Skip to content

Latest commit

 

History

History
2544 lines (2323 loc) · 385 KB

CHANGELOG_V16.md

File metadata and controls

2544 lines (2323 loc) · 385 KB
Raw

Node.js 16 ChangeLog

LTS 'Gallium' Current
16.14.0
16.13.2
16.13.1
16.13.0
 16.12.0
16.11.1
16.11.0
16.10.0
16.9.1
16.9.0
16.8.0
16.7.0
16.6.2
16.6.1
16.6.0
16.5.0
16.4.2
16.4.1
16.4.0
16.3.0
16.2.0
16.1.0
16.0.0

2022-02-08, Version 16.14.0 'Gallium' (LTS), @danielleadams

Notable changes

Importing JSON modules now requires experimental import assertions syntax

This release adds experimental support for the import assertions stage 3 proposal.

To keep Node.js ESM implementation as compatible as possible with the HTML spec, import assertions are now required to import JSON modules (still behind the --experimental-json-modules CLI flag):

import info from './package.json' assert { type: 'json' };

Or use dynamic import:

const info = await import('./package.json', { assert: { type: 'json' } });

Contributed by Antoine du Hamel and Geoffrey Booth #40250

Other notable changes

  • async_hooks:
    • (SEMVER-MINOR) expose async_wrap providers (Rafael Gonzaga) #40760
  • child_process:
    • (SEMVER-MINOR) add support for URL to cp.fork (Antoine du Hamel) #41225
  • doc:
    • add @Mesteery to collaborators (Mestery) #41543
    • add @bnb as a collaborator (Tierney Cyren) #41100
  • esm:
    • (SEMVER-MINOR) graduate capturerejections to supported (James M Snell) #41267
    • (SEMVER-MINOR) add EventEmitterAsyncResource to core (James M Snell) #41246
  • events:
    • (SEMVER-MINOR) propagate weak option for kNewListener (James M Snell) #40899
  • fs:
    • (SEMVER-MINOR) accept URL as argument for fs.rm and fs.rmSync (Antoine du Hamel) #41132
  • lib:
    • (SEMVER-MINOR) make AbortSignal cloneable/transferable (James M Snell) #41050
    • (SEMVER-MINOR) add AbortSignal.timeout (James M Snell) #40899
    • (SEMVER-MINOR) add reason to AbortSignal (James M Snell) #40807
    • (SEMVER-MINOR) add unsubscribe method to non-active DC channels (simon-id) #40433
    • (SEMVER-MINOR) add return value for DC channel.unsubscribe (simon-id) #40433
  • loader:
    • (SEMVER-MINOR) return package format from defaultResolve if known (Gabriel Bota) #40980
  • perf_hooks:
    • (SEMVER-MINOR) multiple fixes for Histogram (James M Snell) #41153
  • process:
    • (SEMVER-MINOR) add getActiveResourcesInfo() (Darshan Sen) #40813
  • src:
    • (SEMVER-MINOR) add x509.fingerprint512 to crypto module (3nprob) #39809
    • (SEMVER-MINOR) add flags for controlling process behavior (Cheng Zhao) #40339
  • stream:
    • (SEMVER-MINOR) add filter method to readable (Benjamin Gruenbaum) #41354
    • (SEMVER-MINOR) add isReadable helper (Robert Nagy) #41199
    • (SEMVER-MINOR) add map method to Readable (Benjamin Gruenbaum) #40815
    • deprecate thenable support (Antoine du Hamel) #40860
  • util:
    • (SEMVER-MINOR) pass through the inspect function to custom inspect functions (Ruben Bridgewater) #41019
    • (SEMVER-MINOR) add numericSeparator to util.inspect (Ruben Bridgewater) #41003
    • (SEMVER-MINOR) always visualize cause property in errors during inspection (Ruben Bridgewater) #41002
  • timers:
    • (SEMVER-MINOR) add experimental scheduler api (James M Snell) #40909
  • v8:
    • (SEMVER-MINOR) multi-tenant promise hook api (Stephen Belanger) #39283

