Any plans to support @types/express@5 (Express 5)?

[aleksandr-shevchenko-0]

Hey! We've run into a type compatibility issue with Express 5.

Description

csrf-csrf type declarations are incompatible with projects using @types/express@5. This is because @types/express-serve-static-core@5.0.2+ removed the deprecated param(name: string, defaultValue?: any): string method from the Request interface (see DefinitelyTyped#71024), making the Request types from Express 4 and Express 5 structurally incompatible.

All versions up to 4.0.3 have @types/express@^4.17.21 in devDependencies, so the bundled .d.cts / .d.ts declarations are built against Express 4 types.

Environment

• csrf-csrf: 4.0.3
• @types/express: 5.0.6
• @types/express-serve-static-core: 5.0.2+ (where param() was removed)
• express: 5.2.1
• TypeScript: 5.9.3

Errors

When consuming csrf-csrf in a project with @types/express@5:

error TS2345: Argument of type 'Request' (from @types/express@5)
is not assignable to parameter of type 'Request' (from @types/express@4).
  Property 'param' is missing in type 'Request' (@types/express-serve-static-core@5.0.7)
  but required in type 'Request' (@types/express-serve-static-core@4.17.43).

This affects doubleCsrfProtection, generateToken, and the getTokenFromRequest callback in config options.

Question

Are there any plans to update the type declarations to support @types/express@5 / Express 5? This is also related to #67.

[psibean]

This is my bad, I should have explicitly tested with express v5 prior to the csrf-csrf@4 release, and I should have at least made it compatible with both express v4 and v5.

It'd definitely be nice to make it framework agnostic (hono, fastify, express, tinyhttp, etc / whatever), but that gets a bit complicated as Node itself doesn't handle cookie parsing and they all do it differently. Manually parsing the cookie header, similar to how express-session parses it's cookie, would add some bloat I'd prefer to avoid, the alternative is another getCsrfTokenFromCookie config option, which would be a breaking change.

I wonder if this creates a need to have an express v4 and an express v5 testing project, both in TS, and have the github actions build and package the lib, have the testing projects depend on the relative file: package, and run tests and typechecks against both.

I'll see if there's a way to make a backwards compatible minor / patch release to support both express v4 and v5, and then try to move towards a more agnostic API in the next major version.

[psibean]

Hey @aleksandr-shevchenko-0 I'm trying to replicate this error but can't seem to.

In your error output it indicates you have @types/express@4 installed as well, e.g. this line:

is not assignable to parameter of type 'Request' (from @types/express@4).

For csrf-csrf the @types/express is on > v5.

Can you do a dependency graph check to see where the v4 is coming from? Is it possible you have another dependency that is still pulling in v4?

I do believe there may be some type issues existing, but I'm not sure the one you've reported here is one of them.