc": "15.0.1",
     "supertest": "4.0.2"
   },

From 4186dff8cdfa0a77005195697a0137f91082b073 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 May 2020 19:44:45 -0400
Subject: [PATCH 357/529] deps: safe-buffer@5.2.1

---
 HISTORY.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index c5a97fd2..60592140 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * deps: safe-buffer@5.2.1
+
 1.17.1 / 2020-04-16
 ===================
 
diff --git a/package.json b/package.json
index 209c6e46..d5eb6be2 100644
--- a/package.json
+++ b/package.json
@@ -16,7 +16,7 @@
     "depd": "~2.0.0",
     "on-headers": "~1.0.2",
     "parseurl": "~1.3.3",
-    "safe-buffer": "5.2.0",
+    "safe-buffer": "5.2.1",
     "uid-safe": "~2.1.5"
   },
   "devDependencies": {

From c5ec988ae982dfc00061fdb1571b2a88ada3aba5 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 18 May 2020 19:49:08 -0400
Subject: [PATCH 358/529] build: Node.js@13.14

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 6c647735..ba846eac 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,7 +15,7 @@ node_js:
   - "10.20"
   - "11.15"
   - "12.16"
-  - "13.13"
+  - "13.14"
 cache:
   directories:
     - node_modules

From 40a6337a7e69346694091f66d55928c913299c56 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Jun 2020 21:33:32 -0400
Subject: [PATCH 359/529] build: mocha@7.2.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index d5eb6be2..9ef314d2 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "7.1.2",
+    "mocha": "7.2.0",
     "nyc": "15.0.1",
     "supertest": "4.0.2"
   },

From fa6ced353fb3eecb9305eefeec9ef02d1dd07f7f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Jun 2020 21:36:35 -0400
Subject: [PATCH 360/529] build: Node.js@10.21

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index ba846eac..9ff2e6e9 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.20"
+  - "10.21"
   - "11.15"
   - "12.16"
   - "13.14"

From 34a4db1c279aad87ca1b12e19574f9e307831a6c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Jun 2020 21:40:20 -0400
Subject: [PATCH 361/529] build: Node.js@12.18

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 9ff2e6e9..db00f6ed 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.21"
   - "11.15"
-  - "12.16"
+  - "12.18"
   - "13.14"
 cache:
   directories:

From 357b98b4f9460173181a5e3dac84db126115b749 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Jun 2020 21:54:22 -0400
Subject: [PATCH 362/529] build: support Node.js 14.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index db00f6ed..f62c5a5a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,6 +16,7 @@ node_js:
   - "11.15"
   - "12.18"
   - "13.14"
+  - "14.4"
 cache:
   directories:
     - node_modules

From 67ccd90bedf155e249652df49714913297bfbc92 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 9 Jun 2020 22:01:55 -0400
Subject: [PATCH 363/529] build: nyc@15.1.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 9ef314d2..4c34510c 100644
--- a/package.json
+++ b/package.json
@@ -26,7 +26,7 @@
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
     "mocha": "7.2.0",
-    "nyc": "15.0.1",
+    "nyc": "15.1.0",
     "supertest": "4.0.2"
   },
   "files": [

From 75896a5525f7245278510b670c2e08a14ec10fc0 Mon Sep 17 00:00:00 2001
From: Glenn Hinks <ghinks@yahoo.com>
Date: Tue, 19 May 2020 08:10:26 -0400
Subject: [PATCH 364/529] docs: expand secret documentation with key advice

fixes #734
fixes #750
closes #752
---
 README.md | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index fe5076d8..14cad1e8 100644
--- a/README.md
+++ b/README.md
@@ -272,7 +272,22 @@ it to be saved. *This has been fixed in PassportJS 0.3.0*
 This is the secret used to sign the session ID cookie. This can be either a string
 for a single secret, or an array of multiple secrets. If an array of secrets is
 provided, only the first element will be used to sign the session ID cookie, while
-all the elements will be considered when verifying the signature in requests.
+all the elements will be considered when verifying the signature in requests. The
+secret itself should be not easily parsed by a human and would best be a random set
+of characters. A best practice may include:
+
+  - The use of environment variables to store the secret, ensuring the secret itself
+    does not exist in your repository.
+  - Periodic updates of the secret, while ensuring the previous secret is in the
+    array.
+
+Using a secret that cannot be guessed will reduce the ability to hijack a session to
+only guessing the session ID (as determined by the `genid` option).
+
+Changing the secret value will invalidate all existing sessions. In order to rotate
+the secret without invalidating sessions, provide an array of secrets, with the new
+secret as first element of the array, and including previous secrets as the later
+elements.
 
 ##### store
 

From 28d2691eaa6ff1796805eef3f9cf66ef6f6428cf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 10 Jun 2020 21:18:03 -0400
Subject: [PATCH 365/529] deps: cookie@0.4.1

---
 HISTORY.md   | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 60592140..355c8021 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * deps: cookie@0.4.1
   * deps: safe-buffer@5.2.1
 
 1.17.1 / 2020-04-16
diff --git a/package.json b/package.json
index 4c34510c..adadb821 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   "repository": "expressjs/session",
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.4.0",
+    "cookie": "0.4.1",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "~2.0.0",

From 0f26a224ef03e7b251b5f92098258b47c02bc579 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 24 Jun 2020 19:03:56 -0400
Subject: [PATCH 366/529] build: mocha@8.0.1

---
 .travis.yml  | 1 +
 package.json | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index f62c5a5a..d7722207 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -68,6 +68,7 @@ before_install:
     elif node_version_lt '4.0' ; then npm_use_module 'mocha' '3.5.3'
     elif node_version_lt '6.0' ; then npm_use_module 'mocha' '5.2.0'
     elif node_version_lt '8.0' ; then npm_use_module 'mocha' '6.2.2'
+    elif node_version_lt '10.0'; then npm_use_module 'mocha' '7.2.0'
     fi
   - |
     # Configure nyc for coverage
diff --git a/package.json b/package.json
index adadb821..e5c7e480 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "7.2.0",
+    "mocha": "8.0.1",
     "nyc": "15.1.0",
     "supertest": "4.0.2"
   },

From e485e11496f78b75f04ca58cde0d124f80f2b9e2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 6 Jul 2020 21:03:04 -0400
Subject: [PATCH 367/529] build: Node.js@14.5

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index d7722207..8fabbdf3 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,7 +16,7 @@ node_js:
   - "11.15"
   - "12.18"
   - "13.14"
-  - "14.4"
+  - "14.5"
 cache:
   directories:
     - node_modules

From 7d7f4f72dd28586d978009b0fde946c51202fb27 Mon Sep 17 00:00:00 2001
From: Glenn Hinks <ghinks@yahoo.com>
Date: Sun, 3 May 2020 09:15:33 -0400
Subject: [PATCH 368/529] tests: add res.writeHead set-cookie test

closes #746
---
 test/session.js | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/test/session.js b/test/session.js
index f0b60fdf..1455f0a6 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1892,6 +1892,21 @@ describe('session()', function(){
           .expect(shouldSetCookieToValue('previous', 'cookieValue'))
           .expect(200, done)
         })
+
+        it('should preserve cookies set in writeHead', function (done) {
+          var server = createServer(null, function (req, res) {
+            var cookie = new Cookie()
+            res.writeHead(200, {
+              'Set-Cookie': cookie.serialize('previous', 'cookieValue')
+            })
+            res.end()
+          })
+
+          request(server)
+            .get('/')
+            .expect(shouldSetCookieToValue('previous', 'cookieValue'))
+            .expect(200, done)
+        })
       })
 
       describe('.originalMaxAge', function () {

From 09d41b9b82fb56e8d86c410d38c52139cd932eec Mon Sep 17 00:00:00 2001
From: Glenn Hinks <ghinks@yahoo.com>
Date: Fri, 3 Jul 2020 11:48:48 -0400
Subject: [PATCH 369/529] docs: remove deprecated store modules from readme

closes #765
---
 README.md | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/README.md b/README.md
index 14cad1e8..66c84da7 100644
--- a/README.md
+++ b/README.md
@@ -617,11 +617,6 @@ and other multi-core embedded devices).
 [connect-mongodb-session-url]: https://www.npmjs.com/package/connect-mongodb-session
 [connect-mongodb-session-image]: https://badgen.net/github/stars/mongodb-js/connect-mongodb-session?label=%E2%98%85
 
-[![★][connect-mssql-image] connect-mssql][connect-mssql-url] A SQL Server-based session store.
-
-[connect-mssql-url]: https://www.npmjs.com/package/connect-mssql
-[connect-mssql-image]: https://badgen.net/github/stars/patriksimek/connect-mssql?label=%E2%98%85
-
 [![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
 
 [connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple
@@ -664,11 +659,6 @@ and other multi-core embedded devices).
 [couchdb-expression-url]: https://www.npmjs.com/package/couchdb-expression
 [couchdb-expression-image]: https://badgen.net/github/stars/tkshnwesper/couchdb-expression?label=%E2%98%85
 
-[![★][documentdb-session-image] documentdb-session][documentdb-session-url] A session store for Microsoft Azure's [DocumentDB](https://azure.microsoft.com/en-us/services/documentdb/) NoSQL database service.
-
-[documentdb-session-url]: https://www.npmjs.com/package/documentdb-session
-[documentdb-session-image]: https://badgen.net/github/stars/dwhieb/documentdb-session?label=%E2%98%85
-
 [![★][dynamodb-store-image] dynamodb-store][dynamodb-store-url] A DynamoDB-based session store.
 
 [dynamodb-store-url]: https://www.npmjs.com/package/dynamodb-store

From 6a128cc5941365d0416d92760328a8e11549eb5d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 7 Jul 2020 21:43:18 -0400
Subject: [PATCH 370/529] Fix res.end patch to always commit headers

fixes #766
closes #767
---
 HISTORY.md      |  1 +
 index.js        |  4 ++++
 test/session.js | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 41 insertions(+)

diff --git a/HISTORY.md b/HISTORY.md
index 355c8021..4fa89ab4 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix `res.end` patch to always commit headers
   * deps: cookie@0.4.1
   * deps: safe-buffer@5.2.1
 
diff --git a/index.js b/index.js
index 9615346c..d7efeab9 100644
--- a/index.js
+++ b/index.js
@@ -272,6 +272,10 @@ function session(options) {
           return ret;
         }
 
+        if (!res._header) {
+          res._implicitHeader()
+        }
+
         if (chunk == null) {
           ret = true;
           return ret;
diff --git a/test/session.js b/test/session.js
index 1455f0a6..8d796f91 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1449,6 +1449,42 @@ describe('session()', function(){
       .get('/')
       .expect(200, 'hello, world', done)
     })
+
+    it('should error when res.end is called twice', function (done) {
+      var error1 = null
+      var error2 = null
+      var server = http.createServer(function (req, res) {
+        res.end()
+
+        try {
+          res.setHeader('Content-Length', '3')
+          res.end('foo')
+        } catch (e) {
+          error1 = e
+        }
+      })
+
+      function respond (req, res) {
+        res.end()
+
+        try {
+          res.setHeader('Content-Length', '3')
+          res.end('foo')
+        } catch (e) {
+          error2 = e
+        }
+      }
+
+      request(server)
+        .get('/')
+        .end(function (err, res) {
+          if (err) return done(err)
+          request(createServer(null, respond))
+            .get('/')
+            .expect(function () { assert.strictEqual((error1 && error1.message), (error2 && error2.message)) })
+            .expect(res.statusCode, res.text, done)
+        })
+    })
   })
 
   describe('req.session', function(){

From c678436a0d2b62113ef5433acf45fe72d36e80ce Mon Sep 17 00:00:00 2001
From: Krispin Leydon <kleydon@users.noreply.github.com>
Date: Sat, 20 Jun 2020 09:44:56 -0700
Subject: [PATCH 371/529] docs: add @quixo3/prisma-session-store-url to the
 list of session stores

closes #760
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 66c84da7..3b2bcbf4 100644
--- a/README.md
+++ b/README.md
@@ -759,6 +759,11 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [nedb-session-store-url]: https://www.npmjs.com/package/nedb-session-store
 [nedb-session-store-image]: https://badgen.net/github/stars/JamesMGreene/nedb-session-store?label=%E2%98%85
 
+[![★][@quixo3/prisma-session-store-image] @quixo3/prisma-session-store][@quixo3/prisma-session-store-url] A session store for the [Prisma Framework](https://www.prisma.io).
+
+[@quixo3/prisma-session-store-url]: https://www.npmjs.com/package/@quixo3/prisma-session-store
+[@quixo3/prisma-session-store-image]: https://badgen.net/github/stars/kleydon/prisma-session-store?label=%E2%98%85
+
 [![★][restsession-image] restsession][restsession-url] Store sessions utilizing a RESTful API
 
 [restsession-url]: https://www.npmjs.com/package/restsession

From 4715f3b4ed75f7a3926137f6754cde42b9fb66b7 Mon Sep 17 00:00:00 2001
From: shree <sammmmmu123@gmail.com>
Date: Sat, 11 Jul 2020 18:03:24 +0530
Subject: [PATCH 372/529] docs: fix typo in readme

closes #768
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 3b2bcbf4..94ec2743 100644
--- a/README.md
+++ b/README.md
@@ -240,7 +240,7 @@ With this enabled, the session identifier cookie will expire in
 
 This is typically used in conjuction with short, non-session-length
 [`maxAge`](#cookiemaxage) values to provide a quick timeout of the session data
-with reduced potentional of it occurring during on going server interactions.
+with reduced potential of it occurring during on going server interactions.
 
 **Note** When this option is set to `true` but the `saveUninitialized` option is
 set to `false`, the cookie will not be set on a response with an uninitialized

From 9face93ed0cdd4494a6513542ac12e15ad0a9848 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 27 Jul 2020 22:41:07 -0400
Subject: [PATCH 373/529] build: Node.js@10.22

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 8fabbdf3..4621c083 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.21"
+  - "10.22"
   - "11.15"
   - "12.18"
   - "13.14"

From c37c46b0773ef3c415dc0aa8efc3f0f904d0772a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 5 Aug 2020 16:44:49 -0400
Subject: [PATCH 374/529] build: mocha@8.1.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e5c7e480..e3f988f7 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "8.0.1",
+    "mocha": "8.1.1",
     "nyc": "15.1.0",
     "supertest": "4.0.2"
   },

From 7d9ec2b7d531c943b65751ea60ca04b7080bf75e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 5 Aug 2020 16:49:27 -0400
Subject: [PATCH 375/529] build: Node.js@14.7

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 4621c083..d0615e91 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,7 +16,7 @@ node_js:
   - "11.15"
   - "12.18"
   - "13.14"
-  - "14.5"
+  - "14.7"
 cache:
   directories:
     - node_modules

From a8641429502fcc076c4b2dcbd6b2320891c1650c Mon Sep 17 00:00:00 2001
From: Jason Luboff <jluboff@gmail.com>
Date: Tue, 18 Aug 2020 15:02:47 -0700
Subject: [PATCH 376/529] docs: add connect-mssql-v2 to the list of session
 stores

closes #775
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 94ec2743..38b75c7c 100644
--- a/README.md
+++ b/README.md
@@ -617,6 +617,11 @@ and other multi-core embedded devices).
 [connect-mongodb-session-url]: https://www.npmjs.com/package/connect-mongodb-session
 [connect-mongodb-session-image]: https://badgen.net/github/stars/mongodb-js/connect-mongodb-session?label=%E2%98%85
 
+[![★][connect-mssql-v2-image] connect-mssql-v2][connect-mssql-v2-url] A Microsoft SQL Server-based session store based on [connect-mssql](https://www.npmjs.com/package/connect-mssql).
+
+[connect-mssql-v2-url]: https://www.npmjs.com/package/connect-mssql-v2
+[connect-mssql-v2-image]: https://badgen.net/github/stars/jluboff/connect-mssql-v2?label=%E2%98%85
+
 [![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
 
 [connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple

From d9702ed2496fabcc5417f3103aaccd381b2084ac Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 31 Aug 2020 20:41:56 -0400
Subject: [PATCH 377/529] build: mocha@8.1.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e3f988f7..cfbcb255 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "8.1.1",
+    "mocha": "8.1.3",
     "nyc": "15.1.0",
     "supertest": "4.0.2"
   },

From c5cd79056384e661d131a0a4174f1448819b09ea Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 3 Sep 2020 20:43:27 -0400
Subject: [PATCH 378/529] tests: add helper for delay store set

---
 test/session.js | 103 ++++++++++++++++--------------------------------
 1 file changed, 33 insertions(+), 70 deletions(-)

diff --git a/test/session.js b/test/session.js
index 8d796f91..021b3251 100644
--- a/test/session.js
+++ b/test/session.js
@@ -290,34 +290,21 @@ describe('session()', function(){
 
   describe('when response ended', function () {
     it('should have saved session', function (done) {
-      var saved = false
       var store = new session.MemoryStore()
       var server = createServer({ store: store }, function (req, res) {
         req.session.hit = true
         res.end('session saved')
       })
 
-      var _set = store.set
-      store.set = function set(sid, sess, callback) {
-        setTimeout(function () {
-          _set.call(store, sid, sess, function (err) {
-            saved = true
-            callback(err)
-          })
-        }, 200)
-      }
-
       request(server)
-      .get('/')
-      .expect(200, 'session saved', function (err) {
-        if (err) return done(err)
-        assert.ok(saved)
-        done()
-      })
+        .get('/')
+        .expect(200)
+        .expect(shouldSetSessionInStore(store, 200))
+        .expect('session saved')
+        .end(done)
     })
 
     it('should have saved session even with empty response', function (done) {
-      var saved = false
       var store = new session.MemoryStore()
       var server = createServer({ store: store }, function (req, res) {
         req.session.hit = true
@@ -325,27 +312,14 @@ describe('session()', function(){
         res.end()
       })
 
-      var _set = store.set
-      store.set = function set(sid, sess, callback) {
-        setTimeout(function () {
-          _set.call(store, sid, sess, function (err) {
-            saved = true
-            callback(err)
-          })
-        }, 200)
-      }
-
       request(server)
-      .get('/')
-      .expect(200, '', function (err) {
-        if (err) return done(err)
-        assert.ok(saved)
-        done()
-      })
+        .get('/')
+        .expect(200)
+        .expect(shouldSetSessionInStore(store, 200))
+        .end(done)
     })
 
     it('should have saved session even with multi-write', function (done) {
-      var saved = false
       var store = new session.MemoryStore()
       var server = createServer({ store: store }, function (req, res) {
         req.session.hit = true
@@ -354,27 +328,15 @@ describe('session()', function(){
         res.end('world')
       })
 
-      var _set = store.set
-      store.set = function set(sid, sess, callback) {
-        setTimeout(function () {
-          _set.call(store, sid, sess, function (err) {
-            saved = true
-            callback(err)
-          })
-        }, 200)
-      }
-
       request(server)
-      .get('/')
-      .expect(200, 'hello, world', function (err) {
-        if (err) return done(err)
-        assert.ok(saved)
-        done()
-      })
+        .get('/')
+        .expect(200)
+        .expect(shouldSetSessionInStore(store, 200))
+        .expect('hello, world')
+        .end(done)
     })
 
     it('should have saved session even with non-chunked response', function (done) {
-      var saved = false
       var store = new session.MemoryStore()
       var server = createServer({ store: store }, function (req, res) {
         req.session.hit = true
@@ -382,23 +344,12 @@ describe('session()', function(){
         res.end('session saved')
       })
 
-      var _set = store.set
-      store.set = function set(sid, sess, callback) {
-        setTimeout(function () {
-          _set.call(store, sid, sess, function (err) {
-            saved = true
-            callback(err)
-          })
-        }, 200)
-      }
-
       request(server)
-      .get('/')
-      .expect(200, 'session saved', function (err) {
-        if (err) return done(err)
-        assert.ok(saved)
-        done()
-      })
+        .get('/')
+        .expect(200)
+        .expect(shouldSetSessionInStore(store, 200))
+        .expect('session saved')
+        .end(done)
     })
 
     it('should have saved session with updated cookie expiration', function (done) {
@@ -2485,13 +2436,25 @@ function shouldSetCookieWithoutAttribute (name, attrib) {
   }
 }
 
-function shouldSetSessionInStore(store) {
+function shouldSetSessionInStore (store, delay) {
   var _set = store.set
   var count = 0
 
   store.set = function set () {
     count++
-    return _set.apply(this, arguments)
+
+    if (!delay) {
+      return _set.apply(this, arguments)
+    }
+
+    var args = new Array(arguments.length + 1)
+
+    args[0] = this
+    for (var i = 1; i < args.length; i++) {
+      args[i] = arguments[i - 1]
+    }
+
+    setTimeout(_set.bind.apply(_set, args), delay)
   }
 
   return function () {

From 284a71a166b514dbb5b15afd0a99a66b1937b9d1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Oct 2020 21:33:40 -0400
Subject: [PATCH 379/529] build: Node.js@12.19

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index d0615e91..5c6f7149 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.22"
   - "11.15"
-  - "12.18"
+  - "12.19"
   - "13.14"
   - "14.7"
 cache:

From 69ac483771e10cfb651f28379a07ca2e6f3ab613 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Oct 2020 21:39:44 -0400
Subject: [PATCH 380/529] build: Node.js@14.13

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 5c6f7149..fe7c7c82 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,7 +16,7 @@ node_js:
   - "11.15"
   - "12.19"
   - "13.14"
-  - "14.7"
+  - "14.13"
 cache:
   directories:
     - node_modules

From 2637221c383805c49dd57287fb58df4b63bc7dbe Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 10 Nov 2020 00:31:28 -0500
Subject: [PATCH 381/529] build: supertest@6.0.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index cfbcb255..f395b686 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.17.1",
     "mocha": "8.1.3",
     "nyc": "15.1.0",
-    "supertest": "4.0.2"
+    "supertest": "6.0.1"
   },
   "files": [
     "session/",

From 0d7f3d83a6309c1473199b6af768c1aa679c869f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 13 Nov 2020 21:30:32 -0500
Subject: [PATCH 382/529] build: mocha@8.2.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f395b686..99eaffd6 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "8.1.3",
+    "mocha": "8.2.1",
     "nyc": "15.1.0",
     "supertest": "6.0.1"
   },

From 1cfd994507daa6c32ad4edd836db7368c6a98af0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 14 Nov 2020 00:31:44 -0500
Subject: [PATCH 383/529] build: support Node.js 15.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index fe7c7c82..9c413128 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,6 +17,7 @@ node_js:
   - "12.19"
   - "13.14"
   - "14.13"
+  - "15.2"
 cache:
   directories:
     - node_modules

From 8914d60a0ef37ef81ffc8ddc361fc8f7d8290c7f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 29 Nov 2020 18:30:13 -0500
Subject: [PATCH 384/529] build: Node.js@12.20

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 9c413128..9404890b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.22"
   - "11.15"
-  - "12.19"
+  - "12.20"
   - "13.14"
   - "14.13"
   - "15.2"

From 7452225b1a8b6768adca916ebdb141d1aac0a502 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 15 Dec 2020 16:30:21 -0500
Subject: [PATCH 385/529] build: Node.js@15.4

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 9404890b..d8ecf916 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,7 +17,7 @@ node_js:
   - "12.20"
   - "13.14"
   - "14.13"
-  - "15.2"
+  - "15.4"
 cache:
   directories:
     - node_modules

From 1813cd4d8035dd31670789dfd014d52752476eef Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Dec 2020 00:18:50 -0500
Subject: [PATCH 386/529] build: Node.js@14.15

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index d8ecf916..c99c0b5e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,7 +16,7 @@ node_js:
   - "11.15"
   - "12.20"
   - "13.14"
-  - "14.13"
+  - "14.15"
   - "15.4"
 cache:
   directories:

From a26b4d351eecae43c1ba6bbe9d3451db1adbaf6c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Dec 2020 00:22:53 -0500
Subject: [PATCH 387/529] build: Node.js@10.23

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index c99c0b5e..772af3c3 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.22"
+  - "10.23"
   - "11.15"
   - "12.20"
   - "13.14"

From 54e4193d7b0a11a61fdfcfdb24f2f2839a45923e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 16 Jan 2021 19:42:02 -0500
Subject: [PATCH 388/529] build: supertest@6.1.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 99eaffd6..cefc5c07 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.17.1",
     "mocha": "8.2.1",
     "nyc": "15.1.0",
-    "supertest": "6.0.1"
+    "supertest": "6.1.1"
   },
   "files": [
     "session/",

From acca90868c4c00ba31e2d763dd98d8fbbaaa175b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 16 Jan 2021 19:49:16 -0500
Subject: [PATCH 389/529] build: Node.js@15.6

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 772af3c3..3e8c9128 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,7 +17,7 @@ node_js:
   - "12.20"
   - "13.14"
   - "14.15"
-  - "15.4"
+  - "15.6"
 cache:
   directories:
     - node_modules

From 7a6c4793602b9b048bd3c2d543bd4de1ea93df29 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 26 Feb 2021 21:39:33 -0500
Subject: [PATCH 390/529] build: Node.js@12.21

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 3e8c9128..68cc93d2 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.23"
   - "11.15"
-  - "12.20"
+  - "12.21"
   - "13.14"
   - "14.15"
   - "15.6"

From 3acbb8149de59581a1d78fbf17e6540f13cea4f1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 26 Feb 2021 21:44:49 -0500
Subject: [PATCH 391/529] build: Node.js@10.24

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 68cc93d2..6f010cd2 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ node_js:
   - "7.10"
   - "8.17"
   - "9.11"
-  - "10.23"
+  - "10.24"
   - "11.15"
   - "12.21"
   - "13.14"

From c1df7c54e89f84342acd03386e998ef54b766477 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 28 Feb 2021 19:43:04 -0500
Subject: [PATCH 392/529] build: Node.js@14.16

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 6f010cd2..c9fc0622 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,7 +16,7 @@ node_js:
   - "11.15"
   - "12.21"
   - "13.14"
-  - "14.15"
+  - "14.16"
   - "15.6"
 cache:
   directories:

From 6e4052d5b26f7e6809c84acc130b891b8370d0e0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 1 Mar 2021 20:31:00 -0500
Subject: [PATCH 393/529] build: Node.js@15.10

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index c9fc0622..e78c4851 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,7 +17,7 @@ node_js:
   - "12.21"
   - "13.14"
   - "14.16"
-  - "15.6"
+  - "15.10"
 cache:
   directories:
     - node_modules

From 373514d6607ce73fc3d0e33a1469c23a55757cff Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 8 Mar 2021 19:30:10 -0500
Subject: [PATCH 394/529] build: mocha@8.3.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index cefc5c07..f02d0e73 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "8.2.1",
+    "mocha": "8.3.1",
     "nyc": "15.1.0",
     "supertest": "6.1.1"
   },

From e007c854f5de4e8455557eef14dae76706090dec Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 19 Mar 2021 21:30:10 -0400
Subject: [PATCH 395/529] build: Node.js@15.12

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index e78c4851..51f530d0 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,7 +17,7 @@ node_js:
   - "12.21"
   - "13.14"
   - "14.16"
-  - "15.10"
+  - "15.12"
 cache:
   directories:
     - node_modules

From f44f0e42df64e76dd6d5b943e23ab279c10358fc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 12 May 2021 23:41:22 -0400
Subject: [PATCH 396/529] build: support Node.js 16.x

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 51f530d0..11828a14 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -18,6 +18,7 @@ node_js:
   - "13.14"
   - "14.16"
   - "15.12"
+  - "16.1"
 cache:
   directories:
     - node_modules

From 657e3c086caf9a2f2167933e8205466bf74c4660 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 12 May 2021 23:48:38 -0400
Subject: [PATCH 397/529] build: mocha@8.4.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f02d0e73..e58b1cec 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "3.19.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
-    "mocha": "8.3.1",
+    "mocha": "8.4.0",
     "nyc": "15.1.0",
     "supertest": "6.1.1"
   },

From 579154ae6b7234fe385167a6534276420848b4ad Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 13 May 2021 21:31:51 -0400
Subject: [PATCH 398/529] build: Node.js@12.22

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 11828a14..2e7e2e23 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,7 +14,7 @@ node_js:
   - "9.11"
   - "10.24"
   - "11.15"
-  - "12.21"
+  - "12.22"
   - "13.14"
   - "14.16"
   - "15.12"

From 5cf60e2be83fcab4ae30d4447eb815ddab31ef47 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20Daubensch=C3=BCtz?= <tim@daubenschuetz.de>
Date: Fri, 20 Nov 2020 15:34:49 +0100
Subject: [PATCH 399/529] docs: add better-sqlite3-session-store to the list of
 session stores

closes #795
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 38b75c7c..bd9ac856 100644
--- a/README.md
+++ b/README.md
@@ -519,6 +519,11 @@ module. Please make a PR to add additional modules :)
 [aerospike-session-store-url]: https://www.npmjs.com/package/aerospike-session-store
 [aerospike-session-store-image]: https://badgen.net/github/stars/aerospike/aerospike-session-store-expressjs?label=%E2%98%85
 
+[![★][better-sqlite3-session-store-image] better-sqlite3-session-store][better-sqlite3-session-store-url] A session store based on [better-sqlite3](https://github.com/JoshuaWise/better-sqlite3).
+
+[better-sqlite3-session-store-url]: https://www.npmjs.com/package/better-sqlite3-session-store
+[better-sqlite3-session-store-image]: https://badgen.net/github/stars/timdaub/better-sqlite3-session-store?label=%E2%98%85
+
 [![★][cassandra-store-image] cassandra-store][cassandra-store-url] An Apache Cassandra-based session store.
 