Commits

  • [336010341f] - assert: prefer reference comparison over string comparison (Darshan Sen) #41015
  • [2d471e47a0] - assert: use stricter stack frame detection in .ifError() (Ruben Bridgewater) #41006
  • [f788a47b8b] - async_hooks: add missing initialization (Michael Dawson) #41288
  • [b688f201df] - async_hooks: fix AsyncLocalStorage in unhandledRejection cases (Bradley Farias) #41202
  • [6af3e34b6b] - Revert "async_hooks: merge resource_symbol with owner_symbol" (Darshan Sen) #40741
  • [85a02ec979] - async_hooks: eliminate require side effects (Stephen Belanger) #40782
  • [078a0c996f] - (SEMVER-MINOR) async_hooks: expose async_wrap providers (Rafael Gonzaga) #40760
  • [4a09904d05] - benchmark: simplify http benchmarker regular expression (Rich Trott) #38206
  • [bc48ed2834] - benchmark: fix benchmark/run.js handling of --set (Rich Trott) #41334
  • [e68bf84e31] - benchmark,test: use Object.hasOwn() where applicable (Rich Trott) #41229
  • [799cf57581] - buffer: fix Blob constructor on various TypedArrays (Irakli Gozalishvili) #40706
  • [5c1dc5f307] - build: fix npm version detection (Michaël Zasso) #41575
  • [3e4d977c28] - build: fix node build failures in WSL Ubuntu (MrJithil) #41476
  • [6ffb1e878c] - build: fix workflow access to git history (Rich Trott) #41472
  • [c49a651e67] - build: start build on z/OS (alexcfyung) #41273
  • [c65ac72b6c] - build: use list for mutable retval rather than tuple (Rich Trott) #41372
  • [ff48705372] - build: remove Python 2 workaround (Rich Trott) #41357
  • [c10fcb1f05] - build: improve readability of texts in workflows (Mestery) #40988
  • [93450e5e8e] - build: use '<(python)' instead of 'python' (Cheng Zhao) #41146
  • [0b411c436a] - build: fix comment-labeled workflow (Mestery) #41176
  • [7756e1c692] - build: use gh cli in workflows file (Mestery) #40985
  • [d3289b2506] - build: fix commit-queue-rebase functionality (Rich Trott) #41140
  • [860d552431] - build: skip documentation generation if no ICU (Rich Trott) #41091
  • [c8625d18ba] - build: re-enable V8 concurrent marking (Michaël Zasso) #41013
  • [74557c3ac1] - build: add --without-corepack (Jonah Snider) #41060
  • [f826c866e9] - build: fail early in test-macos.yml (Rich Trott) #41035
  • [535bb5fb6b] - build: add tools/doc to tools.yml updates (Rich Trott) #41036
  • [20c4c6aa72] - build: update Actions versions (Mestery) #40987
  • [70fd4a15fc] - build: set persist-credentials: false on workflows (Rich Trott) #40972
  • [b72e50e5ef] - build: add OpenSSL gyp artifacts to .gitignore (Luigi Pinca) #40967
  • [066e0d6b44] - build: remove legacy -J test.py option from Makefile/vcbuild (Rich Trott) #40945
  • [f5233b004a] - build: ignore unrelated workflow changes in slow Actions tests (Rich Trott) #40928
  • [a905dfe8d5] - build: remove extraneous quotation marks from commit body (Rich Trott) #40963
  • [6971e5720b] - build: fix branch name for lint-md-dependencies update (Rich Trott) #40924
  • [a09bc8bf1d] - build: fix make invocation in tools.yml (Rich Trott) #40890
  • [323c058fed] - build: fix tools.yml errors (Rich Trott) #40870
  • [e354464c3e] - build: add GitHub Action to update tools modules (Rich Trott) #40644
  • [bfbb7fc24a] - build,tools: automate enforcement of emeritus criteria (Rich Trott) #41155
  • [fc38d15483] - build,tools,win: trim unused VCBUILD_PYTHON_LOCATION variable (David Sanders) #41235
  • [9086338549] - child_process: queue pending messages (Erick Wendel) #41221
  • [d25b17279f] - child_process: revise argument processing (Rich Trott) #41280
  • [15e5d7acf4] - (SEMVER-MINOR) child_process: add support for URL to cp.fork (Antoine du Hamel) #41225
  • [06b775cd5c] - cluster: use linkedlist for round_robin_handle (twchn) #40615
  • [a40989faea] - crypto: fix error capture when loading engine (Tobias Nießen) #41187
  • [3055edec2f] - crypto: add missing null check (Michael Dawson) #40598
  • [cf3423d8b6] - crypto: trim input for NETSCAPE_SPKI_b64_decode (Shelley Vohr) #40757
  • [e60841b598] - crypto: throw errors in SignTraits::DeriveBits (Tobias Nießen) #40796
  • [00fd7d28ef] - crypto: fix build without scrypt (Martin Jansa) #40613
  • [ebc370cac8] - deps: V8: cherry-pick cc9a8a37445e (Gus Caplan) #41825
  • [a59ade62cf] - deps: upgrade npm to 8.3.1 (npm-robot) #41503
  • [9dd097325a] - deps: V8: cherry-pick 3b6b21f595f6 (Michaël Zasso) #41457
  • [af6f1d512d] - deps: upgrade to libuv 1.43.0 (Colin Ihrig) #41398
  • [875fa40960] - deps: upgrade npm to 8.3.0 (npm team) #41127
  • [3c13bbd8aa] - deps: upgrade npm to 8.2.0 (npm team) #41065
  • [6c7088890e] - deps: update Acorn to v8.6.0 (Michaël Zasso) #40993
  • [e092fdebea] - deps: upgrade npm to 8.1.4 (npm team) #40865
  • [3e388ef28d] - deps: V8: cherry-pick cced52a97ee9 (Ray Wang) #40656
  • [58889e2463] - deps: V8: cherry-pick 7ae0b77628f6 (Ray Wang) #40882
  • [7cbbe0d982] - deps: V8: cherry-pick cced52a97ee9 (Ray Wang) #40656
  • [f260bbc0ab] - deps: V8: cherry-pick 7ae0b77628f6 (Ray Wang) #40882
  • [a3aa9bcaf8] - deps: update to uvwasi 0.0.12 (Colin Ihrig) #40847
  • [c0200e20a0] - deps: upgrade npm to 8.1.3 (npm team) #40726
  • [036650e046] - deps: V8: backport 77599ffe0a74 (Lu Yahan) #41566
  • [0b27486895] - deps: V8: cherry-pick e74d6918fb9f (Lu Yahan) #41566
  • [77ad5dd0ff] - deps: V8: cherry-pick 471f862954f3 (Lu Yahan) #41566
  • [dc6843cabe] - deps: V8: cherry-pick 3cab84c24723 (Lu Yahan) #41566
  • [e391da45cf] - deps: V8: cherry-pick d8dc66f92169 (Lu Yahan) #41566
  • [5aa45ae757] - deps: update ICU to 70.1 (Michaël Zasso) #40658
  • [0466400d7a] - deps: update archs files for OpenSSL-1.1.1m+quic (Richard Lau) #41175
  • [553246c1e4] - deps: upgrade openssl sources to OpenSSL_1_1_1m+quic (Richard Lau) #41175
  • [95c19c36a9] - deps: add -fno-strict-aliasing flag to libuv (Daniel Bevenius) #40631
  • [ce525e9661] - doc: align links in table to top (nikoladev) #41396
  • [1db154fa96] - doc: remove statement about client private keys (Tobias Nießen) #41505
  • [7ba53103a5] - doc: fix typo in onboarding.md (Antoine du Hamel) #41544
  • [0d009aebd5] - doc: add Mesteery to collaborators (Mestery) #41543
  • [2bea4bd9ee] - doc: add missing word in readable.read() text (Rich Trott) #41524
  • [d5ad2b7fcd] - doc: add missing YAML tag in esm.md (Antoine du Hamel) #41516
  • [c914d95494] - doc: expand fs.access() mode parameter docs (Colin Ihrig) #41484
  • [d4458162a4] - doc: correct checkHost behavior with wildcards etc (Tobias Nießen) #41468
  • [dea8895091] - doc: remove extraneous colon in legacy subject (Tobias Nießen) #41477
  • [e425f369ea] - doc: remove SameValue comparison reference (Rich Trott) #41460
  • [30cb6948f1] - doc: update mailmap entries for mhdawson (Michael Dawson) #41437
  • [2586f098ac] - doc: add guidance on order vulns are listed in (Michael Dawson) #41429
  • [790898eaae] - doc: update output in inspector examples (David Sanders) #41390
  • [00333fe737] - doc: add note regarding unfinished TLA (Antoine du Hamel) #41434
  • [fe24cb2cd9] - doc: add reference for === operator in assert.md (Rich Trott) #41442
  • [52a988bfb8] - doc: clarify uncaughtException origin for ESM (Antoine du Hamel) #41339
  • [91c3e28018] - doc: revise HTTPRequestOptions text (Rich Trott) #41407
  • [b281bf59ff] - doc: add reference for == and != operators (Rich Trott) #41413
  • [66b90f9d02] - doc: add @RaisinTen to the TSC (Michael Dawson) #41419
  • [14068f8728] - doc: update Abstract Equality Comparison text in assert.md (Rich Trott) #41375
  • [c95151247a] - doc: fix example commands for REPLACEME updates (Richard Lau) #41269
  • [04a81b3e21] - doc: document that require.main may be undefined (Antoine du Hamel) #41384
  • [71bc352328] - doc: clarify entry point behavior when using loader hooks (Antoine du Hamel) #41304
  • [add1184b74] - doc: clarify require behavior with non .js extensions (Antoine du Hamel) #41345
  • [7618b551dc] - doc: revise frozen-intrinsics text (Rich Trott) #41342
  • [41cfc32602] - doc: fix example description for worker_threads (Dmitry Petrov) #41341
  • [46c38eb5fc] - doc: make pull-request guide default branch agnostic (Antoine du Hamel) #41299
  • [1c0c140ae5] - doc: fix sync comment in observer snippet (Eric Jacobson) #41262
  • [081f72e4c0] - doc: remove section about amending commits in PR guide (Thiago Santos) #41287
  • [720fad8876] - doc: remove legacy in-page links in v8.md (Rich Trott) #41291
  • [9eb8233bf6] - doc: include stack trace difference in ES modules (Marcos Bérgamo) #41157
  • [f3b0dfc325] - doc: fix example in node-api docs (Michael Dawson) #41264
  • [aa04a2c562] - doc: add usage recommendation for writable._destroy (Rafael Gonzaga) #41040
  • [a6e7cf5bd4] - doc: make function signature comply with JSDoc comment (Rich Trott) #41242
  • [e7d57ac2cc] - doc: align maxHeaderSize default with current value (Gil Pedersen) #41183
  • [ad06e3d3e0] - doc: add unhandledRejection to strict mode (Colin Ihrig) #41194
  • [11a5f7a81f] - doc: adding estimated execution time (mawaregetsuka) #41142
  • [ba85147a33] - doc: fix syntax error in nested conditions example (Mateusz Burzyński) #41205
  • [8be5b66201] - doc: fix closing parenthesis (AlphaDio) #41190
  • [f0693cb5f9] - doc: add security steward on/offboarding steps (Michael Dawson) #41129
  • [ac025f17b2] - doc: align module resolve algorithm with implementation (Qingyu Deng) #38837
  • [f6bf74748d] - doc: update nodejs-sec managers (Michael Dawson) #41128
  • [c4a5db6e2c] - doc: move style guide to findable location (Rich Trott) #41119
  • [35d0a4eb92] - doc: fix comments in test-fs-watch.js (jakub-g) #41046
  • [22970c67fc] - doc: document support building with Python 3.10 on Windows (Christian Clauss) #41098
  • [f35bd5223f] - doc: add note about pip being required (Piotr Rybak) #40669
  • [179886fa1d] - doc: remove OpenJSF Slack nodejs from support doc (Rich Trott) #41108
  • [e401e6c1af] - doc: simplify major release preparation (Bethany Nicolle Griggs) #40816
  • [ecc086cc7f] - doc: clarify escaping for ES modules (notroid5) #41074
  • [7930725014] - doc: add @bnb as a collaborator (Tierney Cyren) #41100
  • [6a9db2ebdb] - doc: add explicit declaration of fd with null val (Henadzi) #40704
  • [084decdcf8] - doc: expand entries for isIP(), isIPv4(), and isIPv6() (Rich Trott) #41028
  • [3f6106c538] - doc: link to commit queue guide (Geoffrey Booth) #41030
  • [c52ce19c80] - doc: specify that message.socket can be nulled (Luigi Pinca) #41014
  • [341a999fdb] - doc: fix JSDoc in ESM loaders examples (Mestery) #40984
  • [268771c85b] - doc: remove legacy -J test.py option from BUILDING.md (Rich Trott) #40945
  • [90ac3dc85e] - doc: add information on suppressing initial break in debugger (Rich Trott) #40960
  • [d9fc06b158] - doc: improve grammar in API description (Tobias Nießen) #40959
  • [02e9c2e7fe] - doc: update BUILDING.md section on running tests (Rich Trott) #40933
  • [9f14f66009] - doc: remove experimental abortcontroller flag (FrankQiu) #38968
  • [d217809fba] - doc: clarify more optional parameters in node-api (Michael Dawson) #40888
  • [dead21c68c] - doc: define "types", "deno" community conditions (Guy Bedford) #40708
  • [019b25fa5d] - doc: document optional params in napi_get_cb_info (Michael Dawson) #40821
  • [38f02dc4c1] - doc: improve README.md lede section (Rich Trott) #40837
  • [1a2c80957b] - doc: add pref to using draft PR versus WIP label (Michael Dawson) #40824
  • [e70c3616c8] - doc: tweak guidance for modules in core (Michael Dawson) #40601
  • [c10b01e857] - doc: claim ABI version for Electron 18 (Keeley Hammond) #40768
  • [7fba4e5819] - doc: fix transform stream example (Evan Lucas) #40777
  • [a74673fc7c] - doc: fix linter-enforced formatting in crypto.md (Mohammed Keyvanzadeh) #40780
  • [d9ae43ef0e] - doc: fix corepack grammar for --force flag (Steven) #40762
  • [7f9bf21241] - doc: clarify getAuthTag with authTagLength (Tobias Nießen) #40713
  • [fbf732de4f] - doc: fix order of announce work (Michael Dawson) #40725
  • [ac56a114ad] - doc: add initial list of technical priorities (Michael Dawson) #40235
  • [f47d6a37f5] - doc: fix lint re-enabling comment in README.md (Rich Trott) #40647
  • [a9adbb680b] - doc: fix spelling of 'WebAssembly' (Geoffrey Booth) #40785
  • [9e68c00d8e] - doc: format v8.md in preparation for stricter linting (Rich Trott) #40647
  • [82facfbe3e] - doc: final round of markdown format changes (Rich Trott) #40645
  • [fe1b6fb0b5] - doc: simplify CHANGELOG.md (Rich Trott) #40475
  • [5c90975275] - doc: correct esm spec scope lookup definition (Guy Bedford) #40592
  • [ce2dc48588] - doc: use GFM footnotes in BUILDING.md (Rich Trott) #40474
  • [ab28dc5e7f] - doc: update maintaining ICU guide (Michaël Zasso) #40658
  • [f4493c1691] - doc: format changelog for v16.13.2 (Danielle Adams) #41483
  • [59d159f6c3] - doc,lib,tools: align multiline comments (Rich Trott) #41109
  • [3cfe85615c] - esm: make process.exit() default to exit code 0 (Gang Chen) #41388
  • [a0a8f4de58] - esm: reconcile JSDoc vs. actual parameter name (Rich Trott) #41238
  • [a554821f67] - (SEMVER-MINOR) esm: working mock test (Bradley Farias) #39240
  • [4e0502625b] - esm: refactor esm tests out of test/message (Geoffrey Booth) #41352
  • [1b8169a842] - (SEMVER-MINOR) esm: add support for JSON import assertion (Antoine du Hamel) #40250
  • [1280e191e2] - events: clarify JSDoc entries (Rich Trott) #41311
  • [24b40b3b05] - (SEMVER-MINOR) events: graduate capturerejections to supported (James M Snell) #41267
  • [3185772b66] - events: add jsdoc details for Event and EventTarget (James M Snell) #41274
  • [b79fdd5775] - (SEMVER-MINOR) events: add EventEmitterAsyncResource to core (James M Snell) #41246
  • [78a8c1b0bd] - (SEMVER-MINOR) events: propagate weak option for kNewListener (James M Snell) #40899
  • [b671194b85] - (SEMVER-MINOR) fs: accept URL as argument for fs.rm and fs.rmSync (Antoine du Hamel) #41132
  • [66556b39e0] - fs: use async directory processing in cp() (Colin Ihrig) #41351
  • [f4cef533c3] - fs: correct param names in JSDoc comments (Rich Trott) #41237
  • [eaab8d0498] - fs: fix error codes for fs.cp (Antoine du Hamel) #41106
  • [67c6170dc7] - fs: fix length option being ignored during read() (Shinho Ahn) #40906
  • [0377edcceb] - fs: nullish coalescing to respect zero positional reads (Omar El-Mihilmy) #40716
  • [d3839041f5] - http: remove duplicate code (Shaw) #39239
  • [0bf829192a] - http: don't write empty data on req/res end() (Santiago Gimeno) #41116
  • [86bbb427ce] - http: add missing initialization (Michael Dawson) #40555
  • [be53296a1d] - http: change totalSocketCount only on socket creation/close (Subhi Al Hasan) #40572
  • [3c99a4d7c0] - http2: handle existing socket data when creating HTTP/2 server sessions (Tim Perry) #41185
  • [5356dfd296] - inspector: add missing initialization (Michael Dawson) #41022
  • [283f1e8721] - lib: fix linting warnings and errors (Danielle Adams) #41805
  • [c776c7c531] - lib: include return types in JSDoc (Rich Trott) #41130
  • [f6cf39a2d5] - lib: remove spurious JSDoc entry (Rich Trott) #41240
  • [a47fc90c1a] - lib: fix checking syntax of esm module (Qingyu Deng) #41198
  • [438b9cfe02] - (SEMVER-MINOR) lib: make AbortSignal cloneable/transferable (James M Snell) #41050
  • [eda57a9160] - lib: use consistent types in JSDoc @returns (Rich Trott) #41089
  • [f40e099e35] - lib: do not lazy load EOL in blob (Ruben Bridgewater) #41004
  • [157753bf26] - (SEMVER-MINOR) lib: add AbortSignal.timeout (James M Snell) #40899
  • [e08df49d7a] - (SEMVER-MINOR) lib: add reason to AbortSignal (James M Snell) #40807
  • [4bcff4c5f8] - Revert "lib: use helper for readability" (Darshan Sen) #40741
  • [4cb1e7c9c2] - lib: fix typos in lib code comments (Yoshiki) #40792
  • [5e606b54b7] - (SEMVER-MINOR) lib: add unsubscribe method to non-active DC channels (simon-id) #40433
  • [594fe5502d] - (SEMVER-MINOR) lib: add return value for DC channel.unsubscribe (simon-id) #40433
  • [cf6379a543] - lib,test,tools: use consistent JSDoc types (Rich Trott) #40989
  • [4814667189] - lib,tools: remove empty lines between JSDoc tags (Rich Trott) #41147
  • [d422e585c8] - loader: fix package resolution for edge case (Gabriel Bota) #41218
  • [694dc12fab] - (SEMVER-MINOR) loader: return package format from defaultResolve if known (Gabriel Bota) #40980
  • [121199f971] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #41456
  • [9467aa9bcf] - meta: update AUTHORS (Node.js GitHub Bot) #41475
  • [e83e41634a] - meta: correct my name in AUTHORS (Jacob Smith) #41444
  • [8dfc1434c2] - meta: update AUTHORS (Node.js GitHub Bot) #41449
  • [dc536f4d14] - meta: add required fields in issue templates (Rich Trott) #41378
  • [5d5c52fa67] - meta: update AUTHORS (Node.js GitHub Bot) #41374
  • [970de5331c] - meta: replace API docs issue template with form (Rich Trott) #41348
  • [08f5c8d131] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #41336
  • [51e6ed014a] - meta: replace feature request template with form (Rich Trott) #41317
  • [bb997ff494] - meta: update AUTHORS (Node.js GitHub Bot) #41322
  • [9319fa3394] - meta: update node-api team name (Richard Lau) #41268
  • [93b5a2781b] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #41248
  • [d3444a55aa] - meta: update AUTHORS (Node.js GitHub Bot) #41234
  • [115775fd12] - meta: remove community-committee from CODEOWNERS (Rich Trott) #41169
  • [5ac60276d6] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #41154
  • [f8c6055af0] - meta: move to emeritus automatically after 18 months (Rich Trott) #41155
  • [7f3604aa5d] - meta: move silverwind to emeriti (Roman Reiss) #41171
  • [d8dbced939] - meta: update AUTHORS (Node.js GitHub Bot) #41144
  • [25d3103f38] - meta: update AUTHORS (Node.js GitHub Bot) #41088
  • [714efe431c] - meta: move one or more TSC members to emeritus (Node.js GitHub Bot) #40908
  • [f51ce33836] - meta: increase security policy response targets (Matteo Collina) #40968
  • [23e925e1fb] - meta: add feature request label for issue template (Mestery) #40970
  • [ad1056d29e] - meta: update AUTHORS (Node.js GitHub Bot) #40900
  • [317cd3fc2b] - meta: update name and email (Viero Fernando) #40848
  • [eb0106d61d] - meta: update AUTHORS (Node.js GitHub Bot) #40809
  • [3a435a3328] - meta: edit GOVERNANCE.md for minor updates (Rich Trott) #40798
  • [1626d17cbe] - meta: update AUTHORS (Node.js GitHub Bot) #40748
  • [442ad8d787] - module: import assertions improvements (Geoffrey Booth) #40785
  • [e7391ea1b3] - module: resolver & spec hardening /w refactoring (Guy Bedford) #40510
  • [03490cb311] - node-api: add missing initialization of last error (Michael Dawson) #41290
  • [375d04a455] - node-api,doc: document parms which can be optional (Michael Dawson) #41021
  • [c021b385c8] - (SEMVER-MINOR) perf_hooks: multiple fixes for Histogram (James M Snell) #41153
  • [7b6db6df39] - policy: add missing JSDoc @param entry (Rich Trott) #41239
  • [c60cff9091] - (SEMVER-MINOR) process: add getActiveResourcesInfo() (Darshan Sen) #40813
  • [f0860bc3c8] - process: support hrtime in the snapshot (Joyee Cheung) #40649
  • [ef337294cc] - readline: skip escaping characters again (Ruben Bridgewater) #41005
  • [370bfda154] - repl: fix and extend require/import tab complete (Mestery) #40216
  • [3c4e3c03ce] - src: gracefully handle errors in GetX509NameObject (Tobias Nießen) #41490
  • [b4d245446f] - src: fix out-of-bounds check of serialization indices (JoostK) #41452
  • [cb30038447] - src: do IWYU for some STL includes (David Sanders) #41236
  • [fe4158aa4e] - src: split out async stack corruption detection from inline fn (Anna Henningsen) #41331
  • [72921f4b31] - src: store native async execution resources as v8::Local (Anna Henningsen) #41331
  • [59625f70ad] - src: guard slightly costly check in MakeCallback more strongly (Anna Henningsen) #41331
  • [2ca37149ad] - src: fix limit calculation (Michael Dawson) #41026
  • [5f01d03acc] - src: use a higher limit in the NearHeapLimitCallback (Joyee Cheung) #41041
  • [7237bcc2d9] - src: reset error struct if error code is napi_ok (JckXia) #40552
  • [9cc2bb75e5] - src: prevent extra copies of TimerWrap::TimerCb (Darshan Sen) #40665
  • [bd9a6a0194] - (SEMVER-MINOR) src: add x509.fingerprint512 to crypto module (3nprob) #39809
  • [7681fdfd7d] - src: add and fix some preprocessor comments (Tobias Nießen) #40701
  • [a9826b09d4] - (SEMVER-MINOR) src: add flags for controlling process behavior (Cheng Zhao) #40339
  • [b1f785cd72] - src,crypto: remove uses of AllocatedBuffer from crypto_sig (Darshan Sen) #40895
  • [807536c541] - src,crypto: use ByteSource::ToBuffer() in crypto_dh (Darshan Sen) #40903
  • [51b86550ae] - src,crypto: remove AllocatedBuffers from crypto_spkac (Darshan Sen) #40752
  • [cebf40396f] - src,crypto: refactor crypto_tls.* (Darshan Sen) #40675
  • [df574f3109] - src,doc: add SyntaxError napi support (Idan Attias) #40736
  • [5e890be360] - stream: remove always-false condition check (Rich Trott) #41488
  • [ae30b391c2] - stream: fix error-path function call (Rich Trott) #41433
  • [5d27f4acbb] - stream: remove unused function argument (Rich Trott) #41403
  • [77c18680ae] - (SEMVER-MINOR) stream: add filter method to readable (Benjamin Gruenbaum) #41354
  • [7cef7699e3] - (SEMVER-MINOR) stream: add isReadable helper (Robert Nagy) #41199
  • [9c718f8af0] - (SEMVER-MINOR) stream: add map method to Readable (Benjamin Gruenbaum) #40815
  • [8cf507abf1] - stream: fix enqueue race condition on esm modules (Rafael Gonzaga) #40901
  • [4522216660] - stream: add isErrored helper (Robert Nagy) #41121
  • [2251bbae0d] - stream: remove whatwg streams experimental warning (James M Snell) #40971
  • [3b1c01216c] - stream: drain Transform with 0 highWaterMark (Robert Nagy) #40947
  • [436e07b36e] - stream: deprecate thenable support (Antoine du Hamel) #40860
  • [9811617b18] - stream: fix the ReadableStreamBYOBReader error message (James M Snell) #40846
  • [e110c96f48] - stream: pipeline with end option (Robert Nagy) #40886
  • [c9f1398faf] - stream: pipeline should drain empty readable (Robert Nagy) #40654
  • [55c9349afa] - stream: fix non readable Duplex readableAborted (Robert Nagy) #40801
  • [1f722a1c77] - stream: allow calling callback before promise (Robert Nagy) #40772
  • [1de552caeb] - test: add ignore for regex space rule (Danielle Adams) #41805
  • [40c09600fd] - test: improve test coverage of dns/promises (Yoshiki Kurihara) #41425
  • [fa425a1aa2] - test: remove broken wiki link from test/common doc (Yoshiki Kurihara) #41426
  • [9242c1900c] - test: do not OR F_OK in fs.access() test (Colin Ihrig) #41484
  • [3bd8e92bbb] - test: mark test-performance-eventloopdelay flaky (Michael Dawson) #41409
  • [874000ff6b] - test: mark test-repl-sigint-nested-eval as flaky (Michael Dawson) #41302
  • [404c8f5501] - test: use spawnSync() full name in test-stdio-pipe-stderr (Rich Trott) #41332
  • [256bf9e6b6] - test: improve expectWarning error message (Rich Trott) #41326
  • [b1e4387c92] - test: use spawnSync() full name (Rich Trott) #41327
  • [8d15bacf2b] - test: add comments explaining _setSimultaneousAccepts deprecation tests (Yoshiki Kurihara) #41307
  • [a53399edbb] - test: mark test-worker-take-heapsnapshot flaky (Michael Dawson) #41253
  • [e444b41093] - test: mark wpt/test-user-timing test flaky (Michael Dawson) #41203
  • [8926d956c1] - test: correct param name in JSDoc comment (Rich Trott) #41241
  • [2e133d5555] - test: mark test-crypto-keygen slow on windows (Michael Dawson) #41207
  • [28c52f60f6] - test: skip ESLint tests if no Intl (Rich Trott) #41105
  • [d6b15424da] - test: add missing JSDoc parameter name (Rich Trott) #41057
  • [3450227ba2] - test: deflake test-trace-atomics-wait (Luigi Pinca) #41018
  • [b9567d99fc] - test: add auth option case for url.format (Hirotaka Tagawa / wafuwafu13) #40516
  • [38fd30f34b] - Revert "test: skip different params test for OpenSSL 3.x" (Daniel Bevenius) #40640
  • [28a216a6dc] - test: mark test-fs-watch-non-recursive flaky on Windows (Luigi Pinca) #40916
  • [ab398b6c80] - test: deflake cluster-concurrent-disconnect (Luigi Pinca) #40877
  • [9e2e4437b9] - test: deflake fs-promises-watch (Luigi Pinca) #40863
  • [55678af57d] - test: fix argument order in assertion (Luigi Pinca) #40842
  • [4978689713] - test: deflake http2-pipe-named-pipe (Luigi Pinca) #40842
  • [f17789addf] - test: use descriptive name for destination file (Luigi Pinca) #40842
  • [48e2b60c44] - test: add AsyncLocalStorage tests using udp, tcp and tls sockets (Darshan Sen) #40741
  • [c002930a62] - test: add tests for invalid UTF-8 (git-srinivas) #40351
  • [25a166dd25] - test: fix flaky test-policy-integrity (Rich Trott) #40763
  • [25b3187021] - test: add semicolons for linter update (Rich Trott) #40720
  • [b4fea14cc3] - test: disable warnings to fix flaky test (Antoine du Hamel) #40739
  • [2c84c3eee8] - test: do not load absolute path crypto engines twice (Richard Lau) #41175
  • [b5b3750678] - timers: use ref counts to count timers (Darshan Sen) #41231
  • [c5f9e96ac4] - (SEMVER-MINOR) timers: add experimental scheduler api (James M Snell) #40909
  • [00abb811ac] - tls: use optional chaining to simplify checks (Antoine du Hamel) #41337
  • [ffca1a71ce] - tls: permit null as a pfx value (CallMeLaNN) #41170
  • [3b5b893abb] - tls: improve handling of shutdown (Jameson Nash) #36111
  • [99a90dbd4a] - tools: enable jsdoc/require-returns-type ESLint rule (Rich Trott) #41130
  • [66feaf429c] - tools: fix small not-quite-a-bug in find-inactive-tsc.mjs (Rich Trott) #41469
  • [7d5686dc9c] - tools: enable ESLint recommended configuration (Rich Trott) #41463
  • [ecf3b6db44] - tools: enable ESLint no-constant-condition rule (Rich Trott) #41463
  • [12ea18ded9] - tools: enable ESLint require-yield rule (Rich Trott) #41463
  • [609a310e2a] - tools: enable ESLint no-sparse-arrays rule (Rich Trott) #41463
  • [063abe52aa] - tools: enable ESLint no-loss-of-precision rule (Rich Trott) #41463
  • [86ece9843f] - tools: replace for loop with map() (Rich Trott) #41451
  • [70ea7462a6] - tools: use GITHUB_ACTIONS env var in inactivity scripts (Rich Trott) #41422
  • [62450d38a8] - tools: replace while+exec() with matchAll() (Rich Trott) #41406
  • [2bc381ee55] - tools: fix argv bug in find-inactive-tsc.mjs (Rich Trott) #41394
  • [3ecc964a29] - tools: remove conditional assignment in custom ESLint rule (Rich Trott) #41325
  • [a136d56aa6] - tools: update lint-md-dependencies to @rollup/[email protected] (Node.js GitHub Bot) #41369
  • [003dd37717] - tools: update doc to [email protected] (Node.js GitHub Bot) #41367
  • [e8f00fd2ff] - tools: remove last of error-masking in commit-queue.sh (Rich Trott) #41356
  • [530c1275a0] - tools: update eslint to 8.6.0 (Node.js GitHub Bot) #41368
  • [9f2365c4e1] - tools: do not mask errors on multiple commit retrieval (Rich Trott) #41340
  • [f31a3a27bf] - tools: enable jsdoc/check-param-names lint rule (Rich Trott) #41311
  • [1d2e676f8d] - tools: improve section tag additions in HTML doc generator (Rich Trott) #41318
  • [12c5333546] - tools: simplify commit-queue.sh merge command (Rich Trott) #41314
  • [85438e367e] - tools: update lint-md-dependencies to [email protected] (Node.js GitHub Bot) #41315
  • [f890582760] - tools: use Object.hasOwn() in alljson.mjs (Rich Trott) #41306
  • [b6a0afc99e] - tools: avoid generating duplicate id attributes (Rich Trott) #41291
  • [7815fbd751] - tools: be intentional about masking possible error in start-ci.sh (Rich Trott) #41284
  • [4011be0d19] - tools: use {N} for spaces in regex (Rich Trott) #41295
  • [599c119de8] - tools: consolidate update-authors.js logic (Rich Trott) #41255
  • [0f728e0825] - tools: update doc dependency mdast-util-gfm-table to 1.0.2 (Rich Trott) #41260
  • [ae32af308a] - tools: make license-builder.sh comply with shellcheck 0.8.0 (Rich Trott) #41258
  • [d51e8ffb22] - tools: use arrow function for callback in lint-sh.js (Rich Trott) #41256
  • [1523aa5a02] - tools: add double-quotes to make-v8.sh (Rich Trott) #41257
  • [49dc1f278e] - tools: enable prefer-object-has-own lint rule (Rich Trott) #41245
  • [f926a490e5] - tools: update eslint to 8.5.0 (Node.js GitHub Bot) #41228
  • [91fc85ae1b] - tools: enable jsdoc/tag-lines ESLint rule (Rich Trott) #41147
  • [de2140d851] - tools: update lint-md-dependencies to @rollup/[email protected] (Node.js GitHub Bot) #41227
  • [433274ac2c] - tools: fix CQ and auto-start-ci jobs (Antoine du Hamel) #41230
  • [95568dc877] - tools: fix GitHub Actions status when CQ is empty (Antoine du Hamel) #41193
  • [719c39d230] - tools: update doc to [email protected] (Node.js GitHub Bot) #41149
  • [0b2144028f] - tools: update lint-md-dependencies to [email protected] [email protected] (Node.js GitHub Bot) #41150
  • [3dc8483345] - tools: update ESLint to 8.4.1 (Rich Trott) #41114
  • [33be3e8451] - tools: enable JSDoc check-alignment lint rule (Rich Trott) #41109
  • [2c28f86eb9] - tools: strip comments from lint-md rollup output (Rich Trott) #41092
  • [1ff152120e] - tools: update highlight.js to 11.3.1 (Rich Trott) #41091
  • [2c009ccc24] - tools: enable jsdoc/require-returns-check lint rule (Rich Trott) #41089
  • [4aae04bb1a] - tools: update ESLint to 8.4.0 (Luigi Pinca) #41085
  • [50420c654c] - tools: enable jsdoc/require-param-name lint rule (Rich Trott) #41057
  • [0983f6b29b] - tools: use jsdoc recommended rules (Rich Trott) #41057
  • [f9cf50f543] - tools: rollback highlight.js (Richard Lau) #41078
  • [5bfa0ea9c4] - tools: remove Babel from license-builder.sh (Rich Trott) #41049
  • [f74d8b56b8] - tools: udpate packages in tools/doc (Rich Trott) #41036
  • [af9b05fc11] - tools: install and enable JSDoc linting in ESLint (Rich Trott) #41027
  • [45e7affa9c] - tools: include JSDoc in ESLint updating tool (Rich Trott) #41027
  • [9e770d4cfd] - tools: ignore unrelated workflow changes in slow Actions tests (Antoine du Hamel) #40990
  • [e5cccdfd74] - tools: remove unneeded tool in update-eslint.sh (Rich Trott) #40995
  • [017cdcd76a] - tools: consolidate ESLint dependencies (Rich Trott) #40995
  • [83f946855f] - tools: update ESLint update script to consolidate dependencies (Rich Trott) #40995
  • [0ed4775069] - tools: run ESLint update to minimize diff on subsequent update (Rich Trott) #40995
  • [5527e9bfac] - tools: update gyp-next to v0.10.1 (Michaël Zasso) #40934
  • [307dd76a90] - tools: fix commit-lint GH Actions CI (Antoine du Hamel) #40845
  • [da35d4fc4b] - tools: ping TSC members identified as inactive (Rich Trott) #40915
  • [2ffe08dc3e] - tools: update lint-md-dependencies to [email protected] (Node.js GitHub Bot) #40929
  • [5336e488f1] - tools: update lint-md dependencies (Rich Trott) #40894
  • [96cfab14d0] - tools: update ESLint to 8.3.0 (Luigi Pinca) #40917
  • [b54d53b9dd] - tools: add find-inactive-tsc (Rich Trott) #40884
  • [4ffbff25f3] - tools: update @babel/eslint-parser to 7.16.3 (Node.js GitHub Bot) #40889
  • [c5d0b3cf84] - tools: only validate first commit message of a PR (Antoine du Hamel) #40740
  • [6b6fb83673] - tools: improve update scripts (Rich Trott) #40644
  • [e915cec505] - tools: notify user if format-md needs to be run (Rich Trott) #40647
  • [ea75ef5fbd] - tools: update babel-eslint-parser to 7.16.0 (Rich Trott) #40720
  • [3580286818] - tools: avoid unnecessary escaping in markdown formatter (Rich Trott) #40645
  • [362f5edf8c] - tools,benchmark,lib,test: enable no-case-declarations lint rule (Rich Trott) #41385
  • [5d70195d56] - tools,lib,test: enable ESLint no-regex-spaces rule (Rich Trott) #41463
  • [53570a8a7a] - tools,test: make -J behavior default for test.py (Rich Trott) #40945
  • [5380de725c] - typings: add types for symbol and accessor properties on primordials (ExE Boss) #40992
  • [782dbbd38c] - typings: add JSDoc for string_decoder (Qingyu Deng) #38229
  • [08c2512bbf] - url: detect hostname more reliably in url.parse() (Rich Trott) #41031
  • [2c7f17c72c] - util: do not reduce to a single line if not appropriate using inspect (Ruben Bridgewater) #41083
  • [7b6c71ab1c] - util: display a present-but-undefined error cause (Jordan Harband) #41247
  • [2602c0ca62] - util: serialize falsy cause values while inspecting errors (Ruben Bridgewater) #41097
  • [89d955658b] - util: make sure error causes of any type may be inspected (Ruben Bridgewater) #41097
  • [8ce85882bd] - (SEMVER-MINOR) util: pass through the inspect function to custom inspect functions (Ruben Bridgewater) #41019
  • [4f300a5b00] - util: escape lone surrogate code points using .inspect() (Ruben Bridgewater) #41001
  • [45a3e2454d] - (SEMVER-MINOR) util: add numericSeparator to util.inspect (Ruben Bridgewater) #41003
  • [b15f5e48fa] - (SEMVER-MINOR) util: always visualize cause property in errors during inspection (Ruben Bridgewater) #41002
  • [e29bd4699d] - (SEMVER-MINOR) v8: multi-tenant promise hook api (Stephen Belanger) #39283

