Express graduation to impact project

[UlisesGascon]

Ref: https://github.com/openjs-foundation/project-status/issues/15#issuecomment-2410399877

As discussed today in the CPC meeting, the idea is to work on this in the following weeks and evaluate the process to follow and requirements.

[ctcpip]

today in the CPC working session, we went through the Impact stage acceptance criteria and are ready to present for consideration by the CPC at the next meeting:

• Document that it is being used successfully in production by at least two independent end users which, in the CPC’s judgement, are of adequate quality and scope.
  • Express is widely deployed in production and CPC working session folks agree this is adequate justification for this item.
  • 34,419,879 weekly downloads on npm as of 2024-10-22
  • 1,353,331 IPs using the HTTP header x-powered-by: Express based on Shodan engine this does not include applications using middleware like Helmet or custom http header rules.
  • Independent analysis
  • The full Express / pillarjs / jshttp ecosystem is around 52B downloads per year (data from 2023-2024).
• Have a defined governing body of at least 5 or more members (owners and core maintainers), of which no more than 1/3 is affiliated with the same employer. In the case there are 5 governing members, 2 may be from the same employer.
  • TC:
  • Blake Embrey
  • Chris de Almeida (IBM)
  • Jean Burellier (Sanofi)
  • Jon Church (Microsoft)
  • Linus Unnebäck
  • Rand McKinney (Adobe)
  • Ulises Gascón (NodeSource)
  • Wes Todd (Netflix)
• Have a documented and publicly accessible description of the project's governance, decision-making, contribution, and release processes. This is preferably laid out in a GOVERNANCE.md file and references a CONTRIBUTING.md and AUTHORS.md file showing the current and emeritus committers.
  • https://github.com/expressjs/express/blob/master/Charter.md
  • https://github.com/expressjs/express/blob/master/Collaborator-Guide.md
  • https://github.com/expressjs/express/blob/master/Contributing.md
  • https://github.com/expressjs/express/graphs/contributors
• Demonstrate a substantial ongoing flow of commits and merged contributions.
  • https://github.com/expressjs/express/commits/master/
  • https://github.com/expressjs/express/pulse/monthly
  • LFX Insights: Express, jshttp and pillarjs
• Have a healthy number of committers from at least two organizations. A committer is defined as someone with the commit bit; i.e., someone who can accept contributions to some or all of the project.
  • Github Contributors: https://github.com/expressjs/express/graphs/contributors?from=10%2F21%2F2023
• Adopt the Foundation Code of Conduct.
  • ✅ https://github.com/expressjs/express/blob/master/Code-Of-Conduct.md
• Accept security reports and publicly disclose them after the fix has been made available.
  • ✅ https://github.com/expressjs/express/security/advisories?state=published
  • ✅ https://expressjs.com/2024/09/29/security-releases.html
• Have a public list of project adopters for at least the primary repo (e.g., ADOPTERS.md or logos on the project website).
  • as discussed in CPC working session, this seems out of place, and we created a PR to remove this criterion
• Other metrics as defined by the applying Project during the application process in cooperation with the CPC.
  • https://github.com/expressjs/discussions/issues/160
• Receive a supermajority vote from the CPC to move to Impact stage. Projects can move directly from At Large to Impact, if they can demonstrate sufficient maturity and have met all requirements.
  • 🙏

[tobie]

This is really sweet. Well done, folks!