 [cassandra-store-url]: https://www.npmjs.com/package/cassandra-store

From a811b59da52031cc9594e8467cc79205711690f0 Mon Sep 17 00:00:00 2001
From: Yuli <stremovsky@gmail.com>
Date: Sat, 1 May 2021 21:53:01 +0300
Subject: [PATCH 400/529] docs: add @databunker/session-store to the list of
 session stores

closes #826
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index bd9ac856..bcccdbd8 100644
--- a/README.md
+++ b/README.md
@@ -799,6 +799,11 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [session-rethinkdb-url]: https://www.npmjs.com/package/session-rethinkdb
 [session-rethinkdb-image]: https://badgen.net/github/stars/llambda/session-rethinkdb?label=%E2%98%85
 
+[![★][@databunker/session-store-image] @databunker/session-store][@databunker/session-store-url] A [Databunker](https://databunker.org/)-based encrypted session store.
+
+[@databunker/session-store-url]: https://www.npmjs.com/package/@databunker/session-store
+[@databunker/session-store-image]: https://badgen.net/github/stars/securitybunker/databunker-session-store?label=%E2%98%85
+
 [![★][sessionstore-image] sessionstore][sessionstore-url] A session store that works with various databases.
 
 [sessionstore-url]: https://www.npmjs.com/package/sessionstore

From 034fd4e0bef8085431180258f329fe1168fb9e01 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 17 May 2021 16:33:52 -0400
Subject: [PATCH 401/529] build: supertest@6.1.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e58b1cec..f216c9fb 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.17.1",
     "mocha": "8.4.0",
     "nyc": "15.1.0",
-    "supertest": "6.1.1"
+    "supertest": "6.1.3"
   },
   "files": [
     "session/",

From b23ec4fa4553845138cbda823bb4e7bbd3d7242f Mon Sep 17 00:00:00 2001
From: john-redd <redd.web.development@gmail.com>
Date: Wed, 26 Aug 2020 09:45:16 -0600
Subject: [PATCH 402/529] docs: note about samesite attribute and secure
 requirements

closes #778
---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index bcccdbd8..77531505 100644
--- a/README.md
+++ b/README.md
@@ -110,6 +110,10 @@ More information about the different enforcement levels can be found in
 **Note** This is an attribute that has not yet been fully standardized, and may change in
 the future. This also means many clients may ignore this attribute until they understand it.
 
+**Note** There is a [draft spec](https://tools.ietf.org/html/draft-west-cookie-incrementalism-01)
+that requires that the `Secure` attribute be set to `true` when the `SameSite` attribute has been
+set to `'none'`. Some web browsers or other clients may be adopting this specification.
+
 ##### cookie.secure
 
 Specifies the `boolean` value for the `Secure` `Set-Cookie` attribute. When truthy,

From 7ff50af0d88e011e9830c14222df79d0b9e4ddc6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 17 May 2021 15:45:22 -0400
Subject: [PATCH 403/529] build: use GitHub Actions instead of Travis CI

---
 .github/workflows/ci.yml | 180 +++++++++++++++++++++++++++++++++++++++
 .travis.yml              | 112 ------------------------
 README.md                |   6 +-
 package.json             |   2 +-
 4 files changed, 184 insertions(+), 116 deletions(-)
 create mode 100644 .github/workflows/ci.yml
 delete mode 100644 .travis.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..2cba7fab
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,180 @@
+name: ci
+
+on:
+- pull_request
+- push
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        name:
+        - Node.js 0.8
+        - Node.js 0.10
+        - Node.js 0.12
+        - io.js 1.x
+        - io.js 2.x
+        - io.js 3.x
+        - Node.js 4.x
+        - Node.js 5.x
+        - Node.js 6.x
+        - Node.js 7.x
+        - Node.js 8.x
+        - Node.js 9.x
+        - Node.js 10.x
+        - Node.js 11.x
+        - Node.js 12.x
+        - Node.js 13.x
+        - Node.js 14.x
+        - Node.js 15.x
+        - Node.js 16.x
+
+        include:
+        - name: Node.js 0.8
+          node-version: "0.8"
+          npm-i: mocha@2.5.3 supertest@1.1.0
+          npm-rm: nyc
+
+        - name: Node.js 0.10
+          node-version: "0.10"
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+
+        - name: Node.js 0.12
+          node-version: "0.12"
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+
+        - name: io.js 1.x
+          node-version: "1.8"
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+
+        - name: io.js 2.x
+          node-version: "2.5"
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+
+        - name: io.js 3.x
+          node-version: "3.3"
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+
+        - name: Node.js 4.x
+          node-version: "4.9"
+          npm-i: mocha@5.2.0 nyc@11.9.0 supertest@3.4.2
+
+        - name: Node.js 5.x
+          node-version: "5.12"
+          npm-i: mocha@5.2.0 nyc@11.9.0 supertest@3.4.2
+
+        - name: Node.js 6.x
+          node-version: "6.17"
+          npm-i: mocha@6.2.2 nyc@14.1.1
+
+        - name: Node.js 7.x
+          node-version: "7.10"
+          npm-i: mocha@6.2.2 nyc@14.1.1
+
+        - name: Node.js 8.x
+          node-version: "8.17"
+          npm-i: mocha@7.2.0
+
+        - name: Node.js 9.x
+          node-version: "9.11"
+          npm-i: mocha@7.2.0
+
+        - name: Node.js 10.x
+          node-version: "10.24"
+
+        - name: Node.js 11.x
+          node-version: "11.15"
+
+        - name: Node.js 12.x
+          node-version: "12.22"
+
+        - name: Node.js 13.x
+          node-version: "13.14"
+
+        - name: Node.js 14.x
+          node-version: "14.17"
+
+        - name: Node.js 15.x
+          node-version: "15.14"
+
+        - name: Node.js 16.x
+          node-version: "16.1"
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Install Node.js ${{ matrix.node-version }}
+      shell: bash -eo pipefail -l {0}
+      run: |
+        nvm install --default ${{ matrix.node-version }}
+        if [[ "${{ matrix.node-version }}" == 0.* ]]; then
+          npm config set strict-ssl false
+        fi
+        dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH"
+
+    - name: Configure npm
+      run: npm config set shrinkwrap false
+
+    - name: Remove npm module(s) ${{ matrix.npm-rm }}
+      run: npm rm --silent --save-dev ${{ matrix.npm-rm }}
+      if: matrix.npm-rm != ''
+
+    - name: Install npm module(s) ${{ matrix.npm-i }}
+      run: npm install --save-dev ${{ matrix.npm-i }}
+      if: matrix.npm-i != ''
+
+    - name: Setup Node.js version-specific dependencies
+      shell: bash
+      run: |
+        # eslint for linting
+        # - remove on Node.js < 6
+        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 6 ]]; then
+          node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
+            grep -E '^eslint(-|$)' | \
+            sort -r | \
+            xargs -n1 npm rm --silent --save-dev
+        fi
+
+    - name: Install Node.js dependencies
+      run: npm install
+
+    - name: List environment
+      id: list_env
+      shell: bash
+      run: |
+        echo "node@$(node -v)"
+        echo "npm@$(npm -v)"
+        npm -s ls ||:
+        (npm -s ls --depth=0 ||:) | awk -F'[ @]' 'NR>1 && $2 { print "::set-output name=" $2 "::" $3 }'
+
+    - name: Run tests
+      shell: bash
+      run: |
+        if npm -ps ls nyc | grep -q nyc; then
+          npm run test-ci
+        else
+          npm test
+        fi
+
+    - name: Lint code
+      if: steps.list_env.outputs.eslint != ''
+      run: npm run lint
+
+    - name: Collect code coverage
+      uses: coverallsapp/github-action@master
+      if: steps.list_env.outputs.nyc != ''
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        flag-name: run-${{ matrix.test_number }}
+        parallel: true
+
+  coverage:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+    - name: Upload code coverage
+      uses: coverallsapp/github-action@master
+      with:
+        github-token: ${{ secrets.github_token }}
+        parallel-finished: true
diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index 2e7e2e23..00000000
--- a/.travis.yml
+++ /dev/null
@@ -1,112 +0,0 @@
-language: node_js
-node_js:
-  - "0.8"
-  - "0.10"
-  - "0.12"
-  - "1.8"
-  - "2.5"
-  - "3.3"
-  - "4.9"
-  - "5.12"
-  - "6.17"
-  - "7.10"
-  - "8.17"
-  - "9.11"
-  - "10.24"
-  - "11.15"
-  - "12.22"
-  - "13.14"
-  - "14.16"
-  - "15.12"
-  - "16.1"
-cache:
-  directories:
-    - node_modules
-before_install:
-  - |
-    # Setup utility functions
-    function node_version_lt () {
-      [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v "${1}")" ]]
-    }
-    function npm_module_installed () {
-      npm -lsp ls | grep -Fq "$(pwd)/node_modules/${1}:${1}@"
-    }
-    function npm_remove_module_re () {
-      node -e '
-        fs = require("fs");
-        p = JSON.parse(fs.readFileSync("package.json", "utf8"));
-        r = RegExp(process.argv[1]);
-        for (k in p.devDependencies) {
-          if (r.test(k)) delete p.devDependencies[k];
-        }
-        fs.writeFileSync("package.json", JSON.stringify(p, null, 2) + "\n");
-      ' "$@"
-    }
-    function npm_use_module () {
-      node -e '
-        fs = require("fs");
-        p = JSON.parse(fs.readFileSync("package.json", "utf8"));
-        p.devDependencies[process.argv[1]] = process.argv[2];
-        fs.writeFileSync("package.json", JSON.stringify(p, null, 2) + "\n");
-      ' "$@"
-    }
-    function v () {
-      tr '.' '\n' <<< "${1}" \
-        | awk '{ printf "%03d", $0 }' \
-        | sed 's/^0*//'
-    }
-  # Configure npm
-  - |
-    # Skip updating shrinkwrap / lock
-    npm config set shrinkwrap false
-  # Setup Node.js version-specific dependencies
-  - |
-    # Configure eslint for linting
-    if node_version_lt '6.0'; then npm_remove_module_re '^eslint(-|$)'
-    fi
-  - |
-    # Configure mocha for testing
-    if   node_version_lt '0.10'; then npm_use_module 'mocha' '2.5.3'
-    elif node_version_lt '4.0' ; then npm_use_module 'mocha' '3.5.3'
-    elif node_version_lt '6.0' ; then npm_use_module 'mocha' '5.2.0'
-    elif node_version_lt '8.0' ; then npm_use_module 'mocha' '6.2.2'
-    elif node_version_lt '10.0'; then npm_use_module 'mocha' '7.2.0'
-    fi
-  - |
-    # Configure nyc for coverage
-    if   node_version_lt '0.10'; then npm_remove_module_re '^nyc$'
-    elif node_version_lt '4.0' ; then npm_use_module 'nyc' '10.3.2'
-    elif node_version_lt '6.0' ; then npm_use_module 'nyc' '11.9.0'
-    elif node_version_lt '8.0' ; then npm_use_module 'nyc' '14.1.1'
-    fi
-  - |
-    # Configure supertest for http calls
-    if   node_version_lt '0.10'; then npm_use_module 'supertest' '1.1.0'
-    elif node_version_lt '4.0' ; then npm_use_module 'supertest' '2.0.0'
-    elif node_version_lt '6.0' ; then npm_use_module 'supertest' '3.4.2'
-    fi
-  # Update Node.js modules
-  - |
-    # Prune & rebuild node_modules
-    if [[ -d node_modules ]]; then
-      npm prune
-      npm rebuild
-    fi
-
-script:
-  - |
-    # Run test script, depending on nyc install
-    if npm_module_installed 'nyc'; then npm run-script test-travis
-    else npm test
-    fi
-  - |
-    # Run linting, depending on eslint install
-    if npm_module_installed 'eslint'; then npm run-script lint
-    fi
-after_script:
-  - |
-    # Upload coverage to coveralls, if exists
-    if [[ -d .nyc_output ]]; then
-      npm install --save-dev coveralls@2
-      nyc report --reporter=text-lcov | coveralls
-    fi
diff --git a/README.md b/README.md
index 77531505..01477c39 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 [![NPM Version][npm-version-image]][npm-url]
 [![NPM Downloads][npm-downloads-image]][node-url]
-[![Build Status][travis-image]][travis-url]
+[![Build Status][ci-image]][ci-url]
 [![Test Coverage][coveralls-image]][coveralls-url]
 
 ## Installation
@@ -881,11 +881,11 @@ On Windows, use the corresponding command;
 [MIT](LICENSE)
 
 [rfc-6265bis-03-4.1.2.7]: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.2.7
+[ci-image]: https://badgen.net/github/checks/expressjs/session/master?label=ci
+[ci-url]: https://github.com/expressjs/session/actions?query=workflow%3Aci
 [coveralls-image]: https://badgen.net/coveralls/c/github/expressjs/session/master
 [coveralls-url]: https://coveralls.io/r/expressjs/session?branch=master
 [node-url]: https://nodejs.org/en/download
 [npm-downloads-image]: https://badgen.net/npm/dm/express-session
 [npm-url]: https://npmjs.org/package/express-session
 [npm-version-image]: https://badgen.net/npm/v/express-session
-[travis-image]: https://badgen.net/travis/expressjs/session/master
-[travis-url]: https://travis-ci.org/expressjs/session
diff --git a/package.json b/package.json
index f216c9fb..634b4f99 100644
--- a/package.json
+++ b/package.json
@@ -41,8 +41,8 @@
   "scripts": {
     "lint": "eslint --plugin markdown --ext js,md . && node ./scripts/lint-readme.js",
     "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
+    "test-ci": "nyc --reporter=lcov --reporter=text npm test",
     "test-cov": "nyc npm test",
-    "test-travis": "nyc npm test -- --no-exit",
     "version": "node scripts/version-history.js && git add HISTORY.md"
   }
 }

From 9a1cc15efbc637a9d4503eb8f8f51a25461a51e3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 May 2021 08:10:33 -0400
Subject: [PATCH 404/529] build: eslint@7.26.0

---
 .eslintrc.yml            | 2 +-
 .github/workflows/ci.yml | 4 ++--
 package.json             | 2 +-
 test/session.js          | 8 ++++----
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.eslintrc.yml b/.eslintrc.yml
index 0740b11f..fe10d7ea 100644
--- a/.eslintrc.yml
+++ b/.eslintrc.yml
@@ -2,7 +2,7 @@ root: true
 rules:
   eol-last: error
   eqeqeq: ["error", "always", { "null": "ignore" }]
-  indent: ["error", 2, { "SwitchCase": 1 }]
+  indent: ["error", 2, { "MemberExpression": "off", "SwitchCase": 1 }]
   no-mixed-spaces-and-tabs: error
   no-trailing-spaces: error
   one-var: ["error", { "initialized": "never" }]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2cba7fab..b52cfc9e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -128,8 +128,8 @@ jobs:
       shell: bash
       run: |
         # eslint for linting
-        # - remove on Node.js < 6
-        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 6 ]]; then
+        # - remove on Node.js < 10
+        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 10 ]]; then
           node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
             grep -E '^eslint(-|$)' | \
             sort -r | \
diff --git a/package.json b/package.json
index 634b4f99..5185b37d 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.5",
-    "eslint": "3.19.0",
+    "eslint": "7.26.0",
     "eslint-plugin-markdown": "1.0.2",
     "express": "4.17.1",
     "mocha": "8.4.0",
diff --git a/test/session.js b/test/session.js
index 021b3251..7ce3c194 100644
--- a/test/session.js
+++ b/test/session.js
@@ -622,8 +622,8 @@ describe('session()', function(){
       before(function () {
         function setup (req) {
           req.secure = req.headers['x-secure']
-              ? JSON.parse(req.headers['x-secure'])
-              : undefined
+            ? JSON.parse(req.headers['x-secure'])
+            : undefined
         }
 
         function respond (req, res) {
@@ -655,8 +655,8 @@ describe('session()', function(){
       before(function () {
         function setup (req) {
           req.secure = req.headers['x-secure']
-              ? JSON.parse(req.headers['x-secure'])
-              : undefined
+            ? JSON.parse(req.headers['x-secure'])
+            : undefined
         }
 
         function respond (req, res) {

From 45cbbf4108ed9e05470d638ec0f6cb7be8b5f12a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 May 2021 08:13:08 -0400
Subject: [PATCH 405/529] bulid: eslint-plugin-markdown@2.1.0

---
 .eslintrc.yml | 7 +++++++
 package.json  | 4 ++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.eslintrc.yml b/.eslintrc.yml
index fe10d7ea..b6b9f62f 100644
--- a/.eslintrc.yml
+++ b/.eslintrc.yml
@@ -1,4 +1,11 @@
 root: true
+extends:
+  - plugin:markdown/recommended
+plugins:
+  - markdown
+overrides:
+  - files: '**/*.md'
+    processor: 'markdown/markdown'
 rules:
   eol-last: error
   eqeqeq: ["error", "always", { "null": "ignore" }]
diff --git a/package.json b/package.json
index 5185b37d..c9e38fa9 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
     "after": "0.8.2",
     "cookie-parser": "1.4.5",
     "eslint": "7.26.0",
-    "eslint-plugin-markdown": "1.0.2",
+    "eslint-plugin-markdown": "2.1.0",
     "express": "4.17.1",
     "mocha": "8.4.0",
     "nyc": "15.1.0",
@@ -39,7 +39,7 @@
     "node": ">= 0.8.0"
   },
   "scripts": {
-    "lint": "eslint --plugin markdown --ext js,md . && node ./scripts/lint-readme.js",
+    "lint": "eslint . && node ./scripts/lint-readme.js",
     "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
     "test-ci": "nyc --reporter=lcov --reporter=text npm test",
     "test-cov": "nyc npm test",

From 4baea4a3750cfd933aba32d91dabfd494174ec86 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 May 2021 08:52:55 -0400
Subject: [PATCH 406/529] build: Node.js@16.2

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b52cfc9e..3c1182bd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -99,7 +99,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.1"
+          node-version: "16.2"
 
     steps:
     - uses: actions/checkout@v2

From 0048bcac451ad867299d404aca94c79cc8bc751d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 19 May 2021 13:33:52 -0400
Subject: [PATCH 407/529] 1.17.2

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 4fa89ab4..774607dc 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.17.2 / 2021-05-19
+===================
 
   * Fix `res.end` patch to always commit headers
   * deps: cookie@0.4.1
diff --git a/package.json b/package.json
index c9e38fa9..d085f292 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.17.1",
+  "version": "1.17.2",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From bccab373df5626a9e1635afcf3661d1e89b4ccae Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 12 Nov 2021 21:09:00 -0500
Subject: [PATCH 408/529] build: update CI for npm TLS upgrade

---
 .github/workflows/ci.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3c1182bd..fc4de3e9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -108,7 +108,10 @@ jobs:
       shell: bash -eo pipefail -l {0}
       run: |
         nvm install --default ${{ matrix.node-version }}
-        if [[ "${{ matrix.node-version }}" == 0.* ]]; then
+        if [[ "${{ matrix.node-version }}" == 0.* && "$(cut -d. -f2 <<< "${{ matrix.node-version }}")" -lt 10 ]]; then
+          nvm install --alias=npm 0.10
+          nvm use ${{ matrix.node-version }}
+          sed -i '1s;^.*$;'"$(printf '#!%q' "$(nvm which npm)")"';' "$(readlink -f "$(which npm)")"
           npm config set strict-ssl false
         fi
         dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH"

From ae3269e9733792bee584e58f03d907ad2a522352 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 12 Nov 2021 21:15:13 -0500
Subject: [PATCH 409/529] build: eslint-plugin-markdown@2.2.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index d085f292..e66b200f 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
     "after": "0.8.2",
     "cookie-parser": "1.4.5",
     "eslint": "7.26.0",
-    "eslint-plugin-markdown": "2.1.0",
+    "eslint-plugin-markdown": "2.2.1",
     "express": "4.17.1",
     "mocha": "8.4.0",
     "nyc": "15.1.0",

From d6c5c19b9f2270e04a64732987bd27a41d2b8ff1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Fri, 12 Nov 2021 21:19:50 -0500
Subject: [PATCH 410/529] build: eslint@7.32.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index e66b200f..c590dfc2 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.5",
-    "eslint": "7.26.0",
+    "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
     "express": "4.17.1",
     "mocha": "8.4.0",

From 81a15883317f052b48c17ab9638dc2cdcdceb0fc Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Dec 2021 23:41:13 -0500
Subject: [PATCH 411/529] build: mocha@9.1.3

---
 .github/workflows/ci.yml | 2 ++
 package.json             | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fc4de3e9..6340057c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -82,9 +82,11 @@ jobs:
 
         - name: Node.js 10.x
           node-version: "10.24"
+          npm-i: mocha@8.4.0
 
         - name: Node.js 11.x
           node-version: "11.15"
+          npm-i: mocha@8.4.0
 
         - name: Node.js 12.x
           node-version: "12.22"
diff --git a/package.json b/package.json
index c590dfc2..be6ccc7b 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
     "express": "4.17.1",
-    "mocha": "8.4.0",
+    "mocha": "9.1.3",
     "nyc": "15.1.0",
     "supertest": "6.1.3"
   },

From 0a1534abce1bf4f115aa8c6171fc0db327ab89fa Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 1 Dec 2021 23:43:27 -0500
Subject: [PATCH 412/529] build: cookie-parser@1.4.6

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index be6ccc7b..3f1bd5f9 100644
--- a/package.json
+++ b/package.json
@@ -21,7 +21,7 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "cookie-parser": "1.4.5",
+    "cookie-parser": "1.4.6",
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
     "express": "4.17.1",

From 2f6cc21a23a1393c0740c6f6bda3261fcabee077 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <targos@protonmail.com>
Date: Mon, 6 Sep 2021 13:32:29 +0200
Subject: [PATCH 413/529] build: Node.js@16.9

closes #844
---
 .github/workflows/ci.yml | 2 +-
 test/session.js          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6340057c..d06912fe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -101,7 +101,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.2"
+          node-version: "16.9"
 
     steps:
     - uses: actions/checkout@v2
diff --git a/test/session.js b/test/session.js
index 7ce3c194..425ed2bc 100644
--- a/test/session.js
+++ b/test/session.js
@@ -581,7 +581,7 @@ describe('session()', function(){
           request(server)
           .get('/')
           .set('Cookie', cookie(res))
-          .expect(500, /Cannot read property/, done)
+          .expect(500, /Cannot read prop/, done)
         })
       })
     })

From 9ab975338843d84a6c3fe8e52939f3a186f32df9 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Dec 2021 21:57:34 -0500
Subject: [PATCH 414/529] build: supertest@6.1.6

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 3f1bd5f9..03078057 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.17.1",
     "mocha": "9.1.3",
     "nyc": "15.1.0",
-    "supertest": "6.1.3"
+    "supertest": "6.1.6"
   },
   "files": [
     "session/",