2022-01-10, Version 16.13.2 'Gallium' (LTS), @danielleadams

This is a security release.

Notable changes

Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531)

Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.

Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.

More details will be available at CVE-2021-44531 after publication.

Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532)

Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.

Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.

More details will be available at CVE-2021-44532 after publication.

Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533)

Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.

Affected versions of Node.js do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

More details will be available at CVE-2021-44533 after publication.

Prototype pollution via console.table properties (Low)(CVE-2022-21824)

Due to the formatting logic of the console.table() function it was not safe to allow user controlled input to be passed to the properties parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be __proto__. The prototype pollution has very limited control, in that it only allows an empty string to be assigned numerical keys of the object prototype.

Versions of Node.js with the fix for this use a null protoype for the object these properties are being assigned to.

More details will be available at CVE-2022-21824 after publication.

Thanks to Patrik Oldsberg (rugvip) for reporting this vulnerability.

Commits

2021-12-01, Version 16.13.1 'Gallium' (LTS), @BethGriggs

Notable Changes

  • [c14eb2325d] - deps: upgrade npm to 8.1.2 (npm team) #40643
  • [a901b6c53c] - deps: update c-ares to 1.18.1 (Richard Lau) #40660
    • This release contains a c-ares update to fix a regression introduced in Node.js v16.6.2 resolving CNAME records containing underscores (#39780).
  • [755c08573f] - doc: add VoltrexMaster to collaborators (voltrexmaster) #40566
  • [881dd7ba2a] - lib: fix regular expression to detect `/` and `\` (Francesco Trotta) #40325

Commits

  • [996bc6e840] - benchmark: increase crypto DSA keygen params (Brian White) #40416
  • [27009092c8] - build: skip long-running Actions for README-only modifications (Rich Trott) #40571
  • [4581997ed0] - build: disable v8 pointer compression on 32bit archs (Cheng Zhao) #40418
  • [17433060d4] - build: fix actions pull request's branch (Mestery) #40494
  • [bfdd32fa62] - build: avoid run find inactive authors on forked repo (Jiawen Geng) #40465
  • [134e8afc59] - build: update codeowners-validator to 0.6 (FrankQiu) #40307
  • [de125a556c] - crypto: avoid double free (Michael Dawson) #40380
  • [c14eb2325d] - deps: upgrade npm to 8.1.2 (npm team) #40643
  • [a901b6c53c] - deps: update c-ares to 1.18.1 (Richard Lau) #40660
  • [76e2c3769e] - deps: upgrade npm to 8.1.1 (npm team) #40554
  • [91c3cf5d0a] - deps: V8: cherry-pick 422dc378a1da (Ray Wang) #40450
  • [769336ab8c] - deps: add riscv64 config into openssl gypi (Lu Yahan) #40473
  • [76d1b5d868] - deps: patch V8 to 9.4.146.24 (Michaël Zasso) #40616
  • [23d11a1dd9] - dgram: fix send with out of bounds offset + length (Nitzan Uziely) #40568
  • [45bdc77dc0] - doc: update cjs-module-lexer repo link (Guy Bedford) #40707
  • [de5c5c8509] - doc: remove --experimental-modules documentation (FrankQiu) #38974
  • [befac5ddd9] - doc: update tracking issues of startup performance (Joyee Cheung) #40629
  • [3cb74d72f8] - doc: fix markdown syntax and HTML tag misses (ryan) #40608
  • [eea061f8f1] - doc: use 'GitHub Actions workflow' instead (Mestery) #40586
  • [7a6e833677] - doc: add node: url scheme (Daniel Nalborczyk) #40573
  • [d72fb7df4a] - doc: call cwd function (Daniel Nalborczyk) #40573
  • [d732ff4614] - doc: remove unused imports (Daniel Nalborczyk) #40573
  • [e2114e21f4] - doc: add info on project's usage of coverity (Michael Dawson) #40506
  • [d38077babe] - doc: fix typo in changelogs (Luigi Pinca) #40585
  • [7c7f8791c6] - doc: update onboarding task (Rich Trott) #40570
  • [0a7c4ff248] - doc: simplify ccache instructions (Rich Trott) #40550
  • [5593dd1b25] - doc: fix macOS environment variables for ccache (Rich Trott) #40550
  • [2d4a042675] - doc: improve async_context introduction (Michaël Zasso) #40560
  • [9fcfef09ac] - doc: use GFM footnotes in webcrypto.md (Rich Trott) #40477
  • [579f01c0a3] - doc: describe buffer limit of v8.serialize (Ray Wang) #40243
  • [3b6cf090a0] - doc: use GFM footnotes in maintaining-V8.md (#40476) (Rich Trott) #40476
  • [dea701004e] - doc: fix fs.symlink code example (Juan José Arboleda) #40414
  • [595117ff0b] - doc: explain backport labels (Stephen Belanger) #40520
  • [042f01e3ed] - doc: fix entry for Slack channel in onboarding.md (Rich Trott) #40563
  • [755c08573f] - doc: add VoltrexMaster to collaborators (voltrexmaster) #40566
  • [c029d0b61f] - doc: document considerations for inclusion in core (Rich Trott) #40338
  • [836fc274e4] - Revert "doc: fix typo in stream docs" (Luigi Pinca) #40819
  • [b3a12767a4] - doc: update link in onboarding doc (Rich Trott) #40539
  • [aa47c9f38f] - doc: clarify behavior of napi_extended_error_info (Michael Dawson) #40458
  • [bf88328bdc] - doc: add updating expected assets to release guide (Richard Lau) #40470
  • [621266afc7] - doc: format doc/api/*.md with markdown formatter (Rich Trott) #40403
  • [7b746381ce] - doc: specify that maxFreeSockets is per host (Luigi Pinca) #40483
  • [934dcc85c3] - doc: update Collaborator guide to reflect GitHub web UI update (Antoine du Hamel) #40456
  • [4724e07476] - doc: indicate n-api out params that may be NULL (Isaac Brodsky) #40371
  • [3b1499c971] - doc: update CHANGELOG.md for Node.js 16.13.0 (Richard Lau) #40617
  • [881dd7ba2a] - lib: fix regular expression to detect `/` and `\` (Francesco Trotta) #40325
  • [0a8c33123e] - lib,url: correct URL's argument to pass idlharness (Khaidi Chu) #39848
  • [480f0e1d20] - meta: use form schema for flaky test template (Michaël Zasso) #40737
  • [55ff97342d] - meta: update AUTHORS (Node.js GitHub Bot) #40668
  • [ef46cb428d] - meta: consolidate AUTHORS entries for brettkiefer (Rich Trott) #40599
  • [7230b6d33d] - meta: consolidate AUTHORS entries for alexzherdev (Rich Trott) #40620
  • [9e12ed4f68] - meta: consolidate AUTHORS entries for Azard (Rich Trott) #40619
  • [97aa8e42b8] - meta: move Fishrock123 to emeritus (Jeremiah Senkpiel) #40596
  • [7b1c89f357] - meta: consolidate AUTHORS entries for clakech (Rich Trott) #40589
  • [0003cb6b3b] - meta: consolidate AUTHORS entries for darai0512 (Rich Trott) #40569
  • [7590bacec1] - meta: update AUTHORS (Node.js GitHub Bot) #40580
  • [a5475df083] - meta: consolidate AUTHORS entries for dfabulich (Rich Trott) #40527
  • [c021a7f169] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #40464
  • [d64cf1706c] - meta: add Richard Lau to TSC list in README.md (Rich Trott) #40523
  • [d09b8239bf] - meta: consolidate AUTHORS entries for dguo (Rich Trott) #40517
  • [66192060e7] - meta: consolidate AUTHORS entries for cxreg (Rich Trott) #40490
  • [b4f51276cb] - meta: update AUTHORS (Node.js GitHub Bot) #40485
  • [2a2b549a28] - meta: consolidate AUTHORS entries for emanuelbuholzer (Rich Trott) #40469
  • [618bbbf2f4] - meta: consolidate AUTHORS entries for ebickle (Rich Trott) #40447
  • [06706e8dd2] - meta: add typings to label-pr-config (Mestery) #40401
  • [e2c9e1ccdd] - meta: consolidate AUTHORS entries for evantorrie (Rich Trott) #40430
  • [dab574e937] - policy: fix message for invalid manifest specifier (Rich Trott) #40574
  • [58de6cebb6] - process: refactor execution (Voltrex) #40664
  • [bc0eb0a3ea] - src: make LoadEnvironment with string work with builtin modules path (Michaël Zasso) #40607
  • [2c8a6ec28e] - src: remove usage of AllocatedBuffer from node_http2 (Darshan Sen) #40584
  • [59c26a2b2c] - src: fix #endif description in crypto_keygen.h (Tobias Nießen) #40639
  • [789fef1309] - src: throw error instead of assertion (Ray Wang) #40243
  • [7a8a6deee7] - src: register external references in os bindings (Joyee Cheung) #40239
  • [7bb3d43432] - src: register external references in crypto bindings (Joyee Cheung) #40239
  • [143c881ccb] - src: add missing inialization in agent.h (Michael Dawson) #40379
  • [c15afda79f] - src: get embedder options on-demand (Joyee Cheung) #40357
  • [ff3b7d228e] - src: ensure V8 initialized before marking milestone (Shelley Vohr) #40405
  • [774bc46327] - src,crypto: remove AllocatedBuffer from crypto_cipher.cc (Darshan Sen) #40400
  • [4030eff3d6] - src,fs: remove ToLocalChecked() call from fs::AfterMkdirp() (Darshan Sen) #40386
  • [3ac99a2417] - src,stream: remove *Check*() calls from non-Initialize() functions (Darshan Sen) #40425
  • [36d3b123a0] - stream: support array of streams in promises pipeline (Mestery) #40193
  • [01ffe0316c] - test: deflake child-process-pipe-dataflow (Luigi Pinca) #40838
  • [63b44fc429] - test: skip macos sandbox test with builtin modules path (Michaël Zasso) #40607
  • [3d50997ccb] - test: add semicolon after chunk size (Luigi Pinca) #40487
  • [f114e35115] - test: deflake http2-cancel-while-client-reading (Luigi Pinca) #40659
  • [f778fa230b] - test: test crypto.setEngine() using an actual engine (Darshan Sen) #40481
  • [b9533c592a] - test: use conventional argument order in assertion (Tobias Nießen) #40591
  • [e72c95c580] - test: fix test description (Luigi Pinca) #40486
  • [af4e682758] - test: pass URL's toascii.window.js WPT (Khaidi Chu) #39910
  • [6de88bc5ed] - test: adjust CLI flags test to ignore blank lines in doc (Rich Trott) #40403
  • [8226690097] - test: mark test-policy-integrity flaky on Windows (Rich Trott) #40684
  • [50c6666b37] - test: fix test-datetime-change-notify after daylight change (Piotr Rybak) #40684
  • [9227f2af79] - test: split test-crypto-dh.js (Joyee Cheung) #40451
  • [c593cff0af] - test,doc: correct documentation for runBenchmark() (Rich Trott) #40683
  • [aef809f5c8] - test,tools: increase pummel/benchmark test timeout from 4x to 6x (Rich Trott) #40684
  • [908f6447cd] - test,tools: increase timeout for benchmark tests (Rich Trott) #40684
  • [64c6575f44] - tools: simplify and fix commit queue (Michaël Zasso) #40742
  • [cba8eaf264] - tools: ensure the PR was not pushed before merging (Antoine du Hamel) #40747
  • [1c8590e1fe] - tools: update ESLint to 8.2.0 (Luigi Pinca) #40734
  • [18800dee0a] - tools: use GitHub Squash and Merge feature when using CQ (Antoine du Hamel) #40666
  • [48a785edb7] - tools: fix bug in prefer-primordials ESLint rule (Antoine du Hamel) #40628
  • [adde2a7a8c] - tools: add script to update c-ares (Richard Lau) #40660
  • [c12ce898e8] - tools: abort CQ session when landing several commits (Antoine du Hamel) #40577
  • [dd08e532a2] - tools: fix commit-lint workflow (Antoine du Hamel) #40673
  • [b4a80dba79] - tools: avoid fetch extra commits when validating commit messages (Antoine du Hamel) #39128
  • [2a53995442] - tools: update ESLint to 8.1.0 (Luigi Pinca) #40582
  • [8648e50183] - tools: fix formatting of warning message in update-authors.js (Rich Trott) #40600
  • [59de0f703f] - tools: udpate doc tools to accommodate GFM footnotes (Rich Trott) #40477
  • [abf3b84d77] - tools: add support for import assertions in linter (Antoine du Hamel) #39924
  • [04c2cbecb9] - tools: update tools/lint-md dependencies to support GFM footnotes (Rich Trott) #40445
  • [a9990876f7] - tools: update lint-md dependencies (Rich Trott) #40404
  • [f45814bad1] - tools,meta: remove exclusions from AUTHORS (Rich Trott) #40648
  • [7d550ad966] - tty: support more CI services in getColorDepth (Richie Bendall) #40385
  • [cdea5b671b] - typings: add more bindings typings (Mestery) #40415
  • [67c7d11f1a] - typings: add JSDoc typings for inspector (Voltrex) #38390
  • [fbe0323ebf] - typings: improve internal bindings typings (Mestery) #40411
  • [63ab0031c3] - typings: separate internalBinding typings (Mestery) #40409

