feat: add express.static dotfiles codemod by singhvishalkr · Pull Request #142 · expressjs/codemod

singhvishalkr · 2026-05-16T07:00:02Z

In Express 5, the express.static middleware's dotfiles option defaults to "ignore" instead of serving them. This breaks functionality that depends on serving dot-directories like .well-known (used for Android App Links, Apple Universal Links, Let's Encrypt verification, etc.).

This PR adds a new codemod that explicitly sets dotfiles: 'allow' on express.static() calls that don't already specify a dotfiles option. A comment is included to flag the change for manual review.

The codemod:

Transforms express.static('public') to express.static('public', { dotfiles: 'allow' /* Express 5: preserve v4 behavior */ })
Preserves existing options when present
Skips calls that already have an explicit dotfiles setting

The README includes a security note encouraging developers to review each call and consider whether serving dotfiles is actually necessary.

Also added the new codemod to the v5-migration-recipe workflow.

Closes #116

Add a codemod that explicitly sets dotfiles: 'allow' on express.static() calls to preserve Express 4 behavior where dotfiles were served by default. In Express 5, the dotfiles option defaults to 'ignore', which can break functionality that depends on serving dot-directories like .well-known (used by Android App Links and Apple Universal Links). Closes expressjs#116

AugustinMauroy

good starting point

AugustinMauroy · 2026-05-25T08:00:47Z

need to bump minor version of this codemod 😁

I bumped the codemod package version to 1.1.0 in the follow-up commit.

AugustinMauroy · 2026-05-25T08:01:11Z

+
+This codemod adds an explicit `dotfiles: 'allow'` option to `express.static()` calls that don't already specify a `dotfiles` option, preserving the Express 4 behavior.
+
+## Example


IMO diff codeblock is easier to get what happened

AugustinMauroy · 2026-05-25T08:03:38Z

+        { pattern: 'express.static($PATH)' },
+        { pattern: 'express.static($PATH, $OPTS)' },


this ins't resolving import alias ...

before doing creazy thing wait @bjohansebas response.
Do you have any function to resolve express import in different cases

I don't think there's any existing function to resolve that. I think the Node Userland Migration project has something we could take inspiration from, right?

But we should identify Express imports, because it's not always express.static; people can import it under different names.

I added binding resolution for default, namespace, and CommonJS express imports before rewriting static() calls, and the multiline fixture is covered in tests.

AugustinMauroy · 2026-05-25T08:03:49Z

+
+  if (!nodes.length) return null
+
+  const edits: Edit[] = []


Suggested change

const edits: Edit[] = []

AugustinMauroy · 2026-05-25T08:03:55Z

+import type { Edit, SgRoot } from '@codemod.com/jssg-types/src/main'
+
+async function transform(root: SgRoot<Js>): Promise<string | null> {
+  const rootNode = root.root()


Suggested change

const rootNode = root.root()

const rootNode = root.root()

const edits: Edit[] = []

AugustinMauroy · 2026-05-25T08:04:53Z

+      if (optsText.includes('dotfiles')) {
+        continue
+      }
+
+      if (optsText.startsWith('{') && optsText.endsWith('}')) {
+        const inner = optsText.slice(1, -1).trim()
+        const newOpts = inner
+          ? `{ ${inner}, dotfiles: 'allow' /* Express 5: preserve v4 behavior */ }`
+          : `{ dotfiles: 'allow' /* Express 5: preserve v4 behavior */ }`
+        edits.push(call.replace(`express.static(${pathArg.text()}, ${newOpts})`))
+      }


this seem weak. add more test case with strange indentation + multi line

Detect default, namespace, and CommonJS express bindings before rewriting static() calls. Add a multiline fixture to cover indentation-sensitive options objects.

Match the reviewer request to bump the codemod minor version alongside the alias-handling fix.

singhvishalkr · 2026-05-25T17:12:08Z

Pushed 559f3d9. I now resolve default, namespace, and CommonJS bindings for express before rewriting static() calls, added a multiline fixture to cover indentation-sensitive options, and bumped the codemod version to 1.1.0.

bjohansebas · 2026-05-25T17:18:21Z

+  const defaultImportPattern = /import\s+([A-Za-z_$][\w$]*)(?:\s*,[\s\S]*?)?\s+from\s+['"]express['"]/g
+  const namespaceImportPattern = /import\s+\*\s+as\s+([A-Za-z_$][\w$]*)\s+from\s+['"]express['"]/g
+  const defaultAsImportPattern = /import\s+\{\s*default\s+as\s+([A-Za-z_$][\w$]*)[\s\S]*?\}\s+from\s+['"]express['"]/g
+  const requirePattern = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\s*\(\s*['"]express['"]\s*\)/g


Don't use regex.

Pushed a1a6b47. I replaced the alias scan with AST/definition-based resolution, removed the regex path, and added a regression for require(express).static(...) so the commonjs case stays covered.

Pushed a1a6b47. The alias lookup now uses AST/definition resolution only, the regex path is gone, and the commonjs case has a direct regression test.

bjohansebas requested a review from AugustinMauroy May 24, 2026 17:40

AugustinMauroy reviewed May 25, 2026

View reviewed changes

singhvishalkr added 2 commits May 25, 2026 22:40

feat(static-dotfiles): resolve express aliases

a51feb2

Detect default, namespace, and CommonJS express bindings before rewriting static() calls. Add a multiline fixture to cover indentation-sensitive options objects.

chore(static-dotfiles): bump codemod version to 1.1.0

559f3d9

Match the reviewer request to bump the codemod minor version alongside the alias-handling fix.

bjohansebas reviewed May 25, 2026

View reviewed changes

fix(static-dotfiles): resolve express aliases without regex

a1a6b47


		This codemod adds an explicit `dotfiles: 'allow'` option to `express.static()` calls that don't already specify a `dotfiles` option, preserving the Express 4 behavior.

		## Example

		{ pattern: 'express.static($PATH)' },
		{ pattern: 'express.static($PATH, $OPTS)' },

	const rootNode = root.root()
	const rootNode = root.root()
	const edits: Edit[] = []

Uh oh!

Conversation

singhvishalkr commented May 16, 2026

Uh oh!

AugustinMauroy left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

singhvishalkr commented May 25, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants