chore(deps): update node.js to v20

Review changes
Download
Patches
Plain diff

Overview 0
Commits 1
Pipelines 6
Changes 3

Open Renovate Bot requested to merge renovate/node-20.x into develop 2 years ago

Overview 0
Commits 1
Pipelines 6
Changes 3

This MR contains the following updates:

Package	Type	Update	Change
node	image	major	`18.16.0` -> `20.8.0`
node	final	major	`18.16.0-alpine3.16` -> `20.2.0-alpine3.16`

Release Notes

nodejs/node

`v20.8.0`: 2023-09-28, Version 20.8.0 (Current), @ruyadorno

Compare Source

Notable Changes

Stream performance improvements

Performance improvements to writable and readable streams, improving the creation and destruction by ±15% and reducing the memory overhead each stream takes in Node.js

Contributed by Benjamin Gruenbaum in #49745 and Raz Luvaton in #49834.

Performance improvements for readable webstream, improving readable stream async iterator consumption by ±140% and improving readable stream pipeTo consumption by ±60%

Contributed by Raz Luvaton in #49662 and #49690.

Rework of memory management in `vm` APIs with the `importModuleDynamically` option

This rework addressed a series of long-standing memory leaks and use-after-free issues in the following APIs that support importModuleDynamically:

vm.Script
vm.compileFunction
vm.SyntheticModule
vm.SourceTextModule

This should enable affected users (in particular Jest users) to upgrade from older versions of Node.js.

Contributed by Joyee Cheung in #48510.

Other notable changes

[32d4d29d02] - deps: add v8::Object::SetInternalFieldForNodeCore() (Joyee Cheung) #49874
[0e686d096b] - doc: deprecate fs.F_OK, fs.R_OK, fs.W_OK, fs.X_OK (Livia Medeiros) #49683
[a5dd057540] - doc: deprecate util.toUSVString (Yagiz Nizipli) #49725
[7b6a73172f] - doc: deprecate calling promisify on a function that returns a promise (Antoine du Hamel) #49647
[1beefd5f16] - esm: set all hooks as release candidate (Geoffrey Booth) #49597
[b0ce78a75b] - module: fix the leak in SourceTextModule and ContextifySript (Joyee Cheung) #48510
[4e578f8ab1] - module: fix leak of vm.SyntheticModule (Joyee Cheung) #48510
[69e4218772] - module: use symbol in WeakMap to manage host defined options (Joyee Cheung) #48510
[14ece0aa76] - (SEMVER-MINOR) src: allow embedders to override NODE_MODULE_VERSION (Cheng Zhao) #49279
[9fd67fbff0] - stream: use bitmap in writable state (Raz Luvaton) #49834
[0ccd4638ac] - stream: use bitmap in readable state (Benjamin Gruenbaum) #49745
[7c5e322346] - stream: improve webstream readable async iterator performance (Raz Luvaton) #49662
[80b342cc38] - (SEMVER-MINOR) test_runner: accept testOnly in run (Moshe Atlow) #49753
[17a05b141d] - (SEMVER-MINOR) test_runner: add junit reporter (Moshe Atlow) #49614

Commits

[4879e3fbbe] - benchmark: add a benchmark for read() of ReadableStreams (Debadree Chatterjee) #49622
[78a6c73157] - benchmark: shorten pipe-to by reducing number of chunks (Raz Luvaton) #49577
[4126a6e4c9] - benchmark: fix webstream pipe-to (Raz Luvaton) #49552
[6010a91825] - bootstrap: do not expand argv1 for snapshots (Joyee Cheung) #49506
[8480280c4b] - bootstrap: only use the isolate snapshot when compiling code cache (Joyee Cheung) #49288
[b30754aa87] - build: run embedtest using node executable (Joyee Cheung) #49506
[31db0b8e2b] - build: add --write-snapshot-as-array-literals to configure.py (Joyee Cheung) #49312
[6fcb51d3ba] - debugger: use internal/url.URL instead of url.parse (LiviaMedeiros) #49590
[32d4d29d02] - deps: add v8::Object::SetInternalFieldForNodeCore() (Joyee Cheung) #49874
[ad37cadc3f] - deps: V8: backport de9a5de (Joyee Cheung) #49703
[cdd1c66222] - deps: V8: cherry-pick b33bf2d (Joyee Cheung) #49703
[61d18d6473] - deps: update undici to 5.24.0 (Node.js GitHub Bot) #49559
[b8a4fef393] - deps: remove pthread-fixes.c from uv.gyp (Ben Noordhuis) #49744
[6c86c0683c] - deps: update googletest to d1467f5 (Node.js GitHub Bot) #49676
[1424404742] - deps: update nghttp2 to 1.56.0 (Node.js GitHub Bot) #49582
[15b54ff95d] - deps: update googletest to 8a6feab (Node.js GitHub Bot) #49463
[2ceab877c2] - deps: update corepack to 0.20.0 (Node.js GitHub Bot) #49464
[4814872ddc] - doc: fix DEP0176 number (LiviaMedeiros) #49858
[0e686d096b] - doc: deprecate fs.F_OK, fs.R_OK, fs.W_OK, fs.X_OK (Livia Medeiros) #49683
[5877c403a2] - doc: add mertcanaltin as a triager (mert.altin) #49826
[864fe56432] - doc: add git node backport way to the backporting guide (Raz Luvaton) #49760
[e0f93492d5] - doc: improve documentation about ICU data fallback (Joyee Cheung) #49666
[a5dd057540] - doc: deprecate util.toUSVString (Yagiz Nizipli) #49725
[774c1cfd52] - doc: add missing function call to example for util.promisify (Jungku Lee) #49719
[fe78a34845] - doc: update output of example in mimeParams.set() (Deokjin Kim) #49718
[4175ea33bd] - doc: add missed inspect with numericSeparator to example (Deokjin Kim) #49717
[3a88571972] - doc: fix history comments (Antoine du Hamel) #49701
[db4ab1ccbb] - doc: add missing history info for import.meta.resolve (Antoine du Hamel) #49700
[a304d1ee19] - doc: link maintaining deps to pull-request.md (Marco Ippolito) #49716
[35294486ad] - doc: fix print results in events (Jungku Lee) #49548
[9f0b0e15c9] - doc: alphabetize cli.md sections (Geoffrey Booth) #49668
[7b6a73172f] - doc: deprecate calling promisify on a function that returns a promise (Antoine du Hamel) #49647
[d316b32fff] - doc: update corepack.md to account for 0.20.0 changes (Antoine du Hamel) #49486
[c2eac7dc7c] - doc: remove @anonrig from performance initiative (Yagiz Nizipli) #49641
[3d839fbf87] - doc: mark Node.js 16 as End-of-Life (Richard Lau) #49651
[53fb5aead8] - doc: save user preference for JS flavor (Vidar Eldøy) #49526
[e3594d5658] - doc: update documentation for node:process warning (Shubham Pandey) #49517
[8e033c3963] - doc: rename possibly confusing variable and CSS class (Antoine du Hamel) #49536
[d0e0eb4bb3] - doc: update outdated history info (Antoine du Hamel) #49530
[b4724e2e3a] - doc: close a parenthesis (Sébastien Règne) #49525
[0471c5798e] - doc: cast GetInternalField() return type to v8::Value in addons.md (Joyee Cheung) #49439
[9f8bea3dda] - doc: fix documentation for input option in child_process (Ariel Weiss) #49481
[f3fea92f8a] - doc: fix missing imports in test.run code examples (Oshri Asulin) #49489
[e426b77b67] - doc: fix documentation for fs.createWriteStream highWaterMark option (Mert Can Altın) #49456
[2b119108ff] - doc: updated releasers instructions for node.js website (Claudio W) #49427
[b9d4a80183] - doc: edit import.meta.resolve documentation (Antoine du Hamel) #49247
[f67433f666] - doc,tools: switch to @node-core/utils (Michaël Zasso) #49851
[142e256fc5] - errors: improve classRegExp in errors.js (Uzlopak) #49643
[6377f1bce2] - errors: use determineSpecificType in more error messages (Antoine du Hamel) #49580
[05f0fcb4c4] - esm: identify parent importing a url with invalid host (Jacob Smith) #49736
[8a6f5fb8f3] - esm: fix return type of import.meta.resolve (Antoine du Hamel) #49698
[a6140f1b8c] - esm: update loaders warning (Geoffrey Booth) #49633
[521a9327e0] - esm: fix support for URL instances in register (Antoine du Hamel) #49655
[3a9ea0925a] - esm: clarify ERR_REQUIRE_ESM errors (Daniel Compton) #49521
[1beefd5f16] - esm: set all hooks as release candidate (Geoffrey Booth) #49597
[be48267888] - esm: remove return value for Module.register (Antoine du Hamel) #49529
[e74a075124] - esm: refactor test-esm-loader-resolve-type (Geoffrey Booth) #49493
[17823b3533] - esm: refactor test-esm-named-exports (Geoffrey Booth) #49493
[f34bd15ac1] - esm: refactor mocking test (Geoffrey Booth) #49465
[ec323bbd99] - fs: replace SetMethodNoSideEffect in node_file (CanadaHonk) #49857
[6acf800123] - fs: improve error performance for unlinkSync (CanadaHonk) #49856
[31702c9403] - fs: improve readFileSync with file descriptors (Yagiz Nizipli) #49691
[835f9fe7b9] - fs: fix file descriptor validator (Yagiz Nizipli) #49752
[b618fe262f] - fs: improve error performance of opendirSync (Yagiz Nizipli) #49705
[938471ef55] - fs: improve error performance of sync methods (Yagiz Nizipli) #49593
[db3fc6d087] - fs: fix readdir and opendir recursive with unknown file types (William Marlow) #49603
[0f020ed22d] - gyp: put cctest filenames in variables (Cheng Zhao) #49178
[0ce1e94d12] - lib: update encoding sets in WHATWG API (Jungku Lee) #49610
[efd6815a7a] - lib: fix internalBinding typings (Yagiz Nizipli) #49742
[1287d5b74e] - lib: allow byob reader for 'blob.stream()' (Debadree Chatterjee) #49713
[bbc710522d] - lib: reset the cwd cache before execution (Maël Nison) #49684
[f62d649e4d] - lib: use internal fileURLToPath (Deokjin Kim) #49558
[e515046941] - lib: use internal pathToFileURL (Livia Medeiros) #49553
[00608e8070] - lib: check SharedArrayBuffer availability in freeze_intrinsics.js (Milan Burda) #49482
[8bfbe7079c] - meta: fix linter error (Antoine du Hamel) #49755
[58f7a9e096] - meta: add primordials strategic initiative (Benjamin Gruenbaum) #49706
[5366027756] - meta: bump github/codeql-action from 2.21.2 to 2.21.5 (dependabot[bot]) #49438
[fe26b74082] - meta: bump rtCamp/action-slack-notify from 2.2.0 to 2.2.1 (dependabot[bot]) #49437
[b0ce78a75b] - module: fix the leak in SourceTextModule and ContextifySript (Joyee Cheung) #48510
[4e578f8ab1] - module: fix leak of vm.SyntheticModule (Joyee Cheung) #48510
[69e4218772] - module: use symbol in WeakMap to manage host defined options (Joyee Cheung) #48510
[96874e8fbc] - node-api: enable uncaught exceptions policy by default (Chengzhong Wu) #49313
[b931aeadfd] - perf_hooks: reduce overhead of new performance_entries (Vinicius Lourenço) #49803
[ad043bac31] - process: add custom dir support for heapsnapshot-signal (Jithil P Ponnan) #47854
[8a7c10194c] - repl: don't accumulate excess indentation in .load (Daniel X Moore) #49461
[10a2adeed5] - src: improve error message when ICU data cannot be initialized (Joyee Cheung) #49666
[ce37688bac] - src: remove unnecessary todo (Rafael Gonzaga) #49227
[f611583b71] - src: use SNAPSHOT_SERDES to log snapshot ser/deserialization (Joyee Cheung) #49637
[a597cb8457] - src: port Pipe to uv_pipe_bind2, uv_pipe_connect2 (Geoff Goodman) #49667
[fb21062338] - src: set --rehash-snapshot explicitly (Joyee Cheung) #49556
[14ece0aa76] - (SEMVER-MINOR) src: allow embedders to override NODE_MODULE_VERSION (Cheng Zhao) #49279
[4b5e23c71b] - src: set ModuleWrap internal fields only once (Joyee Cheung) #49391
[2d3f5c7cab] - src: fix fs_type_to_name default value (Mustafa Ateş Uzun) #49239
[cfbcb1059c] - src: fix comment on StreamResource (rogertyang) #49193
[39fb83ad16] - src: do not rely on the internal field being default to undefined (Joyee Cheung) #49413
[9fd67fbff0] - stream: use bitmap in writable state (Raz Luvaton) #49834
[0ccd4638ac] - stream: use bitmap in readable state (Benjamin Gruenbaum) #49745
[b29d927010] - stream: improve readable webstream pipeTo (Raz Luvaton) #49690
[7c5e322346] - stream: improve webstream readable async iterator performance (Raz Luvaton) #49662
[be211ef818] - test: deflake test-vm-contextified-script-leak (Joyee Cheung) #49710
[355f10dab2] - test: use checkIfCollectable in vm leak tests (Joyee Cheung) #49671
[17cfc531aa] - test: add checkIfCollectable to test/common/gc.js (Joyee Cheung) #49671
[e49a573752] - test: add os setPriority, getPriority test coverage (Wael) #38771
[5f02711522] - test: deflake test-runner-output (Moshe Atlow) #49878
[cd9754d6a7] - test: mark test-runner-output as flaky (Joyee Cheung) #49854
[5ad00424dd] - test: use mustSucceed instead of mustCall (SiddharthDevulapalli) #49788
[3db9b40081] - test: refactor test-readline-async-iterators into a benchmark (Shubham Pandey) #49237
[2cc5ad7859] - Revert "test: mark test-http-regr-gh-2928 as flaky" (Luigi Pinca) #49708
[e5185b053c] - test: use fs.constants for fs.access constants (Livia Medeiros) #49685
[b9e5b43462] - test: deflake test-http-regr-gh-2928 (Luigi Pinca) #49574
[1fffda504e] - test: fix argument computation in embedtest (Joyee Cheung) #49506
[6e56f2db52] - test: skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) #49621
[ab3afb330d] - test: mark test-runner-watch-mode as flaky (Joyee Cheung) #49627
[185d9b50db] - test: deflake test-tls-socket-close (Luigi Pinca) #49575
[c70c74a9e6] - test: show more info on failure in test-cli-syntax-require.js (Joyee Cheung) #49561
[ed7c6d1114] - test: mark test-http-regr-gh-2928 as flaky (Joyee Cheung) #49565
[3599eebab9] - test: use spawnSyncAndExitWithoutError in sea tests (Joyee Cheung) #49543
[f79b153e89] - test: use spawnSyncAndExitWithoutError in test/common/sea.js (Joyee Cheung) #49543
[c079c73769] - test: use setImmediate() in test-heapdump-shadowrealm.js (Joyee Cheung) #49573
[667a92493c] - test: skip test-child-process-pipe-dataflow.js on Windows (Joyee Cheung) #49563
[91af0a9a3c] - Revert "test: ignore the copied entry_point.c" (Chengzhong Wu) #49515
[567afc71b8] - test: avoid copying test source files (Chengzhong Wu) #49515
[ced25a976d] - test: increase coverage of Module.register and initialize hook (Antoine du Hamel) #49532
[be02fbdb8a] - test: isolate globalPreload tests (Geoffrey Booth) #49545
[f214428845] - test: split test-crypto-dh to avoid timeout on slow machines in the CI (Joyee Cheung) #49492
[3987094569] - test: make test-dotenv-node-options locale-independent (Livia Medeiros) #49470
[34c1741792] - test: add test for urlstrings usage in node:fs (Livia Medeiros) #49471
[c3c6c4f007] - test: make test-worker-prof more robust (Joyee Cheung) #49274
[843df1a4da] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #49714
[80b342cc38] - (SEMVER-MINOR) test_runner: accept testOnly in run (Moshe Atlow) #49753
[76865515b9] - test_runner: fix test runner watch mode when no positional arguments (Moshe Atlow) #49578
[17a05b141d] - (SEMVER-MINOR) test_runner: add junit reporter (Moshe Atlow) #49614
[5672e38457] - test_runner: add jsdocs to mock.js (Caio Borghi) #49555
[b4d42a8f2b] - test_runner: fix invalid timer call (Erick Wendel) #49477
[f755e6786b] - test_runner: add jsdocs to MockTimers (Erick Wendel) #49476
[e7285d4bf0] - test_runner: fix typescript coverage (Moshe Atlow) #49406
[07a2e29bf3] - tools: support updating @reporters/github manually (Moshe Atlow) #49871
[5ac6722031] - tools: skip ruff on tools/node_modules (Moshe Atlow) #49838
[462228bd24] - tools: fix uvwasi updater (Michael Dawson) #49682
[ff81bfb958] - tools: update lint-md-dependencies to rollup@3.29.2 (Node.js GitHub Bot) #49679
[08ffc6344c] - tools: restrict internal code from using public url module (LiviaMedeiros) #49590
[728ebf6c97] - tools: update eslint to 8.49.0 (Node.js GitHub Bot) #49586
[20d038ffb1] - tools: update lint-md-dependencies to rollup@3.29.0 unified@11.0.3 (Node.js GitHub Bot) #49584
[210c15bd12] - tools: allow passing absolute path of config.gypi in js2c (Cheng Zhao) #49162
[e341efe173] - tools: configure never-stale label correctly (Michaël Zasso) #49498
[a8a8a498ce] - tools: update doc dependencies (Node.js GitHub Bot) #49467
[ac06607f9e] - typings: fix missing property in ExportedHooks (Antoine du Hamel) #49567
[097b59807a] - url: improve invalid url performance (Yagiz Nizipli) #49692
[7c2060cfac] - util: add getCwdSafe internal util fn (João Lenon) #48434
[c23c60f545] - zlib: disable CRC32 SIMD optimization (Luigi Pinca) #49511

`v20.7.0`: 2023-09-18, Version 20.7.0 (Current), @UlisesGascon

Compare Source

Notable Changes

[022f1b70c1] - src: support multiple --env-file declarations (Yagiz Nizipli) #49542
[4a1d1cad61] - crypto: update root certificates to NSS 3.93 (Node.js GitHub Bot) #49341
[a1a65f593c] - deps: upgrade npm to 10.1.0 (npm team) #49570
[6c2480cad9] - (SEMVER-MINOR) deps: upgrade npm to 10.0.0 (npm team) #49423
[bef900e56b] - doc: move and rename loaders section (Geoffrey Booth) #49261
[db4ce8a593] - doc: add release key for Ulises Gascon (Ulises Gascón) #49196
[11c85ffa98] - (SEMVER-MINOR) lib: add api to detect whether source-maps are enabled (翠 / green) #46391
[ec51e25ed7] - src,permission: add multiple allow-fs-* flags (Carlos Espa) #49047
[efdc95fbc0] - (SEMVER-MINOR) test_runner: expose location of tests (Colin Ihrig) #48975