2021-10-26, Version 16.13.0 'Gallium' (LTS), @richardlau

Notable Changes

This release marks the transition of Node.js 16.x into Long Term Support (LTS) with the codename 'Gallium'. The 16.x release line now moves into "Active LTS" and will remain so until October 2022. After that time, it will move into "Maintenance" until end of life in April 2024.

2021-10-20, Version 16.12.0 (Current), @richardlau

Notable Changes

Experimental ESM Loader Hooks API

Node.js ESM Loader hooks have been consolidated to represent the steps involved needed to facilitate future loader chaining:

  1. resolve: resolve [+ getFormat]
  2. load: getFormat + getSource + transformSource

For consistency, getGlobalPreloadCode has been renamed to globalPreload.

A loader exporting obsolete hook(s) will trigger a single deprecation warning (per loader) listing the errant hooks.

Contributed by Jacob Smith, Geoffrey Booth, and Bradley Farias - nodejs#37468

Other Notable Changes

  • [8fdabcb918] - deps: upgrade npm to 8.1.0 (npm team) #40463
  • [d1d9f2de30] - doc: deprecate (doc-only) http abort related (dr-js) #36670
  • [4116b6c907] - (SEMVER-MINOR) vm: add support for import assertions in dynamic imports (Antoine du Hamel) #40249

Commits

2021-10-12, Version 16.11.1 (Current), @danielleadams

This is a security release.

Notable changes

  • CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
    • The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2021-22959 after publication.
  • CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)
    • The http parser ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details will be available at CVE-2021-22960 after publication.

Commits

2021-10-08, Version 16.11.0 (Current), @danielleadams

Notable Changes

  • crypto
    • update root certificates (Richard Lau) #40280
  • deps
    • upgrade npm to 8.0.0 (npm team) #40369
    • update nghttp2 to v1.45.1 (thunder-coding) #40206
    • update V8 to 9.4.146.19 (Michaël Zasso) #40285
  • tools
    • update certdata.txt (Richard Lau) #40280

Commits

2021-09-22, Version 16.10.0 (Current), @BethGriggs

Notable Changes

  • [fb226ff2ee] - (SEMVER-MINOR) crypto: add rsa-pss keygen parameters (Filip Skokan) #39927
  • [85206b7311] - deps: upgrade npm to 7.24.0 (npm team) #40167
  • [98f56d179c] - deps: update Acorn to v8.5.0 (Michaël Zasso) #40015
  • [9655329772] - doc: add Ayase-252 to collaborators (Qingyu Deng) #40078
  • [59fff925be] - (SEMVER-MINOR) fs: make open and close stream override optional when unused (Antoine du Hamel) #40013
  • [a63a4bce90] - (SEMVER-MINOR) http: limit requests per connection (Artur K) #40082
    • The maximum number of requests a socket can handle before closing keep alive connection can be set with server.maxRequestsPerSocket.
  • [9a672961fa] - (SEMVER-MINOR) src: add --no-global-search-paths cli option (Cheng Zhao) #39754
    • Adds the --no-global-search-paths command-line option to not search modules from global paths like $HOME/.node_modules and $NODE_PATH.
  • [fe920b6cbf] - (SEMVER-MINOR) src: make napi_create_reference accept symbol (JckXia) #39926
  • [97f3072ceb] - (SEMVER-MINOR) stream: add signal support to pipeline generators (Robert Nagy) #39067

Commits

  • [b7dc651884] - build: run modified internet tests on GitHub Actions (Rich Trott) #40100
  • [8d5787a043] - build: add .mailmap/AUTHORS to paths-ignore for test-macos (Rich Trott) #40109
  • [9793e7ff08] - build: add .mailmap/AUTHORS to path-ignore for test-asan (Rich Trott) #40109
  • [886921de38] - build: add paths-ignore for build-tarball workflow (Rich Trott) #40109
  • [01b1946b38] - build: only lint version numbers for pull requests (Michaël Zasso) #40027
  • [c804d070a6] - build: add daily/on-demand internet test workflow (Rich Trott) #40086
  • [7bddaecbf4] - build: add YAML linting to GitHub Actions (Rich Trott) #40007
  • [5a20f9055c] - build: add YAML linting (Rich Trott) #40007
  • [0b30867c08] - build: run AUTHORS update weekly (Rich Trott) #40004
  • [22a78a75ee] - build: preserves symbols during LTO with macOS linker (Jesse Chan) #39839
  • [f0dec58d43] - crypto: fix webcrypto ed(25519|448) spki/pkcs8 import (Filip Skokan) #40131
  • [d80082f3eb] - crypto: use validateObject (Voltrex) #39872
  • [d657ae6f8a] - crypto: fix RSA-PSS default saltLength (Tobias Nießen) #39999
  • [fc45cbe7a8] - crypto: fix default MGF1 hash for OpenSSL 3 (Tobias Nießen) #40031
  • [105c9e6d3b] - crypto: check webcrypto asymmetric key types during importKey (Filip Skokan) #39962
  • [fb226ff2ee] - (SEMVER-MINOR) crypto: add rsa-pss keygen parameters (Filip Skokan) #39927
  • [85206b7311] - deps: upgrade npm to 7.24.0 (npm team) #40167
  • [06f6e01f37] - deps: add riscv64 into openssl Makefile and gen openssl-riscv64 (Lu Yahan) #40063
  • [9c76c69972] - deps: patch V8 to 9.3.345.19 (Michaël Zasso) #40108
  • [0df47d5843] - deps: upgrade npm to 7.23.0 (npm team) #40055
  • [b3843bf417] - deps: patch v8 for vs2019 in std17 (Jiawen Geng) #40060
  • [67759585a0] - deps: patch for v8 on windows (Jiawen Geng) #40010
  • [98f56d179c] - deps: update Acorn to v8.5.0 (Michaël Zasso) #40015
  • [5c6708582e] - dns: cleanup validation (Voltrex) #40061
  • [e4825dcfd5] - doc: changes default values for fs.read fns (RISHABH BUDHIRAJA) #39163
  • [0254b4b0d3] - doc: fix markdown indentation in lists (Michaël Zasso) #40142
  • [b6939a3419] - doc: prepare README.md for stricter linting (Rich Trott) #40137
  • [a07d8444f9] - doc: fix comma splice (Rich Trott) #40133
  • [2488bc0c4f] - doc: clean up weird notes about reentrancy (Anna Henningsen) #40107
  • [8b80dcbc30] - doc: correct parameters in fs and stream documentation (vipul kumar) #39984
  • [1ced732078] - doc: fix CJS-ESM selector in Safari (Bradley Farias) #40135
  • [7fdb12739d] - doc: add timeout.close (Nikita Galkin) #40036
  • [81cb14bb58] - doc: clarify that ObjectWrap requires manual cleanup on shutdown (Gerhard Stöbich) #40074
  • [8aad81dd99] - doc: add full list of subsystems (FrankQiu) #39971
  • [9655329772] - doc: add Ayase-252 to collaborators (Qingyu Deng) #40078
  • [6d399e11e9] - doc: fix CCM cipher example in MJS (Tobias Nießen) #39949
  • [d426ee9b17] - doc: fix property name 'detail' of performanceEntry (Christian Boehlke) #40019
  • [846e7e880e] - doc: fix list indentation in corepack.md (Alexey Ten) #40029
  • [b6dd2ea930] - doc: fix missing history version in fs.md (Antoine du Hamel) #39972
  • [f666f5a8d1] - events: fix duplicate require which cause performance penalty (wwwzbwcom) #39892
  • [59fff925be] - (SEMVER-MINOR) fs: make open and close stream override optional when unused (Antoine du Hamel) #40013
  • [a63a4bce90] - (SEMVER-MINOR) http: limit requests per connection (Artur K) #40082
  • [bc9c2ca6af] - http: remove CRLF variable (shfshanyue) #40101
  • [dd50b91f77] - lib: remove useless statement (Maledong) #39983
  • [608528028c] - lib: avoid creating a throw away object in validateObject (Antoine du Hamel) #39807
  • [edcfffeaea] - lib: use standard property names (null) #39981
  • [640353af86] - lib,repl: ignore non-canBeRequiredByUsers built-in (Khaidi Chu) #39942
  • [4444b5c938] - meta: update AUTHORS (Node.js GitHub Bot) #40148
  • [4993318862] - meta: update GeoffreyBooth email addresses in AUTHORS and .mailmap (Rich Trott) #40132
  • [98d42fa1f4] - meta: add mailmap entry for LPardue (Rich Trott) #40129
  • [effdfa91be] - meta: update GeoffreyBooth email address (Geoffrey Booth) #40102
  • [588257c00a] - meta: add .mailmap entry for arcanis (Rich Trott) #40103
  • [7ee3fbd1e0] - meta: update AUTHORS (Node.js GitHub Bot) #40087
  • [2a41530a5e] - meta: consolidate AUTHORS entry for mikemaccana (Rich Trott) #40051
  • [a71579b05e] - meta: add more mailmap entries for bajtos (Rich Trott) #40023
  • [29104f5e64] - meta: consolidate AUTHORS entries for mithunsasidharan (Rich Trott) #40003
  • [381293f54a] - meta: update AUTHORS (Node.js GitHub Bot) #39957
  • [1eca9bc5b2] - module: support pattern trailers for imports field (Guy Bedford) #40041
  • [7376edca6d] - module: deprecate trailing slash pattern mappings (Guy Bedford) #40039
  • [92f182b23d] - module: fix $ pattern replacements (Guy Bedford) #40044
  • [d6124d8259] - repl: fix top level await with surrogate characters (Mestery) #39931
  • [9a672961fa] - (SEMVER-MINOR) src: add --no-global-search-paths cli option (Cheng Zhao) #39754
  • [51f9ad4897] - (SEMVER-MINOR) src: add option to disable global search paths (Cheng Zhao) #39754
  • [95528b284d] - src: remove unnecessary comment and add a CHECK in crypto_tls.cc (Darshan Sen) #39991
  • [31994fbf8e] - src: register zlib external references for snapshot (Joyee Cheung) #40050
  • [cfcd57182b] - src: fix -Wunreachable-code-return error (Shelley Vohr) #40034
  • [9f3a015b60] - src: add option to disable loading native addons (Dominic Elm) #39977
  • [570bef1710] - Revert "src: skip test_fatal/test_threads for Debug builds" (Anna Henningsen) #39954
  • [842f936e04] - src: use Isolate::TryGetCurrent where appropriate (Anna Henningsen) #39954
  • [fe920b6cbf] - (SEMVER-MINOR) src: make napi_create_reference accept symbol (JckXia) #39926
  • [73aa4e34ff] - src: fix C4805 MSVC warning (Michaël Zasso) #39998
  • [826eee363c] - src: register external references of PipeWrap for snapshot (Joyee Cheung) #39961
  • [7a17cbfdea] - src: register external references of TTYWrap for snapshot (Joyee Cheung) #39961
  • [00cca48081] - src: register external references of TCPWrap for snapshot (Joyee Cheung) #39961
  • [6095fb07b6] - src: register external references of SignalWrap for snapshot (Joyee Cheung) #39961
  • [db75711c5c] - src: register missing process methods external references (Joyee Cheung) #39961
  • [b4e074c295] - src: register missing stream wrap external references (Joyee Cheung) #39961
  • [a2c1c3ef64] - src: register external references of BaseObject for snapshot (Joyee Cheung) #39961
  • [6fdf02523e] - src: register external references of node-report for snapshot (Joyee Cheung) #39961
  • [bef78a2f88] - src: register external references of dtrace for snapshot (Joyee Cheung) #39961
  • [97f3072ceb] - (SEMVER-MINOR) stream: add signal support to pipeline generators (Robert Nagy) #39067
  • [6be405bd7b] - test: fix test-dgram-udp6-link-local-address on Windows (Michaël Zasso) #40005
  • [ec94bec9a3] - test: do not run test-corepack-yarn-install with no internet (Antoine du Hamel) #40090
  • [4aa2610252] - test: update OpenSSL3 error messages for 3.0.0+quic (Daniel Bevenius) #40093
  • [4367a61a9b] - test: mark test-crypto-timing-safe-equal-benchmarks flaky (Richard Lau) #40065
  • [5b5e27281c] - test: fix internet/test-dns (Rich Trott) #40083
  • [67bbfeb7e1] - test: make tests pass on Windows with Unix EOL (Michaël Zasso) #40002
  • [a8c99d9f09] - tools: update doc generator dependencies (Michaël Zasso) #40042
  • [ec6de1195a] - tools: update ansi-regex in lint-md rollup (Rich Trott) #40112
  • [d55804ca4e] - tools: update all dependencies of markdown linter (Michaël Zasso) #40035
  • [f03bae7c82] - tools: update remark-html to v13.0.2 (Michaël Zasso) #40043
  • [99af21292f] - tools,build: update YAML files in preparation for linting (Rich Trott) #40007
  • [590ace418d] - tools,doc: fix misrendering of consecutive JS blocks (Rich Trott) #40146
  • [5983568204] - worker: avoid potential deadlock on NearHeapLimit (Santiago Gimeno) #38403

2021-09-10, Version 16.9.1 (Current), @richardlau

Notable Changes

This release fixes a regression introduced by the V8 9.3 update in Node.js 16.9.0.

Commits

2021-09-07, Version 16.9.0 (Current), @targos

Notable Changes

Corepack

Node.js now includes Corepack, a script that acts as a bridge between Node.js projects and the package managers they are intended to be used with during development. In practical terms, Corepack will let you use Yarn and pnpm without having to install them - just like what currently happens with npm, which is shipped in Node.js by default. Please head over to the Corepack documentation page for more information on how to use it.

Contributed by Maël Nison - #39608

V8 9.3

V8 is updated to version 9.3, which includes performance improvements and new JavaScript features.

Object.hasOwn

Object.hasOwn is a static alias for Object.prototype.hasOwnProperty.call:

Object.hasOwn({ value: 42 }, 'value'); // Returns `true`.

