Same comment as here: expressjs/discussions#228 (comment)

I think we need more eyes on the funding field before we publish. Ideally a change like this would be reviewed by a few members of the TC before landing since it is often considered a sensitive issue.

Just release it. It is Oct 31st.

The funding field is only some metadata npm adds on the package-lock.json for people who install this version.

We plan to include a security patch too so this release is on hold now

@UlisesGascon

We plan to include a security patch too so this release is on hold now

Can you please disclose how serious (low, medium, high) it is? Does it impact a dependency or express code itself? Can it be sorted by npm overrides?

We are kind of aggressive with user input and never pass untrusted/unfiltered parameters to express functions.

I believe we are undecided if it is really a security issue after investigation. And even if we were we would not disclose information about it until we had a patch.