All four packages on this page are imported by exactly one file, lib/request.js, and each backs a small cluster of req members. They share a lineage: all are jshttp-organization packages extracted from Express core so that header parsing gets one canonical, RFC-tested implementation across the Node ecosystem.

var accepts = require('accepts');
var typeis = require('type-is');
var fresh = require('fresh');
var parseRange = require('range-parser');

accepts (^2.0.0) -- what does the client want?

Backs req.accepts, req.acceptsEncodings, req.acceptsCharsets, req.acceptsLanguages. The Express side is a one-line adapter per method; all q-value ordering, wildcard, and extension-to-MIME logic lives in the package:

req.accepts = function(){
  var accept = accepts(this);
  return accept.types.apply(accept, arguments);
};

Its most important indirect consumer is res.format, which calls req.accepts(keys) to pick a representation and 406s otherwise -- the mechanism shown working in examples/content-negotiation/index.js and exercised by test/acceptance/content-negotiation.js. Even res.redirect negotiates its body (text versus HTML) through this path.

type-is (^2.1.0) -- what did the client send?

The mirror image: matches the request's Content-Type against patterns. Backs req.is:

req.is = function is(types) {
  var arr = types;

  // support flattened arguments
  if (!Array.isArray(types)) {
    arr = new Array(arguments.length);
    for (var i = 0; i < arr.length; i++) {
      arr[i] = arguments[i];
    }
  }

  return typeis(this, arr);
};

req.is('json'), req.is('text/*'), and extension shorthand all resolve in the package. type-is is also how body-parser decides whether a given parser should touch a request at all, so the same matching semantics govern req.is and express.json({ type: ... }).

fresh (^2.0.0) -- can we answer 304?

Implements the RFC 7232 conditional-request check: compares If-None-Match/If-Modified-Since from the client against ETag/Last-Modified on the outgoing response. Express gates it by method and status before asking:

// GET, HEAD, or QUERY for weak freshness validation only
if ('GET' !== method && 'HEAD' !== method && 'QUERY' !== method) return false;

// 2xx or 304 as per rfc2616 14.26
if ((status >= 200 && status < 300) || 304 === status) {
  return fresh(this.headers, {
    'etag': res.get('ETag'),
    'last-modified': res.get('Last-Modified')
  })
}

(QUERY is the draft safe-method verb -- Express 5 already includes it.) req.fresh is read in one hot place: res.send, where a truthy result flips the response to 304 and drops the body. This is the feature that lets an Express API return "not modified" without any handler code mentioning caching. req.stale is defined as !this.fresh.

range-parser (^1.2.1) -- which bytes?

Backs req.range(size, options), which parses the Range header against a known resource length and returns ranges, -1 for unsatisfiable, or -2 for malformed -- the distinction a handler needs to choose between 206, 416, and ignoring the header:

req.range = function range(size, options) {
  var range = this.get('Range');
  if (!range) return;
  return parseRange(size, range, options);
};

For static files you never call this yourself -- send does its own range handling -- but handlers that stream from databases or object stores use req.range to honor partial requests with the same parser.

Related: proxy-addr and parseurl

Two more lib/request.js imports complete the request-side picture. proxy-addr (^2.0.7) resolves req.ip/req.ips by walking X-Forwarded-For exactly as far as the compiled trust proxy fn allows (its .compile is also what lib/utils.js uses to turn CIDR strings into trust functions). parseurl (^1.3.3) backs req.path and the raw querystring split in req.query; its value is memoization -- parsing the URL once per request no matter how many middleware ask.