Commits

[e84515594e] - benchmark: use tmpdir.resolve() (Livia Medeiros) #49137
[f37444e896] - bootstrap: build code cache from deserialized isolate (Joyee Cheung) #49099
[af6dc1754d] - bootstrap: do not generate code cache in an unfinalized isolate (Joyee Cheung) #49108
[cade5716df] - build: add symlink to compile_commands.json file if needed (Juan José) #49260
[34a2590b05] - build: expand when we run internet tests (Michael Dawson) #49218
[f637fd46ab] - build: fix typo libray -> library (configure.py) (michalbiesek) #49106
[ef3d8dd493] - crypto: remove webcrypto EdDSA key checks and properties (Filip Skokan) #49408
[4a1d1cad61] - crypto: update root certificates to NSS 3.93 (Node.js GitHub Bot) #49341
[7eb10a38ea] - crypto: remove getDefaultEncoding() (Tobias Nießen) #49170
[772496c030] - crypto: remove default encoding from DiffieHellman (Tobias Nießen) #49169
[c795083232] - crypto: remove default encoding from Hash/Hmac (Tobias Nießen) #49167
[08197aa010] - crypto: remove default encoding from sign/verify (Tobias Nießen) #49145
[a1a65f593c] - deps: upgrade npm to 10.1.0 (npm team) #49570
[6c2480cad9] - (SEMVER-MINOR) deps: upgrade npm to 10.0.0 (npm team) #49423
[84195d9584] - deps: add missing thread-common.c in uv.gyp (Santiago Gimeno) #49410
[5b70b68b3d] - deps: V8: cherry-pick eadaef5 (Adam Majer) #49401
[fe34d632e8] - deps: update zlib to 1.2.13.1-motley-f5fd0ad (Node.js GitHub Bot) #49252
[db4ce8a593] - doc: add release key for Ulises Gascon (Ulises Gascón) #49196
[e5f3a694cf] - doc: fix node-api call example (Chengzhong Wu) #49395
[021345a724] - doc: add news issue for Diagnostics WG (Michael Dawson) #49306
[f82347266b] - doc: clarify policy expectations (Rafael Gonzaga) #48947
[73cfd9c895] - doc: add print results for examples in StringDecoder (Jungku Lee) #49326
[63ab591416] - doc: update outdated reference to NIST SP 800-131A (Tobias Nießen) #49316
[935dfe2afd] - doc: use cjs as block code's type in MockTimers (Deokjin Kim) #49309
[7c0cd2fb87] - doc: update options.filter description for fs.cp (Shubham Pandey) #49289
[f72e79ea67] - doc: add riscv64 to list of architectures (Stewart X Addison) #49284
[d19c710064] - doc: avoid "not currently recommended" (Tobias Nießen) #49300
[ae656101c0] - doc: update module hooks docs (Geoffrey Booth) #49265
[fefbdb92f2] - doc: modify param description for end(),write() in StringDecoder (Jungku Lee) #49285
[59e66a1ebe] - doc: use NODE_API_SUPPORTED_VERSION_MAX in release doc (Cheng Zhao) #49268
[ac3b88449b] - doc: fix typo in stream.finished documentation (Antoine du Hamel) #49271
[7428ebf6c3] - doc: update description for percent_encode sets in WHATWG API (Jungku Lee) #49258
[bef900e56b] - doc: move and rename loaders section (Geoffrey Booth) #49261
[a22e0d9696] - doc: clarify use of Uint8Array for n-api (Fedor Indutny) #48742
[1704f24cb9] - doc: add signature for module.register (Geoffrey Booth) #49251
[5a363bb01b] - doc: caveat unavailability of import.meta.resolve in custom loaders (Jacob Smith) #49242
[8101f2b259] - doc: use same name in the doc as in the code (Hyunjin Kim) #49216
[edf278d60d] - doc: add notable-change label mention to MR template (Rafael Gonzaga) #49188
[3df2251a6a] - doc: add h1 summary to security release process (Rafael Gonzaga) #49112
[9fcd99a744] - doc: update to semver-minor releases by default (Rafael Gonzaga) #49175
[777931f499] - doc: fix wording in napi_async_init (Tobias Nießen) #49180
[f45c8e10c0] - doc,test: add known path resolution issue in permission model (Tobias Nießen) #49155
[a6cfea3f74] - esm: align sync and async load implementations (Antoine du Hamel) #49152
[9fac310b33] - fs: add the options param description in openAsBlob() (Yeseul Lee) #49308
[92772a8175] - fs: remove redundant code in readableWebStream() (Deokjin Kim) #49298
[88ba79b083] - fs: make sure to write entire buffer (Robert Nagy) #49211
[11c85ffa98] - (SEMVER-MINOR) lib: add api to detect whether source-maps are enabled (翠 / green) #46391
[c12711ebfe] - lib: implement WeakReference on top of JS WeakRef (Joyee Cheung) #49053
[9a0891f88d] - meta: bump step-security/harden-runner from 2.5.0 to 2.5.1 (dependabot[bot]) #49435
[ae67f41ef1] - meta: bump actions/checkout from 3.5.3 to 3.6.0 (dependabot[bot]) #49436
[71b4411fb2] - meta: bump actions/setup-node from 3.7.0 to 3.8.1 (dependabot[bot]) #49434
[83b7d3a395] - meta: remove modules team from CODEOWNERS (Benjamin Gruenbaum) #49412
[81ff68c45c] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #49264
[ab975233cc] - meta: mention nodejs/tsc when changing GH templates (Rafael Gonzaga) #49189
[ceaa5494de] - meta: add test/reporters to codeowners (Chemi Atlow) #49186
[de0a51b7cf] - net: improve performance of isIPv4 and isIPv6 (Uzlopak) #49568
[8d0913bf95] - net: use asserts in JS Socket Stream to catch races in future (Tim Perry) #49400
[2486836a7d] - net: fix crash due to simultaneous close/shutdown on JS Stream Sockets (Tim Perry) #49400
[7a808340cd] - node-api: fix compiler warning in node_api.h (Michael Graeb) #49103
[30f26a99f4] - permission: ensure to resolve path when calling mkdtemp (RafaelGSS) nodejs-private/node-private#440
[5051c75a5b] - policy: fix path to URL conversion (Antoine du Hamel) #49133
[173aed4757] - report: fix recent coverity warning (Michael Dawson) #48954
[d7ff78b442] - sea: generate code cache with deserialized isolate (Joyee Cheung) #49226
[022f1b70c1] - src: support multiple --env-file declarations (Yagiz Nizipli) #49542
[154b1c2115] - src: don't overwrite environment from .env file (Phil Nash) #49424
[dc4de1c69b] - src: modify code for empty string (pluris) #49336
[701c46f967] - src: remove unused PromiseWrap-related code (Joyee Cheung) #49335
[4a094dc7af] - src: rename IsAnyByteSource to IsAnyBufferSource (Tobias Nießen) #49346
[55d6649175] - src: support snapshot deserialization in RAIIIsolate (Joyee Cheung) #49226
[dc092864ef] - src: remove unused function GetName() in node_perf (Jungku Lee) #49244
[f2552a410e] - src: use ARES_SUCCESS instead of 0 (Jungku Lee) #49048
[4a9ae31519] - src: add a condition if the argument of DomainToUnicode is empty (Jungku Lee) #49097
[f460362cdf] - src: remove C++ WeakReference implementation (Joyee Cheung) #49053
[2a35383b3e] - src: use per-realm GetBindingData() wherever applicable (Joyee Cheung) #49007
[184bbddcf5] - src: add per-realm GetBindingData() method (Joyee Cheung) #49007
[e9946885f9] - src: serialize both BaseObject slots (Joyee Cheung) #48996
[ec51e25ed7] - src,permission: add multiple allow-fs-* flags (Carlos Espa) #49047
[8aac95de4b] - stream: improve tee perf by reduce ReflectConstruct usages (Raz Luvaton) #49546
[0eea7fd8fb] - stream: use Buffer.from when constructor is a Buffer (Matthew Aitken) #49250
[b961d9bd52] - stream: add highWaterMark for the map operator (Raz Luvaton) #49249
[ca1384166d] - test: fix warning for comment in embedtest (Jungku Lee) #49416
[2a35782809] - test: simplify test-crypto-dh-group-setters (Tobias Nießen) #49404
[6740f3c209] - test: verify dynamic import call with absolute path strings (Chengzhong Wu) #49275
[6ed47bd8fb] - test: reduce length in crypto keygen tests (Joyee Cheung) #49221
[4faa30c553] - test: split JWK async elliptic curve keygen tests (Joyee Cheung) #49221
[e04a2603d8] - test: split test-crypto-keygen.js (Joyee Cheung) #49221
[0d23c1d4ce] - test: rename test-crypto-modp1-error (Tobias Nießen) #49348
[48e41569e2] - test: migrate message source map tests from Python to JS (Yiyun Lei) #49238
[a11e64e09c] - test: fix compiler warning in NodeCryptoEnv (Tobias Nießen) #49206
[345543938f] - test: handle EUNATCH (Abdirahim Musse) #48050
[e391f4b197] - test: use tmpdir.resolve() (Livia Medeiros) #49136
[910378f93f] - test: reduce flakiness of test-esm-loader-hooks (Antoine du Hamel) #49248
[4a85f70462] - test: add spawnSyncAndExit() and spawnSyncAndExitWithoutError() (Joyee Cheung) #49200
[9610008b79] - test: make test-perf-hooks more robust and work with workers (Joyee Cheung) #49197
[dc8fff9a75] - test: use gcUntil() in test-v8-serialize-leak (Joyee Cheung) #49168
[ca9f801332] - test: make WeakReference tests robust (Joyee Cheung) #49053
[de103a4686] - test: add test for effect of UV_THREADPOOL_SIZE (Tobias Nießen) #49165
[47d24f144b] - test: use expectSyncExit{WithErrors} in snapshot tests (Joyee Cheung) #49020
[c441f5a097] - test: add expectSyncExitWithoutError() and expectSyncExit() utils (Joyee Cheung) #49020
[4d184b5251] - test: remove --no-warnings flag in test_runner fixtures (Raz Luvaton) #48989
[25e967a90b] - test: reorder test files fixtures for better understanding (Raz Luvaton) #48787
[fac56dbcc0] - test,benchmark: use tmpdir.fileURL() (Livia Medeiros) #49138
[36763fa532] - test_runner: preserve original property descriptor (Erick Wendel) #49433
[40e9fcdbea] - test_runner: add support for setImmediate (Erick Wendel) #49397
[23216f1935] - test_runner: report covered lines, functions and branches to reporters (Phil Nash) #49320
[283f2806b1] - test_runner: expose spec reporter as newable function (Chemi Atlow) #49184
[546ad5f770] - test_runner: reland run global after() hook earlier (Colin Ihrig) #49116
[efdc95fbc0] - (SEMVER-MINOR) test_runner: expose location of tests (Colin Ihrig) #48975
[4bc0a8fe99] - test_runner: fix global after not failing the tests (Raz Luvaton) #48913
[08738b2664] - test_runner: fix timeout in *Each hook failing further tests (Raz Luvaton) #48925
[c2f1830f66] - test_runner: cleanup test timeout abort listener (Raz Luvaton) #48915
[75333f38b2] - test_runner: fix global before not called when no global test exists (Raz Luvaton) #48877
[b28b85adf8] - tls: remove redundant code in onConnectSecure() (Deokjin Kim) #49457
[83fc4dccbc] - tls: refactor to use validateFunction (Deokjin Kim) #49422
[8949cc79dd] - tls: ensure TLS Sockets are closed if the underlying wrap closes (Tim Perry) #49327
[1df56e6f01] - tools: update eslint to 8.48.0 (Node.js GitHub Bot) #49343
[ef50ec5b57] - tools: update lint-md-dependencies (Node.js GitHub Bot) #49342
[9a8fb4fc34] - tools: remove v8_dump_build_config action (Cheng Zhao) #49301
[91b2d4314b] - tools: update lint-md-dependencies (Node.js GitHub Bot) #49253
[b51946ebdd] - tools: fix github reporter appended multiple times (Moshe Atlow) #49199
[ae40cb1612] - url: validate pathToFileURL(path) argument as string (LiviaMedeiros) #49161
[e787673dcf] - url: handle unicode hostname if empty (Yagiz Nizipli) #49396
[6ee74be87f] - vm: store MicrotaskQueue in ContextifyContext directly (Joyee Cheung) #48982
[0179c6dc8f] - worker: protect against user mutating well-known prototypes (Antoine du Hamel) #49270

`v20.6.1`: 2023-09-08, Version 20.6.1 (Current), @ruyadorno and @RafaelGSS

Compare Source

Commit

[8acbe6d8e8] - esm: fix loading of CJS modules from ESM (Antoine du Hamel) #49500

`v20.6.0`: 2023-09-04, Version 20.6.0 (Current), @juanarbol prepared by @UlisesGascon

Compare Source

Notable changes

built-in `.env` file support

Starting from Node.js v20.6.0, Node.js supports .env files for configuring environment variables.

Your configuration file should follow the INI file format, with each line containing a key-value pair for an environment variable. To initialize your Node.js application with predefined configurations, use the following CLI command: node --env-file=config.env index.js.

For example, you can access the following environment variable using process.env.PASSWORD when your application is initialized:

PASSWORD=nodejs

In addition to environment variables, this change allows you to define your NODE_OPTIONS directly in the .env file, eliminating the need to include it in your package.json.

This feature was contributed by Yagiz Nizipli in #48890.

`import.meta.resolve` unflagged

In ES modules, import.meta.resolve(specifier) can be used to get an absolute URL string to which specifier resolves, similar to require.resolve in CommonJS. This aligns Node.js with browsers and other server-side runtimes.

This feature was contributed by Guy Bedford in #49028

New `node:module` API `register` for module customization hooks; new `initialize` hook

There is a new API register available on node:module to specify a file that exports module customization hooks, and pass data to the hooks, and establish communication channels with them. The “define the file with the hooks” part was previously handled by a flag --experimental-loader, but when the hooks moved into a dedicated thread in 20.0.0 there was a need to provide a way to communicate between the main (application) thread and the hooks thread. This can now be done by calling register from the main thread and passing data, including MessageChannel instances.

We encourage users to migrate to an approach that uses --import with register, such as:

node --import ./file-that-calls-register.js ./app.js

Using --import ensures that the customization hooks are registered before any application code runs, even the entry point.

This feature was contributed by Izaak Schroeder in #48842 and #48559

Module customization `load` hook can now support CommonJS

Authors of module customization hooks can how handle both ES module and CommonJS sources in the load hook. This works for CommonJS modules referenced via either import or require, so long as the main entry point of the application is handled by the ES module loader (such as because the entry point is an ES module file, or if the --import flag is passed). This should simplify the customization of the Node.js module loading process, as package authors can customize more of Node.js without relying on deprecated APIs such as require.extensions.

This feature was contributed by Antoine du Hamel in #47999

Node.js C++ addons now have experimental support for cppgc (Oilpan), a C++ garbage collection library in V8.

Now when Node.js starts up, it makes sure that there is a v8::CppHeap attached to the V8 isolate. This enables users to allocate in the v8::CppHeap using <cppgc/*> headers from V8, which are now also included into the Node.js headers available to addons. Note that since Node.js only bundles the cppgc library coming from V8, the ABI stability of cppgc is currently not guaranteed in semver-minor and -patch updates, but we do not expect the ABI to break often, as it has been stable and battle-tested in Chromium for years. We may consider including cppgc into the ABI stability guarantees when it gets enough adoption internally and externally.

To help addon authors create JavaScript-to-C++ references of which V8's garbage collector can be aware, a helper function node::SetCppgcReference(isolate, js_object, cppgc_object) has been added to node.h. V8 may provide a native alternative in the future, which could then replace this Node.js-specific helper. In the mean time, users can use this API to avoid having to hard-code the layout of JavaScript wrapper objects. An example of how to create garbage-collected C++ objects in the unified heap and wrap it in a JavaScript object can be found in the Node.js addon tests.

The existing node::ObjectWrap helper would continue to work, while cppgc-based object management serves as an alternative with some advantages mentioned in the V8 blog post about Oilpan.

This feature was contributed by Daryl Haresign and Joyee Cheung in #48660 and #45704.

Other notable changes

[d6862b085c] - deps: V8: cherry-pick 9327503 (Joyee Cheung) #48660
[00fc8bb8b3] - doc: add rluvaton to collaborators (Raz Luvaton) #49215
[d649339abd] - doc: add new TSC members (Michael Dawson) #48841
[67f9896247] - (SEMVER-MINOR) inspector: open add SymbolDispose (Chemi Atlow) #48765
[5aef593db3] - module: implement register utility (João Lenon) #46826

Commits

[771abcb5da] - benchmark: add benchmarks for the test_runner (Raz Luvaton) #48931
[6b27bb0dab] - benchmark: add pm startup benchmark (Rafael Gonzaga) #48905
[1f35c0ca55] - child_process: harden against prototype pollution (Livia Medeiros) #48726
[d6862b085c] - deps: V8: cherry-pick 9327503 (Joyee Cheung) #48660
[f71e383948] - deps: update simdutf to 3.2.17 (Node.js GitHub Bot) #49019
[e14f0456ae] - deps: update googletest to 7e33b6a (Node.js GitHub Bot) #49034
[bfaa0fb500] - deps: update zlib to 1.2.13.1-motley-526382e (Node.js GitHub Bot) #49033
[b79c652c85] - deps: update undici to 5.23.0 (Node.js GitHub Bot) #49021
[6ead86145c] - deps: update googletest to c875c4e (Node.js GitHub Bot) #48964
[4b0e50501e] - deps: update ada to 2.6.0 (Node.js GitHub Bot) #48896
[d960ee0ba3] - deps: upgrade npm to 9.8.1 (npm team) #48838
[d92b0139ca] - deps: update zlib to 1.2.13.1-motley-61dc0bd (Node.js GitHub Bot) #48788
[2a7835c376] - deps: V8: cherry-pick 9f4b769 (Joyee Cheung) #48830
[c8e17829ac] - deps: V8: cherry-pick c1a54d5 (Joyee Cheung) #48830
[318e075b6f] - deps: update googletest to cc36671 (Node.js GitHub Bot) #48789
[114e088267] - diagnostics_channel: fix last subscriber removal (Gabriel Schulhof) #48933
[00fc8bb8b3] - doc: add rluvaton to collaborators (Raz Luvaton) #49215
[21949c45b6] - doc: add print results for examples in WebStreams (Jungku Lee) #49143
[032107a6fe] - doc: fix Type notation in webstreams (Deokjin Kim) #49121
[91d41e7c5a] - doc: fix name of the flag in initialize() docs (Antoine du Hamel) #49158
[aa4caf810e] - doc: make the NODE_VERSION_IS_RELEASE revert clear (Rafael Gonzaga) #49114
[f888a1dbe3] - doc: update process.binding deprecation text (Tobias Nießen) #49086
[89fa3faf92] - doc: update with latest security release (Rafael Gonzaga) #49085
[3d36e7a941] - doc: add description for --port flag of node inspect (Michael Bianco) #48785
[e9d9ca12a3] - doc: add missing period (Rich Trott) #49094
[7e7b554de0] - doc: add ESM examples in http.md (btea) #47763
[48f8ccfd54] - doc: detailed description of keystrokes Ctrl-Y and Meta-Y (Ray) #43529
[195885c8f8] - doc: add "type" to test runner event details (Phil Nash) #49014
[6ce25f8415] - doc: reserve 118 for Electron 27 (David Sanders) #49023
[9c26c0f296] - doc: clarify use of process.env in worker threads on Windows (Daeyeon Jeong) #49008
[7186e02aa0] - doc: remove v14 mention (Rafael Gonzaga) #49005
[9641ac6c65] - doc: drop github actions check in sec release process (Rafael Gonzaga) #48978
[f3d62abb19] - doc: improved joinDuplicateHeaders definition (Matteo Bianchi) #48859
[0db104a08b] - doc: fix second parameter name of events.addAbortListener (Deokjin Kim) #48922
[5173c559b7] - doc: add new reporter events to custom reporter examples (Chemi Atlow) #48903
[660da785e6] - doc: run license-builder (github-actions[bot]) #48898
[092f9fe92a] - doc: change duration to duration_ms on test documentation (Ardi_Nugraha) #48892
[5e4730858d] - doc: improve requireHostHeader (Guido Penta) #48860
[045e3c549a] - doc: add ver of 18.x where Node-api 9 is supported (Michael Dawson) #48876
[c20d35df34] - doc: include experimental features assessment (Rafael Gonzaga) #48824
[d649339abd] - doc: add new TSC members (Michael Dawson) #48841
[aeac327f2b] - doc: refactor node-api support matrix (Michael Dawson) #48774
[388c7d9232] - doc: declare path on example of async_hooks.executionAsyncId() (Deokjin Kim) #48556
[fe20528c8e] - doc: remove the . in the end to reduce confusing (Jason) #48719
[e69c8e173f] - doc: nodejs-social over nodejs/tweet (Rafael Gonzaga) #48769
[ea547849fd] - doc: expand on squashing and rebasing to land a MR (Chengzhong Wu) #48751
[31442b96a5] - esm: fix globalPreload warning (Antoine du Hamel) #49069
[eb1215878b] - esm: unflag import.meta.resolve (Guy Bedford) #49028
[57b24a34e6] - esm: import.meta.resolve exact module not found errors should return (Guy Bedford) #49038
[f23b2a3066] - esm: protect ERR_UNSUPPORTED_DIR_IMPORT against prototype pollution (Antoine du Hamel) #49060
[386e826a56] - esm: add initialize hook, integrate with register (Izaak Schroeder) #48842
[74a2e1e0ab] - esm: fix typo parentUrl -> parentURL (Antoine du Hamel) #48999
[0a4f7c669a] - esm: unflag Module.register and allow nested loader import() (Izaak Schroeder) #48559
[a5597470ce] - esm: add back globalPreload tests and fix failing ones (Antoine du Hamel) #48779
[d568600b42] - events: remove weak listener for event target (Raz Luvaton) #48952
[3d942d9842] - fs: fix readdir recursive sync & callback (Ethan Arrowood) #48698
[c14ff69d69] - fs: mention URL in NUL character error message (LiviaMedeiros) #48828
[d634d781d7] - fs: make mkdtemp accept buffers and URL (LiviaMedeiros) #48828
[4515a285a4] - fs: remove redundant nullCheck (Livia Medeiros) #48826
[742597b14a] - http: start connections checking interval on listen (Paolo Insogna) #48611
[67f9896247] - (SEMVER-MINOR) inspector: open add SymbolDispose (Chemi Atlow) #48765
[b66a3c1c96] - lib: fix MIME overmatch in data URLs (André Alves) #49104
[dca8678a22] - lib: fix to add resolve() before return at Blob.stream()'s source.pull() (bellbind) #48935
[420b85c00f] - lib: remove invalid parameter to toASCII (Yagiz Nizipli) #48878
[a12ce11b09] - lib,permission: drop repl autocomplete when pm enabled (Rafael Gonzaga) #48920
[458eaf5e75] - meta: bump github/codeql-action from 2.20.1 to 2.21.2 (dependabot[bot]) #48986
[4f88cb10e0] - meta: bump step-security/harden-runner from 2.4.1 to 2.5.0 (dependabot[bot]) #48985
[22fc2a6ec6] - meta: bump actions/setup-node from 3.6.0 to 3.7.0 (dependabot[bot]) #48984
[40103adabd] - meta: bump actions/setup-python from 4.6.1 to 4.7.0 (dependabot[bot]) #48983
[84c0c6848c] - meta: add mailmap entry for atlowChemi (Chemi Atlow) #48810
[1a6e9450b8] - module: make CJS load from ESM loader (Antoine du Hamel) #47999
[a5322c4b4a] - module: ensure successful import returns the same result (Antoine du Hamel) #46662
[5aef593db3] - module: implement register utility (João Lenon) #46826
[015c4f788d] - node-api: avoid macro redefinition (Tobias Nießen) #48879
[53ee98566b] - permission: move PrintTree into unnamed namespace (Tobias Nießen) #48874
[30ea480135] - permission: fix data types in PrintTree (Tobias Nießen) #48770
[8380800375] - readline: add paste bracket mode (Jakub Jankiewicz) #47150
[bc009d0c10] - sea: add support for V8 bytecode-only caching (Darshan Sen) #48191
[f2f4ce9e29] - src: use effective cppgc wrapper id to deduce non-cppgc id (Joyee Cheung) #48660
[bf7ff369f6] - src: add built-in .env file support (Yagiz Nizipli) #48890
[8d6948f8e2] - src: remove duplicated code in GenerateSingleExecutableBlob() (Jungku Lee) #49119
[b030004cee] - src: refactor vector writing in snapshot builder (Joyee Cheung) #48851
[497df8288d] - src: add ability to overload fast api functions (Yagiz Nizipli) #48993
[e5b0dfa359] - src: remove redundant code for uv_handle_type (Jungku Lee) #49061
[f126b9e3d1] - src: modernize use-equals-default (Jason) #48735
[db4370fc3e] - src: avoid string copy in BuiltinLoader::GetBuiltinIds (Yagiz Nizipli) #48721
[9d13503c4e] - src: fix callback_queue.h missing header (Jason) #48733
[6c389df3aa] - src: cast v8::Object::GetInternalField() return value to v8::Value (Joyee Cheung) #48943
[7b9adff0be] - src: do not pass user input to format string (Antoine du Hamel) #48973
[e0fdb7b092] - src: remove ContextEmbedderIndex::kBindingDataStoreIndex (Joyee Cheung) #48836
[578c3d1e14] - src: use ARES_SUCCESS instead of 0 (Hyunjin Kim) #48834
[ed23426aac] - src: save the performance milestone time origin in the AliasedArray (Joyee Cheung) #48708
[5dec186663] - src: support snapshot in single executable applications (Joyee Cheung) #46824
[d759d4f631] - src: remove unnecessary temporary creation (Jason) #48734
[409cc692db] - src: fix nullptr access on realm (Jan Olaf Krems) #48802
[07d0fd61b1] - src: remove OnScopeLeaveImpl's move assignment overload (Jason) #48732
[41cc3efa23] - src: use string_view for utf-8 string creation (Yagiz Nizipli) #48722
[62a46d9335] - src,permission: restrict by default when pm enabled (Rafael Gonzaga) #48907
[099159ce04] - src,tools: initialize cppgc (Daryl Haresign) #48660
[600c08d197] - stream: improve WebStreams performance (Raz Luvaton) #49089
[609b25fa99] - stream: implement ReadableStream.from (Debadree Chatterjee) #48395
[750cca2738] - test: use tmpdir.resolve() (Livia Medeiros) #49128
[6595367649] - test: use tmpdir.resolve() (Livia Medeiros) #49127
[661b055e75] - test: use tmpdir.resolve() in fs tests (Livia Medeiros) #49126
[b3c56d206f] - test: use tmpdir.resolve() in fs tests (Livia Medeiros) #49125
[3ddb155d16] - test: fix assertion message in test_async.c (Tobias Nießen) #49146
[1d17c1032d] - test: refactor test-esm-loader-hooks for easier debugging (Antoine du Hamel) #49131
[13bd7a0293] - test: add tmpdir.resolve() (Livia Medeiros) #49079
[89b1bce56d] - test: document fixtures.fileURL() (Livia Medeiros) #49083
[2fcb855c76] - test: reduce flakiness of test-esm-loader-hooks (Antoine du Hamel) #49105
[7816e040df] - test: stabilize the inspector-open-dispose test (Chemi Atlow) #49000
[e70e9747e4] - test: print instruction for creating missing snapshot in assertSnapshot (Raz Luvaton) #48914
[669ac03520] - test: add tmpdir.fileURL() (Livia Medeiros) #49040
[b945d7be35] - test: use spawn and spawnPromisified instead of exec (Antoine du Hamel) #48991
[b3a7427583] - test: refactor test-node-output-errors (Antoine du Hamel) #48992
[6c3e5c4d69] - test: use fixtures.fileURL when appropriate (Antoine du Hamel) #48990
[9138b78bcb] - test: validate error code rather than message (Antoine du Hamel) #48972
[b4ca4a6f80] - test: fix snapshot tests when cwd contains spaces or backslashes (Antoine du Hamel) #48959
[d4398d458c] - test: order common.mjs in ASCII order (Antoine du Hamel) #48960
[b5991f5250] - test: fix some assumptions in tests (Antoine du Hamel) #48958
[62e23f83f9] - test: improve internal/worker/io.js coverage (Yoshiki Kurihara) #42387
[314bd6095c] - test: fix es-module/test-esm-initialization (Antoine du Hamel) #48880
[3680a66df4] - test: validate host with commas on url.parse (Yagiz Nizipli) #48878
[24c3742372] - test: delete test-net-bytes-per-incoming-chunk-overhead (Michaël Zasso) #48811
[e01cce50f5] - test: skip experimental test with pointer compression (Colin Ihrig) #48738
[d5e93b1074] - test: fix flaky test-string-decode.js on x86 (Stefan Stojanovic) #48750
[9136667d7d] - test_runner: dont set exit code on todo tests (Moshe Atlow) #48929
[52c94908c0] - test_runner: fix todo and only in spec reporter (Moshe Atlow) #48929
[5ccfb8d515] - test_runner: unwrap error message in TAP reporter (Colin Ihrig) #48942
[fa19b0ed05] - test_runner: add __proto__ null (Raz Luvaton) #48663
[65d23940bf] - test_runner: fix async callback in describe not awaited (Raz Luvaton) #48856
[4bd5e55b43] - test_runner: fix test_runner test:fail event type (Ethan Arrowood) #48854
[41058beed8] - test_runner: call abort on test finish (Raz Luvaton) #48827
[821b11a59f] - tls: fix bugs of double TLS (rogertyang) #48969
[4439327e73] - tools: update lint-md-dependencies (Node.js GitHub Bot) #49122
[21dc844309] - tools: use spec reporter in actions (Moshe Atlow) #49129
[3471758696] - tools: use @reporters/github when running in github actions (Moshe Atlow) #49129
[95a6e7661e] - tools: add @reporters/github to tools (Moshe Atlow) #49129
[995cbf93eb] - tools: update eslint to 8.47.0 (Node.js GitHub Bot) #49124
[ed065bc56e] - tools: update lint-md-dependencies to rollup@3.27.2 (Node.js GitHub Bot) #49035
[a5f37178ad] - tools: limit the number of auto start CIs (Antoine du Hamel) #49067
[c1bd680f89] - tools: update eslint to 8.46.0 (Node.js GitHub Bot) #48966
[e09a6b4821] - tools: update lint-md-dependencies to rollup@3.27.0 (Node.js GitHub Bot) #48965
[0cd2393bd9] - tools: update lint-md-dependencies to rollup@3.26.3 (Node.js GitHub Bot) #48888
[41929a2906] - tools: update lint-md-dependencies to @rollup/plugin-commonjs @25.0.3 (Node.js GitHub Bot) #48791
[1761bdfbd9] - tools: update eslint to 8.45.0 (Node.js GitHub Bot) #48793
[b82f05cc4b] - typings: update JSDoc for cwd in child_process (LiviaMedeiros) #49029
[be7b511255] - typings: sync JSDoc with the actual implementation (Hyunjin Kim) #48853
[45c860035d] - url: overload canParse V8 fast api method (Yagiz Nizipli) #48993
[60d614157b] - url: fix isURL detection by checking path (Zhuo Zhang) #48928
[b12c3b5240] - url: ensure getter access do not mutate observable symbols (Antoine du Hamel) #48897
[30fb7b7535] - url: reduce pathToFileURL cpp calls (Yagiz Nizipli) #48709
[c3dbd0c1e4] - util: use primordials.ArrayPrototypeIndexOf instead of mutable method (DaisyDogs07) #48586
[b79b2927ca] - watch: decrease debounce rate (Moshe Atlow) #48926
[a12996298e] - watch: use debounce instead of throttle (Moshe Atlow) #48926

`v20.5.1`: 2023-08-09, Version 20.5.1 (Current), @RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-32002: Policies can be bypassed via Module._load (High)
CVE-2023-32558: process.binding() can bypass the permission model through path traversal (High)
CVE-2023-32004: Permission model can be bypassed by specifying a path traversal sequence in a Buffer (High)
CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
CVE-2023-32005: fs.statfs can bypass the permission model (Low)
CVE-2023-32003: fs.mkdtemp() and fs.mkdtempSync() can bypass the permission model (Low)
OpenSSL Security Releases

More detailed information on each of the vulnerabilities can be found in August 2023 Security Releases blog post.