From 6782719ebecc8a6fe2cd5d24b79501bc8cce9474 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Dec 2021 21:58:27 -0500
Subject: [PATCH 415/529] build: express@4.17.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 03078057..f83da9c0 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "cookie-parser": "1.4.6",
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
-    "express": "4.17.1",
+    "express": "4.17.2",
     "mocha": "9.1.3",
     "nyc": "15.1.0",
     "supertest": "6.1.6"

From b40e624ae8824f1d44500b0ea774ce97dfaf91b6 Mon Sep 17 00:00:00 2001
From: Max Andersson <max.andersson@neotechnology.com>
Date: Wed, 20 Oct 2021 11:18:06 +0100
Subject: [PATCH 416/529] docs: add connect-neo4j to the list of session stores

closes #851
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 01477c39..2d1963b7 100644
--- a/README.md
+++ b/README.md
@@ -631,6 +631,11 @@ and other multi-core embedded devices).
 [connect-mssql-v2-url]: https://www.npmjs.com/package/connect-mssql-v2
 [connect-mssql-v2-image]: https://badgen.net/github/stars/jluboff/connect-mssql-v2?label=%E2%98%85
 
+[![★][connect-neo4j-image] connect-neo4j][connect-neo4j-url] A [Neo4j](https://neo4j.com)-based session store.
+
+[connect-neo4j-url]: https://www.npmjs.com/package/connect-neo4j
+[connect-neo4j-image]: https://badgen.net/github/stars/MaxAndersson/connect-neo4j?label=%E2%98%85
+
 [![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
 
 [connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple

From 72ee3081a3577923dbfc739d2574d1938e15a07e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Dec 2021 22:15:35 -0500
Subject: [PATCH 417/529] build: Node.js@16.13

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d06912fe..462696b1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -101,7 +101,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.9"
+          node-version: "16.13"
 
     steps:
     - uses: actions/checkout@v2

From e2d3dfa5551a3506f0209fd482b0616d58d20784 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Dec 2021 22:16:01 -0500
Subject: [PATCH 418/529] build: support Node.js 17.x

---
 .github/workflows/ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 462696b1..d3cf49ed 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,6 +29,7 @@ jobs:
         - Node.js 14.x
         - Node.js 15.x
         - Node.js 16.x
+        - Node.js 17.x
 
         include:
         - name: Node.js 0.8
@@ -103,6 +104,9 @@ jobs:
         - name: Node.js 16.x
           node-version: "16.13"
 
+        - name: Node.js 17.x
+          node-version: "17.3"
+
     steps:
     - uses: actions/checkout@v2
 

From 66634e9f77132a444dfda7e279a399054e3b28df Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 23 Dec 2021 22:19:48 -0500
Subject: [PATCH 419/529] build: Node.js@14.18

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d3cf49ed..1f69a643 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -96,7 +96,7 @@ jobs:
           node-version: "13.14"
 
         - name: Node.js 14.x
-          node-version: "14.17"
+          node-version: "14.18"
 
         - name: Node.js 15.x
           node-version: "15.14"

From c2eefb8572e8bf74789946886ec1dacebaeea368 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 6 Feb 2022 21:11:28 -0500
Subject: [PATCH 420/529] build: use mocha@2.5.3 for Node.js < 4

---
 .github/workflows/ci.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1f69a643..d1cc3499 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -39,23 +39,23 @@ jobs:
 
         - name: Node.js 0.10
           node-version: "0.10"
-          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+          npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: Node.js 0.12
           node-version: "0.12"
-          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+          npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: io.js 1.x
           node-version: "1.8"
-          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+          npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: io.js 2.x
           node-version: "2.5"
-          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+          npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: io.js 3.x
           node-version: "3.3"
-          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.0
+          npm-i: mocha@2.5.3 nyc@10.3.2 supertest@2.0.0
 
         - name: Node.js 4.x
           node-version: "4.9"

From 3b91d4b2c733942713be2f6280be43e91ef36bc5 Mon Sep 17 00:00:00 2001
From: Travis Horn <travis@travishorn.com>
Date: Sun, 6 Feb 2022 14:08:07 -0600
Subject: [PATCH 421/529] docs: add connect-lowdb to the list of session stores

closes #873
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 2d1963b7..e2513c84 100644
--- a/README.md
+++ b/README.md
@@ -595,6 +595,11 @@ and other multi-core embedded devices).
 [connect-loki-url]: https://www.npmjs.com/package/connect-loki
 [connect-loki-image]: https://badgen.net/github/stars/Requarks/connect-loki?label=%E2%98%85
 
+[![★][connect-lowdb-image] connect-lowdb][connect-lowdb-url] A lowdb-based session store.
+
+[connect-lowdb-url]: https://www.npmjs.com/package/connect-lowdb
+[connect-lowdb-image]: https://badgen.net/github/stars/travishorn/connect-lowdb?label=%E2%98%85
+
 [![★][connect-memcached-image] connect-memcached][connect-memcached-url] A memcached-based session store.
 
 [connect-memcached-url]: https://www.npmjs.com/package/connect-memcached

From 99b93afd52b3de4234a79ee956d0e36ff6ca674b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 19 Feb 2022 20:03:00 -0500
Subject: [PATCH 422/529] build: Node.js@17.5

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d1cc3499..1136d442 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,7 +105,7 @@ jobs:
           node-version: "16.13"
 
         - name: Node.js 17.x
-          node-version: "17.3"
+          node-version: "17.5"
 
     steps:
     - uses: actions/checkout@v2

From 00dd7075f2d60f8c9f87e5a739a0739ba362e9c7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 19 Feb 2022 20:06:00 -0500
Subject: [PATCH 423/529] build: Node.js@16.14

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1136d442..7ed18da5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -102,7 +102,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.13"
+          node-version: "16.14"
 
         - name: Node.js 17.x
           node-version: "17.5"

From 3b2406d00558dc6eaf42733579ec3f6af040f6cb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 19 Feb 2022 20:09:37 -0500
Subject: [PATCH 424/529] build: Node.js@14.19

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7ed18da5..4018263c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -96,7 +96,7 @@ jobs:
           node-version: "13.14"
 
         - name: Node.js 14.x
-          node-version: "14.18"
+          node-version: "14.19"
 
         - name: Node.js 15.x
           node-version: "15.14"

From 8108059514c7e4ae420f2d4e86c6987518a4a2ff Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 22 Feb 2022 00:12:46 -0500
Subject: [PATCH 425/529] build: mocha@9.2.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f83da9c0..f27aa2e2 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
     "express": "4.17.2",
-    "mocha": "9.1.3",
+    "mocha": "9.2.1",
     "nyc": "15.1.0",
     "supertest": "6.1.6"
   },

From ca8e298823a8ebbc50de496c8f3bbc5909f78f16 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 22 Feb 2022 00:17:35 -0500
Subject: [PATCH 426/529] build: express@4.17.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index f27aa2e2..4744c9f7 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,7 @@
     "cookie-parser": "1.4.6",
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
-    "express": "4.17.2",
+    "express": "4.17.3",
     "mocha": "9.2.1",
     "nyc": "15.1.0",
     "supertest": "6.1.6"

From 62d5df60f4d380a080d9a90b41ddb56b71446f35 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 3 Mar 2022 22:54:12 -0500
Subject: [PATCH 427/529] build: supertest@6.2.2

---
 .github/workflows/ci.yml | 4 ++--
 package.json             | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4018263c..1817a822 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -67,11 +67,11 @@ jobs:
 
         - name: Node.js 6.x
           node-version: "6.17"
-          npm-i: mocha@6.2.2 nyc@14.1.1
+          npm-i: mocha@6.2.2 nyc@14.1.1 supertest@6.1.6
 
         - name: Node.js 7.x
           node-version: "7.10"
-          npm-i: mocha@6.2.2 nyc@14.1.1
+          npm-i: mocha@6.2.2 nyc@14.1.1 supertest@6.1.6
 
         - name: Node.js 8.x
           node-version: "8.17"
diff --git a/package.json b/package.json
index 4744c9f7..5ae5f69a 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.17.3",
     "mocha": "9.2.1",
     "nyc": "15.1.0",
-    "supertest": "6.1.6"
+    "supertest": "6.2.2"
   },
   "files": [
     "session/",

From 1c2a1d74f5e91948150af53eb406a89a218e0b09 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 3 Mar 2022 22:58:15 -0500
Subject: [PATCH 428/529] deps: cookie@0.4.2

---
 HISTORY.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 774607dc..21cd8015 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * deps: cookie@0.4.2
+
 1.17.2 / 2021-05-19
 ===================
 
diff --git a/package.json b/package.json
index 5ae5f69a..ec8e8446 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   "repository": "expressjs/session",
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.4.1",
+    "cookie": "0.4.2",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "~2.0.0",

From 796cd0259a7c2122c80900332bc61f9eedc1fba7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Mar 2022 18:55:23 -0400
Subject: [PATCH 429/529] build: Node.js@17.8

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1817a822..40e77f42 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,7 +105,7 @@ jobs:
           node-version: "16.14"
 
         - name: Node.js 17.x
-          node-version: "17.5"
+          node-version: "17.8"
 
     steps:
     - uses: actions/checkout@v2

From 9ea6d4a9e5614db8e667e7d8212b1f0e744f32d3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 23 Mar 2022 18:58:05 -0400
Subject: [PATCH 430/529] build: mocha@9.2.2

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ec8e8446..965e7185 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
     "express": "4.17.3",
-    "mocha": "9.2.1",
+    "mocha": "9.2.2",
     "nyc": "15.1.0",
     "supertest": "6.2.2"
   },

From 5df613c481bc7c5979aeaeac691b64ef0a5c4948 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 27 Mar 2022 14:10:03 -0400
Subject: [PATCH 431/529] docs: document default cookie.sameSite

closes #783
---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index e2513c84..0e2015d3 100644
--- a/README.md
+++ b/README.md
@@ -97,6 +97,7 @@ is the root path of the domain.
 ##### cookie.sameSite
 
 Specifies the `boolean` or `string` to be the value for the `SameSite` `Set-Cookie` attribute.
+By default, this is `false`.
 
   - `true` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
   - `false` will not set the `SameSite` attribute.

From 070492992bd7a12b004b749d9215b344273b72ea Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 4 Apr 2022 19:43:16 -0400
Subject: [PATCH 432/529] docs: add user login example

---
 README.md | 85 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 84 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 0e2015d3..45e68a98 100644
--- a/README.md
+++ b/README.md
@@ -829,7 +829,9 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [tch-nedb-session-url]: https://www.npmjs.com/package/tch-nedb-session
 [tch-nedb-session-image]: https://badgen.net/github/stars/tomaschyly/NeDBSession?label=%E2%98%85
 
-## Example
+## Examples
+
+### View counter
 
 A simple example using `express-session` to store page views for a user.
 