Error cause

Errors can now be optionally constructed with a cause option, pointing to another error. This adds a cause property on the new error:

const error1 = new Error('Error one');
const error2 = new Error('Error two', { cause: error1 });
// error2.cause === error1

Contributed by Michaël Zasso - #39947

Other Notable Changes

  • [34c627e4bc] - (SEMVER-MINOR) crypto: add RSA-PSS params to asymmetricKeyDetails (Tobias Nießen) #39851
  • [20da0a5379] - (SEMVER-MINOR) module: support pattern trailers (Guy Bedford) #39635
  • [cb44781371] - (SEMVER-MINOR) stream: add stream.compose (Robert Nagy) #39029

Commits

  • [2343c394fb] - async_hooks: use resource stack for AsyncLocalStorage run (Stephen Belanger) #39890
  • [00951827cd] - Revert "build: add windows-2022 to GitHub test matrix" (Michaël Zasso) #39982
  • [e7834535b3] - build: add windows-2022 to GitHub test matrix (Michaël Zasso) #39857
  • [c49b0c0dd4] - build: add support for Visual Studio 2022 (Michaël Zasso) #39857
  • [afdb665e57] - build: fix find-inactive-collaborators workflow token (Rich Trott) #39909
  • [0ff88f362f] - build: update token used for pull requests (Rich Trott) #39907
  • [beca890330] - build: adapt v8_pch.h to V8 9.3 (Michaël Zasso) #39469
  • [2170346aa3] - build: reset embedder string to "-node.0" (Michaël Zasso) #39947
  • [d33ab968ab] - cluster: fix comment regarding child_process file (Yash Ladha) #39308
  • [585199497f] - crypto: fix regression in RSA-PSS keygen (Tobias Nießen) #39937
  • [34c627e4bc] - (SEMVER-MINOR) crypto: add RSA-PSS params to asymmetricKeyDetails (Tobias Nießen) #39851
  • [1dd91582da] - crypto: fix rsa-pss one-shot sign/verify error handling (Filip Skokan) #39830
  • [20cf47004e] - crypto: fix JWK RSA-PSS SubtleCrypto.exportKey (Filip Skokan) #39828
  • [e25dc8e470] - deps: upgrade npm to 7.21.1 (npm team) #39904
  • [9270684837] - deps: update archs files for OpenSSL-1.1.1l+quic (Richard Lau) #39867
  • [4b5bbec6cc] - deps: upgrade openssl sources to OpenSSL_1_1_1l+quic (Richard Lau) #39867
  • [71659fd4ba] - (SEMVER-MINOR) deps: add corepack (Maël Nison) #39608
  • [7470db0dfb] - deps: restore minimum ICU version to 68 (Michaël Zasso) #39470
  • [92d83d18d2] - deps: make V8 9.3 abi-compatible with 9.0 (Michaël Zasso) #39947
  • [0140face81] - deps: V8: cherry-pick 00bb1a77c03e (Darshan Sen) #39829
  • [3e1053e755] - deps: V8: cherry-pick 81814ed44574 (Stephen Belanger) #39719
  • [d9d0104878] - deps: silence irrelevant V8 warning (Michaël Zasso) #38990
  • [cd9b03ea40] - deps: silence irrelevant V8 warnings (Michaël Zasso) #37587
  • [b83cab712f] - deps: fix V8 build issue with inline methods (Jiawen Geng) #35415
  • [068824d754] - deps: make v8.h compatible with VS2015 (Joao Reis) #32116
  • [54f4f1af50] - deps: V8: forward declaration of Rtl*FunctionTable (Refael Ackermann) #32116
  • [10ba1cb8b2] - deps: V8: patch register-arm64.h (Refael Ackermann) #32116
  • [3ce6f72124] - deps: V8: un-cherry-pick bd019bd (Refael Ackermann) #32116
  • [f43c292520] - (SEMVER-MINOR) deps: update V8 to 9.3.345.16 (Michaël Zasso) #39947
  • [9e782eb758] - doc: remove {C,Dec}ompressionStream documentation (Luigi Pinca) #39899
  • [7857e9cc77] - doc: add descriptions about when options.mode is ignored (Ray) #39881
  • [d43b555047] - doc: remove danbev from TSC member list (Daniel Bevenius) #39978
  • [fc01dd916e] - doc: add missing changes to generateKeyPair(Sync) (Tobias Nießen) #39963
  • [953f2e9f88] - doc: add nodejs/tweet issue creation to sec. doc (Daniel Bevenius) #39940
  • [29c4b07716] - doc: update WASI example to use import.meta.url (Guy Bedford) #39925
  • [9eb4a70c14] - doc: move reference to OpenSSL flags SSL_OP_* (Tobias Nießen) #39935
  • [8ea4befc82] - doc: add docs for duplex.allowHalfOpen property (Tim Perry) #39126
  • [bc2b73ec9b] - doc: add FrankQiu to a triager (FrankQiu) #39922
  • [8b68f8ec38] - doc: add VoltrexMaster to triagers (voltrexmaster) #39920
  • [3a8f77ac0d] - doc: document JavaScript tool for benchmark comparison (Michaël Zasso) #39835
  • [4ac703ca8e] - doc: add Mesteery to triagers (Mestery) #39887
  • [d059a5186b] - doc: update maintaining openssl guide (Richard Lau) #39878
  • [486150580c] - doc: move ERR_WORKER_UNSPPORTED_EXTENSION to legacy (Qingyu Deng) #39788
  • [a4b8c13798] - events: protect property defs against prototype polution (James M Snell) #39773
  • [cfbe9065ae] - events: add brand checks for detached accessors (James M Snell) #39773
  • [112af69194] - fs: add docs and tests for AsyncIterable support in fh.writeFile (Antoine du Hamel) #39836
  • [402071bc45] - meta: remove duplicate AUTHORS entry for NigelKibodeaux (Rich Trott) #39967
  • [3588f07603] - meta: add mailmap entry for Ethan-Arrowood (Rich Trott) #39930
  • [259e0cf4d7] - meta: add mailmap entry for branisha (Rich Trott) #39889
  • [bc236a6714] - meta: update .mailmap to remove duplicate AUTHORS entry for addaleax (Rich Trott) #39880
  • [20da0a5379] - (SEMVER-MINOR) module: support pattern trailers (Guy Bedford) #39635
  • [879dc4658e] - src: remove usage of AllocatedBuffer from src/node_buffer.cc (Darshan Sen) #39941
  • [79ce096470] - src: remove extra semicolons outside fns (Shelley Vohr) #39800
  • [cb44781371] - (SEMVER-MINOR) stream: add stream.compose (Robert Nagy) #39029
  • [ca9b781d20] - test: use assert.match instead of regexp.test (Michaël Zasso) #39928
  • [007e2855af] - test: use error code mapping in place of raw errno (Darshan Sen) #38675
  • [00529b0ef2] - test: add test to verify other extension can be loaded by worker (Qingyu Deng) #39788
  • [4e7212c88c] - test: update error message keywords (leeight) #39826
  • [549d717722] - test: adapt test-fs-read to V8 9.3 (Michaël Zasso) #39469
  • [644b25e068] - test: adapt test-util-inspect to V8 9.3 (Michaël Zasso) #39469
  • [105bff9ea5] - test: adapt test-v8-flags to V8 9.3 (Michaël Zasso) #39469
  • [d92bd9a982] - tools: add support for import assertions in linter (Antoine du Hamel) #39924
  • [9763561e30] - tools: update gyp-next to v0.10.0 (Michaël Zasso) #39857
  • [9f105c73fc] - tools: update V8 gypfiles for 9.3 (Michaël Zasso) #39469
  • [16271d2f50] - worker: remove file extension check (Qingyu Deng) #39788
  • [3b1ce93e03] - worker: add brand checks for detached MessageEvent accessors (James M Snell) #39773

2021-08-25, Version 16.8.0 (Current), @targos

Notable Changes

  • [2e90b10f35] - doc: deprecate type coercion for dns.lookup options (Antoine du Hamel) #38906
  • [a6d50a18a0] - (SEMVER-MINOR) stream: add stream.Duplex.from utility (Robert Nagy) #39519
  • [af7047a815] - (SEMVER-MINOR) stream: add isDisturbed helper (Robert Nagy) #39628
  • [66400374de] - (SEMVER-MINOR) util: expose toUSVString (Robert Nagy) #39814

Commits

  • [90bf247a55] - build: fix update authors commit (Mestery) #39858
  • [c968372e37] - build: add authors.yml (Tierney Cyren) #35831
  • [3f284cf65c] - build: add option to hide console window (Cheng Zhao) #39712
  • [a01e3ab41d] - deps: V8: cherry-pick 00bb1a77c03e (Darshan Sen) #39829
  • [cce95c4c5b] - deps: upgrade npm to 7.21.0 (Myles Borins) #39813
  • [254810a22e] - doc: add duplicate CVE check in sec. release doc (Daniel Bevenius) #39845
  • [8c50d16712] - doc: improve description of the triagers team (Michaël Zasso) #39833
  • [c02165d992] - doc: update instructions for cc (Michael Dawson) #39674
  • [208305fd8f] - doc: move util.toUSVString() outside of deprecated group (Luigi Pinca) #39840
  • [2e90b10f35] - doc: deprecate type coercion for dns.lookup options (Antoine du Hamel) #38906
  • [8460a3216c] - doc: deprecate using non-boolean values in the verbatim option (Antoine du Hamel) #38906
  • [3041d57201] - doc: fix malformed changelog entries (Rich Trott) #39791
  • [2b02f747c3] - doc: fix lint errors in packages.md (Rich Trott) #39792
  • [a387600d8f] - doc: add example of self-reference in scoped packages (Jesús Leganés-Combarro 'piranna) #37630
  • [7a25bf3a6d] - doc: add himadriganguly as a triager (Himadri Ganguly) #39757
  • [d1900f43ce] - fs: combine require() and destructure (Colin Ihrig) #39806
  • [158d4464d2] - meta: add gyp as owner of gyp files and tools/gyp (Mary Marchini) #34847
  • [8fa38500f2] - policy: canonicalize before resolving specifiers (Bradley Farias) #37863
  • [a7a217be13] - repl: fix tla function hoisting (Don Jayamanne) #39745
  • [3a8399ee61] - src: return Maybe<bool> from InitializeContextRuntime() (Darshan Sen) #39695
  • [a704c9dfce] - (SEMVER-MINOR) src: call overload ctor from the original ctor (Darshan Sen) #39768
  • [0918ea0683] - (SEMVER-MINOR) src: add a constructor overload for CallbackScope (Darshan Sen) #39768
  • [a6d50a18a0] - (SEMVER-MINOR) stream: duplexify (Robert Nagy) #39519
  • [af7047a815] - (SEMVER-MINOR) stream: add isDisturbed helper (Robert Nagy) #39628
  • [f98311a7c8] - tools: update workflow to open a pull request (Rich Trott) #39825
  • [d33f897509] - tools: use find-inactive-collaborators to modify README.md (Rich Trott) #39825
  • [d82ee96861] - tools: update gyp-next to v0.9.5 (Jiawen Geng) #39818
  • [79079ea01b] - tools: fix markdown linting (Rich Trott) #39832
  • [01093b07cc] - tools: update markdown linter dependencies and move to ESM (Antoine du Hamel) #39801
  • [9dc0c91392] - tools: update rollup to latest version in markdown linter (Rich Trott) #39797
  • [c34e2534ab] - tools: update markdown lint dependencies (Rich Trott) #39770
  • [66400374de] - (SEMVER-MINOR) util: expose toUSVString (Robert Nagy) #39814

2021-08-17, Version 16.7.0 (Current), @danielleadams

Notable Changes

  • fs:
    • experimental: add recursive cp method (Benjamin Coe) #39372

Commits

  • [a80c989306] - async_hooks: merge resource_symbol with owner_symbol (Darshan Sen) #38468
  • [69a2a6b6c3] - bootstrap: call _undestroy() inside _destroy for stdout and stderr (Matteo Collina) #39685
  • [5bc31ea0aa] - buffer: add endings option, remove Node.js specific encoding option (James M Snell) #39708
  • [091a579275] - (SEMVER-MINOR) buffer: add Blob.prototype.stream method and other cleanups (James M Snell) #39693
  • [097d898e58] - build: run coverage for inspector protocol changes (Richard Lau) #39725
  • [cf028df0ed] - build: fix V8 build with pointer compression (Michaël Zasso) #39664
  • [9d38400de1] - build: exclude markdown files from some GitHub Actions (Rich Trott) #39565
  • [eeb804a7b7] - build: use lts shorthand in GitHub Actions (Rich Trott) #39538
  • [93a904d0ba] - (SEMVER-MINOR) crypto: implement webcrypto.randomUUID (Michaël Zasso) #39648
  • [3321b65a5a] - debugger: prevent simultaneous heap snapshots (Rich Trott) #39638
  • [6c375e18b6] - debugger: remove undefined parameter (Rich Trott) #39570
  • [103bf20988] - deps: V8: cherry-pick 81814ed44574 (Stephen Belanger) #39719
  • [cf5e5b5711] - deps: upgrade to libuv 1.42.0 (Luigi Pinca) #39525
  • [5f92d2fe6d] - dgram: use simplified validator (Voltrex) #39753
  • [c7e918b06a] - (SEMVER-MINOR) dns: add "tries" option to Resolve options (Luan Devecchi) #39610
  • [5d66646b71] - doc: correct cjs code to match mjs code (Raz Luvaton) #39509
  • [f18bb2a0f1] - doc: fix typo in hmac.paramNames default (Justin) #39766
  • [338a166e83] - doc: fix fs.rmdir recursive option deprecation history (Antoine du Hamel) #39728
  • [bfb1dc0a2c] - doc: fixed variable names in queueMicrotask example (ashish maurya) #39634
  • [08b31f12f8] - doc: change "Version 4 UUID" to "version 4 UUID" (Tobias Nießen) #39682
  • [f5200f9785] - doc: update debugger.md description and examples (Rich Trott) #39661
  • [4700f1e529] - doc: fix color contrast issue in light mode (Rich Trott) #39660
  • [88c83a4698] - (SEMVER-MINOR) doc: add missing change to resolver ctor (Luan Devecchi) #39610
  • [760cafa5ed] - doc: fix typo in url.md (Howie Zhao) #39666
  • [9ab5503693] - doc: add point to ask H1 reporter about credit (Daniel Bevenius) #39585
  • [7514405456] - doc: update min mac ver + move mac arm64 to tier 1 (Ash Cripps) #39586
  • [d7c8c6dcee] - doc: add missing introduced_in metadata (Richard Lau) #39575
  • [8072517097] - doc: add code examples to Writable.destroy() and Writable.destroyed (Juan José Arboleda) #39491
  • [55f47cc2d0] - doc: add String.prototype.at and %TypedArray%.prototype.at (Jordan Harband) #39583
  • [0c0412e2c4] - doc: move NODE_MODULE_VERSION in release guide (Richard Lau) #39544
  • [5df74f9b21] - doc: remove outdated ARM information from release guide (Richard Lau) #39544
  • [8eccb11ea0] - doc: fence command examples in release guide (Richard Lau) #39544
  • [0bd97e1f2d] - doc: update backport labels in release guide (Richard Lau) #39544
  • [2129ad6a0a] - doc: add code example to fs.truncate method (Juan José Arboleda) #39454
  • [3ff5e153ef] - doc: add code example to http.createServer method (Juan José Arboleda) #39455
  • [7d0c869cfa] - doc: add PerformanceObserver buffered document (legendecas) #39514
  • [0dc167a03f] - (SEMVER-MINOR) fs: add recursive cp method (Benjamin Coe) #39372
  • [54dd3df943] - http: decodes url.username and url.password for authorization header (Lew Gordon) #39310
  • [81e62f67bf] - inspector: update inspector_protocol to 89c4adf (Rich Trott) #39650
  • [793fee4915] - inspector: update inspector_protocol to 8ec18cf (Rich Trott) #39614
  • [5afdc1f4c0] - lib: simplify validators (Voltrex) #39753
  • [ca3cb96d25] - lib: cleanup validation (Voltrex) #39652
  • [cc08d3062f] - lib: cleanup instance validation (Voltrex) #39656
  • [2751cdf6f9] - lib: use helper for readability (Voltrex) #39649
  • [c68415cba2] - lib: use validators (Voltrex) #39663
  • [be2d60dd1d] - lib: use validator (Voltrex) #39547
  • [486d51ac0c] - lib: use validateObject (Voltrex) #39605
  • [058e882a2a] - lib: use ERR_ILLEGAL_CONSTRUCTOR (Mestery) #39556
  • [07cadc4432] - meta: consolidate AUTHORS entries for ooHmartY (Rich Trott) #39705
  • [6c788b8030] - meta: consolidate AUTHORS entries for homosaur (Rich Trott) #39705
  • [07351edebe] - meta: consolidate AUTHORS entries for Ayase-252 (Rich Trott) #39705
  • [5fe282769b] - meta: consolidate AUTHORS entries for robin-drexler (Rich Trott) #39705
  • [fc2a626357] - meta: consolidate AUTHORS entries for samshull (Rich Trott) #39705
  • [67cfc66a47] - meta: update AUTHORS (Rich Trott) #39705
  • [91008fbdeb] - meta: consolidate email addresses for MarshallOfSound (Rich Trott) #39651
  • [a76b63536a] - meta: consolidate email addresses for tadjik1 (Rich Trott) #39651
  • [aaab2095db] - meta: consolidate email addresses for szmarczak (Rich Trott) #39651
  • [f413a9d83c] - meta: update AUTHORS (Rich Trott) #39636
  • [7a91d4bfe9] - meta: simplify mailmap (Rich Trott) #39612
  • [4ec5d2de5d] - meta: consolidate emails for tadhgcreedon (Rich Trott) #39611
  • [bb88c38eac] - meta: consolidate emails for timcosta (Rich Trott) #39611
  • [0920a8cf6f] - meta: consolidate emails for timruffles (Rich Trott) #39611
  • [1474a9d4b1] - meta: update AUTHORS (Rich Trott) #39629
  • [c59e3ec685] - meta: add mailmap entry for ryzokuken (Rich Trott) #39596
  • [34f4bb8277] - meta: add mailmap entry for uttampawar (Rich Trott) #39596
  • [fd213edda2] - meta: add mailmap entry for dmabupt (Rich Trott) #39596
  • [6b664e224b] - meta: align README/.mailmap/AUTHORS email entries (Rich Trott) #39505
  • [96d8ecbd66] - meta: add mailmap entry for garygsc (Rich Trott) #39588
  • [16d85f3f48] - meta: add mailmap entry for ttzztztz (Rich Trott) #39588
  • [60ab111fdb] - meta: update AUTHORS (Rich Trott) #39587
  • [b43f87d729] - meta: update .mailmap to remove duplication in AUTHORS (Rich Trott) #39561
  • [6f4a2aa5a4] - meta: add .mailmap entries to remove AUTHORS duplicates (Rich Trott) #39560
  • [86d144c500] - meta: add .mailmap entry to remove duplication in AUTHORS (Rich Trott) #39559
  • [110c088f02] - meta: update collaborator email in AUTHORS/.mailmap (Rich Trott) #39521
  • [72af147bb5] - meta: update collaborator email in README (Rich Trott) #39521
  • [23bc4cfb21] - meta: update collaborator email in AUTHORS/.mailmap (Rich Trott) #39521
  • [e4289728c7] - meta: move gdams to emeritus (Rich Trott) #39539
  • [4df59bc727] - module: add some typings to internal/modules/esm/resolve (Antoine du Hamel) #39504
  • [b5858589d0] - node-api: handle pending exception in cb wrapper (Michael Dawson) #39476
  • [016b7ba616] - perf_hooks: fix PerformanceObserver gc crash (James M Snell) #39550
  • [b37575b67c] - perf_hooks: fix performance timeline wpt failures (legendecas) #39532
  • [64c02eb3cc] - (SEMVER-MINOR) perf_hooks: web performance timeline compliance (legendecas) #39297
  • [7ff21397d6] - policy: fix integrity when DEFAULT_ENCODING is set (Tobias Nießen) #39750
  • [03be967cad] - src: fix TextDecoder final flush size calculation (James M Snell) #39737
  • [9046e78943] - src: fix crash in AfterGetAddrInfo (Anna Henningsen) #39735
  • [2a00ef5ede] - (SEMVER-MINOR) src: fix align in cares_wrap.h (Luan) #39610
  • [60a2b31c68] - src: add cosmetic space character to async_wrap.h file (Juan José Arboleda) #39459
  • [cd9b0bf68c] - stream: ensure text() stream consumer flushes correctly (James M Snell) #39737
  • [f57a0e4d8b] - (SEMVER-MINOR) stream: utility consumers for web and node.js streams (James M Snell) #39594
  • [975edf5330] - stream: clean endWritableNT (Mestery) #39645
  • [9e38fc6757] - (SEMVER-MINOR) stream: add readableDidRead if has been read from (Robert Nagy) #39589
  • [a5ded4a85a] - test: use simplfied validator (voltrexmaster) #39753
  • [53cf53c95a] - (SEMVER-MINOR) test: enable blob.prototype.stream tests (James M Snell) #39693
  • [7e9884598f] - test: update WPT abort tests (Michaël Zasso) #39697
  • [94381fbdf5] - test: update WPT common and resources (Michaël Zasso) #39697
  • [34a041a846] - test: fix test-debugger-heap-profiler for workers (Richard Lau) #39687
  • [9f5acfa90e] - test: increase memory for coverage action (Benjamin Coe) #39690
  • [0be15cedc4] - test: use template to concatenate string (Himadri Ganguly) #39621
  • [952a5282e2] - (SEMVER-MINOR) test: pull Web Platform Tests for WebCryptoAPI (Michaël Zasso) #39648
  • [3622fb1e03] - test: deflake test-http2-buffersize (Luigi Pinca) #39591
  • [1962c7c7b3] - test: convert anonymous function to arrow function (Himadri Ganguly) #39604
  • [635e1a0274] - test: add test-debugger-breakpoint-exists (Rich Trott) #39570
  • [cff2aea5df] - test: add known issues test for debugger heap snapshot race (Rich Trott) #39557
  • [5e1011238a] - tools: bump remark-preset-lint-node to 3.0.0 (Rich Trott) #39755
  • [eb741253fd] - tools: update path-parse in markdown linter package-lock file (Rich Trott) #39729
  • [52a172f983] - tools: fix more build warnings in inspector_protocol (Richard Lau) #39725
  • [77f9c1fa98] - tools: cherry-pick ffb34b6d5dbf0 (Darshan Sen) #39725
  • [b9510d21c9] - tools: update inspector_protocol to e8ba1a7 (Rich Trott) #39694
  • [8d509d8773] - tools: update inspector_protocol to 39ca567 (Rich Trott) #39694
  • [ee7142fa37] - tools: update inspector_protocol to 97d3146 (Rich Trott) #39694
  • [c6323d847d] - Revert "tools: fix compiler warning in inspector_protocol" (Rich Trott) #39694
  • [6e19c166e4] - tools: update inspector_protocol to a53e96d31a2755eb16ca37 (Rich Trott) #39694
  • [61c53f39d2] - tools: update inspector_protocol to fe0467fd105a (Rich Trott) #39694
  • [b1b6f20353] - tools: improve error detection in find-inactive-collaborators (Rich Trott) #39617
  • [d1360fcf48] - tools: update ESLint to 7.32.0 (Luigi Pinca) #39602
  • [af1c782cad] - tools: update ESLint to 7.31.0 (Colin Ihrig) #39424
  • [37dda19461] - (SEMVER-MINOR) url,buffer: implement URL.createObjectURL (James M Snell) #39693
  • [dcab88ad38] - worker: add brand checks for detached properties/methods (James M Snell) #39763