Commits

[92300b51b4] - deps: update archs files for openssl-3.0.10+quic1 (Node.js GitHub Bot) #49036
[559698abf2] - deps: upgrade openssl sources to quictls/openssl-3.0.10+quic1 (Node.js GitHub Bot) #49036
[1bf3429e8e] - lib,permission: restrict process.binding when pm is enabled (RafaelGSS) nodejs-private/node-private#438
[98a83a67e6] - permission: ensure to resolve path when calling mkdtemp (RafaelGSS) nodejs-private/node-private#464
[1f0cde466b] - permission: handle buffer path on fs calls (RafaelGSS) nodejs-private/node-private#439
[bd094d60ea] - permission: handle fstatfs and add pm supported list (RafaelGSS) nodejs-private/node-private#441
[7337d21484] - policy: handle Module.constructor and main.extensions bypass (RafaelGSS) nodejs-private/node-private#417
[cf348ec640] - policy: disable process.binding() when enabled (Tobias Nießen) nodejs-private/node-private#397

`v20.5.0`: 2023-07-18, Version 20.5.0 (Current), @juanarbol

Compare Source

Notable Changes

[45be29d89f] - doc: add atlowChemi to collaborators (atlowChemi) #48757
[a316808136] - (SEMVER-MINOR) events: allow safely adding listener to abortSignal (Chemi Atlow) #48596
[986b46a567] - fs: add a fast-path for readFileSync utf-8 (Yagiz Nizipli) #48658
[0ef73ff6f0] - (SEMVER-MINOR) test_runner: add shards support (Raz Luvaton) #48639

Commits

[eb0aba59b8] - bootstrap: use correct descriptor for Symbol.{dispose,asyncDispose} (Jordan Harband) #48703
[e2d0195dcf] - bootstrap: hide experimental web globals with flag kNoBrowserGlobals (Chengzhong Wu) #48545
[67a1018389] - build: do not pass target toolchain flags to host toolchain (Ivan Trubach) #48597
[7d843bb942] - child_process: use addAbortListener (atlowChemi) #48550
[4e08160f8c] - child_process: support Symbol.dispose (Moshe Atlow) #48551
[ef7728bf36] - deps: update nghttp2 to 1.55.1 (Node.js GitHub Bot) #48790
[1454f02499] - deps: update nghttp2 to 1.55.0 (Node.js GitHub Bot) #48746
[fa94debf46] - deps: update minimatch to 9.0.3 (Node.js GitHub Bot) #48704
[c73cfcc144] - deps: update acorn to 8.10.0 (Node.js GitHub Bot) #48713
[b7a076a052] - deps: V8: cherry-pick cb00db4 (Keyhan Vakil) #48671
[150e15536b] - deps: upgrade npm to 9.8.0 (npm team) #48665
[c47b2cbd35] - dgram: socket add asyncDispose (atlowChemi) #48717
[002ce31cca] - dgram: use addAbortListener (atlowChemi) #48550
[45be29d89f] - doc: add atlowChemi to collaborators (atlowChemi) #48757
[69b55d2261] - doc: fix ambiguity in http.md and https.md (an5er) #48692
[caccb051c7] - doc: clarify transform._transform() callback argument logic (Rafael Sofi-zada) #48680
[999ae0c8c3] - doc: fix copy node executable in Windows (Yoav Vainrich) #48624
[7daefaeb44] - doc: drop <b> of v20 changelog (Rafael Gonzaga) #48649
[dd7ea3e1df] - doc: mention git node release prepare (Rafael Gonzaga) #48644
[cc7809df21] - esm: fix emit deprecation on legacy main resolve (Antoine du Hamel) #48664
[67b13d1dba] - events: fix bug listenerCount don't compare wrapped listener (yuzheng14) #48592
[a316808136] - (SEMVER-MINOR) events: allow safely adding listener to abortSignal (Chemi Atlow) #48596
[986b46a567] - fs: add a fast-path for readFileSync utf-8 (Yagiz Nizipli) #48658
[e4333ac41f] - http2: use addAbortListener (atlowChemi) #48550
[4a0b66e4f9] - http2: send RST code 8 on AbortController signal (Devraj Mehta) #48573
[1295c76fce] - lib: use addAbortListener (atlowChemi) #48550
[dff6c25a36] - meta: bump actions/checkout from 3.5.2 to 3.5.3 (dependabot[bot]) #48625
[b5cb69ceaa] - meta: bump step-security/harden-runner from 2.4.0 to 2.4.1 (dependabot[bot]) #48626
[332e480b46] - meta: bump ossf/scorecard-action from 2.1.3 to 2.2.0 (dependabot[bot]) #48628
[25c5a0aaee] - meta: bump github/codeql-action from 2.3.6 to 2.20.1 (dependabot[bot]) #48627
[6406f50ab1] - module: add SourceMap.lineLengths (Isaac Z. Schlueter) #48461
[cfa69bd48c] - net: server add asyncDispose (atlowChemi) #48717
[ac11264cc5] - net: use addAbortListener (atlowChemi) #48550
[82d6b13bf6] - permission: add debug log when inserting fs nodes (Rafael Gonzaga) #48677
[f4333b1cdd] - permission: v8.writeHeapSnapshot and process.report (Rafael Gonzaga) #48564
[f691dca6c9] - readline: use addAbortListener (atlowChemi) #48550
[227e6bd898] - src: pass syscall on fs.readFileSync fail operation (Yagiz Nizipli) #48815
[a9a4b73653] - src: make BaseObject iteration order deterministic (Joyee Cheung) #48702
[d99ea4845a] - src: remove kEagerCompile for CompileFunction (Keyhan Vakil) #48671
[df363d0010] - src: deduplicate X509 getter implementations (Tobias Nießen) #48563
[9cf2e1f55b] - src,lib: reducing C++ calls of esm legacy main resolve (Vinicius Lourenço) #48325
[daeb21dde9] - stream: fix deadlock when pipeing to full sink (Robert Nagy) #48691
[5a382d02d6] - stream: use addAbortListener (atlowChemi) #48550
[6e82077dd4] - test: deflake test-net-throttle (Luigi Pinca) #48599
[d378b2c822] - test: move test-net-throttle to parallel (Luigi Pinca) #48599
[dfa0aee5bf] - Revert "test: remove test-crypto-keygen flaky designation" (Luigi Pinca) #48652
[0ef73ff6f0] - (SEMVER-MINOR) test_runner: add shards support (Raz Luvaton) #48639
[e2442bb7ef] - timers: support Symbol.dispose (Moshe Atlow) #48633
[4398ade426] - tools: run fetch_deps.py with Python 3 (Richard Lau) #48729
[38ce95d054] - tools: update doc to unist-util-select@5.0.0 unist-util-visit@5.0.0 (Node.js GitHub Bot) #48714
[b25e78a998] - tools: update lint-md-dependencies to rollup@3.26.2 (Node.js GitHub Bot) #48705
[a1f4ff7c59] - tools: update eslint to 8.44.0 (Node.js GitHub Bot) #48632
[42dc6eb698] - tools: update lint-md-dependencies to rollup@3.26.0 (Node.js GitHub Bot) #48631
[07bfcc45ab] - url: fix canParse false value when v8 optimizes (Yagiz Nizipli) #48817

`v20.4.0`: 2023-07-05, Version 20.4.0 (Current), @RafaelGSS

Compare Source

Notable Changes

Mock Timers

The new feature allows developers to write more reliable and predictable tests for time-dependent functionality. It includes MockTimers with the ability to mock setTimeout, setInterval from globals, node:timers, and node:timers/promises.

The feature provides a simple API to advance time, enable specific timers, and release all timers.

import assert from 'node:assert';
import { test } from 'node:test';

test('mocks setTimeout to be executed synchronously without having to actually wait for it', (context) => {
  const fn = context.mock.fn();
  // Optionally choose what to mock
  context.mock.timers.enable(['setTimeout']);
  const nineSecs = 9000;
  setTimeout(fn, nineSecs);

  const threeSeconds = 3000;
  context.mock.timers.tick(threeSeconds);
  context.mock.timers.tick(threeSeconds);
  context.mock.timers.tick(threeSeconds);

  assert.strictEqual(fn.mock.callCount(), 1);
});

This feature was contributed by Erick Wendel in #47775.

Support to the explicit resource management proposal

Node is adding support to the explicit resource management proposal to its resources allowing users of TypeScript/babel to use using/await using with V8 support for everyone else on the way.

This feature was contributed by Moshe Atlow and Benjamin Gruenbaum in #48518.

Other notable changes

[fe333d2584] - crypto: update root certificates to NSS 3.90 (Node.js GitHub Bot) #48416
[60c2ea4e79] - doc: add vmoroz to collaborators (Vladimir Morozov) #48527
[5cacdf9e6b] - doc: add kvakil to collaborators (Keyhan Vakil) #48449
[504d1d7bdc] - (SEMVER-MINOR) tls: add ALPNCallback server option for dynamic ALPN negotiation (Tim Perry) #45190

Commits

[8a611a387f] - benchmark: add bar.R (Rafael Gonzaga) #47729
[12fa716cf9] - benchmark: refactor crypto oneshot (Filip Skokan) #48267
[d6ecbde592] - benchmark: add crypto.create*Key (Filip Skokan) #48284
[e60b6dedd8] - bootstrap: unify snapshot builder and embedder entry points (Joyee Cheung) #48242
[40662957b1] - bootstrap: simplify initialization of source map handlers (Joyee Cheung) #48304
[6551538079] - build: fix configure --link-module (Richard Lau) #48522
[f7f32089e7] - build: sync libuv header change (Jiawen Geng) #48429
[f60205c915] - build: update action to close stale MRs (Michael Dawson) #48196
[4f4d0b802e] - child_process: improve spawn performance on Linux (Keyhan Vakil) #48523
[fe333d2584] - crypto: update root certificates to NSS 3.90 (Node.js GitHub Bot) #48416
[89aaf16237] - crypto: remove OPENSSL_FIPS guard for OpenSSL 3 (Richard Lau) #48392
[6199e1946c] - deps: upgrade to libuv 1.46.0 (Santiago Gimeno) #48618
[1b2b930fda] - deps: add loong64 config into openssl gypi (Shi Pujin) #48043
[ba8d048929] - deps: update acorn to 8.9.0 (Node.js GitHub Bot) #48484
[d96f921d06] - deps: update zlib to 1.2.13.1-motley-f81f385 (Node.js GitHub Bot) #48541
[ed1d047e8f] - deps: update googletest to ec4fed9 (Node.js GitHub Bot) #48538
[f43d718c67] - deps: update minimatch to 9.0.2 (Node.js GitHub Bot) #48542
[2f66147cbf] - deps: update corepack to 0.19.0 (Node.js GitHub Bot) #48540
[d91b0fde73] - deps: V8: cherry-pick 1a782f6 (Keyhan Vakil) #48523
[112335e342] - deps: update corepack to 0.18.1 (Node.js GitHub Bot) #48483
[2b141c413f] - deps: update icu to 73.2 (Node.js GitHub Bot) #48502
[188b34d4a1] - deps: upgrade npm to 9.7.2 (npm team) #48514
[bf0444b5d9] - deps: update zlib to 1.2.13.1-motley-3ca9f16 (Node.js GitHub Bot) #48413
[b339d80a56] - deps: upgrade npm to 9.7.1 (npm team) #48378
[4132931b87] - deps: update simdutf to 3.2.14 (Node.js GitHub Bot) #48344
[8cd56c1e85] - deps: update ada to 2.5.1 (Node.js GitHub Bot) #48319
[78cffcd645] - deps: update zlib to 982b036 (Node.js GitHub Bot) #48327
[6d00c2e33b] - doc: fix options order (Luigi Pinca) #48617
[7ad2d3a5d1] - doc: update security release stewards (Rafael Gonzaga) #48569
[cc3a056fdd] - doc: update return type for describe (Shrujal Shah) #48572
[99ae0b98af] - doc: run license-builder (github-actions[bot]) #48552
[9750d8205c] - doc: add description of autoAllocateChunkSize in ReadableStream (Debadree Chatterjee) #48004
[417927bb41] - doc: fix filename type in watch result (Dmitry Semigradsky) #48032
[ca2ae86bd7] - doc: unnest mime and MIMEParams from MIMEType constructor (Dmitry Semigradsky) #47950
[bda1228135] - doc: update security-release-process.md (Rafael Gonzaga) #48504
[60c2ea4e79] - doc: add vmoroz to collaborators (Vladimir Morozov) #48527
[37bc0eac4a] - doc: improve inspector.close() description (mary marchini) #48494
[2a403cdad5] - doc: link to Runtime Keys in export conditions (Jacob Hummer) #48408
[e2d579e644] - doc: update fs flags documentation (sinkhaha) #48463
[38bf290115] - doc: revise error.md introduction (Antoine du Hamel) #48423
[641a2e9c6d] - doc: add preveen-stack to triagers (Preveen P) #48387
[4ab5e8d2e3] - doc: refine when file is undefined in test events (Moshe Atlow) #48451
[5cacdf9e6b] - doc: add kvakil to collaborators (Keyhan Vakil) #48449
[b9c643e3ef] - doc: add additional info on TSFN dispatch (Michael Dawson) #48367
[17a0e1d1bf] - doc: add link for news from security wg (Michael Dawson) #48396
[3a62994a4f] - doc: fix typo in events.md (Darshan Sen) #48436
[e10a4cdf68] - doc: run license-builder (github-actions[bot]) #48336
[19fde638fd] - fs: call the callback with an error if writeSync fails (killa) #47949
[4cad9fd8bd] - fs: remove unneeded return statement (Luigi Pinca) #48526
[d367b73f43] - fs: use kResistStopPropagation (Chemi Atlow) #48521
[e50c3169af] - fs, stream: initial Symbol.dispose and Symbol.asyncDispose support (Moshe Atlow) #48518
[7d8a0b6eb7] - http: null the joinDuplicateHeaders property on cleanup (Luigi Pinca) #48608
[94ebb02f59] - http: server add async dispose (atlowChemi) #48548
[c6a69e31a3] - http: remove useless ternary in test (geekreal) #48481
[2f0f40328f] - http: fix for handling on boot timers headers and request (Franciszek Koltuniuk) #48291
[5378ad8ab1] - http2: server add asyncDispose (atlowChemi) #48548
[97a58c5970] - https: server add asyncDispose (atlowChemi) #48548
[40ae6eb6aa] - https: fix connection checking interval not clearing on server close (Nitzan Uziely) #48383
[15530fea4c] - lib: merge cjs and esm package json reader caches (Yagiz Nizipli) #48477
[32bda81c31] - lib: reduce url getters on makeRequireFunction (Yagiz Nizipli) #48492
[0da03f01ba] - lib: remove duplicated requires in check_syntax (Yagiz Nizipli) #48508
[97b00c347d] - lib: add option to force handling stopped events (Chemi Atlow) #48301
[fe16749649] - lib: fix output message when repl is used with pm (Rafael Gonzaga) #48438
[8c2c02d28a] - lib: create weakRef only if any signals provided (Chemi Atlow) #48448
[b6ae411ea9] - lib: remove obsolete deletion of bufferBinding.zeroFill (Chengzhong Wu) #47881
[562b3d4856] - lib: move web global bootstrapping to the expected file (Chengzhong Wu) #47881
[f9c0d5acac] - lib: fix blob.stream() causing hanging promises (Debadree Chatterjee) #48232
[0162a0f5bf] - lib: add support for inherited custom inspection methods (Antoine du Hamel) #48306
[159ab6627a] - lib: reduce URL invocations on http2 origins (Yagiz Nizipli) #48338
[f0709fdc59] - module: add SourceMap.findOrigin (Isaac Z. Schlueter) #47790
[4ec2d925b1] - module: reduce url invocations in esm/load.js (Yagiz Nizipli) #48337
[2c363971cc] - net: improve network family autoselection handle handling (Paolo Insogna) #48464
[dbf9e9ffc8] - node-api: provide napi_define_properties fast path (Gabriel Schulhof) #48440
[87ad657777] - node-api: implement external strings (Gabriel Schulhof) #48339
[4efa6807ea] - permission: handle end nodes with children cases (Rafael Gonzaga) #48531
[84fe811108] - repl: display dynamic import variant in static import error messages (Hemanth HM) #48129
[bdcc037470] - report: disable js stack when no context is entered (Chengzhong Wu) #48495
[97bd9ccd04] - src: fix uninitialized field access in AsyncHooks (Jan Olaf Krems) #48566
[404958fc96] - src: fix Coverity issue regarding unnecessary copy (Yagiz Nizipli) #48565
[c4b8edea24] - src: refactor SplitString in util (Yagiz Nizipli) #48491
[5bc13a4772] - src: revert IS_RELEASE (Rafael Gonzaga) #48505
[4971e46051] - src: add V8 fast api to guessHandleType (Yagiz Nizipli) #48349
[954e46e792] - src: return uint32 for guessHandleType (Yagiz Nizipli) #48349
[05009675da] - src: make realm binding data store weak (Chengzhong Wu) #47688
[120ac74352] - src: remove aliased buffer weak callback (Chengzhong Wu) #47688
[6591826e99] - src: handle wasm out of bound in osx will raise SIGBUS correctly (Congcong Cai) #46561
[1b84ddeec2] - src: implement constants binding directly (Joyee Cheung) #48186
[06d49c1f10] - src: implement natives binding without special casing (Joyee Cheung) #48186
[325441abf5] - src: add missing to_ascii method in dns queries (Daniel Lemire) #48354
[84d0eb74b8] - stream: fix premature pipeline end (Robert Nagy) #48435
[3df7368735] - test: add missing assertions to test-runner-cli (Moshe Atlow) #48593
[07eb310b0d] - test: remove test-crypto-keygen flaky designation (Luigi Pinca) #48575
[75aa0a7682] - test: remove test-timers-immediate-queue flaky designation (Luigi Pinca) #48575
[a9756f3126] - test: add Symbol.dispose support to mock timers (Benjamin Gruenbaum) #48549
[0f912a7248] - test: mark test-child-process-stdio-reuse-readable-stdio flaky (Luigi Pinca) #48537
[30f4bc4985] - test: make IsolateData per-isolate in cctest (Joyee Cheung) #48450
[407ce3fdcb] - test: define NAPI_VERSION before including node_api.h (Chengzhong Wu) #48376
[24a8fa95f0] - test: remove unnecessary noop function args to mustNotCall() (Antoine du Hamel) #48513
[09af579775] - test: skip test-runner-watch-mode on IBMi (Moshe Atlow) #48473
[77cb1ee0b2] - test: add missing <algorithm> include for std::find (Sam James) #48380
[7c790ca03c] - test: fix flaky test-watch-mode (Moshe Atlow) #48147
[1398829746] - test: fix test-net-autoselectfamily for kernel without IPv6 support (Livia Medeiros) #48265
[764119ba4b] - test: update url web-platform tests (Yagiz Nizipli) #48319
[f1ead59629] - test: ignore the copied entry_point.c (Luigi Pinca) #48297
[fc5d1bddcb] - test: refactor test-gc-http-client-timeout (Luigi Pinca) #48292
[46a3d068a0] - test: update encoding web-platform tests (Yagiz Nizipli) #48320
[141e5aad83] - test: update FileAPI web-platform tests (Yagiz Nizipli) #48322
[83cfc67099] - test: update user-timing web-platform tests (Yagiz Nizipli) #48321
[2c56835a33] - test_runner: fixed test shorthands return type (Shocker) #48555
[7d01c8894a] - (SEMVER-MINOR) test_runner: add initial draft for fakeTimers (Erick Wendel) #47775
[de4f14c249] - test_runner: add enqueue and dequeue events (Moshe Atlow) #48428
[5ebe3a4ea7] - test_runner: make --test-name-pattern recursive (Moshe Atlow) #48382
[93bf447308] - test_runner: refactor coverage report output for readability (Damien Seguin) #47791
[504d1d7bdc] - (SEMVER-MINOR) tls: add ALPNCallback server option for dynamic ALPN negotiation (Tim Perry) #45190
[203c3cf4ca] - tools: update lint-md-dependencies (Node.js GitHub Bot) #48544
[333907b19d] - tools: speedup compilation of js2c output (Keyhan Vakil) #48160
[10bd5f4d97] - tools: update lint-md-dependencies (Node.js GitHub Bot) #48486
[52de27b9fe] - tools: pin ruff version number (Rich Trott) #48505
[4345526644] - tools: replace sed with perl (Luigi Pinca) #48499
[6c590835f3] - tools: automate update openssl v16 (Marco Ippolito) #48377
[90b5335338] - tools: update eslint to 8.43.0 (Node.js GitHub Bot) #48487
[cd83530a11] - tools: update doc to to-vfile@8.0.0 (Node.js GitHub Bot) #48485
[e500b439bd] - tools: prepare tools/doc for to-vfile 8.0.0 (Rich Trott) #48485
[d623616813] - tools: update lint-md-dependencies (Node.js GitHub Bot) #48417
[a2e107dde4] - tools: update create-or-update-pull-request-action (Richard Lau) #48398
[8009e2c3be] - tools: update eslint-plugin-jsdoc (Richard Lau) #48393
[10385c8565] - tools: add version update to external dependencies (Andrea Fassina) #48081
[b1cef81b18] - tools: update eslint to 8.42.0 (Node.js GitHub Bot) #48328
[0923dc0b8e] - tools: disable jsdoc/no-defaults rule (Luigi Pinca) #48328
[b03146da85] - typings: remove unused primordials (Yagiz Nizipli) #48509
[e9c9d187b9] - typings: fix JSDoc in ESM loader modules (Antoine du Hamel) #48424
[fafe651d23] - url: conform to origin getter spec changes (Yagiz Nizipli) #48319

`v20.3.1`: 2023-06-20, Version 20.3.1 (Current), @RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
CVE-2023-30584: Path Traversal Bypass in Experimental Permission Model (High)
CVE-2023-30587: Bypass of Experimental Permission Model via Node.js Inspector (High)
CVE-2023-30582: Inadequate Permission Model Allows Unauthorized File Watching (Medium)
CVE-2023-30583: Bypass of Experimental Permission Model via fs.openAsBlob() (Medium)
CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
CVE-2023-30586: Bypass of Experimental Permission Model via Arbitrary OpenSSL Engines (Medium)
CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
OpenSSL Security Releases

More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.