@@ -867,6 +869,87 @@ app.get('/foo', function (req, res, next) {
 app.get('/bar', function (req, res, next) {
   res.send('you viewed this page ' + req.session.views['/bar'] + ' times')
 })
+
+app.listen(3000)
+```
+
+### User login
+
+A simple example using `express-session` to keep a user log in session.
+
+```js
+var escapeHtml = require('escape-html')
+var express = require('express')
+var session = require('express-session')
+
+var app = express()
+
+app.use(session({
+  secret: 'keyboard cat',
+  resave: false,
+  saveUninitialized: true
+}))
+
+// middleware to test if authenticated
+function isAuthenticated (req, res, next) {
+  if (req.session.user) next()
+  else next('route')
+}
+
+app.get('/', isAuthenticated, function (req, res) {
+  // this is only called when there is an authentication user due to isAuthenticated
+  res.send('hello, ' + escapeHtml(req.session.user) + '!' +
+    ' <a href="/logout">Logout</a>')
+})
+
+app.get('/', function (req, res) {
+  res.send('<form action="/login" method="post">' +
+    'Username: <input name="user"><br>' +
+    'Password: <input name="pass" type="password"><br>' +
+    '<input type="submit" text="Login"></form>')
+})
+
+app.post('/login', express.urlencoded({ extended: false }), function (req, res) {
+  // login logic to validate req.body.user and req.body.pass
+  // would be implemented here. for this example any combo works
+
+  // regenerate the session, which is good practice to help
+  // guard against forms of session fixation
+  req.session.regenerate(function (err) {
+    if (err) next(err)
+
+    // store user information in session, typically a user id
+    req.session.user = req.body.user
+
+    // save the session before redirection to ensure page
+    // load does not happen before session is saved
+    req.session.save(function (err) {
+      if (err) return next(err)
+      res.redirect('/')
+    })
+  })
+})
+
+app.get('/logout', function (req, res, next) {
+  // logout logic
+
+  // clear the user from the session object and save.
+  // this will ensure that re-using the old session id
+  // does not have a logged in user
+  req.session.user = null
+  req.session.save(function (err) {
+    if (err) next(err)
+
+    // regenerate the session, which is good practice to help
+    // guard against forms of session fixation
+    req.session.regenerate(function (err) {
+      if (err) next(err)
+      res.redirect('/')
+    })
+  })
+})
+
+app.listen(3000)
 ```
 
 ## Debugging

From 78d1acd95ad07112c7bf4a5806730fb3f95ec792 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 12 Apr 2022 22:09:48 -0400
Subject: [PATCH 433/529] build: Node.js@17.9

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 40e77f42..ae4cd745 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,7 +105,7 @@ jobs:
           node-version: "16.14"
 
         - name: Node.js 17.x
-          node-version: "17.8"
+          node-version: "17.9"
 
     steps:
     - uses: actions/checkout@v2

From 18a10117962202ccc245a21590b0eef3a1e69fee Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 21 Apr 2022 21:54:27 -0400
Subject: [PATCH 434/529] build: support Node.js 18.x

---
 .github/workflows/ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ae4cd745..7847ca4a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,6 +30,7 @@ jobs:
         - Node.js 15.x
         - Node.js 16.x
         - Node.js 17.x
+        - Node.js 18.x
 
         include:
         - name: Node.js 0.8
@@ -107,6 +108,9 @@ jobs:
         - name: Node.js 17.x
           node-version: "17.9"
 
+        - name: Node.js 18.x
+          node-version: "18.0"
+
     steps:
     - uses: actions/checkout@v2
 

From 86ed9f3f6f3fed192ab85ea2c0db875c4942e3f0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 8 May 2022 20:41:49 -0400
Subject: [PATCH 435/529] build: supertest@6.2.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 965e7185..8cf683d6 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.17.3",
     "mocha": "9.2.2",
     "nyc": "15.1.0",
-    "supertest": "6.2.2"
+    "supertest": "6.2.3"
   },
   "files": [
     "session/",

From 08f5dca7339517f59ca500b03b1da1deec996f66 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 8 May 2022 20:49:11 -0400
Subject: [PATCH 436/529] build: Node.js@16.15

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7847ca4a..bc591048 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -103,7 +103,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.14"
+          node-version: "16.15"
 
         - name: Node.js 17.x
           node-version: "17.9"

From a1aebf29c8040a622631a60ad67f69a7815c0ceb Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 8 May 2022 20:55:19 -0400
Subject: [PATCH 437/529] build: mocha@10.0.0

---
 .github/workflows/ci.yml | 2 ++
 package.json             | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bc591048..7e662fb3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -92,9 +92,11 @@ jobs:
 
         - name: Node.js 12.x
           node-version: "12.22"
+          npm-i: mocha@9.2.2
 
         - name: Node.js 13.x
           node-version: "13.14"
+          npm-i: mocha@9.2.2
 
         - name: Node.js 14.x
           node-version: "14.19"
diff --git a/package.json b/package.json
index 8cf683d6..9723dfe5 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
     "express": "4.17.3",
-    "mocha": "9.2.2",
+    "mocha": "10.0.0",
     "nyc": "15.1.0",
     "supertest": "6.2.3"
   },

From a06b0beda7e9686c19c2f3dd3d72114c80e8457d Mon Sep 17 00:00:00 2001
From: Noah Liechti <38284563+noahliechti@users.noreply.github.com>
Date: Fri, 14 Jan 2022 16:34:57 +0100
Subject: [PATCH 438/529] build: remove unnecessary entry from package files

closes #869
---
 package.json | 1 -
 1 file changed, 1 deletion(-)

diff --git a/package.json b/package.json
index 9723dfe5..15fec342 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,6 @@
   "files": [
     "session/",
     "HISTORY.md",
-    "LICENSE",
     "index.js"
   ],
   "engines": {

From 99d6cdea3e04e6fb48c155c1e0ad507fde5d8702 Mon Sep 17 00:00:00 2001
From: Jeremy Neander <jeremy.neander@gmail.com>
Date: Mon, 18 Oct 2021 11:50:34 -0500
Subject: [PATCH 439/529] Fix resaving already-saved new session at end of
 request

closes #849
---
 HISTORY.md      |  1 +
 index.js        |  2 +-
 test/session.js | 25 +++++++++++++++++++++++++
 3 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 21cd8015..64fee3c7 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Fix resaving already-saved new session at end of request
   * deps: cookie@0.4.2
 
 1.17.2 / 2021-05-19
diff --git a/index.js b/index.js
index d7efeab9..40a442ba 100644
--- a/index.js
+++ b/index.js
@@ -444,7 +444,7 @@ function session(options) {
         return false;
       }
 
-      return !saveUninitializedSession && cookieId !== req.sessionID
+      return !saveUninitializedSession && !savedHash && cookieId !== req.sessionID
         ? isModified(req.session)
         : !isSaved(req.session)
     }
diff --git a/test/session.js b/test/session.js
index 425ed2bc..7416b261 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1775,6 +1775,31 @@ describe('session()', function(){
           .expect(200, 'saved', done)
         })
       })
+
+      describe('when saveUninitialized is false', function () {
+        it('should prevent end-of-request save', function (done) {
+          var store = new session.MemoryStore()
+          var server = createServer({ saveUninitialized: false, store: store }, function (req, res) {
+            req.session.hit = true
+            req.session.save(function (err) {
+              if (err) return res.end(err.message)
+              res.end('saved')
+            })
+          })
+
+          request(server)
+            .get('/')
+            .expect(shouldSetSessionInStore(store))
+            .expect(200, 'saved', function (err, res) {
+              if (err) return done(err)
+              request(server)
+                .get('/')
+                .set('Cookie', cookie(res))
+                .expect(shouldSetSessionInStore(store))
+                .expect(200, 'saved', done)
+            })
+        })
+      })
     })
 
     describe('.touch()', function () {

From 1010fadc2f071ddf2add94235d72224cf65159c6 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 11 May 2022 14:51:00 -0400
Subject: [PATCH 440/529] 1.17.3

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 64fee3c7..9fdd147f 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.17.3 / 2022-05-11
+===================
 
   * Fix resaving already-saved new session at end of request
   * deps: cookie@0.4.2
diff --git a/package.json b/package.json
index 15fec342..711e9866 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.17.2",
+  "version": "1.17.3",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From d06b73c3aaa08fda13e9834303d9556501f225b1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Sep 2022 20:40:44 -0400
Subject: [PATCH 441/529] build: downgrade nyc on Node.js 8/9

---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7e662fb3..807849bc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -76,11 +76,11 @@ jobs:
 
         - name: Node.js 8.x
           node-version: "8.17"
-          npm-i: mocha@7.2.0
+          npm-i: mocha@7.2.0 nyc@14.1.1
 
         - name: Node.js 9.x
           node-version: "9.11"
-          npm-i: mocha@7.2.0
+          npm-i: mocha@7.2.0 nyc@14.1.1
 
         - name: Node.js 10.x
           node-version: "10.24"

From 1e992fd5794f15e9640d6d6e37b714ecb04f033b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Sep 2022 20:47:06 -0400
Subject: [PATCH 442/529] build: Node.js@18.9

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 807849bc..b5af9c03 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -111,7 +111,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.0"
+          node-version: "18.9"
 
     steps:
     - uses: actions/checkout@v2

From 4b38b12c4c156018392311d05db4a8fc6f31fb36 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Dec 2022 20:38:38 -0500
Subject: [PATCH 443/529] build: mocha@10.2.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 711e9866..a2d2d119 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "7.32.0",
     "eslint-plugin-markdown": "2.2.1",
     "express": "4.17.3",
-    "mocha": "10.0.0",
+    "mocha": "10.2.0",
     "nyc": "15.1.0",
     "supertest": "6.2.3"
   },

From 4fafd15e5443f9d24d8dd12e59f5a5841c5a1de1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Dec 2022 20:42:08 -0500
Subject: [PATCH 444/529] build: Node.js@16.19

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b5af9c03..98a8d85f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,7 +105,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.15"
+          node-version: "16.19"
 
         - name: Node.js 17.x
           node-version: "17.9"

From a8968b80c6a19741d67458cf402aadfbf3fba7d7 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Dec 2022 20:43:49 -0500
Subject: [PATCH 445/529] build: Node.js@14.21

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 98a8d85f..4095d9b3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -99,7 +99,7 @@ jobs:
           npm-i: mocha@9.2.2
 
         - name: Node.js 14.x
-          node-version: "14.19"
+          node-version: "14.21"
 
         - name: Node.js 15.x
           node-version: "15.14"

From 474572597eac48ae2abd12b2df8741a13e6c2260 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 12 Dec 2022 20:45:17 -0500
Subject: [PATCH 446/529] build: Node.js@18.12

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4095d9b3..dcb37bed 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -111,7 +111,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.9"
+          node-version: "18.12"
 
     steps:
     - uses: actions/checkout@v2

From a77973ba460aadd72afa8960ad01f463d23436ac Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 14 Jan 2023 22:53:53 -0500
Subject: [PATCH 447/529] build: support Node.js 19.x

---
 .github/workflows/ci.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dcb37bed..33cd7fea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,6 +31,7 @@ jobs:
         - Node.js 16.x
         - Node.js 17.x
         - Node.js 18.x
+        - Node.js 19.x
 
         include:
         - name: Node.js 0.8
@@ -113,6 +114,9 @@ jobs:
         - name: Node.js 18.x
           node-version: "18.12"
 
+        - name: Node.js 19.x
+          node-version: "19.4"
+
     steps:
     - uses: actions/checkout@v2
 
@@ -129,7 +133,12 @@ jobs:
         dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH"
 
     - name: Configure npm
-      run: npm config set shrinkwrap false
+      run: |
+        if [[ "$(npm config get package-lock)" == "true" ]]; then
+          npm config set package-lock false
+        else
+          npm config set shrinkwrap false
+        fi
 
     - name: Remove npm module(s) ${{ matrix.npm-rm }}
       run: npm rm --silent --save-dev ${{ matrix.npm-rm }}

From a1f7b0f6fa6c91ad9b0737f776ce273b7d8b64e8 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 14 Jan 2023 22:58:49 -0500
Subject: [PATCH 448/529] build: supertest@6.3.3

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index a2d2d119..dbcf990b 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.17.3",
     "mocha": "10.2.0",
     "nyc": "15.1.0",
-    "supertest": "6.2.3"
+    "supertest": "6.3.3"
   },
   "files": [
     "session/",

From d21a69faa8415c759f4464cb3890066351434e7c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 14 Jan 2023 23:02:12 -0500
Subject: [PATCH 449/529] build: eslint@8.31.0

---
 .github/workflows/ci.yml | 4 ++--
 package.json             | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 33cd7fea..7519f5cf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -152,8 +152,8 @@ jobs:
       shell: bash
       run: |
         # eslint for linting
-        # - remove on Node.js < 10
-        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 10 ]]; then
+        # - remove on Node.js < 12
+        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 12 ]]; then
           node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
             grep -E '^eslint(-|$)' | \
             sort -r | \
diff --git a/package.json b/package.json
index dbcf990b..ef7ad2dd 100644
--- a/package.json
+++ b/package.json
@@ -22,8 +22,8 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.6",
-    "eslint": "7.32.0",
-    "eslint-plugin-markdown": "2.2.1",
+    "eslint": "8.31.0",
+    "eslint-plugin-markdown": "3.0.0",
     "express": "4.17.3",
     "mocha": "10.2.0",
     "nyc": "15.1.0",

From b57e1868b9ed38edc4703fbfef3261c364f57ea3 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 3 May 2023 18:44:55 -0400
Subject: [PATCH 450/529] build: Node.js@18.16

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7519f5cf..c96b39e1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -112,7 +112,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.12"
+          node-version: "18.16"
 
         - name: Node.js 19.x
           node-version: "19.4"

From 249ea7259abf25b4d396652b338359408e6db4b2 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 3 May 2023 18:47:26 -0400
Subject: [PATCH 451/529] build: Node.js@19.9

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c96b39e1..7b8c7cf6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -115,7 +115,7 @@ jobs:
           node-version: "18.16"
 
         - name: Node.js 19.x
-          node-version: "19.4"
+          node-version: "19.9"
 
     steps:
     - uses: actions/checkout@v2

From bd69beef941a982013a21704fa8eb7214db13765 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 3 May 2023 18:49:08 -0400
Subject: [PATCH 452/529] build: support Node.js 20.x

---
 .github/workflows/ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7b8c7cf6..02605500 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,6 +32,7 @@ jobs:
         - Node.js 17.x
         - Node.js 18.x
         - Node.js 19.x
+        - Node.js 20.x
 
         include:
         - name: Node.js 0.8
@@ -117,6 +118,9 @@ jobs:
         - name: Node.js 19.x
           node-version: "19.9"
 
+        - name: Node.js 20.x
+          node-version: "20.1"
+
     steps:
     - uses: actions/checkout@v2
 

From 710ae0620eae293d765882fc7056f0511218e525 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Jun 2023 22:49:45 -0400
Subject: [PATCH 453/529] build: eslint@8.42.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ef7ad2dd..ee0252f0 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.6",
-    "eslint": "8.31.0",
+    "eslint": "8.42.0",
     "eslint-plugin-markdown": "3.0.0",
     "express": "4.17.3",
     "mocha": "10.2.0",

From d8a8fe23e78e65b81e6e1ab4bcaa13061fa4a89f Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Thu, 8 Jun 2023 23:02:49 -0400
Subject: [PATCH 454/529] Support any type in "secret" that crypto.createHmac
 supports

---
 HISTORY.md      |  6 ++++++
 README.md       | 13 +++++++------
 package.json    |  2 +-
 test/session.js | 45 +++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 59 insertions(+), 7 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 9fdd147f..30facb56 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * Support any type in `secret` that `crypto.createHmac` supports
+  * deps: cookie-signature@1.0.7
+
 1.17.3 / 2022-05-11
 ===================
 
diff --git a/README.md b/README.md
index 45e68a98..b5dbcba5 100644
--- a/README.md
+++ b/README.md
@@ -274,12 +274,13 @@ it to be saved. *This has been fixed in PassportJS 0.3.0*
 
 **Required option**
 
-This is the secret used to sign the session ID cookie. This can be either a string
-for a single secret, or an array of multiple secrets. If an array of secrets is
-provided, only the first element will be used to sign the session ID cookie, while
-all the elements will be considered when verifying the signature in requests. The
-secret itself should be not easily parsed by a human and would best be a random set
-of characters. A best practice may include:
+This is the secret used to sign the session ID cookie. The secret can be any type
+of value that is supported by Node.js `crypto.createHmac` (like a string or a
+`Buffer`). This can be either a single secret, or an array of multiple secrets. If
+an array of secrets is provided, only the first element will be used to sign the
+session ID cookie, while all the elements will be considered when verifying the
+signature in requests. The secret itself should be not easily parsed by a human and
+would best be a random set of characters. A best practice may include:
 
   - The use of environment variables to store the secret, ensuring the secret itself
     does not exist in your repository.
diff --git a/package.json b/package.json
index ee0252f0..b58aea28 100644
--- a/package.json
+++ b/package.json
@@ -11,7 +11,7 @@
   "license": "MIT",
   "dependencies": {
     "cookie": "0.4.2",
-    "cookie-signature": "1.0.6",
+    "cookie-signature": "1.0.7",
     "debug": "2.6.9",
     "depd": "~2.0.0",
     "on-headers": "~1.0.2",
diff --git a/test/session.js b/test/session.js
index 7416b261..09893902 100644
--- a/test/session.js
+++ b/test/session.js
@@ -2,6 +2,7 @@
 var after = require('after')
 var assert = require('assert')
 var cookieParser = require('cookie-parser')
+var crypto = require('crypto')
 var express = require('express')
 var fs = require('fs')
 var http = require('http')
@@ -1197,6 +1198,50 @@ describe('session()', function(){
       assert.throws(createServer.bind(null, { secret: [] }), /secret option array/);
     })
 
+    it('should sign and unsign with a string', function (done) {
+      var server = createServer({ secret: 'awesome cat' }, function (req, res) {
+        if (!req.session.user) {
+          req.session.user = 'bob'
+          res.end('set')
+        } else {
+          res.end('get:' + JSON.stringify(req.session.user))
+        }
+      })
+
+      request(server)
+        .get('/')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, 'set', function (err, res) {
+          if (err) return done(err)
+          request(server)
+            .get('/')
+            .set('Cookie', cookie(res))
+            .expect(200, 'get:"bob"', done)
+        })
+    })
+
+    it('should sign and unsign with a Buffer', function (done) {
+      var server = createServer({ secret: crypto.randomBytes(32) }, function (req, res) {
+        if (!req.session.user) {
+          req.session.user = 'bob'
+          res.end('set')
+        } else {
+          res.end('get:' + JSON.stringify(req.session.user))
+        }
+      })
+
+      request(server)
+        .get('/')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, 'set', function (err, res) {
+          if (err) return done(err)
+          request(server)
+            .get('/')
+            .set('Cookie', cookie(res))
+            .expect(200, 'get:"bob"', done)
+        })
+    })
+
     describe('when an array', function () {
       it('should sign cookies', function (done) {
         var server = createServer({ secret: ['keyboard cat', 'nyan cat'] }, function (req, res) {

From b3530542ec675d6a9d913837f1a4853b550a3cff Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Aug 2023 20:43:37 -0400
Subject: [PATCH 455/529] build: Node.js@20.5

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 02605500..9c841b72 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -119,7 +119,7 @@ jobs:
           node-version: "19.9"
 
         - name: Node.js 20.x
-          node-version: "20.1"
+          node-version: "20.5"
 
     steps:
     - uses: actions/checkout@v2

From 7adb9fec0ac0875a6cce73b6b4eade9b11b65d53 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Aug 2023 20:46:22 -0400
Subject: [PATCH 456/529] build: Node.js@18.17

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9c841b72..dd6b1f25 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -113,7 +113,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.16"
+          node-version: "18.17"
 
         - name: Node.js 19.x
           node-version: "19.9"

From addaa54541a285c6e725b05d5e81fc6542111dce Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 16 Aug 2023 20:47:14 -0400
Subject: [PATCH 457/529] build: Node.js@16.20

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dd6b1f25..502a3280 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -107,7 +107,7 @@ jobs:
           node-version: "15.14"
 
         - name: Node.js 16.x
-          node-version: "16.19"
+          node-version: "16.20"
 
         - name: Node.js 17.x
           node-version: "17.9"

From 49e5eb67b72dd8e5618f9f9317828d696520d960 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 12 Sep 2023 19:54:52 -0400
Subject: [PATCH 458/529] build: eslint@8.49.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index b58aea28..0aa03a97 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.6",
-    "eslint": "8.42.0",
+    "eslint": "8.49.0",
     "eslint-plugin-markdown": "3.0.0",
     "express": "4.17.3",
     "mocha": "10.2.0",

From 25cedf86553bf89c7ea81c8a12cc479d9bd8defd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 12 Sep 2023 19:57:08 -0400
Subject: [PATCH 459/529] build: eslint-plugin-markdown@3.0.1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 0aa03a97..597df1a9 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
     "after": "0.8.2",
     "cookie-parser": "1.4.6",
     "eslint": "8.49.0",
-    "eslint-plugin-markdown": "3.0.0",
+    "eslint-plugin-markdown": "3.0.1",
     "express": "4.17.3",
     "mocha": "10.2.0",
     "nyc": "15.1.0",

From 54a8ee59e533639fbede38f00884e6ef0580e516 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 7 Nov 2023 23:10:58 -0500
Subject: [PATCH 460/529] build: support Node.js 21.x

---
 .github/workflows/ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 502a3280..ba089e20 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,6 +33,7 @@ jobs:
         - Node.js 18.x
         - Node.js 19.x
         - Node.js 20.x
+        - Node.js 21.x
 
         include:
         - name: Node.js 0.8
@@ -121,6 +122,9 @@ jobs:
         - name: Node.js 20.x
           node-version: "20.5"
 
+        - name: Node.js 21.x
+          node-version: "21.1"
+
     steps:
     - uses: actions/checkout@v2
 

From e942982391130adeea57d5555ebfc0b83f6bee1e Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 7 Nov 2023 23:12:06 -0500
Subject: [PATCH 461/529] build: Node.js@20.9

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ba089e20..65a945cb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -120,7 +120,7 @@ jobs:
           node-version: "19.9"
 
         - name: Node.js 20.x
-          node-version: "20.5"
+          node-version: "20.9"
 
         - name: Node.js 21.x
           node-version: "21.1"

From fc24b2640abd9ebec295ff3b426c09691ef51e7a Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Tue, 7 Nov 2023 23:14:32 -0500
Subject: [PATCH 462/529] build: Node.js@18.18

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 65a945cb..4c51044d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -114,7 +114,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.17"
+          node-version: "18.18"
 
         - name: Node.js 19.x
           node-version: "19.9"

From 4bfc5baa0dc368352faf41e340fea812dee90fbd Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Dec 2023 20:33:10 -0500
Subject: [PATCH 463/529] build: use $GITHUB_OUTPUT for environment list

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4c51044d..b0c097c9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -178,7 +178,7 @@ jobs:
         echo "node@$(node -v)"
         echo "npm@$(npm -v)"
         npm -s ls ||:
-        (npm -s ls --depth=0 ||:) | awk -F'[ @]' 'NR>1 && $2 { print "::set-output name=" $2 "::" $3 }'
+        (npm -s ls --depth=0 ||:) | awk -F'[ @]' 'NR>1 && $2 { print $2 "=" $3 }' >> "$GITHUB_OUTPUT"
 
     - name: Run tests
       shell: bash

From c1611ad8b3f9c7564d130040c2b188293727e155 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Dec 2023 20:34:20 -0500
Subject: [PATCH 464/529] build: actions/checkout@v3

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b0c097c9..7c3ee7df 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -126,7 +126,7 @@ jobs:
           node-version: "21.1"
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
 
     - name: Install Node.js ${{ matrix.node-version }}
       shell: bash -eo pipefail -l {0}

From 825e6c00c13d472be8b08f202209668ad3a1769d Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 10 Dec 2023 20:38:10 -0500
Subject: [PATCH 465/529] build: fix code coverage aggregate upload

---
 .github/workflows/ci.yml | 39 ++++++++++++++++++++++++++++++++-------
 1 file changed, 32 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7c3ee7df..2d4bfc2c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -185,6 +185,7 @@ jobs:
       run: |
         if npm -ps ls nyc | grep -q nyc; then
           npm run test-ci
+          cp coverage/lcov.info "coverage/${{ matrix.name }}.lcov"
         else
           npm test
         fi
@@ -194,19 +195,43 @@ jobs:
       run: npm run lint
 
     - name: Collect code coverage
-      uses: coverallsapp/github-action@master
+      if: steps.list_env.outputs.nyc != ''
+      run: |
+        if [[ -d ./coverage ]]; then
+          mv ./coverage "./${{ matrix.name }}"
+          mkdir ./coverage
+          mv "./${{ matrix.name }}" "./coverage/${{ matrix.name }}"
+        fi
+
+    - name: Upload code coverage
+      uses: actions/upload-artifact@v3
       if: steps.list_env.outputs.nyc != ''
       with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-        flag-name: run-${{ matrix.test_number }}
-        parallel: true
+        name: coverage
+        path: ./coverage
+        retention-days: 1
 
   coverage:
     needs: test
     runs-on: ubuntu-latest
     steps:
-    - name: Upload code coverage
+    - uses: actions/checkout@v3
+
+    - name: Install lcov
+      shell: bash
+      run: sudo apt-get -y install lcov
+
+    - name: Collect coverage reports
+      uses: actions/download-artifact@v3
+      with:
+        name: coverage
+        path: ./coverage
+
+    - name: Merge coverage reports
+      shell: bash
+      run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info
+
+    - name: Upload coverage report
       uses: coverallsapp/github-action@master
       with:
-        github-token: ${{ secrets.github_token }}
-        parallel-finished: true
+        github-token: ${{ secrets.GITHUB_TOKEN }}

From 6b7c9a0d29aa0dee84ffdffb5da2d88f53906832 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 3 Jan 2024 19:44:48 -0500
Subject: [PATCH 466/529] build: Node.js@21.5

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2d4bfc2c..e770d94a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -123,7 +123,7 @@ jobs:
           node-version: "20.9"
 
         - name: Node.js 21.x
-          node-version: "21.1"
+          node-version: "21.5"
 
     steps:
     - uses: actions/checkout@v3

From 8e9f7a4a701b77a8baff1ea3f7b568dc70bf6ecf Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 3 Jan 2024 19:45:09 -0500
Subject: [PATCH 467/529] build: Node.js@20.10

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e770d94a..cde69396 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -120,7 +120,7 @@ jobs:
           node-version: "19.9"
 
         - name: Node.js 20.x
-          node-version: "20.9"
+          node-version: "20.10"
 
         - name: Node.js 21.x
           node-version: "21.5"

