Dependencies

Express's dependency tree is the framework's most important architectural decision. The runtime list is small and deliberate; the dev list is mostly the test suite plus a handful of example-only packages.

Runtime dependencies

From package.json (28 packages):

Package	Version	Role
accepts	^2.0.0	req.accepts* — Accept header negotiation.
body-parser	^2.2.1	Re-exported as express.json/urlencoded/text/raw.
content-disposition	^1.0.0	res.attachment, res.download — generates Content-Disposition headers.
content-type	^1.0.5	setCharset in lib/utils.js.
cookie	^0.7.1	res.cookie — serialises cookie strings.
cookie-signature	^1.2.1	Signs values when signed: true in res.cookie.
debug	^4.4.0	Diagnostic logging in lib/application.js, lib/view.js, etc.
depd	^2.0.0	Deprecation warnings in lib/response.js.
encodeurl	^2.0.0	URL encoding in res.location.
escape-html	^1.0.3	Escapes URLs and template strings in res.redirect.
etag	^1.8.1	Strong/weak ETag generators in lib/utils.js.
finalhandler	^2.1.0	Default 404 / error responder, used in app.handle.
fresh	^2.0.0	req.fresh and send's caching path.
http-errors	^2.0.0	res.format builds 406 errors via createError(406, ...).
merge-descriptors	^2.0.0	Mixes EventEmitter and application prototypes onto the callable app function.
mime-types	^3.0.0	res.type, res.contentType, setCharset, normalizeType.
on-finished	^2.4.1	res.sendFile's lifecycle hooks.
once	^1.4.0	Wraps the app.listen callback so it fires at most once.
parseurl	^1.3.3	req.path, req.query URL parsing.
proxy-addr	^2.0.7	req.ip, req.ips, and compileTrust in lib/utils.js.
qs	^6.14.2	Extended query string parsing in compileQueryParser.
range-parser	^1.2.1	req.range.
router	^2.2.0	The actual routing implementation. Re-exported as express.Router and express.Route.
send	^1.1.0	File streaming behind res.sendFile and serve-static.
serve-static	^2.2.0	Re-exported as express.static.
statuses	^2.0.1	Standard HTTP status messages used by res.sendStatus and res.redirect body.
type-is	^2.0.1	req.is content-type checks.
vary	^1.1.2	res.vary.

Dev dependencies

From package.json (14 packages, ~test and examples):

Package	Version	Role
after	0.8.2	Async assertion helper used by some tests.
connect-redis	^8.0.1	Used by examples/online for Redis-backed sessions.
cookie-parser	1.4.7	Parses inbound Cookie headers in tests/examples.
cookie-session	2.1.1	Session example backend.
ejs	^3.1.10	Template engine used in tests + examples/ejs.
eslint	8.47.0	Linter. Config in .eslintrc.yml.
express-session	^1.18.1	Server-side session example.
hbs	4.2.0	Handlebars adapter used in examples/error.
marked	^15.0.3	Markdown rendering in examples/markdown.
method-override	3.0.0	Used in route examples.
mocha	^10.7.3	Test runner.
morgan	1.10.1	HTTP logger in examples.
nyc	^17.1.0	Coverage harness for npm run test-ci and test-cov.
pbkdf2-password	1.2.1	Password hashing in examples/auth.
supertest	^6.3.0	HTTP assertion library used by tests.
vhost	~3.0.2	Virtual hosting middleware used in examples/vhost.

(package.json lists 14 dev deps strictly; supertest is included via ^6.3.0.)

What was removed

In Express 5.1.0 (Mar 2025), the following were dropped and replaced with native Node functionality:

• setprototypeof → Object.setPrototypeOf
• safe-buffer → node:buffer's Buffer
• utils-merge → object spread
• methods → node:http's METHODS
• depd → continued to be used in lib/response.js; later changes may move away from it as well

Earlier (Express 5.0.0, Sep 2024), path-is-absolute was replaced by path.isAbsolute from node:path.

Internal consumers

Consumer	Direct external imports
lib/express.js	body-parser, merge-descriptors, router, serve-static, node:events
lib/application.js	finalhandler, debug, once, router, node:http, node:path
lib/request.js	accepts, node:net, type-is, node:http, fresh, range-parser, parseurl, proxy-addr
lib/response.js	content-disposition, http-errors, depd, encodeurl, escape-html, node:http, on-finished, mime-types, node:path, statuses, cookie-signature, cookie, send, vary, node:buffer
lib/utils.js	node:http, content-type, etag, mime-types, proxy-addr, qs, node:querystring, node:buffer
lib/view.js	debug, node:path, node:fs

Related pages

• Architecture — the diagrammed dependency map.
• Lore — the timeline of dependency extractions and removals.