expressjs/express

By the numbers

A quantitative snapshot of the expressjs/express repository. Data collected on 2026-04-30 from master at commit 6340c1ea.

Size

xychart-beta horizontal
    title "Lines of code by file (lib/)"
    x-axis [response.js, application.js, request.js, utils.js, view.js, express.js]
    y-axis "Lines" 0 --> 1100
    bar [1047, 631, 527, 271, 205, 81]

File	Lines
`lib/response.js`	1,047
`lib/application.js`	631
`lib/request.js`	527
`lib/utils.js`	271
`lib/view.js`	205
`lib/express.js`	81
Total core (`lib/`)	2,762

Metric	Value
Source files in `lib/`	6
Test files (`.js` under `test/`)	91
Total `.js` files (excluding `node_modules`)	~150 (lib + test + examples)
Total JS LOC	~21,300
Test-to-source ratio	Tests dwarf core source ~6.7×
Runtime dependencies	28
Dev dependencies	14
Examples bundled	26
GitHub workflows	4 (`ci.yml`, `codeql.yml`, `legacy.yml`, `scorecard.yml`)

Activity

Metric	Value
Total commits in history	6,139
First commit	2009-06-26
Latest commit	2026-04-23
Commits in the last 6 months	53
Unique commit author emails (all-time)	385

Recent monthly commit volume

xychart-beta
    title "Commits per month, last 12 months"
    x-axis ["2025-05","2025-06","2025-07","2025-08","2025-09","2025-10","2025-11","2025-12","2026-01","2026-02","2026-03","2026-04"]
    y-axis "Commits" 0 --> 20
    bar [10, 5, 7, 6, 2, 6, 9, 9, 14, 11, 5, 4]

The current rhythm is roughly 5–15 commits/month, dominated by dependency bumps, small bug fixes, and triage-driven cleanup. Activity sits well below the 2014–2018 peak when v4 was actively developed.

Top-touched files in `lib/`

lib/response.js and lib/application.js are the largest and most frequently changed files in the core. The router and body parser have been extracted into separate repositories, so most user-facing changes now land in those files (helpers like res.send, res.json, res.cookie, res.sendFile).

Bot-attributed commits

Of the all-time commit history, 41 commits (~0.7%) carry an obvious bot attribution — predominantly dependabot[bot] (currently 39 commits with author email 49699333+dependabot[bot]@users.noreply.github.com) plus a handful of github-actions and other automation. This is a lower bound; AI-assisted commits without explicit Co-authored-by markers are not counted.

In recent months, the dependabot share is much higher: roughly half of the last 50 commits are dependency bumps in package.json or in workflow action versions.

Complexity

Subsystem	Largest file	Lines	Notes
Response API	`lib/response.js`	1,047	Most user-facing surface; many helpers (`send`, `json`, `cookie`, `sendFile`, `redirect`, `format`, ...)
App + settings	`lib/application.js`	631	Init, mount, settings, view rendering, listen
Request API	`lib/request.js`	527	Helpers + getters (`accepts*`, `is`, `ip`, `host`, `query`, `fresh`)
Utils	`lib/utils.js`	271	ETag, query parser, trust proxy, content-type helpers
View	`lib/view.js`	205	Filesystem lookup + engine dispatch
Factory	`lib/express.js`	81	Smallest file; wires the rest together

The largest individual test file is test/express.urlencoded.js at ~26,700 bytes (now thin given the body-parser extraction); the test directory total is ~570 KB. The biggest churn target is lib/response.js, mirroring the fact that response helpers are where most user-visible behaviour lives.

External dependencies dominate apparent complexity. The 28 runtime dependencies include the routing, body parsing, and file-sending packages that used to live inside this repo before being extracted.