From 7dec651403d4ce7b072c2992914a0a28b93922a0 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Wed, 3 Jan 2024 19:46:01 -0500
Subject: [PATCH 468/529] build: Node.js@18.19

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cde69396..d4d66ca1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -114,7 +114,7 @@ jobs:
           node-version: "17.9"
 
         - name: Node.js 18.x
-          node-version: "18.18"
+          node-version: "18.19"
 
         - name: Node.js 19.x
           node-version: "19.9"

From a46e8578183efffe8fdc122375b53bd2c9ee51b1 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 27 Jan 2024 21:40:27 -0500
Subject: [PATCH 469/529] supertest@6.3.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 597df1a9..2b12839e 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "express": "4.17.3",
     "mocha": "10.2.0",
     "nyc": "15.1.0",
-    "supertest": "6.3.3"
+    "supertest": "6.3.4"
   },
   "files": [
     "session/",

From 2a7a50bcbc2d5844c030d4d684108f09f60b460c Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sat, 27 Jan 2024 21:42:33 -0500
Subject: [PATCH 470/529] eslint@8.56.0

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 2b12839e..2f5190c8 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
   "devDependencies": {
     "after": "0.8.2",
     "cookie-parser": "1.4.6",
-    "eslint": "8.49.0",
+    "eslint": "8.56.0",
     "eslint-plugin-markdown": "3.0.1",
     "express": "4.17.3",
     "mocha": "10.2.0",

From e5f19cedac9edcc754dda7807f99e834614763d6 Mon Sep 17 00:00:00 2001
From: Lukas Elmer <lukas.elmer@gmail.com>
Date: Mon, 14 Nov 2022 17:45:37 +0100
Subject: [PATCH 471/529] docs: add note on length of secret

closes #919
---
 README.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/README.md b/README.md
index b5dbcba5..6ce6ae4a 100644
--- a/README.md
+++ b/README.md
@@ -295,6 +295,9 @@ the secret without invalidating sessions, provide an array of secrets, with the
 secret as first element of the array, and including previous secrets as the later
 elements.
 
+**Note** HMAC-256 is used to sign the session ID. For this reason, the secret should
+contain at least 32 bytes of entropy.
+
 ##### store
 
 The session store instance, defaults to a new `MemoryStore` instance.

From a1f884fb8f8937d7b1628bbe5349ee6aa375742f Mon Sep 17 00:00:00 2001
From: Kam Lasater <ckl@seekayel.com>
Date: Wed, 30 Nov 2022 15:08:10 -0500
Subject: [PATCH 472/529] docs: add @cyclic.sh/session-store to the list of
 session stores

closes #922
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 6ce6ae4a..39d14796 100644
--- a/README.md
+++ b/README.md
@@ -818,6 +818,11 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [session-rethinkdb-url]: https://www.npmjs.com/package/session-rethinkdb
 [session-rethinkdb-image]: https://badgen.net/github/stars/llambda/session-rethinkdb?label=%E2%98%85
 
+[![★][@cyclic.sh/session-store-image] @cyclic.sh/session-store][@cyclic.sh/session-store-url] A DynamoDB-based session store for [Cyclic.sh](https://www.cyclic.sh/) apps.
+
+[@cyclic.sh/session-store-url]: https://www.npmjs.com/package/@cyclic.sh/session-store
+[@cyclic.sh/session-store-image]: https://badgen.net/github/stars/cyclic-software/session-store?label=%E2%98%85
+
 [![★][@databunker/session-store-image] @databunker/session-store][@databunker/session-store-url] A [Databunker](https://databunker.org/)-based encrypted session store.
 
 [@databunker/session-store-url]: https://www.npmjs.com/package/@databunker/session-store

From 9d377c5a58295cdb77e6b85dc4c0a5ab63c78ddf Mon Sep 17 00:00:00 2001
From: Jordan Day <jordan@modernhawk.com>
Date: Mon, 27 Feb 2023 13:35:06 -0600
Subject: [PATCH 473/529] docs: add dynamodb-store-v3 to the list of session
 stores

closes #930
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 39d14796..21303c32 100644
--- a/README.md
+++ b/README.md
@@ -693,6 +693,11 @@ and other multi-core embedded devices).
 [dynamodb-store-url]: https://www.npmjs.com/package/dynamodb-store
 [dynamodb-store-image]: https://badgen.net/github/stars/rafaelrpinto/dynamodb-store?label=%E2%98%85
 
+[![★][dynamodb-store-v3-image] dynamodb-store-v3][dynamodb-store-v3-url] Implementation of a session store using DynamoDB backed by the [AWS SDK for JavaScript v3](https://github.com/aws/aws-sdk-js-v3).
+
+[dynamodb-store-v3-url]: https://www.npmjs.com/package/dynamodb-store-v3
+[dynamodb-store-v3-image]: https://badgen.net/github/stars/FryDay/dynamodb-store-v3?label=%E2%98%85
+
 [![★][express-etcd-image] express-etcd][express-etcd-url] An [etcd](https://github.com/stianeikeland/node-etcd) based session store.
 
 [express-etcd-url]: https://www.npmjs.com/package/express-etcd

From 71c3f741080703520f16bccf8ed455f193cb69bb Mon Sep 17 00:00:00 2001
From: Ajesh DS <iam@ajesh.dev>
Date: Mon, 24 Jul 2023 04:32:30 +0530
Subject: [PATCH 474/529] docs: add connect-cosmosdb to the list of session
 stores

closes #950
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 21303c32..ab2de080 100644
--- a/README.md
+++ b/README.md
@@ -560,6 +560,11 @@ and other multi-core embedded devices).
 [connect-cloudant-store-url]: https://www.npmjs.com/package/connect-cloudant-store
 [connect-cloudant-store-image]: https://badgen.net/github/stars/adriantanasa/connect-cloudant-store?label=%E2%98%85
 
+[![★][connect-cosmosdb-image] connect-cosmosdb][connect-cosmosdb-url] An Azure [Cosmos DB](https://azure.microsoft.com/en-us/products/cosmos-db/)-based session store.
+
+[connect-cosmosdb-url]: https://www.npmjs.com/package/connect-cosmosdb
+[connect-cosmosdb-image]: https://badgen.net/github/stars/thekillingspree/connect-cosmosdb?label=%E2%98%85
+
 [![★][connect-couchbase-image] connect-couchbase][connect-couchbase-url] A [couchbase](http://www.couchbase.com/)-based session store.
 
 [connect-couchbase-url]: https://www.npmjs.com/package/connect-couchbase

From 3ee08c466c37f2eb81d18ce13f0d3653416f79df Mon Sep 17 00:00:00 2001
From: Marc Udoff <marc.udoff@deshaw.com>
Date: Mon, 1 May 2023 11:36:09 -0400
Subject: [PATCH 475/529] Add "priority" to cookie options

closes #884
closes #939
---
 HISTORY.md        |  5 +++++
 README.md         | 15 +++++++++++++++
 package.json      |  2 +-
 session/cookie.js |  3 ++-
 test/cookie.js    |  8 ++++++++
 test/session.js   | 22 +++++++++++++++-------
 6 files changed, 46 insertions(+), 9 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 30facb56..29e5657a 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,7 +1,12 @@
 unreleased
 ==========
 
+  * Add `priority` to `cookie` options
   * Support any type in `secret` that `crypto.createHmac` supports
+  * deps: cookie@0.5.0
+    - Fix `expires` option to reject invalid dates
+    - perf: improve default decode speed
+    - perf: remove slow string split in parse
   * deps: cookie-signature@1.0.7
 
 1.17.3 / 2022-05-11
diff --git a/README.md b/README.md
index ab2de080..5096ac0f 100644
--- a/README.md
+++ b/README.md
@@ -94,6 +94,20 @@ defined in the object is what is used.
 Specifies the value for the `Path` `Set-Cookie`. By default, this is set to `'/'`, which
 is the root path of the domain.
 
+##### cookie.priority
+
+Specifies the `string` to be the value for the [`Priority` `Set-Cookie` attribute][rfc-west-cookie-priority-00-4.1].
+
+  - `'low'` will set the `Priority` attribute to `Low`.
+  - `'medium'` will set the `Priority` attribute to `Medium`, the default priority when not set.
+  - `'high'` will set the `Priority` attribute to `High`.
+
+More information about the different priority levels can be found in
+[the specification][rfc-west-cookie-priority-00-4.1].
+
+**Note** This is an attribute that has not yet been fully standardized, and may change in the future.
+This also means many clients may ignore this attribute until they understand it.
+
 ##### cookie.sameSite
 
 Specifies the `boolean` or `string` to be the value for the `SameSite` `Set-Cookie` attribute.
@@ -994,6 +1008,7 @@ On Windows, use the corresponding command;
 [MIT](LICENSE)
 
 [rfc-6265bis-03-4.1.2.7]: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.2.7
+[rfc-west-cookie-priority-00-4.1]: https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1
 [ci-image]: https://badgen.net/github/checks/expressjs/session/master?label=ci
 [ci-url]: https://github.com/expressjs/session/actions?query=workflow%3Aci
 [coveralls-image]: https://badgen.net/coveralls/c/github/expressjs/session/master
diff --git a/package.json b/package.json
index 2f5190c8..f3d663b4 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   "repository": "expressjs/session",
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.4.2",
+    "cookie": "0.5.0",
     "cookie-signature": "1.0.7",
     "debug": "2.6.9",
     "depd": "~2.0.0",
diff --git a/session/cookie.js b/session/cookie.js
index a8b4e570..ff24d08b 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -116,7 +116,8 @@ Cookie.prototype = {
 
   get data() {
     return {
-      originalMaxAge: this.originalMaxAge
+      originalMaxAge: this.originalMaxAge,
+      priority: this.priority
       , expires: this._expires
       , secure: this.secure
       , httpOnly: this.httpOnly
diff --git a/test/cookie.js b/test/cookie.js
index 65ae1fc3..0869db9e 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -114,5 +114,13 @@ describe('new Cookie()', function () {
         assert.strictEqual(cookie.path, '/foo')
       })
     })
+
+    describe('priority', function () {
+      it('should set priority', function () {
+        var cookie = new Cookie({ priority: 'high' })
+
+        assert.strictEqual(cookie.priority, 'high')
+      })
+    })
   })
 })
diff --git a/test/session.js b/test/session.js
index 09893902..755017d1 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1923,18 +1923,26 @@ describe('session()', function(){
         })
 
         it('should override defaults', function(done){
-          var server = createServer({ cookie: { path: '/admin', httpOnly: false, secure: true, maxAge: 5000 } }, function (req, res) {
+          var opts = {
+            httpOnly: false,
+            maxAge: 5000,
+            path: '/admin',
+            priority: 'high',
+            secure: true
+          }
+          var server = createServer({ cookie: opts }, function (req, res) {
             req.session.cookie.secure = false
             res.end()
           })
 
           request(server)
-          .get('/admin')
-          .expect(shouldSetCookieWithAttribute('connect.sid', 'Expires'))
-          .expect(shouldSetCookieWithoutAttribute('connect.sid', 'HttpOnly'))
-          .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', '/admin'))
-          .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
-          .expect(200, done)
+            .get('/admin')
+            .expect(shouldSetCookieWithAttribute('connect.sid', 'Expires'))
+            .expect(shouldSetCookieWithoutAttribute('connect.sid', 'HttpOnly'))
+            .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', '/admin'))
+            .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+            .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'Priority', 'High'))
+            .expect(200, done)
         })
 
         it('should preserve cookies set before writeHead is called', function(done){

From f9f2318615bd12ad47342fd8cd88a1e0b52686f1 Mon Sep 17 00:00:00 2001
From: Alexandre ZANNI <16578570+noraj@users.noreply.github.com>
Date: Fri, 13 Oct 2023 10:22:16 +0200
Subject: [PATCH 476/529] docs: remove session-rethinkdb to the list of session
 stores

closes #960
---
 README.md | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/README.md b/README.md
index 5096ac0f..2ee2385e 100644
--- a/README.md
+++ b/README.md
@@ -837,11 +837,6 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [session-pouchdb-store-url]: https://www.npmjs.com/package/session-pouchdb-store
 [session-pouchdb-store-image]: https://badgen.net/github/stars/solzimer/session-pouchdb-store?label=%E2%98%85
 
-[![★][session-rethinkdb-image] session-rethinkdb][session-rethinkdb-url] A [RethinkDB](http://rethinkdb.com/)-based session store.
-
-[session-rethinkdb-url]: https://www.npmjs.com/package/session-rethinkdb
-[session-rethinkdb-image]: https://badgen.net/github/stars/llambda/session-rethinkdb?label=%E2%98%85
-
 [![★][@cyclic.sh/session-store-image] @cyclic.sh/session-store][@cyclic.sh/session-store-url] A DynamoDB-based session store for [Cyclic.sh](https://www.cyclic.sh/) apps.
 
 [@cyclic.sh/session-store-url]: https://www.npmjs.com/package/@cyclic.sh/session-store

From d9354ef09ffb1b750b7cd3eb0ddd3f0cdfd4bfab Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 28 Jan 2024 14:44:24 -0500
Subject: [PATCH 477/529] Fix handling errors from setting cookie

---
 HISTORY.md      |  1 +
 index.js        |  6 +++++-
 test/session.js | 17 +++++++++++++++++
 3 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 29e5657a..c0f46aa2 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Add `priority` to `cookie` options
+  * Fix handling errors from setting cookie
   * Support any type in `secret` that `crypto.createHmac` supports
   * deps: cookie@0.5.0
     - Fix `expires` option to reject invalid dates
diff --git a/index.js b/index.js
index 40a442ba..981262cc 100644
--- a/index.js
+++ b/index.js
@@ -240,7 +240,11 @@ function session(options) {
       }
 
       // set cookie
-      setcookie(res, name, req.sessionID, secrets[0], req.session.cookie.data);
+      try {
+        setcookie(res, name, req.sessionID, secrets[0], req.session.cookie.data)
+      } catch (err) {
+        defer(next, err)
+      }
     });
 
     // proxy end() to commit the session
diff --git a/test/session.js b/test/session.js
index 755017d1..e1b6419b 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1945,6 +1945,23 @@ describe('session()', function(){
             .expect(200, done)
         })
 
+        it('should forward errors setting cookie', function (done) {
+          var cb = after(2, done)
+          var server = createServer({ cookie: { expires: new Date(NaN) } }, function (req, res) {
+            res.end()
+          })
+
+          server.on('error', function onerror (err) {
+            assert.ok(err)
+            assert.strictEqual(err.message, 'option expires is invalid')
+            cb()
+          })
+
+          request(server)
+            .get('/admin')
+            .expect(200, cb)
+        })
+
         it('should preserve cookies set before writeHead is called', function(done){
           var server = createServer(null, function (req, res) {
             var cookie = new Cookie()

From 88e0f2eff2a9b2456d70c1d5edac3c45b1552581 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 28 Jan 2024 14:46:52 -0500
Subject: [PATCH 478/529] build: actions/checkout@v4

---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d4d66ca1..a27948bd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -126,7 +126,7 @@ jobs:
           node-version: "21.5"
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
 
     - name: Install Node.js ${{ matrix.node-version }}
       shell: bash -eo pipefail -l {0}
@@ -215,7 +215,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
 
     - name: Install lcov
       shell: bash

From 6153b3f52ddad6d975c40b851694602a5be3d35b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 28 Jan 2024 14:57:28 -0500
Subject: [PATCH 479/529] build: Node.js@21.6

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a27948bd..66f1f09c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -123,7 +123,7 @@ jobs:
           node-version: "20.10"
 
         - name: Node.js 21.x
-          node-version: "21.5"
+          node-version: "21.6"
 
     steps:
     - uses: actions/checkout@v4

From 50e1429314e3b08b3680a3805a849e68414afc4b Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 28 Jan 2024 14:57:37 -0500
Subject: [PATCH 480/529] build: Node.js@20.11

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 66f1f09c..38dc4da7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -120,7 +120,7 @@ jobs:
           node-version: "19.9"
 
         - name: Node.js 20.x
-          node-version: "20.10"
+          node-version: "20.11"
 
         - name: Node.js 21.x
           node-version: "21.6"

From 408229ea3373097732875315d6f63c45e39fd3b6 Mon Sep 17 00:00:00 2001
From: Alex Op <alexop1000@gmail.com>
Date: Tue, 26 Dec 2023 11:09:58 +0100
Subject: [PATCH 481/529] Add "partitioned" to cookie options

fixes #961
closes #966
---
 HISTORY.md        |  3 ++-
 README.md         | 13 +++++++++++++
 package.json      |  2 +-
 session/cookie.js |  1 +
 test/cookie.js    |  8 ++++++++
 test/session.js   | 35 +++++++++++++++++++++++++++++++++++
 6 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index c0f46aa2..ef77098b 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,10 +1,11 @@
 unreleased
 ==========
 
+  * Add `partitioned` to `cookie` options
   * Add `priority` to `cookie` options
   * Fix handling errors from setting cookie
   * Support any type in `secret` that `crypto.createHmac` supports
-  * deps: cookie@0.5.0
+  * deps: cookie@0.6.0
     - Fix `expires` option to reject invalid dates
     - perf: improve default decode speed
     - perf: remove slow string split in parse
diff --git a/README.md b/README.md
index 2ee2385e..e8d6db55 100644
--- a/README.md
+++ b/README.md
@@ -89,6 +89,18 @@ no maximum age is set.
 **Note** If both `expires` and `maxAge` are set in the options, then the last one
 defined in the object is what is used.
 
+##### cookie.partitioned
+
+Specifies the `boolean` value for the [`Partitioned` `Set-Cookie`](rfc-cutler-httpbis-partitioned-cookies)
+attribute. When truthy, the `Partitioned` attribute is set, otherwise it is not.
+By default, the `Partitioned` attribute is not set.
+
+**Note** This is an attribute that has not yet been fully standardized, and may
+change in the future. This also means many clients may ignore this attribute until
+they understand it.
+
+More information about can be found in [the proposal](https://github.com/privacycg/CHIPS).
+
 ##### cookie.path
 
 Specifies the value for the `Path` `Set-Cookie`. By default, this is set to `'/'`, which
@@ -1003,6 +1015,7 @@ On Windows, use the corresponding command;
 [MIT](LICENSE)
 
 [rfc-6265bis-03-4.1.2.7]: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.2.7
+[rfc-cutler-httpbis-partitioned-cookies]: https://tools.ietf.org/html/draft-cutler-httpbis-partitioned-cookies/
 [rfc-west-cookie-priority-00-4.1]: https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1
 [ci-image]: https://badgen.net/github/checks/expressjs/session/master?label=ci
 [ci-url]: https://github.com/expressjs/session/actions?query=workflow%3Aci
diff --git a/package.json b/package.json
index f3d663b4..52cd1d00 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   "repository": "expressjs/session",
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.5.0",
+    "cookie": "0.6.0",
     "cookie-signature": "1.0.7",
     "debug": "2.6.9",
     "depd": "~2.0.0",
diff --git a/session/cookie.js b/session/cookie.js
index ff24d08b..8bb5907b 100644
--- a/session/cookie.js
+++ b/session/cookie.js
@@ -117,6 +117,7 @@ Cookie.prototype = {
   get data() {
     return {
       originalMaxAge: this.originalMaxAge,
+      partitioned: this.partitioned,
       priority: this.priority
       , expires: this._expires
       , secure: this.secure
diff --git a/test/cookie.js b/test/cookie.js
index 0869db9e..ea676e35 100644
--- a/test/cookie.js
+++ b/test/cookie.js
@@ -107,6 +107,14 @@ describe('new Cookie()', function () {
       })
     })
 
+    describe('partitioned', function () {
+      it('should set partitioned', function () {
+        var cookie = new Cookie({ partitioned: true })
+
+        assert.strictEqual(cookie.partitioned, true)
+      })
+    })
+
     describe('path', function () {
       it('should set path', function () {
         var cookie = new Cookie({ path: '/foo' })
diff --git a/test/session.js b/test/session.js
index e1b6419b..7bf3e51f 100644
--- a/test/session.js
+++ b/test/session.js
@@ -2233,6 +2233,41 @@ describe('session()', function(){
           })
         })
       })
+
+      describe('.partitioned', function () {
+        describe('by default', function () {
+          it('should not set partitioned attribute', function (done) {
+            var server = createServer()
+
+            request(server)
+              .get('/')
+              .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Partitioned'))
+              .expect(200, done)
+          })
+        })
+
+        describe('when "false"', function () {
+          it('should not set partitioned attribute', function (done) {
+            var server = createServer({ cookie: { partitioned: false } })
+
+            request(server)
+              .get('/')
+              .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Partitioned'))
+              .expect(200, done)
+          })
+        })
+
+        describe('when "true"', function () {
+          it('should set partitioned attribute', function (done) {
+            var server = createServer({ cookie: { partitioned: true } })
+
+            request(server)
+              .get('/')
+              .expect(shouldSetCookieWithAttribute('connect.sid', 'Partitioned'))
+              .expect(200, done)
+          })
+        })
+      })
     })
   })
 

From 991b7ee815d32cb7e17ce51904d007596e8ec862 Mon Sep 17 00:00:00 2001
From: Kenneth Tan Xin You <kennethtxytqw@users.noreply.github.com>
Date: Wed, 18 Aug 2021 16:27:40 +0800
Subject: [PATCH 482/529] Add debug log for pathname mismatch

closes #840
---
 HISTORY.md | 1 +
 index.js   | 6 +++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index ef77098b..ea175bdb 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Add debug log for pathname mismatch
   * Add `partitioned` to `cookie` options
   * Add `priority` to `cookie` options
   * Fix handling errors from setting cookie
diff --git a/index.js b/index.js
index 981262cc..d41b2378 100644
--- a/index.js
+++ b/index.js
@@ -193,7 +193,11 @@ function session(options) {
 
     // pathname mismatch
     var originalPath = parseUrl.original(req).pathname || '/'
-    if (originalPath.indexOf(cookieOptions.path || '/') !== 0) return next();
+    if (originalPath.indexOf(cookieOptions.path || '/') !== 0) {
+      debug('pathname mismatch')
+      next()
+      return
+    }
 
     // ensure a secret is available or bail
     if (!secret && !req.secret) {

From 855f21ab9325b6be1b857c582b7ba810595d3bf5 Mon Sep 17 00:00:00 2001
From: noiissyboy <vigneshwaran.india@gmail.com>
Date: Wed, 18 May 2022 10:49:07 +0530
Subject: [PATCH 483/529] docs: add connect-ottoman to the list of session
 stores

closes #895
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index e8d6db55..65a37e63 100644
--- a/README.md
+++ b/README.md
@@ -677,6 +677,11 @@ and other multi-core embedded devices).
 [connect-neo4j-url]: https://www.npmjs.com/package/connect-neo4j
 [connect-neo4j-image]: https://badgen.net/github/stars/MaxAndersson/connect-neo4j?label=%E2%98%85
 
+[![★][connect-ottoman-image] connect-ottoman][connect-ottoman-url] A [couchbase ottoman](http://www.couchbase.com/)-based session store.
+
+[connect-ottoman-url]: https://www.npmjs.com/package/connect-ottoman
+[connect-ottoman-image]: https://badgen.net/github/stars/noiissyboy/connect-ottoman?label=%E2%98%85
+
 [![★][connect-pg-simple-image] connect-pg-simple][connect-pg-simple-url] A PostgreSQL-based session store.
 
 [connect-pg-simple-url]: https://www.npmjs.com/package/connect-pg-simple

From 24d4972764d2c962f806c38357f257cf97081009 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 28 Jan 2024 16:20:57 -0500
Subject: [PATCH 484/529] 1.18.0

---
 HISTORY.md   | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index ea175bdb..a9903c03 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,5 @@
-unreleased
-==========
+1.18.0 / 2024-01-28
+===================
 
   * Add debug log for pathname mismatch
   * Add `partitioned` to `cookie` options
diff --git a/package.json b/package.json
index 52cd1d00..597a6994 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.17.3",
+  "version": "1.18.0",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 8f0a1c4a35d80293eb51633e90916bdbdaa09ec4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=8D=C3=B1igo=20Marqu=C3=ADnez=20Prado?=
 <25435858+inigomarquinez@users.noreply.github.com>
Date: Tue, 14 May 2024 18:19:12 +0200
Subject: [PATCH 485/529] ci: add support for OSSF scorecard reporting (#984)

PR-URL: https://github.com/expressjs/session/pull/984
---
 .github/workflows/scorecard.yml | 73 +++++++++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 .github/workflows/scorecard.yml

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 00000000..0e064f47
--- /dev/null
+++ b/.github/workflows/scorecard.yml
@@ -0,0 +1,73 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '16 21 * * 1'
+  push:
+    branches: [ "master" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.2
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@2f93e4319b2f04a2efc38fa7f78bd681bc3f7b2f # v2.23.2
+        with:
+          sarif_file: results.sarif

From 341b179ec67c85c751ba0f5cfee8e514a139f630 Mon Sep 17 00:00:00 2001
From: Nick O'Leary <nick.oleary@gmail.com>
Date: Tue, 8 Oct 2024 18:50:29 +0100
Subject: [PATCH 486/529] dep: cookie@0.7.2 (#997)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>
---
 HISTORY.md   | 15 +++++++++++++++
 package.json |  2 +-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index a9903c03..256606b7 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,18 @@
+unreleased
+==========
+
+
+  * deps: cookie@0.7.2
+    - Fix object assignment of `hasOwnProperty`
+  * deps: cookie@0.7.1
+    - Allow leading dot for domain
+      - Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
+    - Add fast path for `serialize` without options, use `obj.hasOwnProperty` when parsing
+  * deps: cookie@0.7.0
+    - perf: parse cookies ~10% faster
+    - fix: narrow the validation of cookies to match RFC6265
+    - fix: add `main` to `package.json` for rspack
+
 1.18.0 / 2024-01-28
 ===================
 
diff --git a/package.json b/package.json
index 597a6994..910f8b6a 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
   "repository": "expressjs/session",
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.6.0",
+    "cookie": "0.7.2",
     "cookie-signature": "1.0.7",
     "debug": "2.6.9",
     "depd": "~2.0.0",

From bbeca94e69b93d437c4ca300b111bd59169de925 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Tue, 8 Oct 2024 21:52:45 +0200
Subject: [PATCH 487/529] 1.18.1

PR-URL: https://github.com/expressjs/session/pull/998
---
 HISTORY.md   | 3 +--
 package.json | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 256606b7..57c68d3a 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,7 +1,6 @@
-unreleased
+1.18.1 / 2024-10-08
 ==========
 
-
   * deps: cookie@0.7.2
     - Fix object assignment of `hasOwnProperty`
   * deps: cookie@0.7.1
diff --git a/package.json b/package.json
index 910f8b6a..e3322438 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.18.0",
+  "version": "1.18.1",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 460e18c8f3b0cc21a437e984f0ea04b9c0138193 Mon Sep 17 00:00:00 2001
From: BaileyFirman <bailey.firman@nintex.com>
Date: Thu, 21 Nov 2024 16:29:59 +1300
Subject: [PATCH 488/529] Refresh server.crt with existing key extending expiry
 to Nov 21 03:28:10 2024 GMT

---
 test/fixtures/server.crt | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/test/fixtures/server.crt b/test/fixtures/server.crt
index c019198a..3f68e2f2 100644
--- a/test/fixtures/server.crt
+++ b/test/fixtures/server.crt
@@ -1,14 +1,15 @@
 -----BEGIN CERTIFICATE-----
-MIICMzCCAZwCCQCJTms0qcIZgDANBgkqhkiG9w0BAQUFADBeMQswCQYDVQQGEwJV
-UzEQMA4GA1UECBMHSW5kaWFuYTEdMBsGA1UEChMUbm9kZS1leHByZXNzLXNlc3Np
-b24xHjAcBgNVBAMTFWV4cHJlc3Mtc2Vzc2lvbi5sb2NhbDAeFw0xNDExMjMwNTQ3
-MzlaFw0yNDExMjAwNTQ3MzlaMF4xCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdJbmRp
-YW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mtc2Vzc2lvbjEeMBwGA1UEAxMVZXhw
-cmVzcy1zZXNzaW9uLmxvY2FsMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDY
-G398zqN6Yv/FAx77eoLLje4VNCYDXUciWBzceaZ5u/rtP/XshTQWDKFfUbb/kmni
-DazsCasSoNsUCrcqQPJF1jF3F9XjsZxcggDab8MAbAMhnhJax2l3yPJsWnB/8mrY
-cdsdQNPXJxQW9MMZgUxz73gIY5/rEeayU9owgcnVcQIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBADi0XXsZlQAKxOyD4qvdJNWJXlfqhr1q53dZmfF7nikDaMDiMspczTS/
-pxNbq2UaMc7g+6qmXPaPQoN3laQQtMdyVfSh6EIJHbzXXzdcCT4fDBYX7iwvh0Gg
-DUpjmxmCzFCaob9+hZzwbJi5MFQ4Qq12LW1aYHMs8wgLboHml1WL
+MIICWzCCAcSgAwIBAgIJAIlOazSpwhmAMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV
+BAYTAlVTMRAwDgYDVQQIEwdJbmRpYW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mt
+c2Vzc2lvbjEeMBwGA1UEAxMVZXhwcmVzcy1zZXNzaW9uLmxvY2FsMB4XDTI0MTEy
+MTAzMjgxMFoXDTM0MTExOTAzMjgxMFowXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgT
+B0luZGlhbmExHTAbBgNVBAoTFG5vZGUtZXhwcmVzcy1zZXNzaW9uMR4wHAYDVQQD
+ExVleHByZXNzLXNlc3Npb24ubG9jYWwwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
+AoGBANgbf3zOo3pi/8UDHvt6gsuN7hU0JgNdRyJYHNx5pnm7+u0/9eyFNBYMoV9R
+tv+SaeINrOwJqxKg2xQKtypA8kXWMXcX1eOxnFyCANpvwwBsAyGeElrHaXfI8mxa
+cH/yathx2x1A09cnFBb0wxmBTHPveAhjn+sR5rJT2jCBydVxAgMBAAGjITAfMB0G
+A1UdDgQWBBTqXycJwRboThk0uB3Cd3+oSLz1fjANBgkqhkiG9w0BAQsFAAOBgQCT
+/E1rZGxemZZ5F8qX9SoTsc04ELEwT3PwA0cgU5fGmWmajPfjw339y53EQAb/H/sM
+hugSreKMLVSAHRhMNGXb+dR0MzJiR4GbKRvYyHul4zjWen9uQrDHdgsqD4RnUcq8
+7HB+i49oFLN59qoI9MOoOKBfAKGKlXd+IL9+jyR/jA==