Commits

[dac08dafc9] - crypto: handle cert with invalid SPKI gracefully (Tobias Nießen) nodejs-private/node-private#393
[d274c3babc] - crypto,https,tls: disable engines if perms enabled (Tobias Nießen) nodejs-private/node-private#409
[5621c1de38] - deps: update archs files for openssl-3.0.9-quic1 (Node.js GitHub Bot) #48402
[771caa9f1c] - deps: upgrade openssl sources to quictls/openssl-3.0.9-quic1 (Node.js GitHub Bot) #48402
[0459bf9c99] - doc,test: clarify behavior of DH generateKeys (Tobias Nießen) nodejs-private/node-private#426
[27e20501aa] - http: disable request smuggling via empty headers (Paolo Insogna) nodejs-private/node-private#427
[9c17e335f1] - msi: do not create AppData\Roaming\npm (Tobias Nießen) nodejs-private/node-private#408
[b51124c637] - permission: handle fs path traversal (RafaelGSS) nodejs-private/node-private#403
[ebc5927adc] - permission: handle fs.openAsBlob (RafaelGSS) nodejs-private/node-private#405
[c39a43bff5] - permission: handle fs.watchFile (RafaelGSS) nodejs-private/node-private#404
[d0a8264ec9] - policy: handle mainModule.__proto__ bypass (RafaelGSS) nodejs-private/node-private#416
[3df13d5a79] - src,permission: restrict inspector when pm enabled (RafaelGSS) nodejs-private/node-private#410

`v20.3.0`: 2023-06-08, Version 20.3.0 (Current), @targos

Compare Source

Notable Changes

[bfcb3d1d9a] - deps: upgrade to libuv 1.45.0, including significant performance improvements to file system operations on Linux (Santiago Gimeno) #48078
[5094d1b292] - doc: add Ruy Adorno to list of TSC members (Michael Dawson) #48172
[2f5dbca690] - doc: mark Node.js 14 as End-of-Life (Richard Lau) #48023
[b1828b325e] - (SEMVER-MINOR) lib: implement AbortSignal.any() (Chemi Atlow) #47821
[f380953103] - module: change default resolver to not throw on unknown scheme (Gil Tayar) #47824
[a94f87ed99] - (SEMVER-MINOR) node-api: define version 9 (Chengzhong Wu) #48151
[9e2b13dfa7] - stream: deprecate asIndexedPairs (Chemi Atlow) #48102

Commits

[35c96156d1] - benchmark: use cluster.isPrimary instead of cluster.isMaster (Deokjin Kim) #48002
[3e6e3abf32] - bootstrap: throw ERR_NOT_SUPPORTED_IN_SNAPSHOT in unsupported operation (Joyee Cheung) #47887
[c480559347] - bootstrap: put is_building_snapshot state in IsolateData (Joyee Cheung) #47887
[50c0a15535] - build: set v8_enable_webassembly=false when lite mode is enabled (Cheng Shao) #48248
[4562805cf6] - build: speed up compilation of mksnapshot output (Keyhan Vakil) #48162
[8b89f13933] - build: add action to close stale MRs (Michael Dawson) #48051
[5d92202220] - build: replace js2c.py with js2c.cc (Joyee Cheung) #46997
[6cf2adc36e] - cluster: use ObjectPrototypeHasOwnProperty (Daeyeon Jeong) #48141
[f564b03c38] - crypto: use openssl's own memory BIOs in crypto_context.cc (GauriSpears) #47160
[ac8dd61fc3] - crypto: remove default encoding from cipher (Tobias Nießen) #47998
[15c2de4407] - crypto: fix setEngine() when OPENSSL_NO_ENGINE set (Tobias Nießen) #47977
[9e2dd5b5e2] - deps: update zlib to 337322d (Node.js GitHub Bot) #48218
[bfcb3d1d9a] - deps: upgrade to libuv 1.45.0 (Santiago Gimeno) #48078
[13930f092f] - deps: update ada to 2.5.0 (Node.js GitHub Bot) #48223
[3047caebec] - deps: set CARES_RANDOM_FILE for c-ares (Richard Lau) #48156
[0db79a0872] - deps: update histogram 0.11.8 (Marco Ippolito) #47742
[99af6716f5] - deps: update histogram to 0.11.7 (Marco Ippolito) #47742
[d4922bc985] - deps: update c-ares to 1.19.1 (Node.js GitHub Bot) #48115
[f6ccdb289f] - deps: update simdutf to 3.2.12 (Node.js GitHub Bot) #48118
[3ed0afc778] - deps: update minimatch to 9.0.1 (Node.js GitHub Bot) #48094
[df7540fb73] - deps: update ada to 2.4.2 (Node.js GitHub Bot) #48092
[07df5c48e8] - deps: update corepack to 0.18.0 (Node.js GitHub Bot) #48091
[d95a5bb559] - deps: update uvwasi to 0.0.18 (Node.js GitHub Bot) #47866
[443477e041] - deps: update uvwasi to 0.0.17 (Node.js GitHub Bot) #47866
[03f67d6d6d] - deps: upgrade npm to 9.6.7 (npm team) #48062
[d3e3a911fd] - deps: update nghttp2 to 1.53.0 (Node.js GitHub Bot) #47997
[f7c4daaf67] - deps: update ada to 2.4.1 (Node.js GitHub Bot) #48036
[c6a752560d] - deps: add loongarch64 into openssl Makefile and gen openssl-loongarch64 (Shi Pujin) #46401
[d194241716] - deps: update undici to 5.22.1 (Node.js GitHub Bot) #47994
[02e919f4a2] - deps,test: update postject to 1.0.0-alpha.6 (Node.js GitHub Bot) #48072
[2c19f596ad] - doc: clarify array args to Buffer.from() (Bryan English) #48274
[d681e5f456] - doc: document watch option for node:test run() (Moshe Atlow) #48256
[96e54ddbca] - doc: reserve 117 for Electron 26 (Calvin) #48245
[9aff8c7818] - doc: update documentation for FIPS support (Richard Lau) #48194
[8c5338648f] - doc: improve the documentation of the stdio option (Kumar Arnav) #48110
[11918d705f] - doc: update Buffer.allocUnsafe description (sinkhaha) #48183
[2b51ee5e22] - doc: update codeowners with website team (Claudio Wunder) #48197
[360df25d04] - doc: fix broken link to new folder doc/contributing/maintaining (Andrea Fassina) #48205
[13e95e21a4] - doc: add atlowChemi to triagers (Chemi Atlow) #48104
[5f83ce530f] - doc: fix typo in readline completer function section (Vadym) #48188
[3c82165d27] - doc: remove broken link for keygen (Rich Trott) #48176
[0ca90a1e6d] - doc: add auto intrinsic height to prevent jitter/flicker (Daniel Holbert) #48195
[f117855092] - doc: add version info on the SEA docs (Antoine du Hamel) #48173
[5094d1b292] - doc: add Ruy to list of TSC members (Michael Dawson) #48172
[39d8140227] - doc: update socket.remote* properties documentation (Saba Kharanauli) #48139
[5497c13efe] - doc: update outdated section on TLSv1.3-PSK (Tobias Nießen) #48123
[281dfaf727] - doc: improve HMAC key recommendations (Tobias Nießen) #48121
[bd311b6c70] - doc: clarify mkdir() recursive behavior (Stephen Odogwu) #48109
[5b061c8922] - doc: fix typo in crypto legacy streams API section (Tobias Nießen) #48122
[10ccb2bd81] - doc: update SEA source link (Rich Trott) #48080
[415bf7f532] - doc: clarify tty.isRaw (Roberto Vidal) #48055
[0ac4b33c76] - doc: correct line break for Windows terminals (Alex Schwartz) #48083
[f30ba5c320] - doc: fix Windows code snippet tags (Antoine du Hamel) #48100
[12fef9b68c] - doc: harmonize fenced code snippet flags (Antoine du Hamel) #48082
[13f163eace] - doc: use secure key length for HMAC generateKey (Tobias Nießen) #48052
[1e3e7c9f33] - doc: update broken EVP_BytesToKey link (Rich Trott) #48064
[5917ba1838] - doc: update broken spkac link (Rich Trott) #48063
[0e4a3b7db1] - doc: document node-api version process (Chengzhong Wu) #47972
[85bbaa94ea] - doc: update process.versions properties (Saba Kharanauli) #48019
[7660eb591a] - doc: fix typo in binding functions (Deokjin Kim) #48003
[2f5dbca690] - doc: mark Node.js 14 as End-of-Life (Richard Lau) #48023
[3b94a739f2] - doc: clarify CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED (Tobias Nießen) #47976
[9e381cfa89] - doc: add heading for permission model limitations (Tobias Nießen) #47989
[802db923e0] - doc,vm: clarify usage of cachedData in vm.compileFunction() (Darshan Sen) #48193
[11a3434810] - esm: remove support for arrays in import internal method (Antoine du Hamel) #48296
[3b00f3afef] - esm: handle globalPreload hook returning a nullish value (Antoine du Hamel) #48249
[3c7846d7e1] - esm: handle more error types thrown from the loader thread (Antoine du Hamel) #48247
[60ce2bcabc] - http: send implicit headers on HEAD with no body (Matteo Collina) #48108
[72de4e7170] - lib: do not disable linter for entire files (Antoine du Hamel) #48299
[10cc60fc91] - lib: use existing isWindows variable (sinkhaha) #48134
[a90010aae9] - lib: support FORCE_COLOR for non TTY streams (Moshe Atlow) #48034
[b1828b325e] - (SEMVER-MINOR) lib: implement AbortSignal.any() (Chemi Atlow) #47821
[8f1b86961f] - meta: bump github/codeql-action from 2.3.3 to 2.3.6 (dependabot[bot]) #48287
[1b87ccdf70] - meta: bump actions/setup-python from 4.6.0 to 4.6.1 (dependabot[bot]) #48286
[10715aea26] - meta: bump codecov/codecov-action from 3.1.3 to 3.1.4 (dependabot[bot]) #48285
[79f73778ab] - meta: remove dont-land-on-v14 auto labeling (Shrujal Shah) #48031
[9c5711f3ea] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #48010
[6d6bf3ee52] - module: reduce the number of URL initializations (Yagiz Nizipli) #48272
[f380953103] - module: change default resolver to not throw on unknown scheme (Gil Tayar) #47824
[950185b0c0] - net: fix address iteration with autoSelectFamily (Fedor Indutny) #48258
[5ddca72e62] - net: fix family autoselection SSL connection handling (Paolo Insogna) #48189
[750e53ca3c] - net: fix family autoselection timeout handling (Paolo Insogna) #47860
[a94f87ed99] - (SEMVER-MINOR) node-api: define version 9 (Chengzhong Wu) #48151
[e834979818] - node-api: add status napi_cannot_run_js (Gabriel Schulhof) #47986
[eafe0c3ec6] - node-api: napi_ref on all types is experimental (Vladimir Morozov) #47975
[9a034746f5] - src: add Realm document in the src README.md (Chengzhong Wu) #47932
[b8f4070f71] - src: check node_extra_ca_certs after openssl cfg (Raghu Saxena) #48159
[0347a18056] - src: include missing header in node_sea.h (Joyee Cheung) #48152
[45c3782c20] - src: remove INT_MAX asserts in SecretKeyGenTraits (Tobias Nießen) #48053
[b25e7045ad] - src: avoid prototype access in binding templates (Joyee Cheung) #47913
[33aa373eec] - src: use Blob{Des|S}erializer for SEA blobs (Joyee Cheung) #47962
[9e2b13dfa7] - stream: deprecate asIndexedPairs (Chemi Atlow) #48102
[96c323dee2] - test: mark test-child-process-pipe-dataflow as flaky (Moshe Atlow) #48334
[9875885357] - test: adapt tests for OpenSSL 3.1 (OttoHollmann) #47859
[3440d7c6bf] - test: unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #48078
[215b2bc72c] - test: fix zlib version regex (Luigi Pinca) #48227
[e12ee59d26] - test: use lower security level in s_client (Luigi Pinca) #48192
[1dabc7390c] - Revert "test: unskip negative-settimeout.any.js WPT" (Filip Skokan) #48182
[c1c4796a86] - test: mark test_cannot_run_js as flaky (Keyhan Vakil) #48181
[8c49d74002] - test: fix flaky test-runner-watch-mode (Moshe Atlow) #48144
[6388766862] - test: skip test-http-pipeline-flood on IBM i (Abdirahim Musse) #48048
[8d2a3b1952] - test: ignore helper files in WPTs (Filip Skokan) #48079
[7a96d825fd] - test: move test-cluster-primary-error flaky test (Yagiz Nizipli) #48039
[a80dd3a8b3] - test: fix suite signal (Benjamin Gruenbaum) #47800
[a41cfd183f] - test: fix parsing test flags (Daeyeon Jeong) #48012
[4d4e506f2b] - test,doc,sea: run SEA tests on ppc64 (Darshan Sen) #48111
[44411fc40c] - test_runner: apply runOnly on suites (Moshe Atlow) #48279
[3f259b7a30] - test_runner: emit test:watch:drained event (Moshe Atlow) #48259
[c9f8e8c562] - test_runner: stop watch mode when abortSignal aborted (Moshe Atlow) #48259
[f3268d64cb] - test_runner: fix global after hook (Moshe Atlow) #48231
[15336c3139] - test_runner: remove redundant check from coverage (Colin Ihrig) #48070
[750d3e8606] - test_runner: pass FORCE_COLOR to child process (Moshe Atlow) #48057
[3278542243] - test_runner: dont split lines on test:stdout (Moshe Atlow) #48057
[027c531766] - test_runner: fix test deserialize edge cases (Moshe Atlow) #48106
[2b797a6d39] - test_runner: delegate stderr and stdout formatting to reporter (Shiba) #48045
[23d310bee8] - test_runner: display dot report as wide as the terminal width (Raz Luvaton) #48038
[fd2620dcf1] - tls: reapply servername on happy eyeballs connect (Fedor Indutny) #48255
[62f847d0b3] - tools: update rollup lint-md-dependencies (Node.js GitHub Bot) #48329
[3e97826a66] - Revert "tools: open issue when update workflow fails" (Marco Ippolito) #48312
[5f08bfe35f] - tools: don't gitignore base64 config.h (Ben Noordhuis) #48174
[ded0e2d755] - tools: update LICENSE and license-builder.sh (Santiago Gimeno) #48078
[07aa264366] - tools: automate histogram update (Marco Ippolito) #48171
[1416b75eaa] - tools: use shasum instead of sha256sum (Luigi Pinca) #48229
[b81e9d9b7b] - tools: harmonize dep_updaters scripts (Antoine du Hamel) #48201
[a60bc41e53] - tools: deps update authenticate github api request (Andrea Fassina) #48200
[7478ed014e] - tools: order dependency jobs alphabetically (Luca) #48184
[568a705799] - tools: refactor v8_pch config (Michaël Zasso) #47364
[801573ba46] - tools: log and verify sha256sum (Andrea Fassina) #48088
[db62325e18] - tools: open issue when update workflow fails (Marco Ippolito) #48018
[ad8a68856d] - tools: alphabetize CODEOWNERS (Rich Trott) #48124
[4cf5a9edaf] - tools: use latest upstream commit for zlib updates (Andrea Fassina) #48054
[8d93af381b] - tools: add security-wg as dep updaters owner (Marco Ippolito) #48113
[5325be1d99] - tools: port js2c.py to C++ (Joyee Cheung) #46997
[6c60d90277] - tools: fix race condition when npm installing (Tobias Nießen) #48101
[0ab840a58f] - tools: refloat 7 Node.js patches to cpplint.py (Rich Trott) #48098
[a298193378] - tools: update cpplint to 1.6.1 (Yagiz Nizipli) #48098
[f6725751b7] - tools: update eslint to 8.41.0 (Node.js GitHub Bot) #48097
[6539361f4e] - tools: update lint-md-dependencies (Node.js GitHub Bot) #48096
[5d94dbb951] - tools: update doc to remark-parse@10.0.2 (Node.js GitHub Bot) #48095
[2226088048] - tools: add debug logs (Marco Ippolito) #48060
[0c8c383583] - tools: fix zconf.h path (Luigi Pinca) #48089
[6adaf4c648] - tools: update remark-preset-lint-node to 4.0.0 (Node.js GitHub Bot) #47995
[92b3334231] - url: clean vertical alignment of docs (Robin Ury) #48037
[ebb6536775] - url: call ada::can_parse directly (Yagiz Nizipli) #47919
[ed4514294a] - vm: properly handle defining symbol props (Nicolas DUBIEN) #47572

`v20.2.0`: 2023-05-16, Version 20.2.0 (Current), @targos

Compare Source

Notable Changes

[c092df9094] - doc: add ovflowd to collaborators (Claudio Wunder) #47844
[4197a9a5a0] - (SEMVER-MINOR) http: prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732
[c4596b9ce7] - (SEMVER-MINOR) sea: add option to disable the experimental SEA warning (Darshan Sen) #47588
[17befe008c] - (SEMVER-MINOR) test_runner: add skip, todo, and only shorthands to test (Chemi Atlow) #47909
[a0634d7f89] - (SEMVER-MINOR) url: add value argument to URLSearchParams has and delete methods (Sankalp Shubham) #47885

