Eexpressjs

expressjs/static-dotfiles

Migrates express.static() options to Express 5 - adds an explicit dotfiles option and renames the removed hidden and from options

transformationmigrationexpressstaticdotfilesexpress.static
Public
8 executions
Use dashboard
Apply to Repository

Run locally

npx codemod @expressjs/static-dotfiles

Migrate express.static options

Express 5 changes several express.static options:

  • The dotfiles option now defaults to "ignore" (Express 4 served dotfiles by default). Files inside a directory that starts with a dot (.), such as .well-known, will no longer be accessible and will return a 404 Not Found error.
  • The hidden option is removed and replaced by dotfiles.
  • The from option (an undocumented alias for root) is removed and replaced by root.

This codemod updates express.static() calls to preserve the Express 4 behavior:

  1. Adds an explicit dotfiles: 'allow' option to calls that don't already specify a dotfiles (or hidden) option.
  2. Renames hidden to dotfiles (hidden: true → dotfiles: 'allow', hidden: false → dotfiles: 'ignore').
  3. Renames from to root.

Example

diff

With existing options

diff

Removed hidden option

diff

Removed from option

diff

Security Consideration

After running this codemod, review each express.static() call to determine if serving dotfiles is actually necessary for your application. If you don't need to serve dotfiles, you can:

  1. Remove the dotfiles: 'allow' option to use the new Express 5 default ("ignore")
  2. Or explicitly set dotfiles: 'deny' to return a 403 Forbidden for dotfile requests

For directories like .well-known that need to be served (e.g., for Android App Links or Apple Universal Links), consider serving them explicitly:

javascript

References

Ready to contribute?

Build your own codemod and share it with the community.

Publish a codemodJoin the community