 -----END CERTIFICATE-----

From c9d0572701a1bd2714b82ce03cf225e60a3f41a9 Mon Sep 17 00:00:00 2001
From: ctcpip <ctcpip@users.noreply.github.com>
Date: Wed, 22 Jan 2025 09:10:19 -0600
Subject: [PATCH 489/529] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F=20use=202048=20bi?=
 =?UTF-8?q?t=20key?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cd test/fixtures

openssl genpkey -algorithm RSA -out new_server.key -pkeyopt rsa_keygen_bits:2048

openssl x509 -in server.crt -signkey new_server.key -days 3650 -out new_server.crt

openssl x509 -in new_server.crt -text -noout

mv new_server.crt server.crt

mv new_server.key server.key
---
 test/fixtures/server.crt | 28 ++++++++++++++++----------
 test/fixtures/server.key | 43 ++++++++++++++++++++++++++--------------
 2 files changed, 45 insertions(+), 26 deletions(-)

diff --git a/test/fixtures/server.crt b/test/fixtures/server.crt
index 3f68e2f2..3bee94f1 100644
--- a/test/fixtures/server.crt
+++ b/test/fixtures/server.crt
@@ -1,15 +1,21 @@
 -----BEGIN CERTIFICATE-----
-MIICWzCCAcSgAwIBAgIJAIlOazSpwhmAMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV
+MIIDYDCCAkigAwIBAgIJAIlOazSpwhmAMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV
 BAYTAlVTMRAwDgYDVQQIEwdJbmRpYW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mt
-c2Vzc2lvbjEeMBwGA1UEAxMVZXhwcmVzcy1zZXNzaW9uLmxvY2FsMB4XDTI0MTEy
-MTAzMjgxMFoXDTM0MTExOTAzMjgxMFowXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgT
+c2Vzc2lvbjEeMBwGA1UEAxMVZXhwcmVzcy1zZXNzaW9uLmxvY2FsMB4XDTI1MDEy
+MjE1MTMyMFoXDTM1MDEyMDE1MTMyMFowXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgT
 B0luZGlhbmExHTAbBgNVBAoTFG5vZGUtZXhwcmVzcy1zZXNzaW9uMR4wHAYDVQQD
-ExVleHByZXNzLXNlc3Npb24ubG9jYWwwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANgbf3zOo3pi/8UDHvt6gsuN7hU0JgNdRyJYHNx5pnm7+u0/9eyFNBYMoV9R
-tv+SaeINrOwJqxKg2xQKtypA8kXWMXcX1eOxnFyCANpvwwBsAyGeElrHaXfI8mxa
-cH/yathx2x1A09cnFBb0wxmBTHPveAhjn+sR5rJT2jCBydVxAgMBAAGjITAfMB0G
-A1UdDgQWBBTqXycJwRboThk0uB3Cd3+oSLz1fjANBgkqhkiG9w0BAQsFAAOBgQCT
-/E1rZGxemZZ5F8qX9SoTsc04ELEwT3PwA0cgU5fGmWmajPfjw339y53EQAb/H/sM
-hugSreKMLVSAHRhMNGXb+dR0MzJiR4GbKRvYyHul4zjWen9uQrDHdgsqD4RnUcq8
-7HB+i49oFLN59qoI9MOoOKBfAKGKlXd+IL9+jyR/jA==
+ExVleHByZXNzLXNlc3Npb24ubG9jYWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQCy4w/9Wa85PGpdkzuZeU2qel+jlQd5L8b0RoKwlQ5k8NS/zIRd2fiF
+8XIQMi5m7sGaYT3xUUItuksQF3XnOGQddppLCnfshjqUeSrMAoSZPnqHsZYsbRhS
+3HiJFLWvBRDndVpmvdyg7BZicqEFmVBYNqsbsGH0Nrx6Xcb3iEZL8Z1mg3y+5f7c
+0s0buXJmX9usc8g7CRiLfuqArAJM8NUSyBonsIlzQvudmNiyqb5UZIYqK8YvCpkZ
+3QcHpzVCZ1uYIKa8MY878PhaiVqwDWGEtXO9xi3rtHXkvm5Y3wwbXYFDoOvA1YvM
+/CtLXNCpHU23WhiIErBb3dvGxZZroCTtAgMBAAGjITAfMB0GA1UdDgQWBBSJqiKJ
+f66iraVLqI3oZsgVeFA14jANBgkqhkiG9w0BAQsFAAOCAQEAP2VZidUCQptk4BiU
+Fi390fR5wrgnqhBRmoE+iL5ok05ToLsg2DyvCefPyZgNp//NIRp6QUIHmPVXWHXx
+fVDPLUC1CuOXy+o6TDWWjbtFW/PG5uPA6uhW4XpaBR5EGlptOBrGIRKIqneUwsMk
+5fpDo7pbU4GSMToDDnhJxijrHIQFTs+PJLAGjCBQn/FRcDR1AJlxW/AyO0bIBSLE
+fnZP+feQG6koDK8rgyT4t4z+hynAuf7y1ToFckNfTkdLdbXG5ceGu21qJCY/8uje
+Nf01ik1p8gL5dZcW3qucTP5p45t3bnUDOjPFmrs87Ooeix9UjZG2hwW258FN86r6
+3PDrTw==
 -----END CERTIFICATE-----
diff --git a/test/fixtures/server.key b/test/fixtures/server.key
index dabf2b83..51b6a7b1 100644
--- a/test/fixtures/server.key
+++ b/test/fixtures/server.key
@@ -1,15 +1,28 @@
------BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDYG398zqN6Yv/FAx77eoLLje4VNCYDXUciWBzceaZ5u/rtP/Xs
-hTQWDKFfUbb/kmniDazsCasSoNsUCrcqQPJF1jF3F9XjsZxcggDab8MAbAMhnhJa
-x2l3yPJsWnB/8mrYcdsdQNPXJxQW9MMZgUxz73gIY5/rEeayU9owgcnVcQIDAQAB
-AoGBALB8HGw/kPA1Ay3Qc6/qCADWYvW8BcM/nQUmMkO3sUW/R5gTYPIMglHzdKIU
-aL9kwcXTZ0HIT4ZCCUffzF/cdD0lqCZjwGl0aM4xUZcPbaM/KmZOUcP92ymsN+rF
-uuJXks6hxrmJ5hh5D6FXdlQjTCdG3u9w0+KD4n1BkBkEaqflAkEA9q4TBt1bLOvV
-bbwz7bunI6bwS5eD7sVn1qUqrm6hcirhF1xCv75pO/uqAyccbguxjp8y2LNuN+cO
-IgSwr+Jq1wJBAOBFuKSMAcg2WmJ4IAT7143yhoHKMgA8Nl4sfLFwFl2/hw+fdEBe
-gndRfKHT4IV/YLcnS7d/H6mEMSAusWx5QPcCQQDTYaF+TWrW2JRAf3jEK/xyiZf6
-PrDYh6KOhWRIqxZ/fYz69p1gL6t/sg0ivH4ZMr4JKBRrK360OrOapQg+/7drAkB6
-3pfPRok/aE/SfN+F+3fX49Q/TUhhipt6ssLJ74/BYsobDBADqAOwXSt7+XmbifKx
-xUydRn9RPwQvDoXT2QZ3AkAdnwR9PMEHAsaibrPyzBztKjPL2rWBRk1QAmcdrTpt
-XL99XfmkERWtiBA/Lz2K332qYOa/zo5c/SADx9fm7+HP
------END RSA PRIVATE KEY-----
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCy4w/9Wa85PGpd
+kzuZeU2qel+jlQd5L8b0RoKwlQ5k8NS/zIRd2fiF8XIQMi5m7sGaYT3xUUItuksQ
+F3XnOGQddppLCnfshjqUeSrMAoSZPnqHsZYsbRhS3HiJFLWvBRDndVpmvdyg7BZi
+cqEFmVBYNqsbsGH0Nrx6Xcb3iEZL8Z1mg3y+5f7c0s0buXJmX9usc8g7CRiLfuqA
+rAJM8NUSyBonsIlzQvudmNiyqb5UZIYqK8YvCpkZ3QcHpzVCZ1uYIKa8MY878Pha
+iVqwDWGEtXO9xi3rtHXkvm5Y3wwbXYFDoOvA1YvM/CtLXNCpHU23WhiIErBb3dvG
+xZZroCTtAgMBAAECggEAA8BHqE4eYsKdz18EP6xfwMymn0FDghrKnvowiN/jSKIV
+L/1rpCUrNTHSLL1EpFNq22AhIqOL0fYnV0vKpOHVlZmUVDEAwUSyS0U8LMF7wtPg
+0WIbrkxOV4R4gZVd1vDyAQyArAlcrEIvGPri3gFwQh1JWsAI2cxhCObZAn1IzhRW
+sMecAmtNzzYWeXentSfkfWr0niKDbSAAuYzgVIEWbIfE+kgqBckrWnyM9IgSdy1g
+0b3NRRD/gvykszX7j9fzXGj8RAcCTbN1miaFcHRg3moa1Pu50KjokINsr5xxYqTk
+ltPYU35gMYzNPvu5clvj067j6ikCFMiE4XOXf58qwQKBgQDpQJ2l6b1LrvGAV4Q6
+qieTYPTnGhnm/rSn7jK+AUIF+UmK3mtASuc14keelXeiI42MzvO1P6LLwkFIzVx0
+2X/BrTDZUvU5P5nsgBkoyiC71bkbCzoiSxIQtRurenmkD7EqM+4zBYMvCvrPFmOr
+twuWk+4XLA+nl5Vl+FUgjehCQQKBgQDEVShtn68Pkq22GXR5kzgFu+GaXuVPJKu8
+z45K4mbG+WrnwuMmnIRbMfN9oGF5JXWAe5AtFqlQEcUQLElllRkdUe76WX15M2Jm
+UeqFFARWjToNs7NXmxjsQZFOe0TyfAsdaX++lUhEpeCcv2MnEoNQS9n8yTwhuJM4
+8Zr9KUWfrQKBgQCFkNK1ZxtWc18nNvYpAbaX1jVnALNEayXX47Z6xw2fjhhmxOZ1
+cm7jlCeez8gpuGId94PmjgIS27G2lqIS51kY9qu6Rp7VoW3q14+Qo+4KoV/V9J/d
+c09s8checUumfrXcjNAht05fadIlM5Tvh2nDWAJGkpyEQ3DxazqT4a7WAQKBgFok
+Zz191Zim1c8H/Oxc5ZnsW3bPHyWpRpiYC1LihCHTHnxuhHCT6EketBb37gj7Y+mr
+0dSB1RcIMZxtWP2k6TUHC1wyfmOJbiJgdfbH6/35NbBY03zjnxvKNvb7rfpPbaMB
+bz+Htvid2HTfgpzL6TKSwPFJS6yH3ECG3YxiyK65AoGAHIYaLIP53pszdd1ruCO6
+0rI6/He6hKwG8SmtbXKCKYSAeNwZJkUI+B0xD8ZTq5h3geJD7CEoVPPsv9xauliG
+fspe/KyTX5DqTBx9xNVYj9C2MSozQNs8ObCsUOMKzRaJtHl64US1VzweWA7Whkwf
+1r8MiT2ty4eCk7V3qW1W88A=
+-----END PRIVATE KEY-----

From d5baeeca833a6370936a844654f0d7147dc234aa Mon Sep 17 00:00:00 2001
From: Wes Todd <wes@wesleytodd.com>
Date: Wed, 22 Jan 2025 17:06:47 -0600
Subject: [PATCH 490/529] feat: gencert script to regenerate the test ssl certs

---
 package.json            |  3 ++-
 test/support/gencert.sh | 12 ++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100755 test/support/gencert.sh

diff --git a/package.json b/package.json
index e3322438..87b31098 100644
--- a/package.json
+++ b/package.json
@@ -42,6 +42,7 @@
     "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
     "test-ci": "nyc --reporter=lcov --reporter=text npm test",
     "test-cov": "nyc npm test",
-    "version": "node scripts/version-history.js && git add HISTORY.md"
+    "version": "node scripts/version-history.js && git add HISTORY.md",
+    "gencert": "./test/support/gencert.sh"
   }
 }
diff --git a/test/support/gencert.sh b/test/support/gencert.sh
new file mode 100755
index 00000000..114bf70f
--- /dev/null
+++ b/test/support/gencert.sh
@@ -0,0 +1,12 @@
+#! /bin/sh
+set -ex
+
+openssl genpkey -algorithm RSA -out new_server.key -pkeyopt rsa_keygen_bits:2048
+
+openssl x509 -in ./test/fixtures/server.crt -signkey new_server.key -days 3650 -out new_server.crt
+
+openssl x509 -in new_server.crt -text -noout
+
+mv new_server.crt ./test/fixtures/server.crt
+
+mv new_server.key ./test/fixtures/server.key

From 67d61ee1799a8070dff4a5b759189be2023c7a62 Mon Sep 17 00:00:00 2001
From: ctcpip <ctcpip@users.noreply.github.com>
Date: Thu, 23 Jan 2025 11:01:24 -0600
Subject: [PATCH 491/529] =?UTF-8?q?=E2=9C=85=20always=20generate=20fresh?=
 =?UTF-8?q?=20cert?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitignore               |  2 ++
 package.json             |  5 ++---
 test/fixtures/.gitkeep   |  0
 test/fixtures/server.crt | 21 ---------------------
 test/fixtures/server.key | 28 ----------------------------
 test/support/gencert.sh  | 11 ++---------
 6 files changed, 6 insertions(+), 61 deletions(-)
 create mode 100644 test/fixtures/.gitkeep
 delete mode 100644 test/fixtures/server.crt
 delete mode 100644 test/fixtures/server.key

diff --git a/.gitignore b/.gitignore
index 207febba..1b6fef23 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,5 @@ coverage
 node_modules
 npm-debug.log
 package-lock.json
+/test/fixtures/server.crt
+/test/fixtures/server.key
diff --git a/package.json b/package.json
index 87b31098..79cb1b4c 100644
--- a/package.json
+++ b/package.json
@@ -39,10 +39,9 @@
   },
   "scripts": {
     "lint": "eslint . && node ./scripts/lint-readme.js",
-    "test": "mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
+    "test": "./test/support/gencert.sh && mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
     "test-ci": "nyc --reporter=lcov --reporter=text npm test",
     "test-cov": "nyc npm test",
-    "version": "node scripts/version-history.js && git add HISTORY.md",
-    "gencert": "./test/support/gencert.sh"
+    "version": "node scripts/version-history.js && git add HISTORY.md"
   }
 }
diff --git a/test/fixtures/.gitkeep b/test/fixtures/.gitkeep
new file mode 100644
index 00000000..e69de29b
diff --git a/test/fixtures/server.crt b/test/fixtures/server.crt
deleted file mode 100644
index 3bee94f1..00000000
--- a/test/fixtures/server.crt
+++ /dev/null
@@ -1,21 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDYDCCAkigAwIBAgIJAIlOazSpwhmAMA0GCSqGSIb3DQEBCwUAMF4xCzAJBgNV
-BAYTAlVTMRAwDgYDVQQIEwdJbmRpYW5hMR0wGwYDVQQKExRub2RlLWV4cHJlc3Mt
-c2Vzc2lvbjEeMBwGA1UEAxMVZXhwcmVzcy1zZXNzaW9uLmxvY2FsMB4XDTI1MDEy
-MjE1MTMyMFoXDTM1MDEyMDE1MTMyMFowXjELMAkGA1UEBhMCVVMxEDAOBgNVBAgT
-B0luZGlhbmExHTAbBgNVBAoTFG5vZGUtZXhwcmVzcy1zZXNzaW9uMR4wHAYDVQQD
-ExVleHByZXNzLXNlc3Npb24ubG9jYWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
-ggEKAoIBAQCy4w/9Wa85PGpdkzuZeU2qel+jlQd5L8b0RoKwlQ5k8NS/zIRd2fiF
-8XIQMi5m7sGaYT3xUUItuksQF3XnOGQddppLCnfshjqUeSrMAoSZPnqHsZYsbRhS
-3HiJFLWvBRDndVpmvdyg7BZicqEFmVBYNqsbsGH0Nrx6Xcb3iEZL8Z1mg3y+5f7c
-0s0buXJmX9usc8g7CRiLfuqArAJM8NUSyBonsIlzQvudmNiyqb5UZIYqK8YvCpkZ
-3QcHpzVCZ1uYIKa8MY878PhaiVqwDWGEtXO9xi3rtHXkvm5Y3wwbXYFDoOvA1YvM
-/CtLXNCpHU23WhiIErBb3dvGxZZroCTtAgMBAAGjITAfMB0GA1UdDgQWBBSJqiKJ
-f66iraVLqI3oZsgVeFA14jANBgkqhkiG9w0BAQsFAAOCAQEAP2VZidUCQptk4BiU
-Fi390fR5wrgnqhBRmoE+iL5ok05ToLsg2DyvCefPyZgNp//NIRp6QUIHmPVXWHXx
-fVDPLUC1CuOXy+o6TDWWjbtFW/PG5uPA6uhW4XpaBR5EGlptOBrGIRKIqneUwsMk
-5fpDo7pbU4GSMToDDnhJxijrHIQFTs+PJLAGjCBQn/FRcDR1AJlxW/AyO0bIBSLE
-fnZP+feQG6koDK8rgyT4t4z+hynAuf7y1ToFckNfTkdLdbXG5ceGu21qJCY/8uje
-Nf01ik1p8gL5dZcW3qucTP5p45t3bnUDOjPFmrs87Ooeix9UjZG2hwW258FN86r6
-3PDrTw==
------END CERTIFICATE-----
diff --git a/test/fixtures/server.key b/test/fixtures/server.key
deleted file mode 100644
index 51b6a7b1..00000000
--- a/test/fixtures/server.key
+++ /dev/null
@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCy4w/9Wa85PGpd
-kzuZeU2qel+jlQd5L8b0RoKwlQ5k8NS/zIRd2fiF8XIQMi5m7sGaYT3xUUItuksQ
-F3XnOGQddppLCnfshjqUeSrMAoSZPnqHsZYsbRhS3HiJFLWvBRDndVpmvdyg7BZi
-cqEFmVBYNqsbsGH0Nrx6Xcb3iEZL8Z1mg3y+5f7c0s0buXJmX9usc8g7CRiLfuqA
-rAJM8NUSyBonsIlzQvudmNiyqb5UZIYqK8YvCpkZ3QcHpzVCZ1uYIKa8MY878Pha
-iVqwDWGEtXO9xi3rtHXkvm5Y3wwbXYFDoOvA1YvM/CtLXNCpHU23WhiIErBb3dvG
-xZZroCTtAgMBAAECggEAA8BHqE4eYsKdz18EP6xfwMymn0FDghrKnvowiN/jSKIV
-L/1rpCUrNTHSLL1EpFNq22AhIqOL0fYnV0vKpOHVlZmUVDEAwUSyS0U8LMF7wtPg
-0WIbrkxOV4R4gZVd1vDyAQyArAlcrEIvGPri3gFwQh1JWsAI2cxhCObZAn1IzhRW
-sMecAmtNzzYWeXentSfkfWr0niKDbSAAuYzgVIEWbIfE+kgqBckrWnyM9IgSdy1g
-0b3NRRD/gvykszX7j9fzXGj8RAcCTbN1miaFcHRg3moa1Pu50KjokINsr5xxYqTk
-ltPYU35gMYzNPvu5clvj067j6ikCFMiE4XOXf58qwQKBgQDpQJ2l6b1LrvGAV4Q6
-qieTYPTnGhnm/rSn7jK+AUIF+UmK3mtASuc14keelXeiI42MzvO1P6LLwkFIzVx0
-2X/BrTDZUvU5P5nsgBkoyiC71bkbCzoiSxIQtRurenmkD7EqM+4zBYMvCvrPFmOr
-twuWk+4XLA+nl5Vl+FUgjehCQQKBgQDEVShtn68Pkq22GXR5kzgFu+GaXuVPJKu8
-z45K4mbG+WrnwuMmnIRbMfN9oGF5JXWAe5AtFqlQEcUQLElllRkdUe76WX15M2Jm
-UeqFFARWjToNs7NXmxjsQZFOe0TyfAsdaX++lUhEpeCcv2MnEoNQS9n8yTwhuJM4
-8Zr9KUWfrQKBgQCFkNK1ZxtWc18nNvYpAbaX1jVnALNEayXX47Z6xw2fjhhmxOZ1
-cm7jlCeez8gpuGId94PmjgIS27G2lqIS51kY9qu6Rp7VoW3q14+Qo+4KoV/V9J/d
-c09s8checUumfrXcjNAht05fadIlM5Tvh2nDWAJGkpyEQ3DxazqT4a7WAQKBgFok
-Zz191Zim1c8H/Oxc5ZnsW3bPHyWpRpiYC1LihCHTHnxuhHCT6EketBb37gj7Y+mr
-0dSB1RcIMZxtWP2k6TUHC1wyfmOJbiJgdfbH6/35NbBY03zjnxvKNvb7rfpPbaMB
-bz+Htvid2HTfgpzL6TKSwPFJS6yH3ECG3YxiyK65AoGAHIYaLIP53pszdd1ruCO6
-0rI6/He6hKwG8SmtbXKCKYSAeNwZJkUI+B0xD8ZTq5h3geJD7CEoVPPsv9xauliG
-fspe/KyTX5DqTBx9xNVYj9C2MSozQNs8ObCsUOMKzRaJtHl64US1VzweWA7Whkwf
-1r8MiT2ty4eCk7V3qW1W88A=
------END PRIVATE KEY-----
diff --git a/test/support/gencert.sh b/test/support/gencert.sh
index 114bf70f..cfdda070 100755
--- a/test/support/gencert.sh
+++ b/test/support/gencert.sh
@@ -1,12 +1,5 @@
 #! /bin/sh
 set -ex
 
-openssl genpkey -algorithm RSA -out new_server.key -pkeyopt rsa_keygen_bits:2048
-
-openssl x509 -in ./test/fixtures/server.crt -signkey new_server.key -days 3650 -out new_server.crt
-
-openssl x509 -in new_server.crt -text -noout
-
-mv new_server.crt ./test/fixtures/server.crt
-
-mv new_server.key ./test/fixtures/server.key
+openssl req -x509 -nodes -newkey rsa:2048 -keyout ./test/fixtures/server.key -out ./test/fixtures/server.crt -days 3650 \
+-subj "/C=US/ST=Illinois/L=Chicago/O=node-express-session/CN=express-session.local"

From 4930de729107448e4b34b5bd39f138f71f1561f6 Mon Sep 17 00:00:00 2001
From: ctcpip <ctcpip@users.noreply.github.com>
Date: Thu, 23 Jan 2025 11:04:34 -0600
Subject: [PATCH 492/529] =?UTF-8?q?=E2=AC=86=EF=B8=8F=20bump=20actions?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/ci.yml | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 38dc4da7..ff3bce76 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -185,7 +185,7 @@ jobs:
       run: |
         if npm -ps ls nyc | grep -q nyc; then
           npm run test-ci
-          cp coverage/lcov.info "coverage/${{ matrix.name }}.lcov"
+          cp coverage/lcov.info "coverage/${{ matrix.node-version }}.lcov"
         else
           npm test
         fi
@@ -198,17 +198,17 @@ jobs:
       if: steps.list_env.outputs.nyc != ''
       run: |
         if [[ -d ./coverage ]]; then
-          mv ./coverage "./${{ matrix.name }}"
+          mv ./coverage "./${{ matrix.node-version }}"
           mkdir ./coverage
-          mv "./${{ matrix.name }}" "./coverage/${{ matrix.name }}"
+          mv "./${{ matrix.node-version }}" "./coverage/${{ matrix.node-version }}"
         fi
 
     - name: Upload code coverage
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       if: steps.list_env.outputs.nyc != ''
       with:
-        name: coverage
-        path: ./coverage
+        name: coverage-${{ matrix.node-version }}
+        path: "./coverage/${{ matrix.node-version }}"
         retention-days: 1
 
   coverage:
@@ -222,9 +222,8 @@ jobs:
       run: sudo apt-get -y install lcov
 
     - name: Collect coverage reports
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
-        name: coverage
         path: ./coverage
 
     - name: Merge coverage reports

From b99e6c6fba30996069c9122e9e041a26f13d1d5e Mon Sep 17 00:00:00 2001
From: Carlos Serrano <carlos.pastor@mailonline.co.uk>
Date: Thu, 17 Apr 2025 16:18:22 +0200
Subject: [PATCH 493/529] chore: upgrade scorecard workflow pinned action
 versions (#1008)

---
 .github/workflows/scorecard.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 0e064f47..d23de00e 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -33,12 +33,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -60,7 +60,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: SARIF file
           path: results.sarif
@@ -68,6 +68,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@2f93e4319b2f04a2efc38fa7f78bd681bc3f7b2f # v2.23.2
+        uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
         with:
-          sarif_file: results.sarif
+          sarif_file: results.sarif
\ No newline at end of file

From 6edf5eeab25c1b89ecd2676ce119d600c741b5f6 Mon Sep 17 00:00:00 2001
From: Sebastian Beltran <bjohansebas@gmail.com>
Date: Sat, 26 Apr 2025 22:09:29 -0500
Subject: [PATCH 494/529] ci: add CodeQL (SAST) (#1005)

---
 .github/workflows/codeql.yml | 66 ++++++++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..9d1b3041
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,66 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: ["master"]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: ["master"]
+  schedule:
+    - cron: "0 0 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
+        with:
+          languages: javascript
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      # - name: Autobuild
+      #   uses: github/codeql-action/autobuild@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+      #   If the Autobuild fails above, remove it and uncomment the following three lines.
+      #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+      # - run: |
+      #   echo "Run, Build Application using script"
+      #   ./location_of_script_within_repo/buildscript.sh
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
+        with:
+          category: "/language:javascript"
\ No newline at end of file

From 122714cbdab4aee732d9e43a90865c73ec9819af Mon Sep 17 00:00:00 2001
From: StepSecurity Bot <bot@stepsecurity.io>
Date: Sat, 17 May 2025 10:33:44 -0700
Subject: [PATCH 495/529] [StepSecurity] Apply security best practices (#1047)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* [StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

* Update dependabot.yml

* ping supertest versions in CI

Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>

---------

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>
Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Co-authored-by: Sebastian Beltran <bjohansebas@gmail.com>
---
 .github/dependabot.yml   | 11 +++++++++++
 .github/workflows/ci.yml | 31 +++++++++++++++++++------------
 2 files changed, 30 insertions(+), 12 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..69f2040f
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: monthly
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ff3bce76..746b29e1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,9 @@ on:
 - pull_request
 - push
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -79,33 +82,34 @@ jobs:
 
         - name: Node.js 8.x
           node-version: "8.17"
-          npm-i: mocha@7.2.0 nyc@14.1.1
+          npm-i: mocha@7.2.0 nyc@14.1.1 supertest@6.1.6
 
         - name: Node.js 9.x
           node-version: "9.11"
-          npm-i: mocha@7.2.0 nyc@14.1.1
+          npm-i: mocha@7.2.0 nyc@14.1.1 supertest@6.1.6
 
         - name: Node.js 10.x
           node-version: "10.24"
-          npm-i: mocha@8.4.0
+          npm-i: mocha@8.4.0 supertest@6.1.6
 
         - name: Node.js 11.x
           node-version: "11.15"
-          npm-i: mocha@8.4.0
+          npm-i: mocha@8.4.0 supertest@6.1.6
 
         - name: Node.js 12.x
           node-version: "12.22"
-          npm-i: mocha@9.2.2
+          npm-i: mocha@9.2.2 supertest@6.1.6
 
         - name: Node.js 13.x
           node-version: "13.14"
-          npm-i: mocha@9.2.2
+          npm-i: mocha@9.2.2 supertest@6.1.6
 
         - name: Node.js 14.x
           node-version: "14.21"
 
         - name: Node.js 15.x
-          node-version: "15.14"
+          node-version: "15.14" 
+          npm-i: supertest@6.1.6
 
         - name: Node.js 16.x
           node-version: "16.20"
@@ -126,7 +130,7 @@ jobs:
           node-version: "21.6"
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: Install Node.js ${{ matrix.node-version }}
       shell: bash -eo pipefail -l {0}
@@ -204,7 +208,7 @@ jobs:
         fi
 
     - name: Upload code coverage
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       if: steps.list_env.outputs.nyc != ''
       with:
         name: coverage-${{ matrix.node-version }}
@@ -212,17 +216,20 @@ jobs:
         retention-days: 1
 
   coverage:
+    permissions:
+      checks: write  # for coverallsapp/github-action to create new checks
+      contents: read  # for actions/checkout to fetch code
     needs: test
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: Install lcov
       shell: bash
       run: sudo apt-get -y install lcov
 
     - name: Collect coverage reports
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         path: ./coverage
 
@@ -231,6 +238,6 @@ jobs:
       run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info
 
     - name: Upload coverage report
-      uses: coverallsapp/github-action@master
+      uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # master
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}

From 168271c665519d7d9164f97873bd0eee88d9e6fb Mon Sep 17 00:00:00 2001
From: Sebastian Beltran <bjohansebas@gmail.com>
Date: Sat, 17 May 2025 13:02:43 -0500
Subject: [PATCH 496/529] fix(dependabot): do not update major versions

Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>
---
 .github/dependabot.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 69f2040f..492d67d0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,3 +9,6 @@ updates:
     directory: /
     schedule:
       interval: monthly
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]

From 92dd3008e334eaa8466a431ae3c032b827b5816d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 18 May 2025 11:19:32 +0200
Subject: [PATCH 497/529] build(deps-dev): bump mocha from 10.2.0 to 10.8.2
 (#1061)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>
---
 HISTORY.md   | 5 +++++
 package.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/HISTORY.md b/HISTORY.md
index 57c68d3a..cc879c63 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unpublished
+==========
+  * deps: mocha@10.8.2
+
+
 1.18.1 / 2024-10-08
 ==========
 
diff --git a/package.json b/package.json
index 79cb1b4c..b4978a27 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint": "8.56.0",
     "eslint-plugin-markdown": "3.0.1",
     "express": "4.17.3",
-    "mocha": "10.2.0",
+    "mocha": "10.8.2",
     "nyc": "15.1.0",
     "supertest": "6.3.4"
   },

From 7e2c6964263b66d7fbdbd75d1c603413880fef64 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 31 May 2025 19:32:09 -0500
Subject: [PATCH 498/529] build(deps): bump ossf/scorecard-action from 2.4.0 to
 2.4.1 (#1048)

Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.0 to 2.4.1.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](https://github.com/ossf/scorecard-action/compare/62b2cac7ed8198b15735ed49ab1e5cf35480ba46...f49aabe0b5af0936a0987cfb85d86b75731b0186)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index d23de00e..3d4b1114 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -38,7 +38,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
         with:
           results_file: results.sarif
           results_format: sarif

From 2633e88780e5655db44d11f917629942cb92628d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 31 May 2025 19:32:43 -0500
Subject: [PATCH 499/529] build(deps): bump github/codeql-action from 3.24.7 to
 3.28.18 (#1050)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.24.7 to 3.28.18.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v3.24.7...ff0a06e83cb2de871e5a09832bc6a81e7276941f)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.28.18
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/codeql.yml    | 4 ++--
 .github/workflows/scorecard.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9d1b3041..894e99aa 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
+        uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
         with:
           languages: javascript
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,6 +61,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
+        uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
         with:
           category: "/language:javascript"
\ No newline at end of file
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 3d4b1114..5ad5ef6a 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -68,6 +68,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
+        uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
         with:
           sarif_file: results.sarif
\ No newline at end of file

From 2caff6ae8976763841abbc8ed7b560cc5ebdf6cf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 31 May 2025 19:33:21 -0500
Subject: [PATCH 500/529] build(deps): bump actions/checkout from 4.1.1 to
 4.2.2 (#1049)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.1 to 4.2.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4.1.1...11bd71901bbe5b1630ceea73d27597364c9af683)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/codeql.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 894e99aa..1a41f87b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL

From ec1957b9bd169c582a00d83f5966f4c5fed9017d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 31 May 2025 19:33:55 -0500
Subject: [PATCH 501/529] build(deps): bump actions/upload-artifact from 4.5.0
 to 4.6.2 (#1052)

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.5.0 to 4.6.2.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4.5.0...ea165f8d65b6e75b540449e92b4886f43607fa02)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 5ad5ef6a..d53e5871 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,7 +60,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: SARIF file
           path: results.sarif

From a698c81f2ab950188cdbd7f30bb3a89fd68e2046 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 31 May 2025 19:34:41 -0500
Subject: [PATCH 502/529] build(deps): bump coverallsapp/github-action from
 1.2.5 to 2.3.6 (#1051)

Bumps [coverallsapp/github-action](https://github.com/coverallsapp/github-action) from 1.2.5 to 2.3.6.
- [Release notes](https://github.com/coverallsapp/github-action/releases)
- [Upgrade guide](https://github.com/coverallsapp/github-action/blob/main/UPGRADE.md)
- [Commits](https://github.com/coverallsapp/github-action/compare/09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d...648a8eb78e6d50909eff900e4ec85cab4524a45b)

---
updated-dependencies:
- dependency-name: coverallsapp/github-action
  dependency-version: 2.3.6
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 746b29e1..210657e2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -238,6 +238,6 @@ jobs:
       run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info
 
     - name: Upload coverage report
-      uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # master
+      uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # master
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}

From b9fcad8a8bc8f1ac84809d81c569ffbcc6f9ef99 Mon Sep 17 00:00:00 2001
From: Noritaka Kobayashi <arukimedesu1166777@gmail.com>
Date: Sat, 12 Jul 2025 02:21:20 +0900
Subject: [PATCH 503/529] chore: fix typos (#1066)

---
 HISTORY.md                 | 2 +-
 README.md                  | 4 ++--
 scripts/version-history.js | 2 +-
 test/session.js            | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index cc879c63..1dcedcc5 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -171,7 +171,7 @@ unpublished
     - Improve error message when `expires` is not a `Date`
     - perf: enable strict mode
     - perf: use for loop in parse
-    - perf: use string concatination for serialization
+    - perf: use string concatenation for serialization
   * deps: parseurl@~1.3.1
     - perf: enable strict mode
   * deps: uid-safe@~2.1.1
diff --git a/README.md b/README.md
index 65a37e63..b880e6b4 100644
--- a/README.md
+++ b/README.md
@@ -269,7 +269,7 @@ With this enabled, the session identifier cookie will expire in
 [`maxAge`](#cookiemaxage) since the last response was sent instead of in
 [`maxAge`](#cookiemaxage) since the session was last modified by the server.
 
-This is typically used in conjuction with short, non-session-length
+This is typically used in conjunction with short, non-session-length
 [`maxAge`](#cookiemaxage) values to provide a quick timeout of the session data
 with reduced potential of it occurring during on going server interactions.
 
@@ -773,7 +773,7 @@ a [variety of storage types](https://www.npmjs.com/package/cache-manager#store-e
 [express-session-level-url]: https://www.npmjs.com/package/express-session-level
 [express-session-level-image]: https://badgen.net/github/stars/tgohn/express-session-level?label=%E2%98%85
 
-[![★][express-session-rsdb-image] express-session-rsdb][express-session-rsdb-url] Session store based on Rocket-Store: A very simple, super fast and yet powerfull, flat file database.
+[![★][express-session-rsdb-image] express-session-rsdb][express-session-rsdb-url] Session store based on Rocket-Store: A very simple, super fast and yet powerful, flat file database.
 
 [express-session-rsdb-url]: https://www.npmjs.com/package/express-session-rsdb
 [express-session-rsdb-image]: https://badgen.net/github/stars/paragi/express-session-rsdb?label=%E2%98%85
diff --git a/scripts/version-history.js b/scripts/version-history.js
index b8a2b0e8..c58268ad 100644
--- a/scripts/version-history.js
+++ b/scripts/version-history.js
@@ -16,7 +16,7 @@ if (!MD_HEADER_REGEXP.test(historyFileLines[1])) {
 }
 
 if (!VERSION_PLACEHOLDER_REGEXP.test(historyFileLines[0])) {
-  console.error('Missing placegolder version in HISTORY.md')
+  console.error('Missing placeholder version in HISTORY.md')
   process.exit(1)
 }
 
diff --git a/test/session.js b/test/session.js
index 7bf3e51f..a7d79b70 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1710,7 +1710,7 @@ describe('session()', function(){
         })
       })
 
-      it('should not override an overriden `reload` in case of errors',  function (done) {
+      it('should not override an overridden `reload` in case of errors',  function (done) {
