serve-static 1.14.1

Serve static files

serve-static@1.14.1 was published on 2019-05-11. Its manifest declares 4 runtime dependencies and 0 peer requirements. Bundled type declarations are not declared in the inspected metadata. The declared Node.js requirement is >= 0.8.0.

All serve-static versions · Permanent reference to 1.14.1 · Latest release

Package specifications

Version	1.14.1
License declaration	MIT
Published	2019-05-11T03:40:40.466Z
Node.js requirement	>= 0.8.0
Type declarations	Not declared
Runtime dependency count	4
Peer requirement count	0
Optional dependency count	0
Minified size	Measurement not available yet
Minified + gzip	Measurement not available yet
Unpacked distribution size	24.31 KiB
Published file count	5
Package type	Not declared
ES module entry	Not declared
Default entry	Not declared
Side effects declaration	Not declared
Direct advisories	1
Resolved graph dependencies	20
Repository stars	1421
Repository forks	240

Install serve-static 1.14.1

npm install serve-static@1.14.1
pnpm add serve-static@1.14.1
yarn add serve-static@1.14.1

Runtime dependencies

send 0.17.1
parseurl ~1.3.3
encodeurl ~1.0.2
escape-html ~1.0.3

Peer requirements

None declared

Optional dependencies

None declared

Resolved dependency graph

This deps.dev graph describes a generic 64-bit Linux environment, not your application lockfile.

debug@2.6.9 — indirect
depd@1.1.2 — indirect
destroy@1.0.4 — indirect
ee-first@1.1.1 — indirect
encodeurl@1.0.2 — direct
escape-html@1.0.3 — direct
etag@1.8.1 — indirect
fresh@0.5.2 — indirect
http-errors@1.7.3 — indirect
inherits@2.0.4 — indirect
mime@1.6.0 — indirect
ms@2.0.0 — indirect
ms@2.1.1 — indirect
on-finished@2.3.0 — indirect
parseurl@1.3.3 — direct
range-parser@1.2.1 — indirect
send@0.17.1 — direct
setprototypeof@1.1.1 — indirect
statuses@1.5.0 — indirect
toidentifier@1.0.0 — indirect

How to interpret the specifications

Bundlephobia measurements use its standard package build and may exclude peer dependencies. Unpacked npm distribution size includes shipped files and is a different measurement. Module declarations do not prove tree-shaking or runtime compatibility.

Advisories apply to this package version directly; transitive dependencies need separate inspection. Repository signals describe the whole repository and are current observations, including on historical-version pages.

Known direct advisories

GHSA-cm22-4g7w-348p

OpenSSF repository checks

Provider assessment: 2026-08-24T00:00:00Z. These are repository checks, not a jsL maintenance score.

Maintained	0/10 — 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Binary-Artifacts	10/10 — no binaries found in the repo
Code-Review	10/10 — all changesets reviewed
Dangerous-Workflow	10/10 — no dangerous workflow patterns detected
Pinned-Dependencies	6/10 — dependency not pinned by hash detected -- score normalized to 6
Token-Permissions	10/10 — GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	0/10 — no effort to earn an OpenSSF best practices badge detected
Fuzzing	0/10 — project is not fuzzed
License	10/10 — license file detected
Security-Policy	10/10 — security policy file detected
Branch-Protection	0/10 — branch protection not enabled on development/release branches
SAST	8/10 — SAST tool detected but not run on all commits

Evidence and freshness

https://registry.npmjs.org/serve-static/1.14.1 — retrieved 2026-10-29T08:53:46.921Z
https://api.deps.dev/v3/projects/github.com%2Fexpressjs%2Fserve-static — retrieved 2026-10-29T06:00:24.807Z
https://api.deps.dev/v3/systems/npm/packages/serve-static/versions/1.14.1 — retrieved 2026-10-29T08:53:47.468Z
https://api.deps.dev/v3/systems/npm/packages/serve-static/versions/1.14.1:dependencies — retrieved 2026-10-29T08:53:47.497Z