[UlisesGascon]

⚠️ Breaking changes

• The X-Powered-By: Express header is no longer sent and the x-powered-by setting is removed. app.enable('x-powered-by') and app.disable('x-powered-by') no longer have any effect; set the header in a middleware if you need it

  app.use((req, res, next) => {
    res.set('X-Powered-By', 'Express');
    next();
  });

[UlisesGascon]

If we agree on this one... not sure if we need a deprecation message on express@5 🤔

[bjohansebas]

-1 on this. Why remove it? Though I also wonder why we should keep it.

[Phillip9587]

helmet removes it and specifies the following reason (https://helmet.js.org/):

Helmet removes the X-Powered-By header, which is set by default in Express and some other frameworks. Removing the header offers very limited security benefits (see this discussion) and is mostly removed to save bandwidth, but may thwart simplistic attackers.

And links this express issue: #2813 (comment)