2021-08-11, Version 16.6.2 (Current), @BethGriggs

This is a security release.

Notable Changes

  • CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)
    • Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of hostnames returned by Domain Name Servers in the Node.js DNS library which can lead to the output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22931.
  • CVE-2021-22940: Use after free on close http2 on stream canceling (High)
    • Node.js was vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix. You can read more about it at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22940.
  • CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low)
    • If the Node.js HTTPS API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22939.

Commits

2021-08-03, Version 16.6.1 (Current), @targos

Notable Changes

  • Updated npm to 7.20.3 (npm team) #39579
  • Reverted an ABI-breaking change from V8 9.2 that could impact some native modules (Michaël Zasso) #39624
  • Fixed a bug in error handling known to affect at least Webpack and Jest (Guy Bedford) #39593

Commits

  • [6c769ccedf] - build: override python executable path on configure (legendecas) #39465
  • [cbf6a01c17] - crypto: fix generateKeyPair with encoding 'jwk' (himself65) #39319
  • [3091295609] - deps: revert ABI-breaking change from V8 9.2 (Michaël Zasso) #39624
  • [06d7b8e8c8] - deps: upgrade npm to 7.20.3 (npm team) #39579
  • [7b612fadc2] - doc: fix crypto.hkdf callback derivedKey type (Filip Skokan) #39453
  • [7a731efd97] - doc,lib,test: rename HKDF 'key' argument (Tobias Nießen) #39474
  • [93bbaa0ce9] - module: fix ERR_REQUIRE_ESM error for null frames (Guy Bedford) #39593
  • [e13162de09] - module: refine enrichCJSError (Antoine du Hamel) #39507
  • [815fbec6f1] - repl: do not include legacy getter/setter methods in completion (Anna Henningsen) #39576
  • [0405c8d3f0] - zlib: avoid converting Uint8Array instances to Buffer (Antoine du Hamel) #39492

2021-07-29, Version 16.6.0 (Current), @BethGriggs

This is a security release.

Notable Changes

Say hello to V8 9.2

The V8 engine is updated to version 9.2.230.21.

It notably introduces the new Array.prototype.at method (also on Typed Arrays and strings):

const array = [1, 2, 3];

console.log(array.at(-1));
// Prints: 3

Contributed by Michaël Zasso - #39470

Other notable changes

Commits

2021-07-14, Version 16.5.0 (Current), @targos

Notable Changes

Experimental Web Streams API

Node.js now exposes an experimental implementation of the Web Streams API.

While it is experimental, the API is not exposed on the global object and is only accessible using the new stream/web core module:

import { ReadableStream, WritableStream } from 'stream/web';
// Or from 'node:stream/web'

Importing the module will emit a single experimental warning per process.

The raw API is implemented and we are now working on its integration with various existing core APIs.

Contributed by James M Snell - #39062

Other notable changes

Commits

2021-07-05, Version 16.4.2 (Current), @BethGriggs

Notable Changes

Node.js 16.4.1 introduced a regression in the Windows installer on non-English locales that is being fixed in this release. There is no need to download this release if you are not using the Windows installer.

Commits

  • [76e709ec63] - win,msi: use localized "Authenticated Users" name (Richard Lau) #39241

2021-07-01, Version 16.4.1 (Current), @BethGriggs

This is a security release.

Notable Changes

Vulnerabilities fixed:

  • CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)
    • Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918
  • CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)
    • Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22921

Commits

2021-06-23, Version 16.4.0 (Current), @danielleadams

Notable changes

  • async_hooks:
    • stabilize part of AsyncLocalStorage (Vladimir de Turckheim) #37675
  • deps:
    • upgrade npm to 7.18.1 (npm team) #39065
    • update V8 to 9.1.269.36 (Michaël Zasso) #38273
  • dns:
    • allow --dns-result-order to change default dns verbatim (Ouyang Yadong) #38099

Commits

  • [d2b972ee52] - async_hooks: check for empty contexts before removing (Bryan English) #39095
  • [03e75fda4c] - async_hooks: switch between native and context hooks correctly (Stephen Belanger) #38912
  • [8115e6ee6d] - (SEMVER-MINOR) async_hooks: stabilize part of AsyncLocalStorage (Vladimir de Turckheim) #37675
  • [5f51729014] - bootstrap: move event loop handle checking into snapshot builder (Joyee Cheung) #39007
  • [9d100aa269] - bootstrap: split NodeMainInstance::Run() (Joyee Cheung) #39007
  • [2aaf2f231f] - build: reconfigure when gyp files change on Windows (Joyee Cheung) #39066
  • [7f225a05ee] - Revert "build: work around bug in MSBuild v16.10.0" (Michaël Zasso) #38977
  • [1853127dde] - build: reset embedder string to "-node.0" (Michaël Zasso) #38273
  • [c0d236f5ea] - build: make build-addons errors fail the build (Richard Lau) #38983
  • [173292bcf8] - build: fix commit-queue default branch (Mary Marchini) #38998
  • [e939e243bf] - build: don't pass python override to V8 build (Richard Lau) #38969
  • [651c58b412] - build: correct Xcode spelling in .gitignore (bl-ue) #38895
  • [5203c9ced7] - build: fast-track npm PRs and dont-land them on LTS (Michaël Zasso) #38885
  • [7de57d4d33] - build: dont-land gyp-next PRs on LTS branches (Michaël Zasso) #38887
  • [e87cd4542b] - child_process: refactor to use validateBoolean (Qingyu Deng) #38927
  • [69fa9e16e9] - (SEMVER-MINOR) child_process: allow options.cwd receive a URL (Khaidi Chu) #38862
  • [cf9d686c35] - crypto: fix aes crash when tag length too small (Khaidi Chu) #38914
  • [1799ea36f0] - crypto: use compatible version of EVP_CIPHER_name (Shelley Vohr) #38925
  • [6d5dc63ae4] - crypto: fix label cast in EVP_PKEY_CTX_set0_rsa_oaep_label (Shelley Vohr) #38926
  • [6e93c17bf5] - crypto: use EVP_get_cipherbynid directly (Shelley Vohr) #38901
  • [82c293959e] - crypto: add missing rand.h include (Shelley Vohr) #38864
  • [e4f802de9a] - debugger: rename internal library for clarity (Rich Trott) #39080
  • [1e8bdab581] - debugger: use ERR_DEBUGGER_STARTUP_ERROR in _inspect.js (Rich Trott) #39024
  • [b43cb69fbb] - debugger: use error codes in debugger REPL (Rich Trott) #39024
  • [dc9218136b] - debugger: use ERR_DEBUGGER_ERROR in debugger client (Rich Trott) #39024
  • [711916a271] - debugger: remove unnecessary boilerplate copyright comment (Rich Trott) #38952
  • [0f65e41442] - debugger: reduce scope of eslint disable comment (Rich Trott) #38946
  • [1fa724ec5a] - deps: upgrade npm to 7.18.1 (npm team) #39065
  • [c6aa68598d] - deps: upgrade npm to 7.17.0 (npm team) #38999
  • [864fe9910b] - deps: make V8 9.1 abi-compatible with 9.0 (Michaël Zasso) #38991
  • [c93f3573eb] - deps: V8: cherry-pick fa4cb172cde2 (Michaël Zasso) #38273
  • [3c6c28b0a1] - deps: V8: cherry-pick 4c074516397b (Michaël Zasso) #38273
  • [3c37396d5c] - deps: V8: cherry-pick 5f4413194480 (Michaël Zasso) #38273
  • [3433559a55] - deps: V8: cherry-pick 272445f10927 (Michaël Zasso) #38273
  • [f56c78574e] - deps: V8: cherry-pick c0fceaa0669b (Michaël Zasso) #38273
  • [7197fcec93] - deps: V8: cherry-pick d59db06bf542 (Michaël Zasso) #38273
  • [bf7aa9fef8] - deps: silence irrelevant V8 warnings (Michaël Zasso) #37587
  • [eac377bc15] - deps: V8: backport aaacffa1e003 (Michaël Zasso) #38273
  • [1a7c8a12c1] - deps: fix V8 build issue with inline methods (Jiawen Geng) #35415
  • [3c9a75522b] - deps: make v8.h compatible with VS2015 (Joao Reis) #32116
  • [8ed258339a] - deps: V8: forward declaration of Rtl*FunctionTable (Refael Ackermann) #32116
  • [4ef37c83a9] - deps: V8: patch register-arm64.h (Refael Ackermann) #32116
  • [7c61c6ee25] - deps: V8: un-cherry-pick bd019bd (Refael Ackermann) #32116
  • [e82ef4148e] - (SEMVER-MINOR) deps: update V8 to 9.1.269.36 (Michaël Zasso) #38273
  • [70af146745] - deps: upgrade npm to 7.16.0 (npm team) #38920
  • [a71df7630e] - (SEMVER-MINOR) dns: allow --dns-result-order to change default dns verbatim (Ouyang Yadong) #38099
  • [dce256b210] - doc: remove references to deleted freenode channels (devsnek) #39047
  • [1afff98805] - doc: fix typos (bl-ue) #39049
  • [858f66e691] - doc: add missing parameter types (Voltrex) #39013
  • [ed91379186] - doc: clearify that http does chunked encoding itself (Mao Wtm) #28379
  • [51561f390a] - doc: add missing changelog links (Antoine du Hamel) #39016
  • [a19170eb9d] - doc: clarify that only one Python version is required to build (bl-ue) #38894
  • [7b219992e0] - doc: fix markup for aesImportParams (Tobias Nießen) #38898
  • [405b50cdba] - doc: use await in filehandle.truncate() snippet (RA80533) #38939
  • [5218fe86d1] - doc: fixed typo in process.md (Derevianchenko Maksym) #38941
  • [f903ad85f2] - doc: add missing semis after classes (Darshan Sen) #38931
  • [0bdeeda3b5] - doc: update write callback documentation (Simone Busoli) #38959
  • [7a7c0588ad] - doc: mark util.inherits as legacy (Voltrex) #38896
  • [f6964dc506] - doc: clarify when readable._read(...) is called (Shaun Keys) #38726
  • [3481b02e77] - doc: mark Node.js v15.x as EOL (Antoine du Hamel) #38891
  • [17a9846920] - doc: fix .mjs syntax in crypto.md (himself65) #38882
  • [8c7b2bab5f] - doc,fs: remove experimental status for WHATWG URL as path (Antoine du Hamel) #38870
  • [eddde6c31a] - errors: don't rekey on primitive type (Benjamin Coe) #39025
  • [3d7892ef39] - errors: add ERR_DEBUGGER_STARTUP_ERROR (Rich Trott) #39024
  • [631856ea32] - errors: add ERR_DEBUGGER_ERROR (Rich Trott) #39024
  • [336571fbdd] - Revert "http: make HEAD method to work with keep-alive" (Michaël Zasso) #38949
  • [c2b4fbba0f] - lib: remove semicolon in preparation for babel/eslint-parser update (Rich Trott) #39094
  • [f17dde81f3] - lib: make internal/options lazy (Joyee Cheung) #38993
  • [551430514b] - lib: add JSDoc typings for child_process (Voltrex) #38222
  • [ded83350a0] - lib: make primordials Promise methods safe (Antoine du Hamel) #38650
  • [637c1fa83c] - lib: refactor debuglog init (Antoine du Hamel) #38838
  • [5b5e07a2cc] - meta: update label-pr-config (Michaël Zasso) #38950
  • [92ed1c6cce] - module: fix legacy node specifier resolution to resolve "main" field (Antoine du Hamel) #38979
  • [4174f139b6] - net: use missing validator (Voltrex) #38984
  • [f7724ab342] - node-api: avoid crashing on passed-in null string (Gabriel Schulhof) #38923
  • [ec3e5b4c15] - node-api: avoid SecondPassCallback crash (Michael Dawson) #38899
  • [74f5e30d69] - node-api: rtn pending excep on napi_new_instance (legendecas) #38798
  • [4c6193fea1] - report: generates report on threads with no isolates (legendecas) #38994
  • [3c7a7d9ee4] - (SEMVER-MINOR) src: allow to negate boolean CLI flags (Michaël Zasso) #39023
  • [284d9c6228] - src: cleanup uv_fs_t regardless of success or not (legendecas) #38996
  • [902bb858d7] - src: refactor to use locale functions (Darshan Sen) #39014
  • [10370c5e8a] - src: fix multiple AddLinkedBinding() calls (Anna Henningsen) #39012
  • [ff8313c3a5] - src: throw error in LoadBuiltinModuleSource when reading fails (Joyee Cheung) #38904
  • [9ba5518f08] - src: skip test_fatal/test_threads for Debug builds (Daniel Bevenius) #38805
  • [06afb8df65] - (SEMVER-MINOR) src: make InitializeOncePerProcess more flexible (Shelley Vohr) #38888
  • [db4b192113] - src: add not-weak DCHECK to PersistentToLocal::Strong (Anna Henningsen) #38875
  • [08b2a4a138] - src,test: raise error for --enable-fips when no FIPS (Daniel Bevenius) #38859
  • [5d92c09bbf] - src,url: separate some tables out of node_url.cc (Khaidi Chu) #38988
  • [c20e28e1a0] - stream: fix pipeline pump (Robert Nagy) #39006
  • [7b026d8a72] - test: move inspector-cli tests to sequential (Rich Trott) #39079
  • [a53911b166] - test: improve buffer coverage (Rongjian Zhang) #38538
  • [5e9175f148] - test: fix name of variable in inspector-cli test (Tobias Nießen) #38869
  • [bd924610ec] - test: fix typo (Houssem Chebab) #39045
  • [d50df5dec1] - test: fix typo in test-http2-invalidheaderfield.js (Ikko Ashimine) #39021
  • [6111671d45] - test: adapt abort tests for new Windows code (Michaël Zasso) #38273
  • [1816d46cef] - test: adapt test-linux-perf to V8 changes (Michaël Zasso) #38273
  • [32961c4781] - test: fix V8 serdes test for V8 9.1 (Michaël Zasso) #38273
  • [f652284b3b] - test: remove obsolete TLS test (Rich Trott) #39001
  • [81bbeab3bd] - test: improve coverage of lib/events.js (Rongjian Zhang) #38582
  • [e82111f890] - test: http outgoing _headers setter null (ycjcl868) #38881
  • [1f10e84939] - test: suppress warning in test_environment.cc (Daniel Bevenius) #38868
  • [379b5f79a9] - tls: tweak clientCertEngine argument parsing (Shelley Vohr) #38900
  • [78d2e0ed8e] - tools: update babel-eslint-parser to 7.14.5 (Rich Trott) #39094
  • [fed641127a] - tools: update ESLint to 7.29.0 (Rich Trott) #39083
  • [3ae2a0be48] - tools: fix typo (Houssem Chebab) #39044
  • [a1d0aef60e] - tools: update doctool dependencies, migrate to ESM (Michaël Zasso) #38966
  • [2a292cf574] - tools: update V8 gypfiles for 9.1 (Michaël Zasso) #38273
  • [0c90fd8454] - tools: avoid crashing CQ when git push fails (Antoine du Hamel) #36861
  • [f817c2d3bb] - tools: fix typo in commit-queue.sh (bl-ue) #39000
  • [be5101eb32] - tools: update ESLint to 7.28.0 (Luigi Pinca) #38955
  • [9bf9ddb490] - tools: refactor snapshot builder (Joyee Cheung) #38902
  • [0706565097] - tools: bump remark-preset-lint-node to 2.3.0 (Rich Trott) #38910
  • [7d35fa7938] - tools: update gyp-next to v0.9.1 (Jiawen Geng) #38867
  • [00c20e621f] - tools,doc: forbid CJS globals in ESM code snippets (Antoine du Hamel) #38889
  • [99161b09f6] - url,src: simplify ipv6 logic by using uv_inet_pton (Khaidi Chu) #38842
  • [f40725f2a1] - vm: use missing validator (Voltrex) #38935
  • [f959cb3c68] - worker: do not look up context twice in PostMessage (Anna Henningsen) #38784