Commits

[456fca0d9c] - bootstrap: initialize per-isolate properties of bindings separately (Joyee Cheung) #47768
[d6d12bf978] - bootstrap: log isolate data info in mksnapshot debug logs (Joyee Cheung) #47768
[e457d89a1b] - buffer: combine checking range of sourceStart in buf.copy (Deokjin Kim) #47758
[00668fcfb4] - child_process: use signal.reason in child process abort (Debadree Chatterjee) #47817
[d7993474ea] - crypto: remove default encoding from scrypt (Tobias Nießen) #47943
[09fb74a7cc] - crypto: fix webcrypto private/secret import with empty usages (Filip Skokan) #47877
[e9c6ee74f3] - crypto: remove default encoding from pbkdf2 (Tobias Nießen) #47869
[b7f13a8679] - deps: update simdutf to 3.2.9 (Node.js GitHub Bot) #47983
[b16f6da153] - deps: V8: cherry-pick 5f025d1 (Michaël Zasso) #47610
[99f8fcab45] - deps: V8: cherry-pick a8a11a8 (Michaël Zasso) #47610
[c2b14b4c78] - deps: update ada to 2.4.0 (Node.js GitHub Bot) #47922
[cad42e7a56] - deps: V8: cherry-pick 1b471b7 (Lu Yahan) #47399
[7b2f17ca59] - deps: upgrade npm to 9.6.6 (npm team) #47862
[d23b1af562] - deps: update ada to 2.3.1 (Node.js GitHub Bot) #47893
[72340c98fb] - dgram: convert macro to template (Tobias Nießen) #47891
[9be922892f] - dns: call ada::idna::to_ascii directly from c++ (Yagiz Nizipli) #47920
[4a1e97156a] - doc: add missing deprecated blocks to cluster (Tobias Nießen) #47981
[13118a19ee] - doc: update description of global (Tobias Nießen) #47969
[372796440b] - doc: update measure memory rejection information (Yash Ladha) #41639
[7ecc6740e4] - doc: fix broken link to TC39 import attributes proposal (Rich Trott) #47954
[b9771c95c7] - doc: fix broken link (Rich Trott) #47953
[6f5ba92e61] - doc: remove broken link (Rich Trott) #47942
[c9ffc555f1] - doc: document make lint-md-clean (Matteo Collina) #47926
[7ed99e8ba5] - doc: mark global object as legacy (Mert Can Altın) #47819
[bf39f2d252] - doc: ntfs junction points must link to directories (Ben Noordhuis) #47907
[4dfc3890d8] - doc: improve permission.has description (Daeyeon Jeong) #47875
[93f1aa2856] - doc: fix params names (Dmitry Semigradsky) #47853
[9a362aa2fb] - doc: update supported version of FreeBSD to 12.4 (Michaël Zasso) #47838
[89c70dc6e6] - doc: add stability experimental to pm (Rafael Gonzaga) #47890
[f96fb2eee7] - doc: swap Matteo with Rafael in the stewards (Rafael Gonzaga) #47841
[1666a146e3] - doc: add valgrind suppression details (Kevin Eady) #47760
[e53e8231ff] - doc: replace EOL versions in README (Tobias Nießen) #47833
[c092df9094] - doc: add ovflowd to collaborators (Claudio Wunder) #47844
[f7106765b3] - doc: update BUILDING.md previous versions links (Tobias Nießen) #47835
[811b43c215] - doc,test: update the v8.startupSnapshot doc and test the example (Joyee Cheung) #47468
[1ec640ac70] - esm: do not use 'beforeExit' on the main thread (Antoine du Hamel) #47964
[106dc612d6] - fs: make readdir recursive algorithm iterative (Ethan Arrowood) #47650
[a0da2348a8] - fs: move fs_use_promises_symbol to per-isolate symbols (Joyee Cheung) #47768
[4197a9a5a0] - (SEMVER-MINOR) http: prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732
[a4d6543598] - http2: improve nghttp2 error callback (Tobias Nießen) #47840
[a4fed6c580] - lib: update comment (sinkhaha) #47884
[fd8bec7b2b] - meta: bump step-security/harden-runner from 2.3.1 to 2.4.0 (Rich Trott) #47980
[f5b4b6d5dc] - meta: bump github/codeql-action from 2.3.2 to 2.3.3 (Rich Trott) #47979
[c05c0a2359] - meta: bump actions/setup-python from 4.5.0 to 4.6.0 (Rich Trott) #47968
[2a3d6d97cb] - meta: add security-wg ping to permission.js (Rafael Gonzaga) #47941
[6c158e8dd1] - meta: bump step-security/harden-runner from 2.2.1 to 2.3.1 (dependabot[bot]) #47808
[f7a8094d37] - meta: bump actions/setup-python from 4.5.0 to 4.6.0 (dependabot[bot]) #47806
[0f58e48792] - meta: bump actions/checkout from 3.3.0 to 3.5.2 (dependabot[bot]) #47805
[652b06dd82] - meta: remove extra space in scorecard workflow (Mestery) #47805
[9f06eaccaf] - meta: bump github/codeql-action from 2.2.9 to 2.3.2 (dependabot[bot]) #47809
[977fd7cf35] - meta: bump codecov/codecov-action from 3.1.1 to 3.1.3 (dependabot[bot]) #47807
[c19385c154] - module: refactor to use normalizeRequirableId in the CJS module loader (Darshan Sen) #47896
[739113f2fc] - module: block requiring test/reporters without scheme (Moshe Atlow) #47831
[f489c6710c] - (NODE-API-SEMVER-MAJOR) node-api: get Node API version used by addon (Vladimir Morozov) #45715
[7222f9d74b] - path: indicate index of wrong resolve() parameter (sosoba) #47660
[7dd32f1536] - permission: remove unused function declaration (Deokjin Kim) #47957
[af86625a05] - permission: resolve reference to absolute path only for fs permission (Daeyeon Jeong) #47930
[1625ae11fe] - quic: address recent coverity warning (Michael Dawson) #47753
[c4596b9ce7] - (SEMVER-MINOR) sea: add option to disable the experimental SEA warning (Darshan Sen) #47588
[1a7fc186bc] - sea: allow requiring core modules with the "node:" prefix (Darshan Sen) #47779
[786a1c5398] - src: deduplicate X509Certificate::Fingerprint* (Tobias Nießen) #47978
[060c1d502b] - src: stop copying code cache, part 2 (Keyhan Vakil) #47958
[1aec718619] - (SEMVER-MINOR) src: add cjs_module_lexer_version base64_version (Jithil P Ponnan) #45629
[0c06bfd8dc] - src: move BlobSerializerDeserializer to a separate header file (Darshan Sen) #47933
[bd553e7521] - src: rename SKIP_CHECK_SIZE to SKIP_CHECK_STRLEN (Tobias Nießen) #47845
[190596c189] - src: register external references for source code (Keyhan Vakil) #47055
[4293cc47f4] - src: support V8 experimental shared values in messaging (Shu-yu Guo) #47706
[9bc5d78f0c] - src: register ext reference for Fingerprint512 (Tobias Nießen) #47892
[a11507e23b] - src: stop copying code cache (Keyhan Vakil) #47144
[515c9b8de6] - src: clarify the parameter name in Permission::Apply (Daeyeon Jeong) #47874
[c4217613f5] - src: fix creating an ArrayBuffer from a Blob created with openAsBlob (Daeyeon Jeong) #47691
[4bc17fd67b] - src: avoid strcmp() with Utf8Value (Tobias Nießen) #47827
[d358317f70] - src: get binding data store directly from the realm (Joyee Cheung) #47437
[b04d51a0b5] - src: prefer data accessor of string and vector (Mohammed Keyvanzadeh) #47750
[2952cc576c] - src: add per-isolate SetFastMethod and Set[Fast]MethodNoSideEffect (Joyee Cheung) #47768
[010d2ecf94] - test: mark test-esm-loader-http-imports as flaky (Tobias Nießen) #47987
[bb33c74c07] - test: add getRandomValues return length (Jithil P Ponnan) #46357
[6e019586f7] - test: unskip negative-settimeout.any.js WPT (Filip Skokan) #47946
[8f547afe5f] - test: use appropriate usages for a negative import test (Filip Skokan) #47878
[7e34f77518] - test: fix webcrypto wrap unwrap tests (Filip Skokan) #47876
[30f4f35244] - test: fix output tests when path includes node version (Moshe Atlow) #47843
[54607bfd68] - test: reduce WPT concurrency (Filip Skokan) #47834
[17945a2495] - test: migrate a pseudo_tty test to use assertSnapshot (Moshe Atlow) #47803
[c9233679e8] - test: fix WPT state when process exits but workers are still running (Filip Skokan) #47826
[34bfb69b5b] - test: migrate message tests to use assertSnapshot (Moshe Atlow) #47498
[d25c785c2a] - test: allow SIGBUS in signal-handler abort test (Michaël Zasso) #47851
[aa2c7e00d7] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #47921
[da27542058] - test_runner: use v8.serialize instead of TAP (Moshe Atlow) #47867
[17befe008c] - (SEMVER-MINOR) test_runner: add shorthands to test (Chemi Atlow) #47909
[42db1d50a0] - test_runner: fix ordering of test hooks (Phil Nash) #47931
[d81c54e3a8] - test_runner: omit inaccessible files from coverage (Colin Ihrig) #47850
[a4e261e910] - tools: debug log for nghttp3 (Marco Ippolito) #47992
[f6ff318d4c] - tools: automate icu-small update (Marco Ippolito) #47727
[706c305381] - tools: update lint-md-dependencies to rollup@3.21.5 (Node.js GitHub Bot) #47903
[e22c686ca9] - tools: update eslint to 8.40.0 (Node.js GitHub Bot) #47906
[36f7cfac93] - tools: update eslint to 8.39.0 (Node.js GitHub Bot) #47789
[7323902a40] - tools: fix jsdoc lint (Moshe Atlow) #47789
[a0634d7f89] - (SEMVER-MINOR) url: add value argument to has and delete methods (Sankalp Shubham) #47885
[1b06c1e003] - url: improve isURL detection (Yagiz Nizipli) #47886
[2bd869d20c] - vm: fix crash when setting __proto__ on context's globalThis (Feng Yu) #47939
[e6685f9e82] - vm,lib: refactor microtaskQueue assignment logic (Khaidi Chu) #47765
[47fea13dac] - worker: support more cases when (de)serializing errors (Moshe Atlow) #47925
[6f3876c035] - worker: use snapshot in workers spawned by workers (Joyee Cheung) #47731

`v20.1.0`: 2023-05-03, Version 20.1.0 (Current), @targos

Compare Source

Notable Changes

[5e99598639] - assert: deprecate CallTracker (Moshe Atlow) #47740
[2d97c89c6f] - crypto: update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659
[ce8820e292] - (SEMVER-MINOR) dns: expose getDefaultResultOrder (btea) #46973
[9d30f469aa] - doc: add KhafraDev to collaborators (Matthew Aitken) #47510
[439ea47a77] - (SEMVER-MINOR) fs: add recursive option to readdir and opendir (Ethan Arrowood) #41439
[a54e898dc8] - (SEMVER-MINOR) fs: add support for mode flag to specify the copy behavior of the cp methods (Tetsuharu Ohzeki) #47084
[4fa773964b] - (SEMVER-MINOR) http: add highWaterMark option http.createServer (HinataKah0) #47405
[2b411f4b42] - (SEMVER-MINOR) stream: preserve object mode in compose (Raz Luvaton) #47413
[5327483f31] - (SEMVER-MINOR) test_runner: add testNamePatterns to run API (Chemi Atlow) #47628
[bdd02a467d] - (SEMVER-MINOR) test_runner: execute before hook on test (Chemi Atlow) #47586
[0e70c187bc] - (SEMVER-MINOR) test_runner: support combining coverage reports (Colin Ihrig) #47686
[75c1d1b66e] - (SEMVER-MINOR) wasi: make returnOnExit true by default (Michael Dawson) #47390

Commits

[33d1bd3e02] - assert: deprecate callTracker (Moshe Atlow) #47740
[6d87355e83] - benchmark: add eventtarget creation bench (Rafael Gonzaga) #47774
[40324a1dea] - benchmark: differentiate whatwg and legacy url (Yagiz Nizipli) #47377
[936d7cb069] - benchmark: add a benchmark for defaultResolve (Antoine du Hamel) #47543
[202042ee93] - bootstrap: support namespaced builtins in snapshot scripts (Joyee Cheung) #47467
[30af5cee55] - build: use pathlib for paths (Mohammed Keyvanzadeh) #47581
[089c9c51e9] - build: refactor configure.py (Mohammed Keyvanzadeh) #47667
[5b851c8074] - build: add devcontainer configuration (Tierney Cyren) #40825
[35e8b3b467] - build: bump ossf/scorecard-action from 2.1.2 to 2.1.3 (dependabot[bot]) #47367
[78c08243df] - build: replace Python linter flake8 with ruff (Christian Clauss) #47519
[2d97c89c6f] - crypto: update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659
[420feb41cf] - crypto: remove INT_MAX restriction in randomBytes (Tobias Nießen) #47559
[6046779dd9] - deps: disable V8 concurrent sparkplug compilation (Michaël Zasso) #47450
[00d461e93f] - deps: V8: cherry-pick c5ab3e4 (Richard Lau) #47736
[d08dd8069f] - deps: update ada to 2.3.0 (Node.js GitHub Bot) #47737
[996245976b] - deps: update undici to 5.22.0 (Node.js GitHub Bot) #47679
[f3ee3126df] - deps: update ada to 2.2.0 (Node.js GitHub Bot) #47678
[1391d3b9ff] - deps: add minimatch as a dependency (Moshe Atlow) #47499
[315454350d] - deps: update ada to 2.1.0 (Node.js GitHub Bot) #47598
[7f7735cad9] - deps: update ICU to 73.1 release (Steven R. Loomis) #47456
[13105c12b7] - deps: patch V8 to 11.3.244.8 (Michaël Zasso) #47536
[ede69d272a] - deps: update undici to 5.21.2 (Node.js GitHub Bot) #47508
[64b5a5f872] - deps: update simdutf to 3.2.8 (Node.js GitHub Bot) #47507
[2664536796] - deps: V8: cherry-pick 8e10685 (Jiawen Geng) #47440
[ba9ec91f0e] - deps: update undici to 5.21.1 (Node.js GitHub Bot) #47488
[ce8820e292] - (SEMVER-MINOR) dns: expose getDefaultResultOrder (btea) #46973
[4c26e28c33] - doc: create maintaining folder for deps (Marco Ippolito) #47589
[aa0ef3eabd] - doc: fix --allow-* CLI flag references (Tobias Nießen) #47804
[98603b6fd3] - doc: clarify fs permissions only affect fs module (Tobias Nießen) #47782
[3befe5dac9] - doc: add copy node executable guide on windows (XLor) #47781
[98450d9892] - doc: remove MoLow from Triagers (Moshe Atlow) #47792
[d75036410d] - doc: fix typo in webstreams.md (Christian Takle) #47766
[ceba37a74f] - doc: move BethGriggs to regular member (Rich Trott) #47776
[b954ea9781] - doc: mark signing the binary is macOS and Windows only in SEA (Xuguang Mei) #47722
[26bccbcd10] - doc: move addaleax to TSC emeriti (Anna Henningsen) #47752
[20b0de242f] - doc: add link to news for Node.js core (Michael Dawson) #47704
[5709133dc7] - doc: fix a typo in permissions.md (Daeyeon Jeong) #47730
[c5c40a89f2] - doc: async_hooks asynchronous content example add mjs code (btea) #47401
[a1403a8df2] - doc: clarify concurrency model of test runner (Tobias Nießen) #47642
[c0c23fbe42] - doc: fix a typo in fs.openAsBlob (Daeyeon Jeong) #47693
[4cef98812d] - doc: fix typos (Mohammed Keyvanzadeh) #47685
[f30ef242ef] - doc: fix capitalization of ASan (Mohammed Keyvanzadeh) #47676
[78a3503406] - doc: fix typos in SECURITY.md (Mohammed Keyvanzadeh) #47677
[9101630e05] - doc: update error code of buffer (Deokjin Kim) #47617
[183f0c3e79] - doc: change offset of example in Buffer.copyBytesFrom (Deokjin Kim) #47606
[d11ff4bc53] - doc: improve fs permissions description (Tobias Nießen) #47596
[b58920c3a9] - doc: remove markdown link from heading (Tobias Nießen) #47585
[c36634e880] - doc: fix history ordering of WASI constructor (Antoine du Hamel) #47611
[d3fadd889d] - doc: fix release-post script location (Rafael Gonzaga) #47517
[2a0bbe7883] - doc: fix typo in webcrypto metadata (Tobias Nießen) #47595
[b0b16ee9f6] - doc: add link for news from uvwasi team (Michael Dawson) #47531
[7ca416af15] - doc: add missing setEncoding call in ESM example (Anna Henningsen) #47558
[f9abd59b41] - doc: update darwin-x64 toolchain used for Node.js 20 releases (Michaël Zasso) #47546
[0dc508070f] - doc: fix split infinitive in Hooks caveat (Jacob Smith) #47550
[4046280475] - doc: fix typo in util.types.isNativeError() (Julian Dax) #47532
[9d30f469aa] - doc: add KhafraDev to collaborators (Matthew Aitken) #47510
[537c17ec48] - doc: create maintaining-brotli.md (Marco Ippolito) #47380
[09ff9eafd9] - doc,fs: update description of fs.stat() method (Mert Can Altın) #47654
[185d6090cd] - doc,test: fix concurrency option of test() (Tobias Nießen) #47734
[a793cf401d] - esm: rename URLCanParse to be consistent (Antoine du Hamel) #47668
[fbb6b72f87] - esm: remove support for deprecated hooks (Antoine du Hamel) #47580
[c150976c4f] - esm: initialize import.meta on eval (Antoine du Hamel) #47551
[55f70f6395] - esm: propagate process.exit from the loader thread to the main thread (Antoine du Hamel) #47548
[269482f61f] - esm: avoid accessing lazy getters for urls (Yagiz Nizipli) #47542
[889add68e5] - esm: avoid try/catch when validating urls (Yagiz Nizipli) #47541
[439ea47a77] - (SEMVER-MINOR) fs: add recursive option to readdir and opendir (Ethan Arrowood) #41439
[a54e898dc8] - (SEMVER-MINOR) fs: add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084
[96f93cc500] - (SEMVER-MINOR) http: remove internal error in assignSocket (Matteo Collina) #47723
[4fa773964b] - (SEMVER-MINOR) http: add highWaterMark opt in http.createServer (HinataKah0) #47405
[94a5abb1e0] - inspector: add tips for Session (theanarkh) #47195
[21ff33127a] - lib: improve esm resolve performance (Yagiz Nizipli) #46652
[b8bdaf86c4] - lib: disallow file-backed blob cloning (James M Snell) #47574
[e8bc03b372] - lib: use webidl DOMString converter in EventTarget (Matthew Aitken) #47514
[91e4a7cdee] - loader: use default loader as cascaded loader in the in loader worker (Joyee Cheung) #47620
[d5089fe00a] - meta: fix dependabot commit message (Mestery) #47810
[92794400ce] - meta: ping nodejs/startup for startup test changes (Joyee Cheung) #47771
[8d43689077] - meta: add mailmap entry for KhafraDev (Rich Trott) #47512
[4d02901935] - node-api: test passing NULL to napi_define_class (Gabriel Schulhof) #47567
[568256dca0] - node-api: test passing NULL to number APIs (Gabriel Schulhof) #47549
[12f0fa386d] - node-api: remove unused mark_arraybuffer_as_untransferable (Chengzhong Wu) #47557
[e8ea83416a] - quic: add more QUIC implementation (James M Snell) #47494
[af227b159d] - readline: fix issue with newline-less last line (Ian Harris) #47317
[e948bec969] - src: avoid copying string in fs_permission (Yagiz Nizipli) #47746
[dc43ce7706] - src: replace idna functions with ada::idna (Yagiz Nizipli) #47735
[1f9e7ce7e8] - src: fix typo in comment in quic/sessionticket.cc (Tobias Nießen) #47754
[2acb57b777] - src: mark fatal error functions as noreturn (Chengzhong Wu) #47695
[4431df7481] - src: split BlobSerializer/BlobDeserializer (Joyee Cheung) #47458
[bf9a52cb3d] - src: prevent changing FunctionTemplateInfo after publish (Shelley Vohr) #46979
[872e6706ca] - src: add v8 fast api for url canParse (Matthew Aitken) #47552
[cfafe431f2] - src: make AliasedBuffers in the binding data weak (Joyee Cheung) #47354
[cf48db0034] - src: use v8::Boolean(b) over b ? True() : False() (Tobias Nießen) #47554
[ba255eda37] - src: fix typo in process.env accessor error message (Moritz Raho) #47014
[daf0c78232] - src: replace static const string_view by static constexpr (Daniel Lemire) #47524
[57e7ed7f47] - src: fix CSMRNG when length exceeds INT_MAX (Tobias Nießen) #47515
[cda36bfd8f] - src: use correct variable in node_builtins.cc (Michaël Zasso) #47343
[adc1601ccd] - src: slim down stream_base-inl.h (lilsweetcaligula) #46972
[f88132f1b8] - stream: prevent pipeline hang with generator functions (Debadree Chatterjee) #47712
[2b411f4b42] - (SEMVER-MINOR) stream: preserve object mode in compose (Raz Luvaton) #47413
[159cf02920] - test: refactor to use getEventListeners in timers (Deokjin Kim) #47759
[97a3d39b8f] - test: add and use tmpdir.hasEnoughSpace() (Tobias Nießen) #47767
[5bb7b26bb5] - test: remove spaces from test runner test names (Tobias Nießen) #47733
[84fa9fd725] - test: refactor WPTRunner and enable parallel WPT execution (Filip Skokan) #47635
[9d3768eb01] - Revert "test: run WPT files in parallel again" (Filip Skokan) #47627
[826f4041d1] - test: mark test-cluster-primary-error flaky on asan (Yagiz Nizipli) #47422
[e5251e31eb] - test_runner: fix --require with --experimental-loader (Moshe Atlow) #47751
[6ee5e42c73] - (SEMVER-MINOR) test_runner: support combining coverage reports (Colin Ihrig) #47686
[f8581e7629] - test_runner: remove no-op validation (Colin Ihrig) #47687
[40b38797c5] - test_runner: fix test runner concurrency (Moshe Atlow) #47675
[2d7cac0c5b] - test_runner: fix test counting (Moshe Atlow) #47675
[5a9b71a52e] - test_runner: fix nested hooks (Moshe Atlow) #47648
[5327483f31] - (SEMVER-MINOR) test_runner: add testNamePatterns to run api (Chemi Atlow) #47628
[b6fb7914ca] - test_runner: support coverage of unnamed functions (Colin Ihrig) #47652
[1f120a396f] - test_runner: move coverage collection to root.postRun() (Colin Ihrig) #47651
[bdd02a467d] - (SEMVER-MINOR) test_runner: execute before hook on test (Chemi Atlow) #47586
[ec24abaa03] - test_runner: avoid reporting parents of failing tests in summary (Moshe Atlow) #47579
[4203057740] - test_runner: fix spec skip detection (Moshe Atlow) #47537
[57c69987ba] - tls: accept SecureContext object in server.addContext() (HinataKah0) #47570
[c620eb80a0] - tools: update doc to highlight.js@11.8.0 (Node.js GitHub Bot) #47786
[326c3f1593] - tools: add the missing LoongArch64 definition in the v8.gyp file (Sun Haiyong) #47641
[8d1588acdc] - tools: update lint-md-dependencies to rollup@3.21.1 (Node.js GitHub Bot) #47787
[226e5b83ee] - tools: move update-npm to dep updaters (Marco Ippolito) #47619
[9d0bef6c0a] - tools: fix update-v8-patch cache (Marco Ippolito) #47725
[63e8c95a66] - tools: automate v8 patch update (Marco Ippolito) #47594
[d2994e52d3] - tools: fix skip message in update-cjs-module-lexer (Tobias Nießen) #47701
[ccf9c37b43] - tools: update lint-md-dependencies to @rollup/plugin-commonjs @24.1.0 (Node.js GitHub Bot) #47577
[0887fa0464] - tools: keep MR titles/description up-to-date (Tobias Nießen) #47621
[b8927ddf16] - tools: fix updating root certificates (Richard Lau) #47607
[87cae0cb59] - tools: update MR label config (Mohammed Keyvanzadeh) #47593
[c17f2688b8] - Revert "tools: ensure failed daily wpt run still generates a report" (Filip Skokan) #47627
[fbe7d73234] - tools: add execution permission to uvwasi script (Mert Can Altın) #47600
[e3f4ff439e] - tools: add update script for googletest (Tobias Nießen) #47482
[7c552e650a] - tools: add option to run workflow with specific tool id (Michaël Zasso) #47591
[1509312170] - tools: automate zlib update (Marco Ippolito) #47417
[6af7f1ee03] - tools: add url and whatwg-url labels automatically (Yagiz Nizipli) #47545
[ff73c05d54] - tools: add performance label to benchmark changes (Yagiz Nizipli) #47545
[9e3e0b0a84] - tools: automate uvwasi dependency update (Ranieri Innocenti Spada) #47509
[233b628f22] - tools: add missing pinned dependencies (Mateo Nunez) #47346
[e4d95859f5] - tools: automate ngtcp2 and nghttp3 update (Marco Ippolito) #47402
[2e8338126b] - tools: move update-undici.sh to dep_updaters and create maintain md (Marco Ippolito) #47380
[8712eafc87] - typings: fix syntax error in tsconfig (Mohammed Keyvanzadeh) #47584
[e4b6b79f18] - url: reduce revokeObjectURL cpp calls (Yagiz Nizipli) #47728
[9aae76727f] - url: handle URL.canParse without base parameter (Yagiz Nizipli) #47547
[180d365439] - url: validate URL constructor arg length (Matthew Aitken) #47513
[4839fc4369] - url: validate argument length in canParse (Matthew Aitken) #47513
[606523d37e] - v8: fix ERR_NOT_BUILDING_SNAPSHOT is not a constructor (Chengzhong Wu) #47721
[75c1d1b66e] - (SEMVER-MINOR) wasi: make returnOnExit true by default (Michael Dawson) #47390

`v20.0.0`: 2023-04-18, Version 20.0.0 (Current), @RafaelGSS

Compare Source

We're excited to announce the release of Node.js 20! Highlights include the new Node.js Permission Model, a synchronous import.meta.resolve, a stable test_runner, updates of the V8 JavaScript engine to 11.3, Ada to 2.0, and more!

As a reminder, Node.js 20 will enter long-term support (LTS) in October, but until then, it will be the "Current" release for the next six months. We encourage you to explore the new features and benefits offered by this latest release and evaluate their potential impact on your applications.

Notable Changes

Permission Model

Node.js now has an experimental feature called the Permission Model. It allows developers to restrict access to specific resources during program execution, such as file system operations, child process spawning, and worker thread creation. The API exists behind a flag --experimental-permission which when enabled will restrict access to all available permissions. By using this feature, developers can prevent their applications from accessing or modifying sensitive data or running potentially harmful code. More information about the Permission Model can be found in the Node.js documentation.

The Permission Model was a contribution by Rafael Gonzaga in #44004.

Custom ESM loader hooks run on dedicated thread

ESM hooks supplied via loaders (--experimental-loader=foo.mjs) now run in a dedicated thread, isolated from the main thread. This provides a separate scope for loaders and ensures no cross-contamination between loaders and application code.

Synchronous import.meta.resolve()

In alignment with browser behavior, this function now returns synchronously. Despite this, user loader resolve hooks can still be defined as async functions (or as sync functions, if the author prefers). Even when there are async resolve hooks loaded, import.meta.resolve will still return synchronously for application code.

Contributed by Anna Henningsen, Antoine du Hamel, Geoffrey Booth, Guy Bedford, Jacob Smith, and Michaël Zasso in #44710

V8 11.3

The V8 engine is updated to version 11.3, which is part of Chromium 113. This version includes three new features to the JavaScript API:

String.prototype.isWellFormed and toWellFormed
Methods that change Array and TypedArray by copy
Resizable ArrayBuffer and growable SharedArrayBuffer
RegExp v flag with set notation + properties of strings
WebAssembly Tail Call

The V8 update was a contribution by Michaël Zasso in #47251.

Stable Test Runner

The recent update to Node.js, version 20, includes an important change to the test_runner module. The module has been marked as stable after a recent update. Previously, the test_runner module was experimental, but this change marks it as a stable module that is ready for production use.

Contributed by Colin Ihrig in #46983

Ada 2.0

Node.js v20 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url.

Ada 2.0 has been integrated into the Node.js codebase, ensuring that all parts of the application can benefit from the improved performance. Additionally, Ada 2.0 features a significant performance boost over its predecessor, Ada 1.0.4, while also eliminating the need for the ICU requirement for URL hostname parsing.

