connect 2.26.6

High performance middleware framework

connect@2.26.6 was published on 2014-10-16. Its manifest declares 29 runtime dependencies and 0 peer requirements. Bundled type declarations are not declared in the inspected metadata. The declared Node.js requirement is >= 0.8.0.

Deprecated: connect 2.x series is deprecated

All connect versions · Permanent reference to 2.26.6 · Latest release

Package specifications

Version	2.26.6
License declaration	MIT
Published	2014-10-16T03:14:54.917Z
Node.js requirement	>= 0.8.0
Type declarations	Not declared
Runtime dependency count	29
Peer requirement count	0
Optional dependency count	0
Minified size	Measurement not available yet
Minified + gzip	Measurement not available yet
Unpacked distribution size	Not supplied
Published file count	Not supplied
Package type	Not declared
ES module entry	Not declared
Default entry	index
Side effects declaration	Not declared
Direct advisories	0
Resolved graph dependencies	75
Repository stars	9871
Repository forks	1078

Install connect 2.26.6

npm install connect@2.26.6
pnpm add connect@2.26.6
yarn add connect@2.26.6

Runtime dependencies

basic-auth-connect 1.0.0
body-parser ~1.8.4
bytes 1.0.0
cookie 0.1.2
cookie-parser ~1.3.3
cookie-signature 1.0.5
compression ~1.1.2
connect-timeout ~1.3.0
csurf ~1.6.2
debug ~2.0.0
depd 0.4.5
errorhandler ~1.2.2
express-session ~1.8.2
finalhandler 0.2.0
fresh 0.2.4
media-typer 0.3.0
method-override ~2.2.0
morgan ~1.3.2
multiparty 3.3.2
on-headers ~1.0.0
parseurl ~1.3.0
qs 2.2.4
response-time ~2.0.1
serve-favicon ~2.1.5
serve-index ~1.2.1
serve-static ~1.6.4
type-is ~1.5.2
vhost ~3.0.0
pause 0.0.1

Peer requirements

None declared

Optional dependencies

None declared

Resolved dependency graph

This deps.dev graph describes a generic 64-bit Linux environment, not your application lockfile.

accepts@1.1.4 — indirect
any-promise@1.3.0 — indirect
base64-url@1.2.1 — indirect
basic-auth@1.0.0 — indirect
basic-auth-connect@1.0.0 — direct
batch@0.5.1 — indirect
body-parser@1.8.4 — direct
bytes@1.0.0 — direct
compressible@2.0.18 — indirect
compression@1.1.2 — direct
connect-timeout@1.3.0 — direct
cookie@0.1.2 — direct
cookie@0.1.3 — indirect
cookie-parser@1.3.5 — direct
cookie-signature@1.0.5 — direct
cookie-signature@1.0.6 — indirect
core-util-is@1.0.3 — indirect
crc@3.0.0 — indirect
crc@3.2.1 — indirect
csrf@2.0.7 — indirect
csurf@1.6.6 — direct
debug@2.0.0 — direct
depd@0.4.5 — direct
destroy@1.0.3 — indirect
ee-first@1.0.5 — indirect
errorhandler@1.2.4 — direct
escape-html@1.0.1 — indirect
etag@1.4.0 — indirect
etag@1.5.1 — indirect
express-session@1.8.2 — direct
finalhandler@0.2.0 — direct
fresh@0.2.4 — direct
http-errors@1.2.8 — indirect
iconv-lite@0.4.4 — indirect
inherits@2.0.4 — indirect
isarray@0.0.1 — indirect
media-typer@0.3.0 — direct
method-override@2.2.0 — direct
methods@1.1.0 — indirect
mime@1.2.11 — indirect
mime-db@1.12.0 — indirect
mime-db@1.54.0 — indirect
mime-types@2.0.14 — indirect
morgan@1.3.2 — direct
ms@0.6.2 — indirect
multiparty@3.3.2 — direct
mz@1.3.0 — indirect
native-or-bluebird@1.1.2 — indirect
negotiator@0.4.9 — indirect
on-finished@2.1.0 — indirect
on-headers@1.0.2 — direct
parseurl@1.3.3 — direct
pause@0.0.1 — direct
qs@2.2.4 — direct
range-parser@1.0.3 — indirect
raw-body@1.3.0 — indirect
readable-stream@1.1.14 — indirect
response-time@2.0.1 — direct
rndm@1.1.1 — indirect
scmp@1.0.0 — indirect
send@0.9.3 — indirect
serve-favicon@2.1.7 — direct
serve-index@1.2.1 — direct
serve-static@1.6.5 — direct
statuses@1.5.0 — indirect
stream-counter@0.2.0 — indirect
string_decoder@0.10.31 — indirect
thenify@3.3.1 — indirect
thenify-all@1.6.0 — indirect
type-is@1.5.7 — direct
uid-safe@1.0.1 — indirect
uid-safe@1.1.0 — indirect
utils-merge@1.0.0 — indirect
vary@1.0.1 — indirect
vhost@3.0.2 — direct

How to interpret the specifications

Bundlephobia measurements use its standard package build and may exclude peer dependencies. Unpacked npm distribution size includes shipped files and is a different measurement. Module declarations do not prove tree-shaking or runtime compatibility.

Advisories apply to this package version directly; transitive dependencies need separate inspection. Repository signals describe the whole repository and are current observations, including on historical-version pages.

OpenSSF repository checks

Provider assessment: 2026-08-24T00:00:00Z. These are repository checks, not a jsL maintenance score.

Code-Review	0/10 — Found 1/30 approved changesets -- score normalized to 0
Binary-Artifacts	10/10 — no binaries found in the repo
Maintained	0/10 — 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Security-Policy	10/10 — security policy file detected
Fuzzing	0/10 — project is not fuzzed
CII-Best-Practices	0/10 — no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	10/10 — no dangerous workflow patterns detected
Token-Permissions	0/10 — detected GitHub workflow tokens with excessive permissions
License	10/10 — license file detected
Branch-Protection	0/10 — branch protection not enabled on development/release branches
Pinned-Dependencies	0/10 — dependency not pinned by hash detected -- score normalized to 0
SAST	0/10 — SAST tool is not run on all commits -- score normalized to 0

Evidence and freshness

https://registry.npmjs.org/connect/2.26.6 — retrieved 2026-10-29T11:40:44.579Z
https://api.deps.dev/v3/projects/github.com%2Fsenchalabs%2Fconnect — retrieved 2026-10-29T07:15:39.066Z
https://api.deps.dev/v3/systems/npm/packages/connect/versions/2.26.6 — retrieved 2026-10-29T11:40:45.166Z
https://api.deps.dev/v3/systems/npm/packages/connect/versions/2.26.6:dependencies — retrieved 2026-10-29T11:40:45.231Z