2021-06-02, Version 16.3.0 (Current), @danielleadams

Notable Changes

  • cli:
    • add -C alias for --conditions flag (Guy Bedford) #38755
  • deps:
    • add workspaces support to npm install commands (Ruy Adorno) #38750

Commits

2021-05-19, Version 16.2.0 (Current), @targos

Notable Changes

  • [36b948560c] - (SEMVER-MINOR) async_hooks: use new v8::Context PromiseHook API (Stephen Belanger) #36394
  • [c0deeeacb2] - lib: support setting process.env.TZ on windows (James M Snell) #38642
  • [4c4902748c] - (SEMVER-MINOR) module: add support for URL to import.meta.resolve (Antoine du Hamel) #38587
  • [c182198c44] - (SEMVER-MINOR) process: add 'worker' event (James M Snell) #38659
  • [fbf02e3198] - (SEMVER-MINOR) util: add util.types.isKeyObject and util.types.isCryptoKey (Filip Skokan) #38619

Commits

  • [36b948560c] - (SEMVER-MINOR) async_hooks: use new v8::Context PromiseHook API (Stephen Belanger) #36394
  • [dcae03203e] - buffer: remove TODOs in atob / btoa (Khaidi Chu) #38548
  • [48b557e904] - buffer: remove unreachable code (Rongjian Zhang) #38537
  • [b0df28dea5] - build: add workaround for V8 builds (Richard Lau) #38632
  • [3bb12db255] - build: remove dependency on distutils.spawn (Richard Lau) #38600
  • [10aaf30da1] - build: add missing torque output sources (Richard Lau) #38576
  • [03b4a3a5bf] - build: compile with -std=gnu++14 (Darshan Sen) #38504
  • [4296591154] - build,src,test,doc: enable FIPS for OpenSSL 3.0 (Daniel Bevenius) #38633
  • [36bb8daba5] - crypto: forbid NODE-ED25519 and NODE-ED448 "raw" key export (Filip Skokan) #38668
  • [36bb7243ff] - debugger: refactor inspect_repl to use primordials (Antoine du Hamel) #38551
  • [16a6c8d5a6] - debugger: refactor to use internal modules (Antoine du Hamel) #38550
  • [11dd9a6838] - debugger: disable only the lint rules required by current file state (Rich Trott) #38529
  • [e79f540fa0] - debugger: avoid non-ASCII char in code file (Rich Trott) #38529
  • [d9867b9358] - debugger: wrap lines longer than 80 chars (Rich Trott) #38529
  • [352a600142] - debugger: rename inspector-cli test module to debugger (Rich Trott) #38530
  • [608d0e11f3] - deps: upgrade npm to 7.13.0 (Ruy Adorno) #38682
  • [5c71f49d3f] - deps: upgrade npm to 7.12.1 (Ruy Adorno) #38628
  • [ec2dbfb200] - deps: patch V8 to 9.0.257.25 (Michaël Zasso) #38556
  • [ab298723b5] - (SEMVER-MINOR) deps: V8: cherry-pick fa4cb172cde2 (Stephen Belanger) #36394
  • [a84e9b3e7d] - (SEMVER-MINOR) deps: V8: cherry-pick 4c074516397b (Stephen Belanger) #36394
  • [043b1aaa3f] - (SEMVER-MINOR) deps: V8: cherry-pick 5f4413194480 (Stephen Belanger) #36394
  • [1a104bac74] - (SEMVER-MINOR) deps: V8: cherry-pick 272445f10927 (Stephen Belanger) #36394
  • [827ae05538] - (SEMVER-MINOR) deps: V8: backport c0fceaa0669b (Stephen Belanger) #36394
  • [f31a6114a4] - deps: V8: cherry-pick 530080c44af2 (Milad Fa) #38489
  • [4001dd28ba] - dgram: extract cluster lazy loading method to make it testable (Rongjian Zhang) #38563
  • [a0dc194e31] - doc: document buffer.kStringMaxLength (Tobias Nießen) #38688
  • [8590c151cd] - doc: update abort signal in fs promise api example (Moritz Kneilmann) #38669
  • [0100a3b026] - doc: add documentation for fs.WriteStream.close() (Hitesh Sharma) #38610
  • [5c38a554ec] - doc: clarify synchronous blocking of Worker stdio (James M Snell) #38658
  • [1765e32c45] - doc: update contact info (Gabriel Schulhof) #38689
  • [c4b161cb89] - doc: change color of doctag on night mode (Qingyu Deng) #38652
  • [6620a3182e] - doc: add ESM code examples in url.md (Antoine du Hamel) #38651
  • [d3de0ef5d4] - doc: fix fs.openSync() signature (Luigi Pinca) #38591
  • [56bf6c1bcd] - doc: typo stats() should be stat(); clarity (Bryan Field) #38541
  • [1d9fd49f41] - doc: fix code example in ecdh.setPublicKey() (Jordan Baczuk) #38542
  • [4c70e42928] - doc: use HEAD instead of master for links (Antoine du Hamel) #38518
  • [ae9128ec61] - doc: clarify DiffieHellmanGroup class docs (Nitzan Uziely) #38363
  • [e59131d97f] - doc: fix broken AHAFS link in fs doc (Rich Trott) #38534
  • [e9d4c8587a] - doc: use AIX instead of Aix in fs.md (Rich Trott) #38535
  • [e0118f347a] - doc: remove extraneous dash from flag prefix (Rodolfo Carvalho) #38532
  • [9e10e1a76f] - doc: corrected workload name as per the latest VS Installer (MrJithil) #38500
  • [38644d6f96] - doc: use sentence case in headers in src/crypto/README.md (Rich Trott) #38524
  • [347b9f2304] - errors: remove input from ERR_INVALID_URL message (moander) #38614
  • [5b40e2f596] - events: use nullish coalencing operator (Voltrex) #38328
  • [3a5856cbc3] - fs: fix async iterator partial writes (Nitzan Uziely) #38615
  • [e8761186a5] - fs: fix error when writing buffers > INT32_MAX (Zach Bjornson) #38546
  • [47080bcfc8] - fs: use assert in fsCall argument checking (Rongjian Zhang) #38519
  • [3d8b8e133f] - http: refactor to remove redundant argument of _deferToConnect (Rongjian Zhang) #38598
  • [c0deeeacb2] - lib: support setting process.env.TZ on windows (James M Snell) #38642
  • [cf4dc80d5f] - lib: make IterableWeakMap safe to iterate (Antoine du Hamel) #38523
  • [90b640efb1] - meta: add v8 team (Jiawen Geng) #38566
  • [4c4902748c] - (SEMVER-MINOR) module: add support for URL to import.meta.resolve (Antoine du Hamel) #38587
  • [14a2a00cda] - node-api: faster threadsafe_function (Fedor Indutny) #38506
  • [be4b3a4164] - path: inline conditions (Voltrex) #38613
  • [c182198c44] - (SEMVER-MINOR) process: add 'worker' event (James M Snell) #38659
  • [e2b8454582] - repl: fix Ctrl+C on top level await (Antoine du Hamel) #38656
  • [718ad105e5] - src: fix fatal errors when a current isolate not exist (legendecas) #38624
  • [524a9d6fcd] - src: update cares_wrap OpenBSD defines (Anna Henningsen) #38670
  • [6b409cf664] - src: remove extra semi after member fn (Shelley Vohr) #38686
  • [bfec80fd66] - src: make workers messaging more resilient (Juan José Arboleda) #38510
  • [ff1b4322f5] - test: refactor test-readline-interface to be shorter (Juan José Arboleda) #38691
  • [8eea317227] - test: stream.finished detects a destroyed IncomingMessage (Nitzan Uziely) #38661
  • [5b25fbe266] - test: set common.bits to 64 for riscv64 (Andreas Schwab) #38626
  • [5a0b52120a] - test: improve coverage of lib/_http_client.js (Rongjian Zhang) #38599
  • [3d0fad3840] - test: improve coverage of lib/os.js (Rongjian Zhang) #38653
  • [16b2fb4e0c] - test: increase coverage for repl (ZiJian Liu) #38559
  • [8f78c6646e] - test: call functions internally (Voltrex) #38560
  • [178fe215a4] - test: increase coverage for Histogram (ZiJian Liu) #38555
  • [95db7d5afc] - test: improve fs coverage (Rongjian Zhang) #38517
  • [f2f768f261] - test: complete coverage of querystring (Rongjian Zhang) #38520
  • [5b44107ae9] - test: increase coverage for AbortController (ZiJian Liu) #38514
  • [662265074c] - test: increase coverage for Blob (ZiJian Liu) #38515
  • [89e1daccf3] - test: run message and pseudo-tty tests in parallel (Richard Lau) #38502
  • [727c2bcc24] - test: move test-net-connect-econnrefused from pummel to sequential (Rich Trott) #38462
  • [e64ebac2da] - test: fix flaky inspector-cli tests when breakpionts are restored (Rich Trott) #38431
  • [b51b4feece] - test: skip tests for openssl-3.0.0-alpha15 (Daniel Bevenius) #38451
  • [db5ee23edf] - test: update OpenSSL 3.0.0-alpha15 error messages (Daniel Bevenius) #38451
  • [24472d9e0c] - test,repl: fix tests when inspector is disabled (Antoine du Hamel) #38564
  • [267a84f5e1] - tools: remove redundant v8 config (Jiawen Geng) #38565
  • [a028805f1b] - tools: update ESLint to 7.26.0 (Colin Ihrig) #38605
  • [ec8ab22ce6] - (SEMVER-MINOR) tools: add Worker to type-parser (James M Snell) #38659
  • [151488539b] - tools: make GH Actions workflows work if default branch is not master (Antoine du Hamel) #38516
  • [c0f0c9a92d] - typings: add JSDoc typings for readline (Voltrex) #38253
  • [fbf02e3198] - (SEMVER-MINOR) util: add util.types.isKeyObject and util.types.isCryptoKey (Filip Skokan) #38619
  • [070ee4bb94] - Revert "worker: remove ERR_CLOSED_MESSAGE_PORT" (Juan José Arboleda) #38510

2021-05-04, Version 16.1.0 (Current), @targos

Notable Changes

  • [8a90f55a05] - (SEMVER-MINOR) fs: allow no-params fsPromises fileHandle read (Nitzan Uziely) #38287