Contributed by Yagiz Nizipli and Daniel Lemire in #47339

Preparing single executable apps now requires injecting a Blob

Building a single executable app now requires injecting a blob prepared by Node.js from a JSON config instead of injecting the raw JS file. This opens up the possibility of embedding multiple co-existing resources into the SEA (Single Executable Apps).

Contributed by Joyee Cheung in #47125

Web Crypto API

Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations. This further improves interoperability with other implementations of Web Crypto API.

This change was made by Filip Skokan in #46067.

Official support for ARM64 Windows

Node.js now includes binaries for ARM64 Windows, allowing for native execution on the platform. The MSI, zip/7z packages, and executable are available from the Node.js download site along with all other platforms. The CI system was updated and all changes are now fully tested on ARM64 Windows, to prevent regressions and ensure compatibility.

ARM64 Windows was upgraded to tier 2 support by Stefan Stojanovic in #47233.

WASI version must now be specified

When new WASI() is called, the version option is now required and has no default value. Any code that relied on the default for the version will need to be updated to request a specific version.

This change was made by Michael Dawson in #47391.

Deprecations and Removals

[3bed5f11e0] - (SEMVER-MAJOR) url: runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526

url.parse() accepts URLs with ports that are not numbers. This behavior might result in host name spoofing with unexpected input. These URLs will throw an error in future versions of Node.js, as the WHATWG URL API does already. Starting with Node.js 20, these URLS cause url.parse() to emit a warning.

Semver-Major Commits

[9fafb0a090] - (SEMVER-MAJOR) async_hooks: deprecate the AsyncResource.bind asyncResource property (James M Snell) #46432
[1948d37595] - (SEMVER-MAJOR) buffer: check INSPECT_MAX_BYTES with validateNumber (Umuoy) #46599
[7bc0e6a4e7] - (SEMVER-MAJOR) buffer: graduate File from experimental and expose as global (Khafra) #47153
[671ffd7825] - (SEMVER-MAJOR) buffer: use min/max of validateNumber (Deokjin Kim) #45796
[ab1614d280] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #47251
[c1bcdbcf79] - (SEMVER-MAJOR) build: warn for gcc versions earlier than 10.1 (Richard Lau) #46806
[649f68fc1e] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Yagiz Nizipli) #45579
[9374700d7a] - (SEMVER-MAJOR) crypto: remove DEFAULT_ENCODING (Tobias Nießen) #47182
[1640aeb680] - (SEMVER-MAJOR) crypto: remove obsolete SSL_OP_* constants (Tobias Nießen) #47073
[c2e4b1fa9a] - (SEMVER-MAJOR) crypto: remove ALPN_ENABLED (Tobias Nießen) #47028
[3ef38c4bd7] - (SEMVER-MAJOR) crypto: use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067
[08af023b1f] - (SEMVER-MAJOR) crypto: runtime deprecate replaced rsa-pss keygen parameters (Filip Skokan) #45653
[7eb0ac3cb6] - (SEMVER-MAJOR) deps: patch V8 to support compilation on win-arm64 (Michaël Zasso) #47251
[a7c129f286] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #47251
[6f5655a18e] - (SEMVER-MAJOR) deps: always define V8_EXPORT_MRIVATE as no-op (Michaël Zasso) #47251
[f226350fcb] - (SEMVER-MAJOR) deps: update V8 to 11.3.244.4 (Michaël Zasso) #47251
[d6dae7420e] - (SEMVER-MAJOR) deps: V8: cherry-pick f1c888e (Michaël Zasso) #45579
[56c436533e] - (SEMVER-MAJOR) deps: fix V8 build on Windows with MSVC (Michaël Zasso) #45579
[51ab98c71b] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #45579
[9f84d3eea8] - (SEMVER-MAJOR) deps: V8: fix v8-cppgc.h for MSVC (Jiawen Geng) #45579
[f2318cd4b5] - (SEMVER-MAJOR) deps: fix V8 build issue with inline methods (Jiawen Geng) #45579
[16e03e7968] - (SEMVER-MAJOR) deps: update V8 to 10.9.194.4 (Yagiz Nizipli) #45579
[6473f5e7f7] - (SEMVER-MAJOR) doc: update toolchains used for Node.js 20 releases (Richard Lau) #47352
[cc18fd9608] - (SEMVER-MAJOR) events: refactor to use validateNumber (Deokjin Kim) #45770
[ff92b40ffc] - (SEMVER-MAJOR) http: close the connection after sending a body without declared length (Tim Perry) #46333
[2a29df6464] - (SEMVER-MAJOR) http: keep HTTP/1.1 conns alive even if the Connection header is removed (Tim Perry) #46331
[391dc74a10] - (SEMVER-MAJOR) http: throw error if options of http.Server is array (Deokjin Kim) #46283
[ed3604cd64] - (SEMVER-MAJOR) http: server check Host header, to meet RFC 7230 5.4 requirement (wwwzbwcom) #45597
[88d71dc301] - (SEMVER-MAJOR) lib: refactor to use min/max of validateNumber (Deokjin Kim) #45772
[e4d641f02a] - (SEMVER-MAJOR) lib: refactor to use validators in http2 (Debadree Chatterjee) #46174
[0f3e531096] - (SEMVER-MAJOR) lib: performance improvement on readline async iterator (Thiago Oliveira Santos) #41276
[5b5898ac86] - (SEMVER-MAJOR) lib,src: update exit codes as per todos (Debadree Chatterjee) #45841
[55321bafd1] - (SEMVER-MAJOR) net: enable autoSelectFamily by default (Paolo Insogna) #46790
[2d0d99733b] - (SEMVER-MAJOR) process: remove process.exit(), process.exitCode coercion to integer (Daeyeon Jeong) #43716
[dc06df31b6] - (SEMVER-MAJOR) readline: refactor to use validateNumber (Deokjin Kim) #45801
[295b2f3ff4] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 115 (Michaël Zasso) #47251
[3803b028dd] - (SEMVER-MAJOR) src: share common code paths for SEA and embedder script (Anna Henningsen) #46825
[e8bddac3e9] - (SEMVER-MAJOR) src: apply ABI-breaking API simplifications (Anna Henningsen) #46705
[f84de0ad4c] - (SEMVER-MAJOR) src: use uint32_t for process initialization flags enum (Anna Henningsen) #46427
[a6242772ec] - (SEMVER-MAJOR) src: fix ArrayBuffer::Detach deprecation (Michaël Zasso) #45579
[dd5c39a808] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 112 (Yagiz Nizipli) #45579
[63eca7fec0] - (SEMVER-MAJOR) stream: validate readable defaultEncoding (Marco Ippolito) #46430
[9e7093f416] - (SEMVER-MAJOR) stream: validate writable defaultEncoding (Marco Ippolito) #46322
[fb91ee4f26] - (SEMVER-MAJOR) test: make trace-gc-flag tests less strict (Yagiz Nizipli) #45579
[eca618071e] - (SEMVER-MAJOR) test: adapt test-v8-stats for V8 update (Michaël Zasso) #45579
[c03354d3e0] - (SEMVER-MAJOR) test: test case for multiple res.writeHead and res.getHeader (Marco Ippolito) #45508
[c733cc0c7f] - (SEMVER-MAJOR) test_runner: mark module as stable (Colin Ihrig) #46983
[7ce223273d] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.1 (Michaël Zasso) #47251
[ca4bd3023e] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.0 (Michaël Zasso) #47251
[58b06a269a] - (SEMVER-MAJOR) tools: update V8 gypfiles (Michaël Zasso) #45579
[027841c964] - (SEMVER-MAJOR) url: use private properties for brand check (Yagiz Nizipli) #46904
[3bed5f11e0] - (SEMVER-MAJOR) url: runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526
[7c76fddf25] - (SEMVER-MAJOR) util,doc: mark parseArgs() as stable (Colin Ihrig) #46718
[4b52727976] - (SEMVER-MAJOR) wasi: make version non-optional (Michael Dawson) #47391

Semver-Minor Commits

[d4b440bfac] - (SEMVER-MINOR) fs: implement byob mode for readableWebStream() (Debadree Chatterjee) #46933
[00c222593e] - (SEMVER-MINOR) src,process: add permission model (Rafael Gonzaga) #44004
[978b57d750] - (SEMVER-MINOR) wasi: no longer require flag to enable wasi (Michael Dawson) #47286

Semver-Patch Commits

[e50c6b9a22] - bootstrap: do not expand process.argv[1] for snapshot entry points (Joyee Cheung) #47466
[c81e1143e4] - bootstrap: store internal loaders in C++ via a binding (Joyee Cheung) #47215
[8e673bdb84] - build: add node-core-utils to setup (Jiawen Geng) #47442
[5b561d72a6] - build: sync cares source change (Jiawen Geng) #47359
[8e6ee53e4e] - build: remove non-exist build file (Jiawen Geng) #47361
[9a4d21d1d9] - build, deps, tools: avoid excessive LTO (Konstantin Demin) #47313
[48c01485cd] - crypto: replace THROW with CHECK for scrypt keylen (Tobias Nießen) #47407
[4c1a27716b] - crypto: re-add padding for AES-KW wrapped JWKs (Filip Skokan) #46563
[b66eb15d12] - deps: update simdutf to 3.2.7 (Node.js GitHub Bot) #47473
[3fc11477ba] - deps: update corepack to 0.17.2 (Node.js GitHub Bot) #47474
[c1776531ab] - deps: upgrade npm to 9.6.4 (npm team) #47432
[e7ca09f310] - deps: update zlib to upstream 5edb52d (Luigi Pinca) #47151
[88387ccd12] - deps: update ada to 2.0.0 (Node.js GitHub Bot) #47339
[9f468cc37e] - deps: cherry-pick Windows ARM64 fix for openssl (Richard Lau) #46570
[eeab210b1b] - deps: update archs files for quictls/openssl-3.0.8+quic (RafaelGSS) #46570
[d93d7716c7] - deps: upgrade openssl sources to quictls/openssl-3.0.8+quic (RafaelGSS) #46571
[0f69ec4dd7] - deps: patch V8 to 10.9.194.9 (Michaël Zasso) #45995
[5890d09644] - deps: patch V8 to 10.9.194.6 (Michaël Zasso) #45748
[c02a7e7e93] - diagnostics_channel: fix ref counting bug when reaching zero subscribers (Stephen Belanger) #47520
[c7ad5bb37d] - doc: info on handling unintended breaking changes (Michael Dawson) #47426
[7d2d40ed0d] - doc: add performance initiative (Yagiz Nizipli) #47424
[d56c0f7318] - doc: do not create a backup file (Luigi Pinca) #47151
[412d27b65b] - doc: add MoLow to the TSC (Colin Ihrig) #47436
[f131cca0c0] - doc: reserve 116 for Electron 25 (Keeley Hammond) #47375
[1022c6f424] - doc: add experimental stages (Geoffrey Booth) #46100
[42d3d74717] - doc: clarify release notes for Node.js 16.19.0 (Richard Lau) #45846
[533c6512da] - doc: clarify release notes for Node.js 14.21.2 (Richard Lau) #45846
[97165fc1a6] - doc: fix doc metadata for Node.js 16.19.0 (Richard Lau) #45863
[a266b8b702] - doc: add registry number for Electron 23 & 24 (Keeley Hammond) #45661
[2613a9ced9] - esm: move hook execution to separate thread (Jacob Smith) #44710
[841f6b3abf] - esm: increase test coverage of edge cases (Antoine du Hamel) #47033
[0d575fe61a] - gyp: put filenames in variables (Cheng Zhao) #46965
[41b186722c] - lib: distinguish webidl interfaces with the extended property "Exposed" (Chengzhong Wu) #46809
[9b7db62276] - lib: makeRequireFunction patch when experimental policy (RafaelGSS) nodejs-private/node-private#358
[d43b532789] - lib: refactor to use validateBuffer (Deokjin Kim) #46489
[9a76a2521b] - meta: ping security-wg team on permission model changes (Rafael Gonzaga) #47483
[a4dadde1ba] - meta: ping startup and realm team on src/node_realm* changes (Joyee Cheung) #47448
[631c3ef3de] - module: do less CJS module loader initialization at run time (Joyee Cheung) #47194
[8bcf0a42f7] - permission: fix chmod,chown improve fs coverage (Rafael Gonzaga) #47529
[54d17ff4b5] - permission: support fs.mkdtemp (Rafael Gonzaga) #47470
[b441b5dc65] - permission: drop process.permission.deny (Rafael Gonzaga) #47335
[aa30e16716] - permission: fix some vulnerabilities in fs (Tobias Nießen) #47091
[1726da9300] - permission: add path separator to loader check (Rafael Gonzaga) #47030
[b164038c86] - permission: fix spawnSync permission check (RafaelGSS) #46975
[af91400886] - policy: makeRequireFunction on mainModule.require (RafaelGSS) nodejs-private/node-private#358
[f8b4e26aee] - quic: add more QUIC impl (James M Snell) #47348
[d65ae9f678] - quic: add additional quic implementation utilities (James M Snell) #47289
[9b104be502] - quic: do not dereference shared_ptr after move (Tobias Nießen) #47294
[09a4bb152f] - quic: add multiple internal utilities (James M Snell) #47263
[2bde0059ca] - sea: use JSON configuration and blob content for SEA (Joyee Cheung) #47125
[78c7475493] - src: allow simdutf::convert_* functions to return zero (Daniel Lemire) #47471
[5250947a53] - src: track ShadowRealm native objects correctly in the heap snapshot (Joyee Cheung) #47389
[8059764621] - src: use the internal field to determine if an object is a BaseObject (Joyee Cheung) #47217
[698508afa8] - src: bootstrap prepare stack trace callback in shadow realm (Chengzhong Wu) #47107
[e6b4d30a2f] - src: bootstrap Web [Exposed=*] APIs in the shadow realm (Chengzhong Wu) #46809
[3646a66044] - src: fix AliasedBuffer memory attribution in heap snapshots (Joyee Cheung) #46817
[8b2126f63f] - src: move AliasedBuffer implementation to -inl.h (Joyee Cheung) #46817
[3abbc3829a] - src: fix useless call in permission.cc (Tobias Nießen) #46833
[7b1e153530] - src: simplify exit code accesses (Daeyeon Jeong) #45125
[7359b92a41] - test: remove unnecessary status check on test-release-npm (RafaelGSS) #47516
[a5a5d2fb7e] - test: mark test/parallel/test-file-write-stream4 as flaky (Yagiz Nizipli) #47423
[81ad73a205] - test: remove unused callback variables (angellovc) #47167
[757a586ead] - test: migrate test runner message tests to snapshot (Moshe Atlow) #47392
[86f890539f] - test: remove stale entry from known_issues.status (Richard Lau) #47454
[1f3773d0c1] - test: move more inspector sequential tests to parallel (Joyee Cheung) #47412
[617b8d44c6] - test: use random port in test-inspector-enabled (Joyee Cheung) #47412
[ade0170c4f] - test: use random port in test-inspector-debug-brk-flag (Joyee Cheung) #47412
[1a78632cd3] - test: use random port in NodeInstance.startViaSignal() (Joyee Cheung) #47412
[23f66b137e] - test: move test-shadow-realm-gc.js to known_issues (Joyee Cheung) #47355
[9dfd0394c5] - test: remove useless WPT init scripts (Khafra) #47221
[1cfe058778] - test: fix test-permission-deny-fs-wildcard (win32) (Tobias Nießen) #47095
[b8ef1b476e] - test: add coverage for custom loader hooks with permission model (Antoine du Hamel) #46977
[4a7c3e9c50] - test: fix file path in permission symlink test (Livia Medeiros) #46859
[10005de6a8] - tools: make js2c.py usable for other build systems (Cheng Zhao) #46930
[1e2f9aca72] - tools: move update-acorn.sh to dep_updaters and create maintaining md (Marco Ippolito) #47382
[174662a463] - tools: update eslint to 8.38.0 (Node.js GitHub Bot) #47475
[a58ca61f35] - tools: update eslint to 8.38.0 (Node.js GitHub Bot) #47475
[37d12730ab] - tools: automate cjs-module-lexer dependency update (Marco Ippolito) #47446
[4fbfa3c9f2] - tools: fix notify-on-push Slack messages (Antoine du Hamel) #47453
[b1f2ff1242] - tools: update lint-md-dependencies to @rollup/plugin-node-resolve @15.0.2 (Node.js GitHub Bot) #47431
[26b2584b84] - tools: add root certificate update script (Richard Lau) #47425
[553b052648] - tools: remove targets for individual test suites in Makefile (Antoine du Hamel) #46892
[747ff43e5b] - url: more sophisticated brand check for URLSearchParams (Timothy Gu) #47414
[e727eb066f] - url: do not use object as hashmap (Timothy Gu) #47415
[81c7875eb7] - url: drop ICU requirement for parsing hostnames (Yagiz Nizipli) #47339
[a4895df94a] - url: use ada::url_aggregator for parsing urls (Yagiz Nizipli) #47339

`v19.9.0`: 2023-04-10, Version 19.9.0 (Current), @RafaelGSS

Compare Source

Notable Changes

Tracing Channel in diagnostic_channel

TracingChannel adds a new, high-performance channel to publish tracing data about the timing and purpose of function executions.

Contributed by Stephen Belanger in #44943

New URL.canParse API

A new API was added to the URL. URL.canParse checks if an input with an optional base value can be parsed correctly according to WHATWG URL specification.

const isValid = URL.canParse('/foo', 'https://example.org/'); // true
const isNotValid = URL.canParse('/foo'); // false

Contributed by Khafra in #47179

Other notable changes

events:

(SEMVER-MINOR) add getMaxListeners method (Khafra) #47039 msi:
(SEMVER-MINOR) migrate to WiX4 (Stefan Stojanovic) #45943 node-api:
(SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) #46319 stream:
(SEMVER-MINOR) add setter & getter for default highWaterMark (Robert Nagy) #46929 test_runner:
(SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) #47238

