express

Dependency profilecaution

Twenty-eight runtime dependencies create a meaningful maintenance surface, but they are consistent with a mature web framework and the release notes show dependency security upgrades.

Type declarationscaution

No type declarations are bundled, which is a minor integration gap for TypeScript consumers; this does not indicate abandonment or poor release hygiene.

Workflow auditcaution

All 5 workflows were analyzed, use read-only permissions, and have no untrusted checkouts or script injection; all 23 action references are pinned. The audit also found high-severity, low-confidence cache-poisoning and high-confidence adhoc-packages findings in npm publishing, so workflow hygiene is not perfect.