         var store = new session.MemoryStore()
         var server = createServer({ store: store, resave: false }, function (req, res) {
           if (req.url === '/') {

From 58087831a68787fb3c1ef8b821efb965225dc725 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Thu, 17 Jul 2025 19:25:18 +0200
Subject: [PATCH 504/529] deps: on-headers@1.1.0 (#1069)

---
 HISTORY.md   | 3 ++-
 package.json | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 1dcedcc5..401ffbd5 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,7 +1,8 @@
 unpublished
 ==========
   * deps: mocha@10.8.2
-
+  * deps: on-headers@~1.1.0
+    - Fix [CVE-2025-7339](https://www.cve.org/CVERecord?id=CVE-2025-7339) ([GHSA-76c9-3jph-rj3q](https://github.com/expressjs/on-headers/security/advisories/GHSA-76c9-3jph-rj3q))
 
 1.18.1 / 2024-10-08
 ==========
diff --git a/package.json b/package.json
index b4978a27..f03896af 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,7 @@
     "cookie-signature": "1.0.7",
     "debug": "2.6.9",
     "depd": "~2.0.0",
-    "on-headers": "~1.0.2",
+    "on-headers": "~1.1.0",
     "parseurl": "~1.3.3",
     "safe-buffer": "5.2.1",
     "uid-safe": "~2.1.5"

From d10709f319d1ff4069e1e552fc7f3ca27989e981 Mon Sep 17 00:00:00 2001
From: Chris de Almeida <ctcpip@users.noreply.github.com>
Date: Thu, 17 Jul 2025 12:51:20 -0500
Subject: [PATCH 505/529] =?UTF-8?q?=F0=9F=94=96=20v1.18.2=20(#1070)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 HISTORY.md   | 2 +-
 package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 401ffbd5..9aacf124 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,4 +1,4 @@
-unpublished
+1.18.2 / 2025-07-17
 ==========
   * deps: mocha@10.8.2
   * deps: on-headers@~1.1.0
diff --git a/package.json b/package.json
index f03896af..7039d1d4 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.18.1",
+  "version": "1.18.2",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 1aa756d20a1af2b922e9897ca0010fa466ce17e7 Mon Sep 17 00:00:00 2001
From: Sebastian Beltran <bjohansebas@gmail.com>
Date: Wed, 23 Jul 2025 07:42:19 -0500
Subject: [PATCH 506/529] chore: add funding to package.json (#1071)

---
 package.json | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/package.json b/package.json
index 7039d1d4..3bc6ac59 100644
--- a/package.json
+++ b/package.json
@@ -8,6 +8,10 @@
     "Joe Wagner <njwjs722@gmail.com>"
   ],
   "repository": "expressjs/session",
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
+  },
   "license": "MIT",
   "dependencies": {
     "cookie": "0.7.2",

From 488102d3d79ee394c90e0b051bf0dbe137956400 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 2 Nov 2025 09:29:37 +0100
Subject: [PATCH 507/529] build(deps): bump actions/download-artifact from
 4.3.0 to 6.0.0 (#1086)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 210657e2..167e2e38 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -229,7 +229,7 @@ jobs:
       run: sudo apt-get -y install lcov
 
     - name: Collect coverage reports
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
       with:
         path: ./coverage
 

From b6f79be32f4afd88b92eda9a3448b7136cecac1e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 2 Nov 2025 09:30:20 +0100
Subject: [PATCH 508/529] build(deps): bump github/codeql-action from 3.28.18
 to 4.31.2 (#1085)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/codeql.yml    | 4 ++--
 .github/workflows/scorecard.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1a41f87b..bdff87f4 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
         with:
           languages: javascript
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,6 +61,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
         with:
           category: "/language:javascript"
\ No newline at end of file
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index d53e5871..a6a29448 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -68,6 +68,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
         with:
           sarif_file: results.sarif
\ No newline at end of file

From c83c8e28d586c3f86f9844356590b2e704843f57 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 2 Dec 2025 09:15:55 +0100
Subject: [PATCH 509/529] build(deps): bump coverallsapp/github-action from
 2.3.6 to 2.3.7 (#1091)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 167e2e38..f7078328 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -238,6 +238,6 @@ jobs:
       run: find ./coverage -name lcov.info -exec printf '-a %q\n' {} \; | xargs lcov -o ./coverage/lcov.info
 
     - name: Upload coverage report
-      uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # master
+      uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # master
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}

From a095a9a17c862746af8c2d8671825e4743d38169 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 2 Dec 2025 09:16:45 +0100
Subject: [PATCH 510/529] build(deps): bump actions/upload-artifact from 4.6.2
 to 5.0.0 (#1090)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml        | 2 +-
 .github/workflows/scorecard.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f7078328..30a606f2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -208,7 +208,7 @@ jobs:
         fi
 
     - name: Upload code coverage
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
       if: steps.list_env.outputs.nyc != ''
       with:
         name: coverage-${{ matrix.node-version }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index a6a29448..a6efdc9e 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,7 +60,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: SARIF file
           path: results.sarif

From 0e7a438512fa584c617d681cf7fca8fb5c42da5d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 2 Dec 2025 09:17:30 +0100
Subject: [PATCH 511/529] build(deps): bump github/codeql-action from 4.31.2 to
 4.31.6 (#1089)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/codeql.yml    | 4 ++--
 .github/workflows/scorecard.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index bdff87f4..31ffb64a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+        uses: github/codeql-action/init@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
         with:
           languages: javascript
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,6 +61,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+        uses: github/codeql-action/analyze@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
         with:
           category: "/language:javascript"
\ No newline at end of file
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index a6efdc9e..51230d44 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -68,6 +68,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+        uses: github/codeql-action/upload-sarif@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
         with:
           sarif_file: results.sarif
\ No newline at end of file

From 1307f30a62d10cf33f7abd59b8ecf3aae428ff3b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 2 Dec 2025 09:18:56 +0100
Subject: [PATCH 512/529] build(deps): bump actions/checkout from 4.2.2 to
 6.0.0 (#1088)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml        | 4 ++--
 .github/workflows/codeql.yml    | 2 +-
 .github/workflows/scorecard.yml | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 30a606f2..13336155 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -130,7 +130,7 @@ jobs:
           node-version: "21.6"
 
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
     - name: Install Node.js ${{ matrix.node-version }}
       shell: bash -eo pipefail -l {0}
@@ -222,7 +222,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
     - name: Install lcov
       shell: bash
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 31ffb64a..8534ee51 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 51230d44..30f54d2b 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
 

From 2cd6561f64cb9e0b847237885802351606d4029d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 17 Dec 2025 16:04:48 -0500
Subject: [PATCH 513/529] build(deps): bump ossf/scorecard-action from 2.4.1 to
 2.4.3 (#1082)

Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.1 to 2.4.3.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](https://github.com/ossf/scorecard-action/compare/f49aabe0b5af0936a0987cfb85d86b75731b0186...4eaacf0543bb3f2c246792bd56e8cdeffafb205a)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 30f54d2b..169262af 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -38,7 +38,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif

From 00b8a5ff111bba1a0ca9bb3d84947446c198a9a3 Mon Sep 17 00:00:00 2001
From: Ayoub Mabrouk <77799760+Ayoub-Mabrouk@users.noreply.github.com>
Date: Thu, 18 Dec 2025 02:53:00 +0100
Subject: [PATCH 514/529] refactor: remove unused `sess` parameter from
 `generateSessionId` function (#1001)

The `sess` parameter was not used in `generateSessionId`, so it was removed to improve code clarity and reduce potential confusion.

Co-authored-by: Sebastian Beltran <bjohansebas@gmail.com>
---
 index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/index.js b/index.js
index d41b2378..85a0330c 100644
--- a/index.js
+++ b/index.js
@@ -523,7 +523,7 @@ function session(options) {
  * @private
  */
 
-function generateSessionId(sess) {
+function generateSessionId() {
   return uid(24);
 }
 

From 6d69f090d6239394e008cf39a2be2d5f60bdde97 Mon Sep 17 00:00:00 2001
From: Sebastian Beltran <bjohansebas@gmail.com>
Date: Thu, 18 Dec 2025 06:45:22 -0500
Subject: [PATCH 515/529] chore: remove history.md from being packaged on
 publish (#1097)

---
 package.json | 1 -
 1 file changed, 1 deletion(-)

diff --git a/package.json b/package.json
index 3bc6ac59..6d04c9c1 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,6 @@
   },
   "files": [
     "session/",
-    "HISTORY.md",
     "index.js"
   ],
   "engines": {

From 264b6a0360a1d4b34955c27948bf1b1cfad74d66 Mon Sep 17 00:00:00 2001
From: Sebastian Beltran <bjohansebas@gmail.com>
Date: Thu, 18 Dec 2025 06:46:00 -0500
Subject: [PATCH 516/529] deps: use tilde notation for dependencies (#1096)

---
 HISTORY.md   | 6 ++++++
 package.json | 8 ++++----
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 9aacf124..e12d0a00 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+# Unreleased changes
+
+### 🚀 Improvements
+
+* deps: use tilde notation for dependencies
+
 1.18.2 / 2025-07-17
 ==========
   * deps: mocha@10.8.2
diff --git a/package.json b/package.json
index 6d04c9c1..42d244b9 100644
--- a/package.json
+++ b/package.json
@@ -14,13 +14,13 @@
   },
   "license": "MIT",
   "dependencies": {
-    "cookie": "0.7.2",
-    "cookie-signature": "1.0.7",
-    "debug": "2.6.9",
+    "cookie": "~0.7.2",
+    "cookie-signature": "~1.0.7",
+    "debug": "~2.6.9",
     "depd": "~2.0.0",
     "on-headers": "~1.1.0",
     "parseurl": "~1.3.3",
-    "safe-buffer": "5.2.1",
+    "safe-buffer": "~5.2.1",
     "uid-safe": "~2.1.5"
   },
   "devDependencies": {

From 73e0193afbee24bca8744e4fc8a67b92810301e8 Mon Sep 17 00:00:00 2001
From: Zacchaeus Bolaji <djunehor@gmail.com>
Date: Sat, 17 Jan 2026 23:20:37 +0100
Subject: [PATCH 517/529] Add sameSite 'auto' support to match secure 'auto'
 pattern (#1087)

* feat: add sameSite 'auto' support for automatic cross-site cookie configuration

* test: enhance session tests for secure and SameSite cookie attributes

* test: update session tests for SameSite cookie handling and logging

* docs: add history entry

* refactor: cache issecure result to avoid duplicate calls

* Apply suggestion from @bjohansebas

---------

Co-authored-by: Sebastian Beltran <bjohansebas@gmail.com>
---
 HISTORY.md      |   4 ++
 README.md       |   9 +++
 index.js        |   8 ++-
 package.json    |   2 +-
 test/session.js | 167 ++++++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 188 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index e12d0a00..60cf6db4 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -2,6 +2,10 @@
 
 ### 🚀 Improvements
 
+* Add sameSite 'auto' support for automatic SameSite attribute configuration
+
+    Added `sameSite: 'auto'` option for cookie configuration that automatically sets `SameSite=None` for HTTPS and `SameSite=Lax` for HTTP connections, simplifying cookie handling across different environments.
+
 * deps: use tilde notation for dependencies
 
 1.18.2 / 2025-07-17
diff --git a/README.md b/README.md
index b880e6b4..4f19ce59 100644
--- a/README.md
+++ b/README.md
@@ -130,6 +130,7 @@ By default, this is `false`.
   - `'lax'` will set the `SameSite` attribute to `Lax` for lax same site enforcement.
   - `'none'` will set the `SameSite` attribute to `None` for an explicit cross-site cookie.
   - `'strict'` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
+  - `'auto'` will set the `SameSite` attribute to `None` for secure connections and `Lax` for non-secure connections.
 
 More information about the different enforcement levels can be found in
 [the specification][rfc-6265bis-03-4.1.2.7].
@@ -141,6 +142,14 @@ the future. This also means many clients may ignore this attribute until they un
 that requires that the `Secure` attribute be set to `true` when the `SameSite` attribute has been
 set to `'none'`. Some web browsers or other clients may be adopting this specification.
 
+The `cookie.sameSite` option can also be set to the special value `'auto'` to have
+this setting automatically match the determined security of the connection. When the connection
+is secure (HTTPS), the `SameSite` attribute will be set to `None` to enable cross-site usage.
+When the connection is not secure (HTTP), the `SameSite` attribute will be set to `Lax` for
+better security while maintaining functionality. This is useful when the Express `"trust proxy"`
+setting is properly setup to simplify development vs production configuration, particularly
+for SAML authentication scenarios.
+
 ##### cookie.secure
 
 Specifies the `boolean` value for the `Secure` `Set-Cookie` attribute. When truthy,
diff --git a/index.js b/index.js
index 85a0330c..1ee99eb5 100644
--- a/index.js
+++ b/index.js
@@ -160,8 +160,14 @@ function session(options) {
     req.session = new Session(req);
     req.session.cookie = new Cookie(cookieOptions);
 
+    var isSecure = issecure(req, trustProxy);
+
     if (cookieOptions.secure === 'auto') {
-      req.session.cookie.secure = issecure(req, trustProxy);
+      req.session.cookie.secure = isSecure;
+    }
+
+    if (cookieOptions.sameSite === 'auto') {
+      req.session.cookie.sameSite = isSecure ? 'none' : 'lax';
     }
   };
 
diff --git a/package.json b/package.json
index 42d244b9..0f7d92e7 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,7 @@
   },
   "scripts": {
     "lint": "eslint . && node ./scripts/lint-readme.js",
-    "test": "./test/support/gencert.sh && mocha --require test/support/env --check-leaks --bail --no-exit --reporter spec test/",
+    "test": "./test/support/gencert.sh && mocha --require test/support/env --check-leaks --no-exit --reporter spec test/",
     "test-ci": "nyc --reporter=lcov --reporter=text npm test",
     "test-cov": "nyc npm test",
     "version": "node scripts/version-history.js && git add HISTORY.md"
diff --git a/test/session.js b/test/session.js
index a7d79b70..31f4707b 100644
--- a/test/session.js
+++ b/test/session.js
@@ -801,6 +801,173 @@ describe('session()', function(){
         })
       })
     })
+
+    describe('when "sameSite" set to "auto"', function () {
+      describe('basic functionality', function () {
+        before(function () {
+          function setup (req) {
+            req.secure = JSON.parse(req.headers['x-secure'])
+          }
+
+          function respond (req, res) {
+            res.end(String(req.secure))
+          }
+
+          this.server = createServer(setup, { cookie: { sameSite: 'auto' } }, respond)
+        })
+
+        it('should set SameSite=None for secure connections', function (done) {
+          request(this.server)
+          .get('/')
+          .set('X-Secure', 'true')
+          .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None'))
+          .expect(200, 'true', done)
+        })
+
+        it('should set SameSite=Lax for insecure connections', function (done) {
+          request(this.server)
+          .get('/')
+          .set('X-Secure', 'false')
+          .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax'))
+          .expect(200, 'false', done)
+        })
+      })
+
+      describe('with proxy settings', function () {
+        describe('when "proxy" is "true"', function () {
+          before(function () {
+            this.server = createServer({ proxy: true, cookie: { sameSite: 'auto' }})
+          })
+
+          it('should set SameSite=None when X-Forwarded-Proto is https', function (done) {
+            request(this.server)
+            .get('/')
+            .set('X-Forwarded-Proto', 'https')
+            .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None'))
+            .expect(200, done)
+          })
+
+          it('should set SameSite=Lax when X-Forwarded-Proto is http', function (done) {
+            request(this.server)
+            .get('/')
+            .set('X-Forwarded-Proto', 'http')
+            .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax'))
+            .expect(200, done)
+          })
+        })
+
+        describe('when "proxy" is "false"', function () {
+          before(function () {
+            this.server = createServer({ proxy: false, cookie: { sameSite: 'auto' }})
+          })
+
+          it('should set SameSite=Lax when X-Forwarded-Proto is https', function (done) {
+            request(this.server)
+            .get('/')
+            .set('X-Forwarded-Proto', 'https')
+            .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax'))
+            .expect(200, done)
+          })
+        })
+      })
+
+      describe('combined with secure auto', function() {
+        describe('when "secure" is "auto"', function () {
+          before(function () {
+            function setup (req) {
+              req.secure = JSON.parse(req.headers['x-secure'])
+            }
+
+            function respond (req, res) {
+              res.end(String(req.secure))
+            }
+
+            this.server = createServer(setup, { cookie: { secure: 'auto', sameSite: 'auto' } }, respond)
+          })
+
+          it('should set both Secure and SameSite=None when secure', function (done) {
+            request(this.server)
+              .get('/')
+              .set('X-Secure', 'true')
+              .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
+              .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None'))
+              .expect(200, 'true', done)
+          })
+
+          it('should set neither Secure nor SameSite=None when insecure', function (done) {
+            request(this.server)
+              .get('/')
+              .set('X-Secure', 'false')
+              .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+              .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax'))
+              .expect(200, 'false', done)
+          })
+        })
+
+        describe('when "secure" is "false"', function () {
+          before(function () {
+            function setup (req) {
+              req.secure = JSON.parse(req.headers['x-secure'])
+            }
+
+            function respond (req, res) {
+              res.end(String(req.secure))
+            }
+
+            this.server = createServer(setup, { cookie: { secure: false, sameSite: 'auto' } }, respond)
+          })
+
+          it('should set SameSite=None without Secure when secure', function (done) {
+            request(this.server)
+              .get('/')
+              .set('X-Secure', 'true')
+              .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+              .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None'))
+              .expect(200, 'true', done)
+          })
+
+          it('should set SameSite=Lax without Secure when insecure', function (done) {
+            request(this.server)
+              .get('/')
+              .set('X-Secure', 'false')
+              .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+              .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'Lax'))
+              .expect(200, 'false', done)
+          })
+        })
+
+        describe('when "secure" is "true"', function () {
+          before(function () {
+            function setup (req) {
+              req.secure = JSON.parse(req.headers['x-secure'])
+            }
+
+            function respond (req, res) {
+              res.end(String(req.secure))
+            }
+
+            this.server = createServer(setup, { cookie: { secure: true, sameSite: 'auto' } }, respond)
+          })
+
+          it('should set both Secure and SameSite=None when secure', function (done) {
+            request(this.server)
+              .get('/')
+              .set('X-Secure', 'true')
+              .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
+              .expect(shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None'))
+              .expect(200, 'true', done)
+          })
+
+          it('should not set cookie when insecure', function (done) {
+            request(this.server)
+              .get('/')
+              .set('X-Secure', 'false')
+              .expect(shouldNotHaveHeader('Set-Cookie'))
+              .expect(200, 'false', done)
+          })
+        })
+      })
+    })
   })
 
   describe('genid option', function(){

From 2673736548304359d3d3fb8f8d3019b4ea5b61a7 Mon Sep 17 00:00:00 2001
From: Lincon <lincond@protonmail.com>
Date: Mon, 19 Jan 2026 11:44:13 -0300
Subject: [PATCH 518/529] feat: add support to dynamic cookie options (#1027)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Sebastian Beltran <bjohansebas@gmail.com>
Co-authored-by: Ulises Gascón <ulisesgascongonzalez@gmail.com>
---
 HISTORY.md      | 21 ++++++++++++++++++++
 README.md       | 20 +++++++++++++++++++
 index.js        |  7 ++++---
 test/session.js | 52 +++++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 97 insertions(+), 3 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 60cf6db4..e28c5427 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -2,6 +2,27 @@
 
 ### 🚀 Improvements
 
+* Add dynamic cookie options support
+
+    Cookie options can now be dynamic, allowing for more flexible and context-aware configuration based on each request.  This feature enables programmatic modification of cookie attributes like `secure`, `httpOnly`, `sameSite`, `maxAge`, `domain`, and `path` based on session or request conditions.
+
+    ```js
+    var app = express()
+    app.use(session({
+      secret: 'keyboard cat',
+      resave: false,
+      saveUninitialized: true,
+      cookie: function (req) {
+        var match = req.url.match(/^\/([^/]+)/);
+        return {
+          path: match ? '/' + match[1] : '/',
+          httpOnly: true,
+          secure: req.secure || false,
+          maxAge: 60000
+        }
+      }
+    }))
+    ```
 * Add sameSite 'auto' support for automatic SameSite attribute configuration
 
     Added `sameSite: 'auto'` option for cookie configuration that automatically sets `SameSite=None` for HTTPS and `SameSite=Lax` for HTTP connections, simplifying cookie handling across different environments.
diff --git a/README.md b/README.md
index 4f19ce59..292b2024 100644
--- a/README.md
+++ b/README.md
@@ -49,6 +49,26 @@ For a list of stores, see [compatible session stores](#compatible-session-stores
 Settings object for the session ID cookie. The default value is
 `{ path: '/', httpOnly: true, secure: false, maxAge: null }`.
 
+In addition to providing a static object, you can also pass a callback function to dynamically generate the cookie options for each request. The callback receives the `req` object as its argument and should return an object containing the cookie settings.
+
+```js
+var app = express()
+app.use(session({
+  secret: 'keyboard cat',
+  resave: false,
+  saveUninitialized: true,
+  cookie: function(req) {
+    var match = req.url.match(/^\/([^/]+)/);
+    return {
+      path: match ? '/' + match[1] : '/',
+      httpOnly: true,
+      secure: req.secure || false,
+      maxAge: 60000
+    }
+  }
+}))
+```
+
 The following are options that can be set in this object.
 
 ##### cookie.domain
diff --git a/index.js b/index.js
index 1ee99eb5..1a509318 100644
--- a/index.js
+++ b/index.js
@@ -70,7 +70,7 @@ var defer = typeof setImmediate === 'function'
  * Setup session store with the given `options`.
  *
  * @param {Object} [options]
- * @param {Object} [options.cookie] Options for cookie
+ * @param {Object|Function} [options.cookie] Options for cookie
  * @param {Function} [options.genid]
  * @param {String} [options.name=connect.sid] Session ID cookie name
  * @param {Boolean} [options.proxy]
@@ -158,7 +158,7 @@ function session(options) {
   store.generate = function(req){
     req.sessionID = generateId(req);
     req.session = new Session(req);
-    req.session.cookie = new Cookie(cookieOptions);
+    req.session.cookie = new Cookie(typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions);
 
     var isSecure = issecure(req, trustProxy);
 
@@ -199,7 +199,8 @@ function session(options) {
 
     // pathname mismatch
     var originalPath = parseUrl.original(req).pathname || '/'
-    if (originalPath.indexOf(cookieOptions.path || '/') !== 0) {
+    var resolvedCookieOptions = typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions
+    if (originalPath.indexOf(resolvedCookieOptions.path || '/') !== 0) {
       debug('pathname mismatch')
       next()
       return
diff --git a/test/session.js b/test/session.js
index 31f4707b..46fed763 100644
--- a/test/session.js
+++ b/test/session.js
@@ -802,6 +802,58 @@ describe('session()', function(){
       })
     })
 
+    describe('when "cookie" is a function', function () {
+      it('should call custom function and apply cookie options', function (done) {
+        var cookieCallbackCalled = false;
+        var cookieCallback = function () {
+          cookieCallbackCalled = true;
+          return { path: '/test', httpOnly: true, secure: false };
+        };
+        var server = createServer({ cookie: cookieCallback });
+        request(server)
+          .get('/test')
+          .expect(
+            shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', '/test')
+          )
+          .expect(shouldSetCookieWithAttribute('connect.sid', 'HttpOnly'))
+          .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+          .expect(200, function (err) {
+            if (err) return done(err);
+            assert.strictEqual(
+              cookieCallbackCalled,
+              true,
+              'should have called cookie callback'
+            );
+            done();
+          });
+      });
+
+      it('should provide req argument', function (done) {
+        var _path = '/test';
+        var cookieCallbackCalled = false;
+        var cookieCallback = function (req) {
+          cookieCallbackCalled = true;
+          return { path: req.url, httpOnly: true, secure: false };
+        };
+        var server = createServer({ cookie: cookieCallback });
+        request(server)
+          .get(_path)
+          .expect(
+            shouldSetCookieWithAttributeAndValue('connect.sid', 'Path', _path)
+          )
+          .expect(shouldSetCookieWithAttribute('connect.sid', 'HttpOnly'))
+          .expect(shouldSetCookieWithoutAttribute('connect.sid', 'Secure'))
+          .expect(200, function (err) {
+            if (err) return done(err);
+            assert.strictEqual(
+              cookieCallbackCalled,
+              true,
+              'should have called cookie callback'
+            );
+            done();
+          });
+      });
+    });
     describe('when "sameSite" set to "auto"', function () {
       describe('basic functionality', function () {
         before(function () {

From c10b2a383841766899f6dcf53c8aff8c7fd3d2e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Thu, 22 Jan 2026 15:44:27 +0100
Subject: [PATCH 519/529] 1.19.0 (#1107)

---
 HISTORY.md   | 36 ++++++------------------------------
 package.json |  2 +-
 2 files changed, 7 insertions(+), 31 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index e28c5427..fae1a0f1 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,33 +1,9 @@
-# Unreleased changes
-
-### 🚀 Improvements
-
-* Add dynamic cookie options support
-
-    Cookie options can now be dynamic, allowing for more flexible and context-aware configuration based on each request.  This feature enables programmatic modification of cookie attributes like `secure`, `httpOnly`, `sameSite`, `maxAge`, `domain`, and `path` based on session or request conditions.
-
-    ```js
-    var app = express()
-    app.use(session({
-      secret: 'keyboard cat',
-      resave: false,
-      saveUninitialized: true,
-      cookie: function (req) {
-        var match = req.url.match(/^\/([^/]+)/);
-        return {
-          path: match ? '/' + match[1] : '/',
-          httpOnly: true,
-          secure: req.secure || false,
-          maxAge: 60000
-        }
-      }
-    }))
-    ```
-* Add sameSite 'auto' support for automatic SameSite attribute configuration
-