Commits

[2cea7d8141] - benchmark: fix invalid requirementsURL (Deokjin Kim) #47378
[6a4076a188] - benchmark: lower URL.canParse runs (Khafra) #47351
[23a69d9279] - buffer: fix blob range error with many chunks (Khafra) #47320
[e3d98c3e7a] - buffer: use private properties for brand checks in File (Khafra) #47154
[9dc6aef98d] - build: bump github/codeql-action from 2.2.6 to 2.2.9 (dependabot[bot]) #47366
[910d2967f1] - build: update stale action from v7 to v8 (Rich Trott) #47357
[666df20ad9] - build: remove Python pip --no-user option (Christian Clauss) #47372
[3970537bb4] - build: avoid usage of pipes library (Mohammed Keyvanzadeh) #47271
[254a03b2eb] - crypto: unify validation of checkPrime checks (Tobias Nießen) #47165
[8e1e9edc57] - deps: update timezone to 2023c (Node.js GitHub Bot) #47302
[30c043c2b9] - deps: update timezone to 2023b (Node.js GitHub Bot) #47256
[40be01bc9c] - deps: update simdutf to 3.2.3 (Node.js GitHub Bot) #47331
[4b09222569] - deps: upgrade npm to 9.6.3 (npm team) #47325
[2a6c23ea5e] - deps: update corepack to 0.17.1 (Node.js GitHub Bot) #47156
[06b718363d] - deps: V8: cherry-pick 3e4952c (Richard Lau) #47236
[7e24498d81] - deps: upgrade npm to 9.6.2 (npm team) #47108
[7a4beaa182] - deps: V8: cherry-pick 215ccd5 (Joyee Cheung) #47212
[8a69929f23] - deps: V8: cherry-pick 975ff4d (Debadree Chatterjee) #47209
[10569de53f] - deps: cherry-pick win/arm64/clang fixes (Cheng Zhao) #47011
[ff6070eb1d] - deps: V8: cherry-pick cb30b8e (Darshan Sen) #47307
[0bbce034f9] - doc: add a note about os.cpus() returning an empty list (codedokode) #47363
[f8511e0b27] - doc: clarify reports are only evaluated on active versions (Rafael Gonzaga) #47341
[863b4d9c5b] - doc: remove Vladimir de Turckheim from Security release stewards (Vladimir de Turckheim) #47318
[2192b5b163] - doc: add importing util to example of `process.report.getReport' (Deokjin Kim) #47298
[1c21fbfa9a] - doc: vm.SourceTextModule() without context option (Axel Kittenberger) #47295
[89445fbea9] - doc: make win arm64 tier 2 platform (Stefan Stojanovic) #47233
[296577a549] - doc: document process for sharing project news (Michael Dawson) #47189
[e29a1462c7] - doc: revise example of assert.CallTracker (Deokjin Kim) #47252
[bac893adbe] - doc: fix typo in SECURITY.md (Rich Trott) #47282
[0949f238d1] - doc: use serial comma in cli docs (Tobias Nießen) #47262
[71246247a9] - doc: improve example for Error.captureStackTrace() (Julian Dax) #46886
[0b2ba441b2] - doc: clarify http error events after calling destroy() (Zach Bjornson) #46903
[a21459e0d5] - doc: update output of example in AbortController (Deokjin Kim) #47227
[7a2090c14c] - doc: drop one-week branch sync on major releases (Rafael Gonzaga) #47149
[eb4de0043d] - doc: fix grammar in the collaborator guide (Mohammed Keyvanzadeh) #47245
[908798ae19] - doc: update stream.reduce concurrency note (Raz Luvaton) #47166
[36c118bc92] - doc: remove use of DEFAULT_ENCODING in PBKDF2 docs (Tobias Nießen) #47181
[7ec87fd5ce] - doc: fix typos in async_context.md (Shubham Sharma) #47155
[a03aaba996] - doc: update collaborator guide to reflect TSC changes (Rich Trott) #47126
[c45a6977ec] - doc: clarify that fs.create{Read,Write}Stream support AbortSignal (Antoine du Hamel) #47122
[82c7757177] - doc: improve documentation for util.types.isNativeError() (Julian Dax) #46840
[8f9b9c17d5] - doc: rename the startup performance initiative to startup snapshot (#47111) (Joyee Cheung)
[c08995e897] - doc: indicate that name is no longer an optional argument (Daniel Roe) #47102
[316d626e61] - doc: fix "maintaining dependencies" heading typos (Keyhan Vakil) #47082
[a4b1a7761f] - esm: skip file: URL conversion to path when possible (Antoine du Hamel) #46305
[c5cd6b7f3b] - (SEMVER-MINOR) events: add getMaxListeners method (Khafra) #47039
[2c2b07ce5f] - fs: invalidate blob created from empty file when written to (Debadree Chatterjee) #47199
[e33dfce401] - inspector: log response and requests in the inspector for debugging (Joyee Cheung) #46941
[f6ec81dc05] - inspector: fix session.disconnect crash (theanarkh) #46942
[a738164fed] - lib: define Event.isTrusted in the prototype (Santiago Gimeno) #46974
[7d37dcdd9a] - (SEMVER-MINOR) lib: add tracing channel to diagnostics_channel (Stephen Belanger) #44943
[16d3dfa0aa] - meta: fix notable-change comment label url (Filip Skokan) #47300
[2c95f6e18b] - meta: clarify the threat model to explain the JSON.parse case (Matteo Collina) #47276
[22b9acdbf8] - meta: update link to collaborators discussion page (Michaël Zasso) #47211
[dc024d930a] - meta: automate description requests when notable change label is added (Danielle Adams) #47078
[54195357f3] - meta: move TSC voting member(s) to regular member(s) (Node.js GitHub Bot) #47180
[a3bffbaa11] - meta: move TSC voting member to regular membership (Node.js GitHub Bot) #46985
[d2a6aa6ecd] - meta: update GOVERNANCE.md to reflect TSC charter changes (Rich Trott) #47126
[b0aad345bf] - meta: ask expected behavior reason in bug template (Ben Noordhuis) #47049
[c03e79b141] - (SEMVER-MINOR) msi: migrate to WiX4 (Stefan Stojanovic) #45943
[ca981be2b9] - (SEMVER-MINOR) node-api: deprecate napi_module_register (Vladimir Morozov) #46319
[77f7200cce] - node-api: extend type-tagging to externals (Gabriel Schulhof) #47141
[55f3d215b8] - node-api: document node-api shutdown finalization (Chengzhong Wu) #45903
[b3fe2ba59b] - node-api: verify cleanup hooks order (Chengzhong Wu) #46692
[d6a12328a6] - repl: preserve preview on ESCAPE key press (Xuguang Mei) #46878
[33b0906640] - sea: fix memory leak detected by asan (Darshan Sen) #47309
[069515153f] - src: remove usage of std::shared_ptr<T>::unique() (Darshan Sen) #47315
[4405fc879a] - src: use stricter compile-time guidance (Tobias Nießen) #46509
[bbde68e5de] - src: remove unused variable in crypto_x509.cc (Michaël Zasso) #47344
[7a80312e19] - src: don't reset embeder signal handlers (Dmitry Vyukov) #47188
[d0a5e7e342] - src: fix some recently introduced coverity issues (Michael Dawson) #47240
[0a4ff2f9a0] - src: replace impossible THROW with CHECK (Tobias Nießen) #47168
[2fd0f79963] - src: fix duplication of externalized builtin code (Keyhan Vakil) #47079
[36a026bf44] - src: remove dead comments about return_code_cache (Keyhan Vakil) #47083
[aefe26692c] - src: remove SSL_CTX_get_tlsext_ticket_keys guards (Tobias Nießen) #47068
[90f4e16350] - src: fix clang 14 linker error (Keyhan Vakil) #47057
[b0809a73da] - src,http2: ensure cleanup if a frame is not sent (ywave620) #47244
[1fc62c7b35] - (SEMVER-MINOR) stream: add setter & getter for default highWaterMark (#46929) (Robert Nagy) #46929
[b8c6ceddd5] - stream: expose stream symbols (Robert Nagy) #45671
[f37825660c] - stream: dont wait for next item in take when finished (Raz Luvaton) #47132
[8eceaaeb4d] - test: fix flaky test-watch-mode-inspect (Moshe Atlow) #47403
[db95ed0b1b] - test: move debugger tests with --port=0 to parallel (Joyee Cheung) #47274
[041885ebd0] - test: use --port=0 in debugger tests that do not have to work on 9229 (Joyee Cheung) #47274
[130420b9e1] - test: run doctool tests in parallel (Joyee Cheung) #47273
[4b4336c34e] - test: verify tracePromise does not do runStores (Stephen Belanger) #47349
[54261f3294] - test: run WPT files in parallel again (Filip Skokan) #47283
[e2eb0543be] - test: update wasm/jsapi WPT (Michaël Zasso) #47210
[d341d0389f] - test: skip test-wasm-web-api on ARM (Michaël Zasso) #47299
[567573b16a] - test: skip instantiateStreaming-bad-imports WPT (Michaël Zasso) #47292
[45e7b10287] - test: fix 'checks' validation test for checkPrime (Tobias Nießen) #47139
[5749dfae70] - test: update URL web-platform-tests (Yagiz Nizipli) #47135
[49981b93d2] - test: reduce flakiness of test-http-remove-header-stays-removed.js (Debadree Chatterjee) #46855
[6772aa652a] - test: fix test-child-process-exec-cwd (Stefan Stojanovic) #47235
[41a69e772b] - test: skip broken tests win arm64 (Stefan Stojanovic) #47020
[7bcfd18f2c] - test: mark test-http-max-sockets as flaky on win32 (Tobias Nießen) #47134
[b96808b3e2] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #47222
[65955f1e46] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #47131
[bc6511a243] - test_runner: color errors only when colors are available (Moshe Atlow) #47394
[463361e625] - test_runner: hide failing tests title when all tests pass (Moshe Atlow) #47370
[eb837ce80d] - test_runner: stringify AssertError expected and actual (Moshe Atlow) #47088
[6b87f29000] - test_runner: add code coverage support to spec reporter (Pulkit Gupta) #46674
[bd4697a2a3] - test_runner: expose reporter for use in run api (Chemi Atlow) #47238
[3e7f8e8482] - test_runner: report failing tests after summary (HinataKah0) #47164
[4530582767] - test_runner: count nested tests (Moshe Atlow) #47094
[5a43586554] - test_runner: accept \x1b as a escape symbol (Debadree Chatterjee) #47050
[a5ebc896f1] - test_runner: support defining test reporter in NODE_OPTIONS (Steve Herzog) #46688
[a65fe5c29a] - tools: fix update-openssl.yml compare version (Marco Ippolito) #47384
[760e13c58d] - tools: ensure failed daily wpt run still generates a report (Filip Skokan) #47376
[9c975f79f0] - tools: use ref_name to get branch pushed on (Debadree Chatterjee) #47358
[b1d6a15028] - tools: add a at here tag for slack messages (Debadree Chatterjee) #47358
[c340de6d51] - tools: disable Codecov commit statuses (Michaël Zasso) #47306
[034082f0e5] - tools: update eslint to 8.37.0 (Node.js GitHub Bot) #47333
[03b6650c81] - tools: fix duration_ms to be milliseconds (Moshe Atlow) #44490
[30c667ec3a] - tools: automate brotli update (Marco Ippolito) #47205
[83791e5459] - tools: fix typo in nghttp2 path (Marco Ippolito) #47330
[53e8dad64a] - tools: add scorecard workflow (Mateo Nunez) #47254
[2499677d0b] - tools: pin actions by hash for auto-start-ci.yml (Gabriela Gutierrez) #46820
[98f64ee724] - tools: standardize base64 update (Marco Ippolito) #47201
[c1ef1fde8f] - tools: update codecov branch (Rich Trott) #47285
[9ecf2a4144] - tools: update lint-md-dependencies to rollup@3.20.2 (Node.js GitHub Bot) #47255
[def7e3d908] - tools: upgrade Windows digital signature to SHA256 (Tobias Nießen) #47206
[0b78ac53ad] - tools: standardize update-llhttp.sh (Marco Ippolito) #47198
[deb80b1c46] - tools: add button to copy code example to clipboard (jakecastelli) #46928
[6dca79f1ce] - tools: standardize update-nghttp2.sh (Marco Ippolito) #47197
[0c613c9347] - tools: fix Slack notification action (Antoine du Hamel) #47237
[3f49da5113] - tools: notify on Slack when invalid commit lands (Antoine du Hamel) #47178
[337123d657] - tools: update daily wpt actions summary (Filip Skokan) #47138
[78ce8d3469] - tools: allow test tap output to include unicode characters (Moshe Atlow) #47175
[8850dacc88] - tools: update lint-md-dependencies to rollup@3.19.1 (Node.js GitHub Bot) #47045
[d1ca5b6d47] - tools: align update-ada.sh with other scripts (Tony Gorez) #47044
[b58d52301e] - tools: update eslint to 8.36.0 (Node.js GitHub Bot) #47046
[d78bef8a1f] - tools,meta: update README and tools to reflect changes in TSC charter (Rich Trott) #47126
[d243115f41] - url: improve URLSearchParams creation performance (Yagiz Nizipli) #47190
[461ef04f87] - url: add pending-deprecation to url.parse() (Yagiz Nizipli) #47203
[ef62e5a59e] - (SEMVER-MINOR) url: implement URL.canParse (Khafra) #47179
[0b565e8f62] - url: allow extension of user provided URL objects (Antoine du Hamel) #46989
[cbb362736b] - util: fix inspecting error with a throwing getter for cause (Antoine du Hamel) #47163
[9537672511] - vm: properly handle defining props on any value (Nicolas DUBIEN) #46615
[75669e98bf] - watch: fix watch path with equals (Moshe Atlow) #47369

`v19.8.1`: 2023-03-15, Version 19.8.1 (Current), @targos

Compare Source

Notable Changes

This release contains a single revert of a change that was introduced in v19.8.0 and introduced application crashes.

Fixes: #47096

Commits

[f7c8aa4cf1] - Revert "vm: fix leak in vm.compileFunction when importModuleDynamically is used" (Michaël Zasso) #47101

`v19.7.0`: 2023-02-21, Version 19.7.0 (Current), @MylesBorins

Compare Source

Notable Changes

[60a612607e] - deps: upgrade npm to 9.5.0 (npm team) #46673
[7d6c27eab1] - deps: add ada as a dependency (Yagiz Nizipli) #46410
[a79a8bf85a] - doc: add debadree25 to collaborators (Debadree Chatterjee) #46716
[0c2c322ee6] - doc: add deokjinkim to collaborators (Deokjin Kim) #46444
[9b23309f53] - doc,lib,src,test: rename --test-coverage (Colin Ihrig) #46017
[8590eb4830] - (SEMVER-MINOR) lib: add aborted() utility function (Debadree Chatterjee) #46494
[164bfe82cc] - (SEMVER-MINOR) src: add initial support for single executable applications (Darshan Sen) #45038
[f3908411fd] - (SEMVER-MINOR) src: allow optional Isolate termination in node::Stop() (Shelley Vohr) #46583
[c34bac2fed] - (SEMVER-MINOR) src: allow blobs in addition to FILE*s in embedder snapshot API (Anna Henningsen) #46491
[683a1f8f3e] - (SEMVER-MINOR) src: allow snapshotting from the embedder API (Anna Henningsen) #45888
[658d2f4710] - (SEMVER-MINOR) src: make build_snapshot a per-Isolate option, rather than a global one (Anna Henningsen) #45888
[6801d3753c] - (SEMVER-MINOR) src: add snapshot support for embedder API (Anna Henningsen) #45888
[e77d538d32] - (SEMVER-MINOR) src: allow embedder control of code generation policy (Shelley Vohr) #46368
[633d3f292d] - (SEMVER-MINOR) stream: add abort signal for ReadableStream and WritableStream (Debadree Chatterjee) #46273
[6119289251] - test_runner: add initial code coverage support (Colin Ihrig) #46017
[a51fe3c663] - url: replace url-parser with ada (Yagiz Nizipli) #46410

Commits

[731a7ae9da] - async_hooks: add async local storage propagation benchmarks (Chengzhong Wu) #46414
[05ad792a07] - async_hooks: remove experimental onPropagate option (James M Snell) #46386
[6b21170b10] - benchmark: add trailing commas in benchmark/path (Antoine du Hamel) #46628
[4b89ec409f] - benchmark: add trailing commas in benchmark/http (Antoine du Hamel) #46609
[ff95eb7386] - benchmark: add trailing commas in benchmark/crypto (Antoine du Hamel) #46553
[638d9b8d4b] - benchmark: add trailing commas in benchmark/url (Antoine du Hamel) #46551
[7524871a9b] - benchmark: add trailing commas in benchmark/http2 (Antoine du Hamel) #46552
[9d9b3f856f] - benchmark: add trailing commas in benchmark/process (Antoine du Hamel) #46481
[6c69ad6d43] - benchmark: add trailing commas in benchmark/misc (Antoine du Hamel) #46474
[7f8b292bee] - benchmark: add trailing commas in benchmark/buffers (Antoine du Hamel) #46473
[897e3c2782] - benchmark: add trailing commas in benchmark/module (Antoine du Hamel) #46461
[7760d40c04] - benchmark: add trailing commas in benchmark/net (Antoine du Hamel) #46439
[8b88d605ca] - benchmark: add trailing commas in benchmark/util (Antoine du Hamel) #46438
[2c8c9f978d] - benchmark: add trailing commas in benchmark/async_hooks (Antoine du Hamel) #46424
[b364b9bd60] - benchmark: add trailing commas in benchmark/fs (Antoine du Hamel) #46426
[e15ddba7e7] - build: add GitHub Action for coverage with --without-intl (Rich Trott) #37954
[c781a48097] - build: do not disable inspector when intl is disabled (Rich Trott) #37954
[b4deb2fcd5] - crypto: don't assume FIPS is disabled by default (Michael Dawson) #46532
[60a612607e] - deps: upgrade npm to 9.5.0 (npm team) #46673
[6c997035fc] - deps: update corepack to 0.16.0 (Node.js GitHub Bot) #46710
[2ed3875eee] - deps: update undici to 5.20.0 (Node.js GitHub Bot) #46711
[20cb13bf7f] - deps: update ada to v1.0.1 (Yagiz Nizipli) #46550
[c0983cfc06] - deps: copy postject-api.h and LICENSE to the deps folder (Darshan Sen) #46582
[7d6c27eab1] - deps: add ada as a dependency (Yagiz Nizipli) #46410
[7e7e2d037b] - deps: update c-ares to 1.19.0 (Michaël Zasso) #46415
[a79a8bf85a] - doc: add debadree25 to collaborators (Debadree Chatterjee) #46716
[6a8b04d709] - doc: move bcoe to emeriti (Benjamin Coe) #46703
[a0a6ee0f54] - doc: add response.strictContentLength to documentation (Marco Ippolito) #46627
[ffdd64dce3] - doc: remove unused functions from example of streamConsumers.text (Deokjin Kim) #46581
[c771d66864] - doc: fix test runner examples (Richie McColl) #46565
[375bb22df9] - doc: update test concurrency description / default values (richiemccoll) #46457
[a7beac04ba] - doc: enrich test command with executable (Tony Gorez) #44347
[aef57cd290] - doc: fix wrong location of requestTimeout's default value (Deokjin Kim) #46423
[0c2c322ee6] - doc: add deokjinkim to collaborators (Deokjin Kim) #46444
[31d3e3c486] - doc: fix -C flag usage (三咲智子 Kevin Deng) #46388
[905a6756a3] - doc: add note about major release rotation (Rafael Gonzaga) #46436
[33a98c42fa] - doc: update threat model based on discussions (Michael Dawson) #46373
[9b23309f53] - doc,lib,src,test: rename --test-coverage (Colin Ihrig) #46017
[f192b83800] - esm: misc test refactors (Geoffrey Booth) #46631
[7f2cdd36cf] - http: add note about clientError event (Paolo Insogna) #46584
[d8c527f24f] - http: use v8::Array::New() with a prebuilt vector (Joyee Cheung) #46447
[fa600fe003] - lib: add trailing commas in internal/process (Antoine du Hamel) #46687
[4aebee63f0] - lib: do not crash using workers with disabled shared array buffers (Ruben Bridgewater) #41023
[a740908588] - lib: delete module findPath unused params (sinkhaha) #45371
[8b46c763d9] - lib: enforce use of trailing commas in more files (Antoine du Hamel) #46655
[aae0020e27] - lib: enforce use of trailing commas for functions (Antoine du Hamel) #46629
[da9ebaf138] - lib: predeclare Event.isTrusted prop descriptor (Santiago Gimeno) #46527
[35570e970e] - lib: tighten AbortSignal.prototype.throwIfAborted implementation (Antoine du Hamel) #46521
[8590eb4830] - (SEMVER-MINOR) lib: add aborted() utility function (Debadree Chatterjee) #46494
[5d1a729f76] - meta: update AUTHORS (Node.js GitHub Bot) #46624
[cb9b9ad879] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #46513
[17b82c85d9] - meta: update AUTHORS (Node.js GitHub Bot) #46504
[bb14a2b098] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #46411
[152a3c7d1d] - process: print versions by sort (Himself65) #46428
[164bfe82cc] - (SEMVER-MINOR) src: add initial support for single executable applications (Darshan Sen) #45038
[f3908411fd] - (SEMVER-MINOR) src: allow optional Isolate termination in node::Stop() (Shelley Vohr) #46583
[bdba600d32] - src: remove icu usage from node_string.cc (Yagiz Nizipli) #46548
[31fb2e22a0] - src: add fflush() to SnapshotData::ToFile() (Anna Henningsen) #46531
[c34bac2fed] - (SEMVER-MINOR) src: allow blobs in addition to FILE*s in embedder snapshot API (Anna Henningsen) #46491
[c3325bfc0d] - src: make edge names in BaseObjects more descriptive in heap snapshots (Joyee Cheung) #46492
[3c5db8f419] - src: avoid leaking snapshot fp on error (Tobias Nießen) #46497
[1a808a4aad] - src: check return value of ftell() (Tobias Nießen) #46495
[f72f643549] - src: remove unused includes from main thread (Yagiz Nizipli) #46471
[60c2a863da] - src: use string_view instead of std::string& (Yagiz Nizipli) #46471
[f35f6d2218] - src: use simdutf utf8 to utf16 instead of icu (Yagiz Nizipli) #46471
[00b81c7afe] - src: replace icu with simdutf for char counts (Yagiz Nizipli) #46472
[683a1f8f3e] - (SEMVER-MINOR) src: allow snapshotting from the embedder API (Anna Henningsen) #45888
[658d2f4710] - (SEMVER-MINOR) src: make build_snapshot a per-Isolate option, rather than a global one (Anna Henningsen) #45888
[6801d3753c] - (SEMVER-MINOR) src: add snapshot support for embedder API (Anna Henningsen) #45888
[95065c3185] - src: add additional utilities to crypto::SecureContext (James M Snell) #45912
[efc59d0843] - src: add KeyObjectHandle::HasInstance (James M Snell) #45912
[a8a2d0e2b1] - src: add GetCurrentCipherName/Version to crypto_common (James M Snell) #45912
[6cf860d3d6] - src: back snapshot I/O with a std::vector sink (Joyee Cheung) #46463
[e77d538d32] - (SEMVER-MINOR) src: allow embedder control of code generation policy (Shelley Vohr) #46368
[7756438c81] - stream: add trailing commas in webstream source files (Antoine du Hamel) #46685
[6b64a945c6] - stream: add trailing commas in stream source files (Antoine du Hamel) #46686
[633d3f292d] - (SEMVER-MINOR) stream: add abort signal for ReadableStream and WritableStream (Debadree Chatterjee) #46273
[f91260b32a] - stream: refactor to use validateAbortSignal (Antoine du Hamel) #46520
[6bf7388b62] - stream: allow transfer of readable byte streams (MrBBot) #45955
[c2068537fa] - stream: add pipeline() for webstreams (Debadree Chatterjee) #46307
[4cf4b41c56] - stream: add suport for abort signal in finished() for webstreams (Debadree Chatterjee) #46403
[b844a09fa5] - stream: dont access Object.prototype.type during TransformStream init (Debadree Chatterjee) #46389
[6ad01fd7b5] - test: fix test-net-autoselectfamily for kernel without IPv6 support (Livia Medeiros) #45856
[2239e24306] - test: fix assertions in test-snapshot-dns-lookup* (Tobias Nießen) #46618
[c4ca98e786] - test: cover publicExponent validation in OpenSSL (Tobias Nießen) #46632
[e60d3f2b1d] - test: add WPTRunner support for variants and generating WPT reports (Filip Skokan) #46498
[217f2f6e2a] - test: add trailing commas in test/pummel (Antoine du Hamel) #46610
[641e1771c8] - test: enable api-invalid-label.any.js in encoding WPTs (Filip Skokan) #46506
[89aa161173] - test: fix tap parser fails if a test logs a number (Pulkit Gupta) #46056
[faba8d4a30] - test: add trailing commas in test/js-native-api (Antoine du Hamel) #46385
[d556ccdd26] - test: make more crypto tests work with BoringSSL (Shelley Vohr) #46429
[c7f29b24a6] - test: add trailing commas in test/known_issues (Antoine du Hamel) #46408
[a66e7ca6c5] - test: add trailing commas in test/internet (Antoine du Hamel) #46407
[0f75633086] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #46575
[ddf5002782] - test_runner: parse non-ascii character correctly (Mert Can Altın) #45736
[5b748114d2] - test_runner: allow nesting test within describe (Moshe Atlow) #46544
[c526f9f70a] - test_runner: fix missing test diagnostics (Moshe Atlow) #46450
[b31aabb101] - test_runner: top-level diagnostics not ommited when running with --test (Pulkit Gupta) #46441
[6119289251] - test_runner: add initial code coverage support (Colin Ihrig) #46017
[6f24f0621e] - timers: cleanup no-longer relevant TODOs in timers/promises (James M Snell) #46499
[1cd22e7d19] - tools: fix bug in prefer-primordials lint rule (Antoine du Hamel) #46659
[87df34ac28] - tools: fix update-ada script (Yagiz Nizipli) #46550
[f62b58a623] - tools: add a daily wpt.fyi synchronized report upload (Filip Skokan) #46498
[803f00aa32] - tools: update eslint to 8.34.0 (Node.js GitHub Bot) #46625
[f87216bdb2] - tools: update lint-md-dependencies to rollup@3.15.0 to-vfile@7.2.4 (Node.js GitHub Bot) #46623
[8ee9e48560] - tools: update doc to remark-html@15.0.2 to-vfile@7.2.4 (Node.js GitHub Bot) #46622
[148c5d9239] - tools: update lint-md-dependencies to rollup@3.13.0 vfile-reporter@7.0.5 (Node.js GitHub Bot) #46503
[51c6c61a58] - tools: update ESLint custom rules to not use the deprecated format (Antoine du Hamel) #46460
[a51fe3c663] - url: replace url-parser with ada (Yagiz Nizipli) #46410
[129c9e7180] - url: remove unused URL::ToFilePath() (Yagiz Nizipli) #46487
[9a604d67c3] - url: remove unused URL::toObject (Yagiz Nizipli) #46486
[d6fbebda54] - url: remove unused setURLConstructor function (Yagiz Nizipli) #46485
[17b3ee33c2] - vm: properly support symbols on globals (Nicolas DUBIEN) #46458

`v19.6.1`: 2023-02-16, Version 19.6.1 (Current), @RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-23919: OpenSSL errors not cleared in error stack (Medium)
CVE-2023-23918: Experimental Policies bypass via process.mainModule.require(High)
CVE-2023-23920: Insecure loading of ICU data through ICU_DATA environment variable (Low)

More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post.

This security release includes OpenSSL security updates as outlined in the recent OpenSSL security advisory and undici security update.

Commits

[97d9d55d2f] - build: build ICU with ICU_NO_USER_DATA_OVERRIDE (RafaelGSS) nodejs-private/node-private#374
[8ac90e6372] - crypto: clear OpenSSL error on invalid ca cert (RafaelGSS) nodejs-private/node-private#368
[10a4c47e3a] - deps: update undici to 5.19.1 (Node.js GitHub Bot) #46634
[b10fc75e4a] - deps: update undici to 5.18.0 (Node.js GitHub Bot) #46502
[e9b64ea8b9] - deps: update undici to 5.17.1 (Node.js GitHub Bot) #46502
[66a24cec47] - deps: cherry-pick Windows ARM64 fix for openssl (Richard Lau) #46573
[d8559aa6f5] - deps: update archs files for quictls/openssl-3.0.8+quic (RafaelGSS) #46573
[dc477f547d] - deps: upgrade openssl sources to quictls/openssl-3.0.8+quic (RafaelGSS) #46573
[2aae197670] - lib: makeRequireFunction patch when experimental policy (RafaelGSS) nodejs-private/node-private#358
[6d17b693ec] - policy: makeRequireFunction on mainModule.require (RafaelGSS) nodejs-private/node-private#358

`v19.6.0`: 2023-02-02, Version 19.6.0 (Current), @ruyadorno

Compare Source

Notable changes

ESM: Leverage loaders when resolving subsequent loaders

Loaders now apply to subsequent loaders, for example: --experimental-loader ts-node --experimental-loader loader-written-in-typescript.

Upgrade npm to 9.4.0

Added --install-strategy=linked option for installations similar to pnpm.