Commits

  • [28e16488cf] - async_hooks,doc: replace process.stdout.fd with 1 (Darshan Sen) #38382
  • [cbab7ec6e5] - benchmark: avoid using console.log() (Antoine du Hamel) #38370
  • [ba15b20062] - benchmark: use process.hrtime.bigint() (Antoine du Hamel) #38369
  • [bc6e719884] - bootstrap: freeze more intrinsics (Antoine du Hamel) #38217
  • [29faf0f12e] - build: fix label-pr workflow (Michaël Zasso) #38399
  • [b5d669a6ea] - build: label PRs with GitHub Action instead of nodejs-github-bot (Phillip Johnsen) #38301
  • [195f679331] - crypto: don't crash with some selfsigned certs (Nils Dralle) #37990
  • [4b073b0beb] - crypto: fix generateKeyPair type checks (Nitzan Uziely) #38364
  • [c1d9b5b386] - crypto: fix scrypt keylen validation (Antoine du Hamel) #38385
  • [7354479ad5] - crypto: fix DiffieHellman generator validation (eladkeyshawn) #38311
  • [0e446d6048] - debugger: enable linter on internal/inspector/inspect_client (Antoine du Hamel) #38417
  • [9f0e80aa4d] - debugger: refactor internal/inspector/_inspect to use more primordials (Antoine du Hamel) #38406
  • [a0c566f85a] - debugger: apply automatic lint fixes for inspect_repl.js (Rich Trott) #38411
  • [b884ea739b] - debugger: apply automatic lint fixes for _inspect.js (Rich Trott) #38411
  • [f946aa0360] - debugger: remove unused function argument (Rich Trott) #38400
  • [203a9689a3] - debugger: align message with Node.js standard (Rich Trott) #38400
  • [ef617dcbb0] - debugger: add usage example for --port (Rafael Gonzaga) #38400
  • [37b5ce2d5a] - debugger: fix race condition/deadlock on initialization (Rich Trott) #38161
  • [2a6203d155] - debugger: replace internal use of deprecated API (Rich Trott) #38161
  • [6fff9fff97] - debugger: allow longer time to connect (Rich Trott) #38161
  • [def85daace] - debugger: accommodate line chunking in Windows (Rich Trott) #38161
  • [07361e6b77] - debugger: fix inspect restart on Windows (Rich Trott) #38161
  • [d65615e119] - debugger: remove unused code (Rich Trott) #38161
  • [62b03bc4f6] - debugger: move node-inspect to internal library (Rich Trott) #38161
  • [e3b75cb5aa] - deps: V8: cherry-pick fd75c97d3f56 (Michaël Zasso) #38455
  • [aabddfbeb5] - deps: upgrade npm to 7.11.2 (Ruy Adorno) #38475
  • [7b9fb92d51] - deps: update to [email protected] (Guy Bedford) #38450
  • [47626c52a3] - deps: patch V8 to 9.0.257.24 (Michaël Zasso) #38423
  • [f455e08621] - deps: patch V8 to 9.0.257.21 (Michaël Zasso) #38333
  • [dd61a26d8c] - deps: update llhttp to 6.0.1 (Fedor Indutny) #38359
  • [05f41cdbcc] - deps: patch V8 to 9.0.257.19 (Michaël Zasso) #38270
  • [224faa0a05] - Revert "doc: os.uptime() temporary bug notice" (Michaël Zasso) #38494
  • [3b0480dde8] - doc: document 'secureConnect' event limitation (James M Snell) #38447
  • [92586046ec] - doc: fix outdated util inspect documentation and layout example (Ruben Bridgewater) #37079
  • [13de4cf1ca] - doc: mark Node.js 10 as End-of-Life (Richard Lau) #38482
  • [3cbfde1f25] - doc: mark querystring api as legacy (James M Snell) #38436
  • [a5929c2487] - doc: update node-api support matrix (Michael Dawson) #38424
  • [f08650cefe] - doc: add arguments for stream event of Http2Server and Http2SecureServer (Qingyu Deng) #37892
  • [2d59273bed] - doc: indicate that abort tests do not generate core files (Rich Trott) #38422
  • [f1970127ee] - doc: add try/catch in http2 respondWithFile example (Matteo Collina) #38410
  • [f6f1317f43] - doc: note the system requirements for V8 tests (DeeDeeG) #38319
  • [4b19beaf3c] - doc: minor clarification to pathObject (James M Snell) #38437
  • [1eae4af6f7] - doc: clarify that fs.Dir async iterator closes automatically (James M Snell) #38438
  • [14afb39259] - doc: document new TCP_KEEPCNT and TCP_KEEPINTVL socket option defaults (Arnold Zokas) #38313
  • [ed5ef21690] - doc: do not mention TCP in the allowHalfOpen option description (Luigi Pinca) #38360
  • [042985c139] - doc: update message to match actual output (Rich Trott) #35271
  • [bcc5e2af76] - doc: request default snap track be updated for LTS (Rod Vagg) #37708
  • [dfd4c7ba93] - doc: mark process.hrtime() as legacy (Antoine du Hamel) #38371
  • [67cd88da00] - doc: fix typo in worker_threads.md (takayama) #38368
  • [a9314cda7d] - doc: fix version history for "exports" patterns (Antoine du Hamel) #38355
  • [76885cd578] - doc: fix package.json "imports" field history (Antoine du Hamel) #38356
  • [0e88ae7ec1] - doc: fix typo in buffer.md (divlo) #38323
  • [1cccc2da51] - doc: fix YAML comment opening tags (Jayden Seric) #38324
  • [25052dc987] - doc: add nodejs-sec email template (Daniel Bevenius) #38290
  • [3858029262] - doc: update TSC members list with three new members (Rich Trott) #38352
  • [2eef587674] - doc: use foo.prototype.bar notation in buffer.md (Voltrex) #38032
  • [8a90f55a05] - (SEMVER-MINOR) fs: allow no-params fsPromises fileHandle read (Nitzan Uziely) #38287
  • [a696f1080c] - inspector: remove redundant method for connection check (Yash Ladha) #37986
  • [fcac2e0363] - lib: harden lint checks for globals (Antoine du Hamel) #38419
  • [277122e1fa] - lib: fix and improve os typings (Akhil Marsonya) #38316
  • [f2c0258b4c] - lib: add support for JSTransferable as a mixin (James M Snell) #38383
  • [96f54d3446] - meta: post comment when pr labeled fast-track (James M Snell) #38446
  • [4711f57cf2] - perf_hooks: add toJSON to performance class (Yash Ladha) #37771
  • [013fa59602] - perf_hooks: fix PerformanceObserver 'gc' crash (James M Snell) #38414
  • [10147f191e] - readline: move utilities to internal modules (Antoine du Hamel) #38466
  • [620ee42ab4] - repl: document top level await limitation with const/let (James M Snell) #38449
  • [aa24681dcb] - repl: display prompt once after error callback (Anna Henningsen) #38314
  • [9c06103a4f] - src: fix validation of negative offset to avoid abort (James M Snell) #38421
  • [7d8cc2abf1] - src: use %progbits instead of @progbits (Stephen Gallagher) #38312
  • [17856f1f88] - src: print arbitrary javascript exception value in node report (legendecas) #38009
  • [769a210d55] - src: refactor to use THROW_* argument based snprintf (Filip Skokan) #38357
  • [e3538bbcd2] - src: fix abort in pbkdf2 (Tobias Nießen) #38354
  • [09cacd7418] - src: fix setting Converter sub char length (James M Snell) #38331
  • [3649ec5276] - src: avoid deferred gc/cleanup for Buffer.from (James M Snell) #38337
  • [f2ffaba78c] - stream: the position of _read() is wrong (helloyou2012) #38292
  • [7ce39b8608] - test: fix common.mustCall length and name properties (Antoine du Hamel) #38464
  • [d1cd1178e7] - test: address deprecation warning (Rich Trott) #38448
  • [67e9e71f75] - test: crypto KeyObject.from() ERR_INVALID_ARG_TYPE (pezhmanparsaee) #37890
  • [9ad611c0b2] - test: fix flaky test-crypto-timing-safe-dqual-benchmarks (Rich Trott) #38476
  • [10b6b4e244] - test: update url Web Platform Tests (Leko) #38435
  • [4f6c4eb144] - test: move abort test from pummel to abort directory (Rich Trott) #38396
  • [231ef4b0ce] - test: move slower tests into pummel and skip on slow devices (Rich Trott) #38395
  • [45322dfa12] - test: skip some pummel tests on slower machines (Rich Trott) #38394
  • [1bc47a4c0f] - test: fix test to allow quictls fork of OpenSSL 3 (Richard Lau) #38372
  • [6ac02755f5] - test: extend timeout on debugger tests for slower machines (Rich Trott) #38161
  • [93b0c78de0] - test: fix comment typo (Rich Trott) #38161
  • [6c3e5043b0] - test: fix test-inspector-cli-address (Rich Trott) #38161
  • [27d7588ad5] - test: add ancestor package.json checks for tmpdir (Richard Lau) #38285
  • [30de03630e] - test: replace function with arrow function and remove unused argument (Andres) #38235
  • [eb8f5ce44f] - test: use .test domain for not found address (Richard Lau) #38286
  • [a4084d66c6] - test,debugger: migrate node-inspect tests to core (Rich Trott) #38161
  • [16eb078aa8] - test,readline: improve tab completion coverage (Antoine du Hamel) #38465
  • [b3ca1b358e] - timers: remove redundant unref calls (Giora Guttsait) #38320
  • [5b393d9258] - tls: validate ticket keys buffer (Antoine du Hamel) #38308
  • [f6745e9370] - tls: fix tlsSocket.setMaxSendFragment abort (eladkeyshawn) #38170
  • [499da2d9e3] - tools: use mktemp to create the workspace directory (Luigi Pinca) #38432
  • [8a83bfd1bd] - tools: use a shallow clone of the npm/cli repository (Luigi Pinca) #38463
  • [bec959ef8b] - tools: disable LTO for "v8_cppgc_shared" target (Jesse Chan) #38346
  • [6350d35b3c] - tools: remove fixer for non-ascii-character ESLint custom rule (Rich Trott) #38413
  • [dce8d2968a] - tools: fix doc generation when version info is not available (Antoine du Hamel) #38398
  • [1033f6c8cb] - tools: add _depot_tools to PATH (for V8 tests) (DeeDeeG) #38299
  • [28f02cb8cf] - tools: update ESLint to 7.25.0 (Colin Ihrig) #38378
  • [f1ea2c8e2b] - tools: update markdown linter rules (Rich Trott) #38384
  • [02e875c645] - tools: remove node-inspect from license (Rich Trott) #38161
  • [d3bd4b4771] - tools: fix type mismatch in test runner (Richard Lau) #38289
  • [9a2651352b] - typings: add JSDoc typings for fs (Voltrex) #38306
  • [e389e86b6b] - typings: add JSDoc typings for util (Rohit Gohri) #38213
  • [ec5b06eae3] - util: fix infinite recursion during inspection (Ruben Bridgewater) #37079
  • [67bd0ec15c] - zlib: fix brotli flush range (Khaidi Chu) #38408

2021-04-20, Version 16.0.0 (Current), @BethGriggs

Notable Changes

Deprecations and Removals

  • (SEMVER-MAJOR) fs: remove permissive rmdir recursive (Antoine du Hamel) #37216
  • (SEMVER-MAJOR) fs: runtime deprecate rmdir recursive option (Antoine du Hamel) #37302
  • (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('http_parser') (James M Snell) #37813
  • (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('url') (James M Snell) #37799
  • (SEMVER-MAJOR) lib: make process.binding('util') return only type checkers (Anna Henningsen) #37819
  • (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('crypto') (James M Snell) #37790
  • (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('signal_wrap') (James M Snell) #37800
  • (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('v8') (James M Snell) #37789
  • (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('async_wrap') (James M Snell) #37576
  • (SEMVER-MAJOR) module: remove module.createRequireFromPath (Antoine du Hamel) #37201
  • (SEMVER-MAJOR) module: runtime deprecate subpath folder mappings (Antoine du Hamel) #37215
  • (SEMVER-MAJOR) module: runtime deprecate "main" index and extension lookups (Antoine du Hamel) #37206
  • (SEMVER-MAJOR) module: runtime deprecate invalid package.json main entries (Antoine du Hamel) #37204
  • (SEMVER-MAJOR) process: runtime deprecate changing process.config (James M Snell) #36902

Stable Timers Promises API

The Timers Promises API provides an alternative set of timer functions that return Promise objects. Added in Node.js v15.0.0, in this release they graduate from experimental status to stable.

Contributed by James Snell - #38112

Toolchain and Compiler Upgrades

Node.js v16.0.0 will be the first release where we ship prebuilt binaries for Apple Silicon. While we’ll be providing separate tarballs for the Intel (darwin-x64) and ARM (darwin-arm64) architectures the macOS installer (.pkg) will be shipped as a ‘fat’ (multi-architecture) binary.

  • (SEMVER-MAJOR) build: remove support for Python 2 (Christian Clauss) #36691
  • (SEMVER-MAJOR) build: default PYTHON to python3 in Makefile (Michaël Zasso) #37764
  • build: update Makefile to support fat binary (Ash Cripps) #37861
  • (SEMVER-MAJOR) build: enable ASLR (PIE) on OS X (woodfairy) #35704
  • build: warn for gcc versions earlier than 8.3.0 (Richard Lau) #37935
  • (SEMVER-MAJOR) doc: update minimum supported Xcode to 11 (Michaël Zasso) #37872
  • (SEMVER-MAJOR) doc: update minimum supported GCC to 8.3 (Michaël Zasso) #37871
  • (SEMVER-MAJOR) doc: update AIX to GCC8 for v16.x (Ash Cripps) #37677
  • tools: set arch in Distribution.xml (Ash Cripps) #38261

V8 9.0

The V8 JavaScript engine is updated to V8 9.0, including performance tweaks and improvements.

This update also brings the ECMAScript RegExp Match Indices, which provide the start and end indices of the captured string. The indices array is available via the .indices property on match objects when the regular expression has the /d flag.

Contributed by Michaël Zasso - #37587

Other Notable Changes

  • (SEMVER-MINOR) assert: graduate assert.match and assert.doesNotMatch (James M Snell) #38111
  • (SEMVER-MAJOR) buffer: expose btoa and atob as globals (James M Snell) #37786
  • (SEMVER-MAJOR) deps: bump minimum ICU version to 68 (Michaël Zasso) #37330
  • deps: update ICU to 69.1 (Michaël Zasso) #38178
  • deps: update llhttp to 6.0.0 (Fedor Indutny) #38277
  • deps: upgrade npm to 7.10.0 (Ruy Adorno) #38254
  • (SEMVER-MINOR) http: add http.ClientRequest.getRawHeaderNames() (simov) #37660
  • (SEMVER-MAJOR) lib,src: update cluster to use Parent (Michael Dawson) #36478
  • (SEMVER-MINOR) module: add support for node:‑prefixed require(…) calls (ExE Boss) #37246
  • (SEMVER-MINOR) perf_hooks: add histogram option to timerify (James M Snell) #37475
  • (SEMVER-MINOR) repl: add auto‑completion for node:‑prefixed require(…) calls (ExE Boss) #37246
  • (SEMVER-MINOR) util: add getSystemErrorMap() impl (eladkeyshawn) #38101

Semver-Major Commits

  • [324a6c235a] - (SEMVER-MAJOR) async_hooks: add thisArg to AsyncResource.bind (James M Snell) #36782
  • [d1e2184c8e] - (SEMVER-MAJOR) buffer: expose btoa and atob as globals (James M Snell) #37786
  • [4268fae04a] - (SEMVER-MAJOR) build: remove support for Python 2 (Christian Clauss) #36691
  • [c3a5e15ebe] - (SEMVER-MAJOR) build: default PYTHON to python3 in Makefile (Michaël Zasso) #37764
  • [1d8c022544] - (SEMVER-MAJOR) build: update Makefile to support fat binary (Ash Cripps) #37861
  • [38f32386c1] - (SEMVER-MAJOR) build: include minimal V8 headers in distribution (Michaël Zasso) #37570
  • [a19af5ee71] - (SEMVER-MAJOR) build: use C++11 ABI with libstdc++ (Anna Henningsen) #36634
  • [8d6b74d347] - (SEMVER-MAJOR) build: enable ASLR (PIE) on OS X (woodfairy) #35704
  • [732ad99e47] - (SEMVER-MAJOR) deps: update V8 to 9.0.257.11 (Michaël Zasso) #37587
  • [43cc8e4b2e] - (SEMVER-MAJOR) deps: bump minimum ICU version to 68 (Michaël Zasso) #37330
  • [c5ff019a4e] - (SEMVER-MAJOR) deps: update V8 to 8.9.255.19 (Michaël Zasso) #37330
  • [c7b3292251] - (SEMVER-MAJOR) deps: update V8 to 8.8.278.17 (Michaël Zasso) #36139
  • [48db20f6f5] - (SEMVER-MAJOR) deps: update V8 to 8.7.220 (Michaël Zasso) #35700
  • [d85e1f0703] - (SEMVER-MAJOR) dns: use url module instead of punycode for IDNA (Antoine du Hamel) #35091
  • [290c158018] - (SEMVER-MAJOR) doc: update minimum supported Xcode to 11 (Michaël Zasso) #37872
  • [1ff2918d80] - (SEMVER-MAJOR) doc: update minimum supported GCC to 8.3 (Michaël Zasso) #37871
  • [2706e67116] - (SEMVER-MAJOR) doc: update AIX to GCC8 for v16.x (Ash Cripps) #37677
  • [5ae5ca90ef] - (SEMVER-MAJOR) doc: add http.IncomingMessage#connection (Pranshu Srivastava) #33768
  • [83d6e63aee] - (SEMVER-MAJOR) events: change EventTarget handler exception behavior (Nitzan Uziely) #37237
  • [9948036ee0] - (SEMVER-MAJOR) fs: remove permissive rmdir recursive (Antoine du Hamel) #37216
  • [d4693ff430] - (SEMVER-MAJOR) fs: add validation for fd and path (Dylan Elliott) #35187
  • [0ddd75bcd8] - (SEMVER-MAJOR) fs: runtime deprecate rmdir recursive option (Antoine du Hamel) #37302
  • [da217d0773] - (SEMVER-MAJOR) fs: fix flag and mode validation (James M Snell) #37480
  • [2ef9a76ece] - (SEMVER-MAJOR) http: use objects with null prototype in Agent (Michaël Zasso) #36409
  • [25e30005b8] - (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('http_parser') (James M Snell) #37813
  • [8bb4e048af] - (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('url') (James M Snell) #37799
  • [fe73e4d578] - (SEMVER-MAJOR) lib: make process.binding('util') return only type checkers (Anna Henningsen) #37819
  • [3bee6d8aad] - (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('crypto') (James M Snell) #37790
  • [ac00df112e] - (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('signal_wrap') (James M Snell) #37800
  • [ae595d76e3] - (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('v8') (James M Snell) #37789
  • [104dac79cc] - (SEMVER-MAJOR) lib: aggregate errors to avoid error swallowing (Antoine du Hamel) #37460
  • [1468c9ff7c] - (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('async_wrap') (James M Snell) #37576
  • [295e766c27] - (SEMVER-MAJOR) lib: remove usage of url.parse (raisinten) #36853
  • [cb3020d824] - (SEMVER-MAJOR) lib: add error handling for input stream (rexagod) #31603
  • [15164cebce] - (SEMVER-MAJOR) lib,src: update cluster to use Parent (Michael Dawson) #36478
  • [3cc9aec988] - (SEMVER-MAJOR) module: runtime deprecate subpath folder mappings (Antoine du Hamel) #37215
  • [9fab73c73b] - (SEMVER-MAJOR) module: runtime deprecate "main" index and extension lookups (Antoine du Hamel) #37206
  • [76a073b67e] - (SEMVER-MAJOR) module: runtime deprecate invalid package.json main entries (Antoine du Hamel) #37204
  • [674614b3f5] - (SEMVER-MAJOR) module: remove module.createRequireFromPath (Antoine du Hamel) #37201
  • [aecd5ebf49] - (SEMVER-MAJOR) module: only set cache when finding module succeeds (Yongsheng Zhang) #36642
  • [f0bf373176] - (SEMVER-MAJOR) perf_hooks: make performance a global (James M Snell) #37970
  • [f3eb224c83] - (SEMVER-MAJOR) perf_hooks: complete overhaul of the implementation (James M Snell) #37136
  • [f1753d4c76] - (SEMVER-MAJOR) process: disallow adding options to process.allowedNodeEnvironmentFlags (Antoine du Hamel) #36660
  • [96f3977ded] - (SEMVER-MAJOR) process: runtime deprecate changing process.config (James M Snell) #36902
  • [45dbcbef90] - (SEMVER-MAJOR) readline: cursorTo throw error on NaN (Zijian Liu) #36379
  • [bf79987433] - (SEMVER-MAJOR) src: mark internally exported functions as explicitly internal (Tyler Ang-Wanek) #37000
  • [1fe571aa0c] - (SEMVER-MAJOR) src: inline AsyncCleanupHookHandle in headers (Tyler Ang-Wanek) #37000
  • [dfc288e7fd] - (SEMVER-MAJOR) src: clean up embedder API (Anna Henningsen) #35897
  • [65e8864fa3] - (SEMVER-MAJOR) worker: send correct error status for worker init (Yash Ladha) #36242

Semver-Minor Commits

  • [944a956087] - (SEMVER-MINOR) assert: graduate assert.match and assert.doesNotMatch (James M Snell) #38111
  • [6a1986d50a] - (SEMVER-MINOR) deps: update llhttp to 5.1.0 (Fedor Indutny) #38146
  • [069b5df4f6] - (SEMVER-MINOR) module: add support for node:‑prefixed require(…) calls (ExE Boss) #37246
  • [b803bca4fa] - (SEMVER-MINOR) perf_hooks: add histogram option to timerify (James M Snell) #37475
  • [95391fe689] - (SEMVER-MINOR) repl: add auto‑completion for node:‑prefixed require(…) calls (ExE Boss) #37246
  • [15b8e6b1c4] - (SEMVER-MINOR) timers: graduate awaitable timers and improve docs (James M Snell) #38112
  • [802171057f] - (SEMVER-MINOR) util: add getSystemErrorMap() impl (eladkeyshawn) #38101

Semver-Patch Commits