-    Added `sameSite: 'auto'` option for cookie configuration that automatically sets `SameSite=None` for HTTPS and `SameSite=Lax` for HTTP connections, simplifying cookie handling across different environments.
-
-* deps: use tilde notation for dependencies
+1.19.0 / 2026-01-22
+==========
+
+  * Add dynamic cookie options support
+  * Add sameSite 'auto' support for automatic SameSite attribute configuration
+  * deps: use tilde notation for dependencies
 
 1.18.2 / 2025-07-17
 ==========
diff --git a/package.json b/package.json
index 0f7d92e7..36387796 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-session",
-  "version": "1.18.2",
+  "version": "1.19.0",
   "description": "Simple session middleware for Express",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [

From 31bb90351eceb003e4fb40d01c6c0ca1c1ba2f6f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 2 Mar 2026 08:42:03 +0100
Subject: [PATCH 520/529] build(deps): bump github/codeql-action from 4.31.6 to
 4.32.4 (#1111)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.6 to 4.32.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/fe4161a26a8629af62121b670040955b330f9af2...89a39a4e59826350b863aa6b6252a07ad50cf83e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/codeql.yml    | 4 ++--
 .github/workflows/scorecard.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8534ee51..e4fbd605 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
+        uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
         with:
           languages: javascript
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,6 +61,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
+        uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
         with:
           category: "/language:javascript"
\ No newline at end of file
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 169262af..a1566ba6 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -68,6 +68,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
+        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
         with:
           sarif_file: results.sarif
\ No newline at end of file

From 1d90a1a61921ae600fc127b3bc0ce6de03890cc5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 2 Mar 2026 08:42:39 +0100
Subject: [PATCH 521/529] build(deps): bump actions/upload-artifact from 5.0.0
 to 7.0.0 (#1112)

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/330a01c490aca151604b8cf639adc76d48f6c5d4...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml        | 2 +-
 .github/workflows/scorecard.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 13336155..152d687d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -208,7 +208,7 @@ jobs:
         fi
 
     - name: Upload code coverage
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
       if: steps.list_env.outputs.nyc != ''
       with:
         name: coverage-${{ matrix.node-version }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index a1566ba6..e6ba6369 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -60,7 +60,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: SARIF file
           path: results.sarif

From 625c136fe52189ed3cc6e7ad4eb45b1cf11540b1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 2 Mar 2026 08:43:16 +0100
Subject: [PATCH 522/529] build(deps): bump actions/download-artifact from
 6.0.0 to 8.0.0 (#1113)

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6.0.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/018cc2cf5baa6db3ef3c5f8a56943fffe632ef53...70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 152d687d..9dee4344 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -229,7 +229,7 @@ jobs:
       run: sudo apt-get -y install lcov
 
     - name: Collect coverage reports
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
       with:
         path: ./coverage
 

From 663359c771f6b13b9b3bd60ee7d56062d98c63bd Mon Sep 17 00:00:00 2001
From: Ignacio Mangas <ignaciomangas@gmail.com>
Date: Mon, 16 Mar 2026 12:23:53 +0100
Subject: [PATCH 523/529] chore: fix node to v25 (#1110)

---
 .github/workflows/ci.yml | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9dee4344..29b55239 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,6 +37,10 @@ jobs:
         - Node.js 19.x
         - Node.js 20.x
         - Node.js 21.x
+        - Node.js 22.x
+        - Node.js 23.x
+        - Node.js 24.x
+        - Node.js 25.x
 
         include:
         - name: Node.js 0.8
@@ -124,10 +128,22 @@ jobs:
           node-version: "19.9"
 
         - name: Node.js 20.x
-          node-version: "20.11"
+          node-version: "20"
 
         - name: Node.js 21.x
-          node-version: "21.6"
+          node-version: "21"
+        
+        - name: Node.js 22.x
+          node-version: "22"
+
+        - name: Node.js 23.x
+          node-version: "23"
+
+        - name: Node.js 24.x
+          node-version: "24"
+
+        - name: Node.js 25.x
+          node-version: "25"
 
     steps:
     - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
@@ -139,7 +155,12 @@ jobs:
         if [[ "${{ matrix.node-version }}" == 0.* && "$(cut -d. -f2 <<< "${{ matrix.node-version }}")" -lt 10 ]]; then
           nvm install --alias=npm 0.10
           nvm use ${{ matrix.node-version }}
-          sed -i '1s;^.*$;'"$(printf '#!%q' "$(nvm which npm)")"';' "$(readlink -f "$(which npm)")"
+          if [[ "$(npm -v)" == 1.1.* ]]; then
+            nvm exec npm npm install -g npm@1.1
+            ln -fs "$(which npm)" "$(dirname "$(nvm which npm)")/npm"
+          else
+            sed -i '1s;^.*$;'"$(printf '#!%q' "$(nvm which npm)")"';' "$(readlink -f "$(which npm)")"
+          fi
           npm config set strict-ssl false
         fi
         dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH"

From 2c9512fb790e4bf80b3b62305eb8078028607785 Mon Sep 17 00:00:00 2001
From: krzysdz <12915102+krzysdz@users.noreply.github.com>
Date: Sun, 14 Jun 2026 19:11:21 +0000
Subject: [PATCH 524/529] Remove nonexistent projects and update link in readme
 (#1122)

- sequelize has a new website and a slightly broken redirect to the new one
- cyclic has shut down
- dynamodb-store-v3 package does not exist

https://github.com/sequelize/website/issues/839
https://github.com/cyclic-software/www/blob/31e26692f2f04e29917fe011b9bfd7a03fbd7e81/content/posts/cyclic-is-shutting-down.md
https://web.archive.org/web/20240501064115/https://www.cyclic.sh/posts/cyclic-is-shutting-down/
---
 README.md | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/README.md b/README.md
index 292b2024..0a7edb04 100644
--- a/README.md
+++ b/README.md
@@ -733,7 +733,7 @@ and other multi-core embedded devices).
 [connect-session-knex-image]: https://badgen.net/github/stars/llambda/connect-session-knex?label=%E2%98%85
 
 [![★][connect-session-sequelize-image] connect-session-sequelize][connect-session-sequelize-url] A session store using
-[Sequelize.js](http://sequelizejs.com/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL.
+[Sequelize.js](https://sequelize.org/), which is a Node.js / io.js ORM for PostgreSQL, MySQL, SQLite and MSSQL.
 
 [connect-session-sequelize-url]: https://www.npmjs.com/package/connect-session-sequelize
 [connect-session-sequelize-image]: https://badgen.net/github/stars/mweibel/connect-session-sequelize?label=%E2%98%85
@@ -758,11 +758,6 @@ and other multi-core embedded devices).
 [dynamodb-store-url]: https://www.npmjs.com/package/dynamodb-store
 [dynamodb-store-image]: https://badgen.net/github/stars/rafaelrpinto/dynamodb-store?label=%E2%98%85
 
-[![★][dynamodb-store-v3-image] dynamodb-store-v3][dynamodb-store-v3-url] Implementation of a session store using DynamoDB backed by the [AWS SDK for JavaScript v3](https://github.com/aws/aws-sdk-js-v3).
-
-[dynamodb-store-v3-url]: https://www.npmjs.com/package/dynamodb-store-v3
-[dynamodb-store-v3-image]: https://badgen.net/github/stars/FryDay/dynamodb-store-v3?label=%E2%98%85
-
 [![★][express-etcd-image] express-etcd][express-etcd-url] An [etcd](https://github.com/stianeikeland/node-etcd) based session store.
 
 [express-etcd-url]: https://www.npmjs.com/package/express-etcd
@@ -868,7 +863,7 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [restsession-url]: https://www.npmjs.com/package/restsession
 [restsession-image]: https://badgen.net/github/stars/jankal/restsession?label=%E2%98%85
 
-[![★][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](http://sequelizejs.com/).
+[![★][sequelstore-connect-image] sequelstore-connect][sequelstore-connect-url] A session store using [Sequelize.js](https://sequelize.org/).
 
 [sequelstore-connect-url]: https://www.npmjs.com/package/sequelstore-connect
 [sequelstore-connect-image]: https://badgen.net/github/stars/MattMcFarland/sequelstore-connect?label=%E2%98%85
@@ -883,11 +878,6 @@ based session store. Supports all backends supported by Fortune (MongoDB, Redis,
 [session-pouchdb-store-url]: https://www.npmjs.com/package/session-pouchdb-store
 [session-pouchdb-store-image]: https://badgen.net/github/stars/solzimer/session-pouchdb-store?label=%E2%98%85
 
-[![★][@cyclic.sh/session-store-image] @cyclic.sh/session-store][@cyclic.sh/session-store-url] A DynamoDB-based session store for [Cyclic.sh](https://www.cyclic.sh/) apps.
-
-[@cyclic.sh/session-store-url]: https://www.npmjs.com/package/@cyclic.sh/session-store
-[@cyclic.sh/session-store-image]: https://badgen.net/github/stars/cyclic-software/session-store?label=%E2%98%85
-
 [![★][@databunker/session-store-image] @databunker/session-store][@databunker/session-store-url] A [Databunker](https://databunker.org/)-based encrypted session store.
 
 [@databunker/session-store-url]: https://www.npmjs.com/package/@databunker/session-store

From e6509b12dea0c2911352725af99874d574c8d66c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= <ulisesgascongonzalez@gmail.com>
Date: Mon, 6 Jul 2026 04:07:01 +0200
Subject: [PATCH 525/529] fix: use RFC 6265 path matching for cookie path
 option (#1114)

* test: add specific RFC 6265 5.1.4 compliance tests

* feat: add specific RFC 6265 5.1.4 handler

* docs: note RFC 6265 5.1.4 compliance in cookie.path documentation

* feat: enhance cookie handling for RFC 6265 compliance with path matching and auto secure/sameSite options

* feat: enforce RFC 6265 section 5.1.4 path matching for session cookie path

---------

Co-authored-by: Sebastian Beltran <bjohansebas@gmail.com>
---
 HISTORY.md      |   6 ++
 README.md       |   7 +++
 index.js        |  48 ++++++++++++++--
 test/session.js | 143 ++++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 200 insertions(+), 4 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index fae1a0f1..251d5fa7 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,9 @@
+unreleased
+==========
+
+  * Enforce RFC 6265 section 5.1.4 path matching for the session cookie path
+  * Fix `secure: 'auto'` and `sameSite: 'auto'` not being resolved when `cookie` is a function
+
 1.19.0 / 2026-01-22
 ==========
 
diff --git a/README.md b/README.md
index 0a7edb04..162ea14d 100644
--- a/README.md
+++ b/README.md
@@ -126,6 +126,12 @@ More information about can be found in [the proposal](https://github.com/privacy
 Specifies the value for the `Path` `Set-Cookie`. By default, this is set to `'/'`, which
 is the root path of the domain.
 
+Since 1.19.1, path matching follows [RFC 6265 section 5.1.4][rfc-6265-5.1.4]. This means
+the session middleware will only activate when the request path is an exact match or falls
+under a segment boundary of the cookie path. For example, a cookie path of `/admin` will
+match `/admin` and `/admin/users` but will **not** match `/administrator`. Prior versions
+used a simple prefix check that did not enforce segment boundaries.
+
 ##### cookie.priority
 
 Specifies the `string` to be the value for the [`Priority` `Set-Cookie` attribute][rfc-west-cookie-priority-00-4.1].
@@ -1038,6 +1044,7 @@ On Windows, use the corresponding command;
 
 [MIT](LICENSE)
 
+[rfc-6265-5.1.4]: https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.4
 [rfc-6265bis-03-4.1.2.7]: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.2.7
 [rfc-cutler-httpbis-partitioned-cookies]: https://tools.ietf.org/html/draft-cutler-httpbis-partitioned-cookies/
 [rfc-west-cookie-priority-00-4.1]: https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1
diff --git a/index.js b/index.js
index 1a509318..41f9447f 100644
--- a/index.js
+++ b/index.js
@@ -158,15 +158,16 @@ function session(options) {
   store.generate = function(req){
     req.sessionID = generateId(req);
     req.session = new Session(req);
-    req.session.cookie = new Cookie(typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions);
+    var resolvedCookieOptions = typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions;
+    req.session.cookie = new Cookie(resolvedCookieOptions);
 
     var isSecure = issecure(req, trustProxy);
 
-    if (cookieOptions.secure === 'auto') {
+    if (resolvedCookieOptions.secure === 'auto') {
       req.session.cookie.secure = isSecure;
     }
 
-    if (cookieOptions.sameSite === 'auto') {
+    if (resolvedCookieOptions.sameSite === 'auto') {
       req.session.cookie.sameSite = isSecure ? 'none' : 'lax';
     }
   };
@@ -200,12 +201,15 @@ function session(options) {
     // pathname mismatch
     var originalPath = parseUrl.original(req).pathname || '/'
     var resolvedCookieOptions = typeof cookieOptions === 'function' ? cookieOptions(req) : cookieOptions
-    if (originalPath.indexOf(resolvedCookieOptions.path || '/') !== 0) {
+    var cfgPath = resolvedCookieOptions.path || '/'
+
+    if (!rfcPathMatch(originalPath, cfgPath)) {
       debug('pathname mismatch')
       next()
       return
     }
 
+
     // ensure a secret is available or bail
     if (!secret && !req.secret) {
       next(new Error('secret option required for sessions'));
@@ -523,6 +527,42 @@ function session(options) {
   };
 };
 
+/**
+ * Check if the cookiePath matches the requestPath following the
+ * rules in RFC 6265 section 5.1.4.
+ *
+ * @param {String} requestPath
+ * @param {String} cookiePath
+ * @return {Boolean}
+ * @private
+ */
+
+function rfcPathMatch(requestPath, cookiePath) {
+  // Normalize inputs (Node 0.8-safe)
+  requestPath = (typeof requestPath === 'string' && requestPath.length) ? requestPath : '/';
+  cookiePath  = (typeof cookiePath  === 'string' && cookiePath.length)  ? cookiePath  : '/';
+
+  // Root cookie matches everything
+  if (cookiePath === '/') return true;
+
+  // Exact match
+  if (requestPath === cookiePath) return true;
+
+  // Prefix match
+  if (requestPath.indexOf(cookiePath) === 0) {
+    // If cookiePath ends with '/', any longer requestPath is OK
+    if (cookiePath.charAt(cookiePath.length - 1) === '/') return true;
+
+    // Otherwise the next char after the prefix must be '/'
+    var nextChar = requestPath.length > cookiePath.length
+      ? requestPath.charAt(cookiePath.length)
+      : '';
+    return nextChar === '/';
+  }
+
+  return false;
+}
+
 /**
  * Generate a session ID for a new session.
  *
diff --git a/test/session.js b/test/session.js
index 46fed763..330c4137 100644
--- a/test/session.js
+++ b/test/session.js
@@ -853,6 +853,40 @@ describe('session()', function(){
             done();
           });
       });
+
+      it('should not set cookie when request-path does not match returned path', function (done) {
+        var cookieCallback = function () {
+          return { path: '/admin', httpOnly: true, secure: false };
+        };
+        var server = createServer({ cookie: cookieCallback });
+        request(server)
+          .get('/administrator')
+          .expect(shouldNotHaveHeader('Set-Cookie'))
+          .expect(200, done);
+      });
+
+      it('should resolve "secure" and "sameSite" set to "auto"', function (done) {
+        function setup (req) {
+          req.secure = JSON.parse(req.headers['x-secure'])
+        }
+
+        function respond (req, res) {
+          res.end(String(req.secure))
+        }
+
+        var cookieCallback = function () {
+          return { path: '/', secure: 'auto', sameSite: 'auto' };
+        };
+        var server = createServer(setup, { cookie: cookieCallback }, respond);
+        request(server)
+          .get('/')
+          .set('X-Secure', 'true')
+          .expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
+          .expect(
+            shouldSetCookieWithAttributeAndValue('connect.sid', 'SameSite', 'None')
+          )
+          .expect(200, 'true', done);
+      });
     });
     describe('when "sameSite" set to "auto"', function () {
       describe('basic functionality', function () {
@@ -2620,6 +2654,115 @@ describe('session()', function(){
   })
 })
 
+describe('path matching (RFC 6265)', function () {
+  describe('when "path" is "/" (root path)', function () {
+    before(function () {
+      this.server = createServer({ cookie: { path: '/' } })
+    })
+
+    it('should set cookie when request-path is "/" (root path)', function (done) {
+      // RFC 6265 5.1.4: "The cookie-path and the request-path are identical."
+      request(this.server)
+        .get('/')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, done)
+    })
+
+    it('should set cookie when request-path is any path ("/foo")', function (done) {
+      // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the last
+      // character of the cookie-path is %x2F ("/")."
+      request(this.server)
+        .get('/foo')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, done)
+    })
+
+    it('should set cookie when request-path has multiple segments ("/foo/bar/baz")', function (done) {
+      // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the last
+      // character of the cookie-path is %x2F ("/")."
+      request(this.server)
+        .get('/foo/bar/baz')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, done)
+    })
+  })
+
+  describe('when "path" is "/admin"', function () {
+    before(function () {
+      this.server = createServer({ cookie: { path: '/admin' } })
+    })
+
+    it('should set cookie when request-path and cookie-path are identical ("/admin")', function (done) {
+      // RFC 6265 5.1.4: "The cookie-path and the request-path are identical."
+      request(this.server)
+        .get('/admin')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, done)
+    })
+
+    it('should set cookie when cookie-path is prefix and last char is "/" ("/admin/")', function (done) {
+      // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the last
+      // character of the cookie-path is %x2F ("/")."
+      request(this.server)
+        .get('/admin/')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, done)
+    })
+
+    it('should set cookie when cookie-path is prefix and next char is "/" ("/admin/users")', function (done) {
+      // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the first
+      // character of the request-path that is not included in the cookie-path is a %x2F ("/") character."
+      request(this.server)
+        .get('/admin/users')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, done)
+    })
+
+    it('should NOT set cookie when cookie-path is not a prefix ("/administrator")', function (done) {
+      // RFC 6265 5.1.4: None of the path-match conditions are met
+      request(this.server)
+        .get('/administrator')
+        .expect(shouldNotHaveHeader('Set-Cookie'))
+        .expect(200, done)
+    })
+  })
+
+  describe('when "path" is "/admin/" (trailing slash)', function () {
+    before(function () {
+      this.server = createServer({ cookie: { path: '/admin/' } })
+    })
+
+    it('should set cookie when cookie-path is prefix and last char is "/" ("/admin/x")', function (done) {
+      // RFC 6265 5.1.4: "The cookie-path is a prefix of the request-path, and the last
+      // character of the cookie-path is %x2F ("/")."
+      request(this.server)
+        .get('/admin/x')
+        .expect(shouldSetCookie('connect.sid'))
+        .expect(200, done)
+    })
+
+    it('should NOT set cookie when request-path is not prefixed by cookie-path ("/admin")', function (done) {
+      // RFC 6265 5.1.4: cookie-path "/admin/" is not a prefix of request-path "/admin"
+      request(this.server)
+        .get('/admin')
+        .expect(shouldNotHaveHeader('Set-Cookie'))
+        .expect(200, done)
+    })
+
+    it('should NOT set cookie when cookie-path is not a prefix ("/administrator")', function (done) {
+      // RFC 6265 5.1.4: None of the path-match conditions are met:
+      // 1. The paths are not identical
+      // 2. "/admin/" is not a prefix of "/administrator"
+      // 3. The prefix condition with next character "/" is not applicable
+      request(this.server)
+        .get('/administrator')
+        .expect(shouldNotHaveHeader('Set-Cookie'))
+        .expect(200, done)
+    })
+  })
+})
+
+
 function cookie(res) {
   var setCookie = res.headers['set-cookie'];
   return (setCookie && setCookie[0]) || undefined;

From 953bfe2ea1878fe79b5494335c0f1c5e332224c2 Mon Sep 17 00:00:00 2001
From: Raashish Aggarwal <94279692+raashish1601@users.noreply.github.com>
Date: Mon, 6 Jul 2026 07:54:05 +0530
Subject: [PATCH 526/529] fix: detect secure socket when connection is missing
 (#1124)

* fix: detect secure socket when connection is missing

* fix: improve secure socket detection logic in session handling

---------

Co-authored-by: Sebastian Beltran <bjohansebas@gmail.com>
---
 index.js        |  3 ++-
 test/session.js | 27 +++++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/index.js b/index.js
index 41f9447f..eb15ea64 100644
--- a/index.js
+++ b/index.js
@@ -677,7 +677,8 @@ function hash(sess) {
 
 function issecure(req, trustProxy) {
   // socket is https server
-  if (req.connection && req.connection.encrypted) {
+  var socket = req.socket || req.connection;
+  if (socket && socket.encrypted) {
     return true;
   }
 
diff --git a/test/session.js b/test/session.js
index 330c4137..abf846f5 100644
--- a/test/session.js
+++ b/test/session.js
@@ -800,6 +800,31 @@ describe('session()', function(){
           .expect(200, 'false', done)
         })
       })
+
+      describe('when request socket is encrypted', function () {
+        it('should set secure over TLS', function (done) {
+          var cert = fs.readFileSync(__dirname + '/fixtures/server.crt', 'ascii')
+          var server = https.createServer({
+            key: fs.readFileSync(__dirname + '/fixtures/server.key', 'ascii'),
+            cert: cert
+          })
+
+          server.on('request', createRequestListener({ secret: 'keyboard cat', cookie: { secure: 'auto' } }))
+
+          var agent = new https.Agent({ ca: cert })
+          var createConnection = agent.createConnection
+
+          agent.createConnection = function (options) {
+            options.servername = 'express-session.local'
+            return createConnection.call(this, options)
+          }
+
+          var req = request(server).get('/')
+          req.agent(agent)
+          req.expect(shouldSetCookieWithAttribute('connect.sid', 'Secure'))
+          req.expect(200, done)
+        })
+      })
     })
 
     describe('when "cookie" is a function', function () {
@@ -888,6 +913,8 @@ describe('session()', function(){
           .expect(200, 'true', done);
       });
     });
+
+
     describe('when "sameSite" set to "auto"', function () {
       describe('basic functionality', function () {
         before(function () {

From 2deb78e42a8dff6c6d8ffcf3f196dfc4ed0f02da Mon Sep 17 00:00:00 2001
From: Ayoub Mabrouk <77799760+Ayoub-Mabrouk@users.noreply.github.com>
Date: Mon, 6 Jul 2026 03:30:48 +0100
Subject: [PATCH 527/529] refactor: replace deprecated substr() with slice()
 (#1099)

Replace all instances of String.prototype.substr() with String.prototype.slice()
to use the standard, non-deprecated method. This maintains compatibility with
Node.js >= 0.8.0 while following modern JavaScript best practices.

All replacements maintain identical functionality as slice() and substr() behave
the same for these use cases.

Co-authored-by: bjohansebas <103585995+bjohansebas@users.noreply.github.com>
---
 index.js        | 6 +++---
 test/session.js | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/index.js b/index.js
index eb15ea64..3e23e901 100644
--- a/index.js
+++ b/index.js
@@ -593,7 +593,7 @@ function getcookie(req, name, secrets) {
     raw = cookies[name];
 
     if (raw) {
-      if (raw.substr(0, 2) === 's:') {
+      if (raw.slice(0, 2) === 's:') {
         val = unsigncookie(raw.slice(2), secrets);
 
         if (val === false) {
@@ -620,7 +620,7 @@ function getcookie(req, name, secrets) {
     raw = req.cookies[name];
 
     if (raw) {
-      if (raw.substr(0, 2) === 's:') {
+      if (raw.slice(0, 2) === 's:') {
         val = unsigncookie(raw.slice(2), secrets);
 
         if (val) {
@@ -696,7 +696,7 @@ function issecure(req, trustProxy) {
   var header = req.headers['x-forwarded-proto'] || '';
   var index = header.indexOf(',');
   var proto = index !== -1
-    ? header.substr(0, index).toLowerCase().trim()
+    ? header.slice(0, index).toLowerCase().trim()
     : header.toLowerCase().trim()
 
   return proto === 'https';
diff --git a/test/session.js b/test/session.js
index abf846f5..405e3ddf 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1299,7 +1299,7 @@ describe('session()', function(){
         var store = new session.MemoryStore()
         var server = createServer({ resave: false, store: store }, function (req, res) {
           if (req.method === 'PUT') {
-            req.session.token = req.url.substr(1)
+            req.session.token = req.url.slice(1)
           }
           res.end('token=' + (req.session.token || ''))
         })

From 2799984fd07d4963fbc128f5f0d9d9f2f48829fe Mon Sep 17 00:00:00 2001
From: Sebastian Beltran <bjohansebas@gmail.com>
Date: Tue, 7 Jul 2026 11:15:48 -0500
Subject: [PATCH 528/529] chore: add groups for GitHub Actions and npm
 dependencies in dependabot (#1133)

---
 .github/dependabot.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 492d67d0..7d2c7033 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,10 @@ updates:
     directory: /
     schedule:
       interval: monthly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
 
   - package-ecosystem: npm
     directory: /
@@ -12,3 +16,7 @@ updates:
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
+    groups:
+      npm-dependencies:
+        patterns:
+          - "*"

From d209c1f4cd645e514cd7320afd15acf7e7b5fcb6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:23:53 -0500
Subject: [PATCH 529/529] build(deps): bump the github-actions group with 6
 updates (#1140)

Bumps the github-actions group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.0` | `7.0.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.0` | `8.0.1` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.32.4` | `4.36.3` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.32.4` | `4.36.3` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.32.4` | `4.36.3` |


Updates `actions/checkout` from 6.0.0 to 7.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

Updates `actions/download-artifact` from 8.0.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c)

Updates `github/codeql-action/init` from 4.32.4 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/89a39a4e59826350b863aa6b6252a07ad50cf83e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a)

Updates `github/codeql-action/analyze` from 4.32.4 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/89a39a4e59826350b863aa6b6252a07ad50cf83e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a)

Updates `github/codeql-action/upload-sarif` from 4.32.4 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/89a39a4e59826350b863aa6b6252a07ad50cf83e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml        | 8 ++++----
 .github/workflows/codeql.yml    | 6 +++---
 .github/workflows/scorecard.yml | 6 +++---
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 29b55239..004c35ed 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -146,7 +146,7 @@ jobs:
           node-version: "25"
 
     steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     - name: Install Node.js ${{ matrix.node-version }}
       shell: bash -eo pipefail -l {0}
@@ -229,7 +229,7 @@ jobs:
         fi
 
     - name: Upload code coverage
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: steps.list_env.outputs.nyc != ''
       with:
         name: coverage-${{ matrix.node-version }}
@@ -243,14 +243,14 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     - name: Install lcov
       shell: bash
       run: sudo apt-get -y install lcov
 
     - name: Collect coverage reports
-      uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         path: ./coverage
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e4fbd605..139ec706 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,11 +34,11 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
         with:
           languages: javascript
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,6 +61,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
         with:
           category: "/language:javascript"
\ No newline at end of file
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index e6ba6369..2bb15b23 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -60,7 +60,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: SARIF file
           path: results.sarif
@@ -68,6 +68,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
         with:
           sarif_file: results.sarif
\ No newline at end of file