My Express 5 + TypeScript 6 boilerplate after years of repeating the same setup
Every time I started a new Node.js API project I'd spend the first day wiring up the same stuff before writing a single line of actual business logic. So I built a boilerplate I'm happy with and open sourced it.
Here's what's in it and why:
No build step. The project runs TypeScript natively via Node's --env-file flag and type stripping. No tsc --build, no output directory. Your .ts files are run directly by Node — no compilation step in between.
Zod everywhere. Request bodies, query params, and env vars are all validated with Zod schemas. The same schemas auto-generate your OpenAPI docs (JSON + YAML), so your documentation is never out of sync with your actual API.
Security defaults out of the box. Helmet, CORS, and express-rate-limit are all wired up. Small config, big difference in production.
Linter + formatter. Dropped ESLint + Prettier in favour of oxlint and oxfmt — both written in Rust, significantly faster in CI and pre-commit hooks. No plugin juggling, no version conflicts between the linter and formatter configs.
Husky pre-commit hooks. Before every commit: unit tests run, staged files go through oxlint and oxfmt, npm audit checks for vulnerabilities, and TypeScript typechecks the whole project. Conventional Commits enforced on commit messages too. Annoying to set up from scratch, nice to just have.
What's under the hood:
- Express 5 + TypeScript 6
- Zod (validation + OpenAPI)
- Winston + Morgan (logging)
- Vitest + Supertest (unit + integration, with coverage)
- Helmet + CORS + express-rate-limit (security)
- Docker multi-stage build
- GitHub Actions CI
Repo: https://github.com/ToniR7/express-typescript-starter
If it saves you some setup time, a ⭐ helps others find it. Happy to answer questions or hear what you'd do differently.