Other notable changes

[a7c9daa497] - (SEMVER-MINOR) fs: add statfs() functions (Colin Ihrig) #46358
[34d70ce615] - (SEMVER-MINOR) vm: expose cachedDataRejected for vm.compileFunction (Anna Henningsen) #46320
[b4ac794923] - (SEMVER-MINOR) v8: support gc profile (theanarkh) #46255
[d52f60009a] - (SEMVER-MINOR) src,lib: add constrainedMemory API for process (theanarkh) #46218
[5ad6c2088e] - (SEMVER-MINOR) buffer: add isAscii method (Yagiz Nizipli) #46046
[fbdc3f7316] - (SEMVER-MINOR) test_runner: add reporters (Moshe Atlow) #45712

Commits

[524eec70e2] - benchmark: add trailing commas (Antoine du Hamel) #46370
[f318a85408] - benchmark: remove buffer benchmarks redundancy (Brian White) #45735
[6186b3ea14] - benchmark: introduce benchmark combination filtering (Brian White) #45735
[5ad6c2088e] - (SEMVER-MINOR) buffer: add isAscii method (Yagiz Nizipli) #46046
[8c6c4338a6] - build: export more OpenSSL symbols on Windows (Mohamed Akram) #45486
[d795d93901] - build: fix MSVC 2022 Release compilation (Vladimir Morozov (REDMOND)) #46228
[8e363cf8e8] - crypto: include hmac.h in crypto_util.h (Adam Langley) #46279
[c1f3e13c65] - deps: update acorn to 8.8.2 (Node.js GitHub Bot) #46363
[813b160bd7] - deps: upgrade npm to 9.4.0 (npm team) #46353
[9c2f3cea70] - deps: update undici to 5.15.0 (Node.js GitHub Bot) #46213
[312e10c1e3] - deps: update to uvwasi 0.0.15 (Colin Ihrig) #46253
[c7024eec16] - doc: correct the sed command for macOS in release process docs (Juan José) #46397
[996bac044b] - doc: include webstreams in finished() and Duplex.from() parameters (Debadree Chatterjee) #46312
[891d18d55c] - doc: pass string to textEncoder.encode as input (Deokjin Kim) #46421
[968db213f8] - doc: add tip for session.post function (theanarkh) #46354
[a64d7f4e31] - doc: add documentation for socket.destroySoon() (Luigi Pinca) #46337
[975788899f] - doc: fix commit message using test instead of deps (Tony Gorez) #46313
[1d44017f52] - doc: add v8 fast api contribution guidelines (Yagiz Nizipli) #46199
[e2698c05fb] - doc: fix small typo error (0xflotus) #46186
[f39fb8c001] - doc: mark some parameters as optional in webstreams (Deokjin Kim) #46269
[7a9af38128] - doc: update output of example in events.getEventListeners (Deokjin Kim) #46268
[729642f30b] - esm: delete preload mock test (Geoffrey Booth) #46402
[7aac21e90a] - esm: leverage loaders when resolving subsequent loaders (Maël Nison) #43772
[a7c9daa497] - (SEMVER-MINOR) fs: add statfs() functions (Colin Ihrig) #46358
[1ec6270efa] - http: res.setHeaders first implementation (Marco Ippolito) #46109
[d4370259e9] - inspector: allow opening inspector when NODE_V8_COVERAGE is set (Moshe Atlow) #46113
[b966ef9a42] - lib: remove unnecessary ObjectGetValueSafe (Chengzhong Wu) #46335
[2b06d66289] - lib: cache parsed source maps to reduce memory footprint (Chengzhong Wu) #46225
[c38673df91] - meta: update AUTHORS (Node.js GitHub Bot) #46399
[c10e602547] - meta: update AUTHORS (Node.js GitHub Bot) #46303
[9dc026b14a] - meta: add .mailmap entry (Rich Trott) #46303
[7c514574f7] - meta: move evanlucas to emeritus (Evan Lucas) #46274
[3a3a6d87f1] - module: move test reporter loading (Geoffrey Booth) #45923
[4ae2492a33] - readline: fix detection of carriage return (Antoine du Hamel) #46306
[43cad78b7a] - src: stop tracing agent before shutting down libuv (Santiago Gimeno) #46380
[360a3f3094] - src: get rid of fp arithmetic in ParseIPv4Host (Tobias Nießen) #46326
[e7b507a8cf] - src: use UNREACHABLE instead of CHECK(falsy) (Tobias Nießen) #46317
[4c59b60ee8] - src: add support for ETW stack walking (José Dapena Paz) #46203
[640d111f95] - src: refactor EndsInANumber in node_url.cc and adds IsIPv4NumberValid (Miguel Teixeira) #46227
[fb7bee2b6e] - src: fix c++ exception on bad command line arg (Ben Noordhuis) #46290
[18c95ec4bd] - src: remove unreachable UNREACHABLE (Tobias Nießen) #46281
[35bf93b01a] - src: replace custom ASCII validation with simdutf one (Anna Henningsen) #46271
[8307a4bbcd] - src: replace unreachable code with static_assert (Tobias Nießen) #46250
[7cf0da020a] - src: use explicit C++17 fallthrough (Tobias Nießen) #46251
[d52f60009a] - (SEMVER-MINOR) src,lib: add constrainedMemory API for process (theanarkh) #46218
[2e5e7a9261] - stream: remove brandchecks from stream duplexify (Debadree Chatterjee) #46315
[9675863461] - stream: fix readable stream as async iterator function (Erick Wendel) #46147
[232bdd5d16] - test: add trailing commas in test/node-api (Antoine du Hamel) #46384
[4cc081815d] - test: add trailing commas in test/message (Antoine du Hamel) #46372
[b83c5d9deb] - test: add trailing commas in test/pseudo-tty (Antoine du Hamel) #46371
[8a45c9d231] - test: fix tap escaping with and without --test (Pulkit Gupta) #46311
[367dc41299] - test: set common.bits to 64 for loong64 (Shi Pujin) #45383
[7385edc7d0] - test: s390x zlib test case fixes (Adam Majer) #46367
[d5d837bdee] - test: fix logInTimeout is not function (theanarkh) #46348
[a1d79546ac] - test: avoid trying to call sysctl directly (Adam Majer) #46366
[747f3689e0] - test: avoid left behind child processes (Richard Lau) #46276
[940484b7aa] - test: add failing test for readline with carriage return (Alec Mev) #46075
[d13116a719] - test,crypto: add CFRG curve vectors to wrap/unwrap tests (Filip Skokan) #46406
[398a7477b3] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #46267
[8b473affe8] - test_runner: make built in reporters internal (Colin Ihrig) #46092
[a49e17e22b] - test_runner: report file in test runner events (Moshe Atlow) #46030
[fbdc3f7316] - test_runner: add reporters (Moshe Atlow) #45712
[6579de8c47] - tools: update eslint to 8.33.0 (Node.js GitHub Bot) #46400
[bf62da55ad] - tools: update doc to unist-util-select@4.0.3 unist-util-visit@4.1.2 (Node.js GitHub Bot) #46364
[b0acf55197] - tools: update lint-md-dependencies to rollup@3.12.0 (Node.js GitHub Bot) #46398
[88b904cf24] - tools: require more trailing commas (Antoine du Hamel) #46346
[4440b3ef87] - tools: update lint-md-dependencies (Node.js GitHub Bot) #46302
[e75faff4bd] - tools: allow icutrim.py to run on python2 (Michael Dawson) #46263
[e460d16d73] - url: refactor to use more primordials (Antoine du Hamel) #45966
[b4ac794923] - (SEMVER-MINOR) v8: support gc profile (theanarkh) #46255
[34d70ce615] - (SEMVER-MINOR) vm: expose cachedDataRejected for vm.compileFunction (Anna Henningsen) #46320

`v19.5.0`: 2023-01-24, Version 19.5.0 (Current), @RafaelGSS

Compare Source

Notable Changes

http:
- (SEMVER-MINOR) join authorization headers (Marco Ippolito) #45982
lib::
- add webstreams to Duplex.from() (Debadree Chatterjee) #46190
stream:
- implement finished() for ReadableStream and WritableStream (Debadree Chatterjee) #46205

Commits

[def36946da] - assert: remove assert.snapshot (Moshe Atlow) #46112
[e1c56ec3fd] - benchmark,tools: use os.availableParallelism() (Deokjin Kim) #46003
[370f621d4d] - build: add extra semi check (Jiawen Geng) #46194
[476c6f892d] - crypto: avoid hang when no algorithm available (Richard Lau) #46237
[8b22310940] - (SEMVER-MINOR) crypto: add CryptoKey Symbol.toStringTag (Filip Skokan) #46042
[78be87b9f9] - crypto: add cipher update/final methods encoding validation (vitpavlenko) #45990
[dc0cdaa101] - crypto: ensure auth tag set for chacha20-poly1305 (Ben Noordhuis) #46185
[1146f02dc5] - crypto: return correct bit length in KeyObject's asymmetricKeyDetails (Filip Skokan) #46106
[961710bb72] - (SEMVER-MINOR) crypto: add KeyObject Symbol.toStringTag (Filip Skokan) #46043
[9cfdac6c82] - deps: V8: cherry-pick e39af94 (Lu Yahan) #46142
[26cde8efb7] - deps: update simdutf to 3.1.0 (Node.js GitHub Bot) #46257
[3f9fb37130] - deps: cherrypick simdutf patch (Jiawen Geng) #46194
[4ff2822836] - deps: bump googletest to 2023.01.13 (Jiawen Geng) #46198
[49556247d2] - deps: add /deps/**/.github/ to .gitignore (Luigi Pinca) #46091
[0c4df83e0d] - deps: add simdutf version to metadata (Mike Roth) #46145
[69aafc3ddd] - deps: update simdutf to 2.1.0 (Node.js GitHub Bot) #46128
[a266daccb5] - deps: update corepack to 0.15.3 (Node.js GitHub Bot) #46037
[6cd70573eb] - deps: upgrade npm to 9.3.1 (npm team) #46242
[679aae2da8] - deps: upgrade npm to 9.3.0 (npm team) #46193
[38dd5061f2] - dgram: sync the old handle state to new handle (theanarkh) #46041
[e36af49b35] - doc: fix mismatched arguments of NodeEventTarget (Deokjin Kim) #45678
[58b836f7c4] - doc: update events API example to have runnable code (Deokjin Kim) #45760
[5c350298b4] - doc: add note to tls docs about secureContext availability (Tim Gerk) #46224
[90924ce198] - doc: add text around collaborative expectations (Michael Dawson) #46121
[2d328355d4] - doc: update to match changed --dns-result-order default (Mordy Tikotzky) #46148
[1015a606b7] - doc: add Node-API media link (Kevin Eady) #46189
[6e355efcff] - doc: update http.setMaxIdleHTTPParsers arguments (Debadree Chatterjee) #46168
[f18ab9405a] - doc: use "file system" instead of "filesystem" (Rich Trott) #46178
[1b45713b00] - doc: https update default request timeout (Marco Ippolito) #46184
[4c88721e2f] - doc: make options of readableStream.pipeTo as optional (Deokjin Kim) #46180
[538c53f010] - doc: add PerformanceObserver.supportedEntryTypes to doc (theanarkh) #45962
[eef7489d24] - doc: duplex and readable from uncaught execption warning (Marco Ippolito) #46135
[686fe585b5] - doc: remove outdated sections from maintaining-v8 (Antoine du Hamel) #46137
[2e826ad528] - doc: fix (EC)DHE remark in TLS docs (Tobias Nießen) #46114
[2e22b29add] - doc: fix ERR_TLS_RENEGOTIATION_DISABLED text (Tobias Nießen) #46122
[e222a2f1d1] - doc: fix spelling in SECURITY.md (Vaishno Chaitanya) #46124
[7718e82f0d] - doc: abort controller emits error in child process (Debadree Chatterjee) #46072
[76408bc1ed] - doc: fix event.cancelBubble documentation (Deokjin Kim) #45986
[82023f2570] - doc: update output of example in inspector (Deokjin Kim) #46073
[a42fc512b6] - doc: add personal pronouns option (Filip Skokan) #46118
[fafae5955d] - doc: mention how to run ncu-ci citgm (Rafael Gonzaga) #46090
[e1fd2f24d9] - doc: include updating release optional step (Rafael Gonzaga) #46089
[1996e610fd] - doc: describe argument of Symbol.for (Deokjin Kim) #46019
[b002330216] - doc,crypto: fix WebCryptoAPI import keyData and export return (Filip Skokan) #46076
[fa3e0c86c7] - esm: mark importAssertions as required (Antoine du Hamel) #46164
[f85a8e4c59] - events: add initEvent to Event (Deokjin Kim) #46069
[5bdfaae680] - events: change status of event.returnvalue to legacy (Deokjin Kim) #46175
[ad7846fe97] - events: change status of event.cancelBubble to legacy (Deokjin Kim) #46146
[5304c89682] - events: change status of event.srcElement to legacy (Deokjin Kim) #46085
[3dcdab3f16] - events: check signal before listener (Deokjin Kim) #46054
[907d67de76] - http: refactor to use validateHeaderName (Deokjin Kim) #46143
[ae5141cb8a] - http: writeHead if statusmessage is undefined dont override headers (Marco Ippolito) #46173
[6e7f9fbc1d] - http: refactor to use min of validateNumber for maxTotalSockets (Deokjin Kim) #46115
[069a30bc4e] - (SEMVER-MINOR) http: join authorization headers (Marco Ippolito) #45982
[68cde4cbcc] - lib: add webstreams to Duplex.from() (Debadree Chatterjee) #46190
[4d73ea708b] - lib: use kEmptyObject and update JSDoc in webstreams (Deokjin Kim) #46183
[1cfa2e6762] - lib: refactor to use validate function (Deokjin Kim) #46101
[2eb87f23c9] - lib: reuse invalid state errors on webstreams (Rafael Gonzaga) #46086
[8684dae8d9] - lib: fix incorrect use of console intrinsic (Colin Ihrig) #46044
[d044ed1d3e] - meta: update AUTHORS (Node.js GitHub Bot) #46215
[5261560757] - meta: update AUTHORS (Node.js GitHub Bot) #46130
[1b557bbee8] - meta: update comment in CODEOWNERS to better reflect current policy (Antoine du Hamel) #45944
[54896ab011] - module: fix unintended mutation (Antoine du Hamel) #46108
[bd98e5baba] - node-api: disambiguate napi_add_finalizer (Chengzhong Wu) #45401
[f0508894d6] - perf_hooks: fix checking range of options.figures in createHistogram (Deokjin Kim) #45999
[e482d5e42d] - src: fix endianness of simdutf (Yagiz Nizipli) #46257
[e2c47cdfad] - src: make BuiltinLoader threadsafe and non-global (Anna Henningsen) #45942
[36ae3ccff3] - src: replace unreachable code with static_assert (Tobias Nießen) #46209
[9d55a1f9a1] - src: hide kMaxDigestMultiplier outside HKDF impl (Tobias Nießen) #46206
[d3d62ed82c] - src: distinguish env stopping flags (Chengzhong Wu) #45907
[e85f76686c] - src: remove return after abort (Shelley Vohr) #46172
[7dc9a53b18] - src: remove unnecessary semicolons (Shelley Vohr) #46171
[28af831d5a] - src: use simdutf for converting externalized builtins to UTF-16 (Anna Henningsen) #46119
[e8eaa490af] - src: use constant strings for memory info names (Chengzhong Wu) #46087
[f4559a1354] - src: fix typo in node_snapshotable.cc (Vadim) #46103
[ca8ff08a5c] - src: keep PipeWrap::Open function consistent with TCPWrap (theanarkh) #46064
[a936eaeb34] - src: speed up process.getActiveResourcesInfo() (Darshan Sen) #46014
[5cf595659f] - src,lib: the handle keeps loop alive in cluster rr mode (theanarkh) #46161
[18695595e1] - stream: fix pipeline calling end on destination more than once (Debadree Chatterjee) #46226
[e5f53b51f0] - stream: implement finished() for ReadableStream and WritableStream (Debadree Chatterjee) #46205
[2f23f17f93] - test: reduce fs-write-optional-params flakiness (LiviaMedeiros) #46238
[255f177108] - test: enable more case of bad buffer in fs.write (Deokjin Kim) #46236
[c09b2036c7] - test: update postject to 1.0.0-alpha.4 (Node.js GitHub Bot) #46212
[4ac5c7180f] - test: refactor to avoid mutation of global by a loader (Michaël Zasso) #46220
[bbf9da8e2c] - test: improve test coverage for WHATWG TextDecoder (Juan José) #45241
[4f491d368c] - test: add fix so that test exits if port 42 is unprivileged (Suyash Nayan) #45904
[6e2f7228f3] - test: use os.availableParallelism() (Deokjin Kim) #46003
[c77b0da512] - test: fix flaky test-runner-exit-code.js (Colin Ihrig) #46138
[f309e2acb6] - test: update Web Events WPT (Deokjin Kim) #46051
[0f60bc9bbc] - test: add test to once() in event lib (Jonathan Diaz) #46126
[8a8b18678a] - test,esm: validate more edge cases for dynamic imports (Antoine du Hamel) #46059
[4d3743938f] - test_runner: update comment to comply with eslint no-fallthrough rule (Antoine du Hamel) #46258
[653b108fdc] - tools: update eslint to 8.32.0 (Node.js GitHub Bot) #46258
[a4b0c916e0] - tools: update lint-md-dependencies (Node.js GitHub Bot) #46214
[f4465e656d] - tools: fix macro name in update-undici (Almeida) #46217
[1aa4534c6f] - tools: add automation for updating postject dependency (Darshan Sen) #46157
[c150b312cd] - tools: update create-or-update-pull-request-action (Michaël Zasso) #46169
[c68a043400] - tools: update eslint to 8.31.0 (Node.js GitHub Bot) #46131
[ac90e419d1] - tools: update lint-md-dependencies to rollup@3.9.1 (Node.js GitHub Bot) #46129
[750fcf84eb] - tools: move update-eslint.sh to dep_updaters/ (Luigi Pinca) #46088
[2e8750a18c] - tools: make update-eslint.sh work with npm@9 (Luigi Pinca) #46088
[e90a3a6eff] - tools: fix lint rule recommendation (Colin Ihrig) #46044
[0985ef8bfb] - tools: add ArrayPrototypeConcat to the list of primordials to avoid (Antoine du Hamel) #44445
[ed69a3af92] - tools: add prefer-proto rule (Jordan Harband) #46083
[4c1c20fae2] - trace_events: refactor to use validateStringArray (Deokjin Kim) #46012
[6c8a81d2dc] - vm: refactor to use validate function (Deokjin Kim) #46176

`v19.4.0`: 2023-01-06, Version 19.4.0 (Current), @RafaelGSS

Compare Source

Notable Changes

buffer:
- (SEMVER-MINOR) add buffer.isUtf8 for utf8 validation (Yagiz Nizipli) #45947
http:
- (SEMVER-MINOR) improved timeout defaults handling (Paolo Insogna) #45778
net:
- add autoSelectFamily global getter and setter (Paolo Insogna) #45777
os:
- (SEMVER-MINOR) add availableParallelism() (Colin Ihrig) #45895
util:
- add fast path for text-decoder fatal flag (Yagiz Nizipli) #45803

Commits

[54b748acc0] - async_hooks: refactor to use validateObject (Deokjin Kim) #46004
[cf2ff81f26] - benchmark: include webstreams benchmark (Rafael Gonzaga) #45876
[6e3d7f8c2d] - bootstrap: optimize modules loaded in the built-in snapshot (Joyee Cheung) #45849
[d181b76374] - bootstrap: make CJS loader snapshotable (Joyee Cheung) #45849
[508e830765] - bootstrap: include event_target into the built-in snapshot (Joyee Cheung) #45849
[dd77c05480] - bootstrap: support module_wrap binding in snapshot (Joyee Cheung) #45849
[fbe399c75c] - (SEMVER-MINOR) buffer: add buffer.isUtf8 for utf8 validation (Yagiz Nizipli) #45947
[233a66f937] - build: fix arm64 cross-compile from powershell (Stefan Stojanovic) #45890
[e7b98a3da2] - build: add option to disable shared readonly heap (Anna Henningsen) #45887
[777c551edf] - crypto: ensure exported webcrypto EC keys use uncompressed point format (Ben Noordhuis) #46021
[f7dba5bef7] - crypto: fix globalThis.crypto this check (Filip Skokan) #45857
[56f3ad101b] - crypto: fix CryptoKey prototype WPT (Filip Skokan) #45857
[c9747f1140] - crypto: use globalThis.crypto over require('crypto').webcrypto (Filip Skokan) #45817
[6eede72241] - crypto: fix CryptoKey WebIDL conformance (Filip Skokan) #45855
[c9802862b7] - crypto: fix error when getRandomValues is called without arguments (Filip Skokan) #45854
[3d09754186] - debugger: refactor console in lib/internal/debugger/inspect.js (Debadree Chatterjee) #45847
[fdda2ff53b] - deps: V8: cherry-pick 30861a3 (Aaron Friel) #45851
[71bf513062] - deps: patch V8 to 10.8.168.25 (Michaël Zasso) #45996
[0552b13232] - deps: update simdutf to 2.0.9 (Node.js GitHub Bot) #45975
[e73be1b3b9] - deps: update to uvwasi 0.0.14 (Colin Ihrig) #45970
[e4323f01c1] - deps: fix updater github workflow job (Yagiz Nizipli) #45972
[05fee67238] - Revert "deps: disable avx512 for simutf on benchmark ci" (Yagiz Nizipli) #45948
[98fc94a444] - deps: disable avx512 for simutf on benchmark ci (Yagiz Nizipli) #45803
[344c5ec0ea] - deps: add simdutf dependency (Yagiz Nizipli) #45803
[7bdad948c8] - deps: V8: backport 8ca9f77 (Anna Henningsen) #45871
[29f90cf5af] - deps: update timezone to 2022g (Node.js GitHub Bot) #45731
[99fec0bf64] - deps: update undici to 5.14.0 (Node.js GitHub Bot) #45812
[faee973fa7] - deps: V8: cherry-pick bc831f8 (Yagiz Nizipli) #45788
[e2944109c6] - deps: V8: cherry-pick bf0bd48 (Michaël Zasso) #45908
[e113d169ee] - doc: update isUtf8 description (Yagiz Nizipli) #45973
[9e16406066] - doc: sort http.createServer() options alphabetically (Luigi Pinca) #45680
[49253e1a8f] - doc: use console.error for error case in timers and tls (Deokjin Kim) #46002
[8be1b666a7] - doc: fix wrong output of example in url.protocol (Deokjin Kim) #45954
[9251dce8b2] - doc: use os.availableParallelism() in async_context and cluster (Deokjin Kim) #45979
[952e03ae66] - doc: make EventEmitterAsyncResource's options as optional (Deokjin Kim) #45985
[71cc3b3712] - doc: replace single executable champion in strategic initiatives doc (Darshan Sen) #45956
[eaf6b63637] - doc: update error message of example in repl (Deokjin Kim) #45920
[d8b5b7da75] - doc: fix typos in packages.md (Eric Mutta) #45957
[4457e051c9] - doc: remove port from example in url.hostname (Deokjin Kim) #45927
[908f4fab52] - doc: show output of example in http (Deokjin Kim) #45915
[faf5c23084] - (SEMVER-MINOR) doc: add parallelism note to os.cpus() (Colin Ihrig) #45895
[9ed547b73c] - doc: fix wrong output of example in url.password (Deokjin Kim) #45928
[a89f8c1337] - doc: fix some history entries in deprecations.md (Antoine du Hamel) #45891
[cf30fca23f] - doc: add tip for NODE_MODULE (theanarkh) #45797
[d500445aec] - doc: reduce likelihood of mismerges during release (Richard Lau) #45864
[e229f060e3] - doc: add backticks to webcrypto rsaOaepParams (Filip Skokan) #45883
[dfa58c1947] - doc: remove release cleanup step (Michaël Zasso) #45858
[b93a9670a8] - doc: add stream/promises pipeline and finished to doc (Marco Ippolito) #45832
[c86f4a17d6] - doc: remove Juan Jose keys (Rafael Gonzaga) #45827
[c37a119f90] - doc: remove last example use of require('crypto').webcrypto (Filip Skokan) #45819
[7e047dfcbb] - doc: fix wrong output of example in util (Deokjin Kim) #45825
[8046e0ef53] - errors: refactor to use a method that formats a list string (Daeyeon Jeong) #45793
[2d49e0e635] - esm: rewrite loader hooks test (Geoffrey Booth) #46016
[47cc0e4bdb] - events: fix violation of symbol naming convention (Deokjin Kim) #45978
[22a66cff66] - fs: refactor to use validateInteger (Deokjin Kim) #46008
[bc43922949] - http: replace var with const on code of comment (Deokjin Kim) #45951
[7ea72ee421] - (SEMVER-MINOR) http: improved timeout defaults handling (Paolo Insogna) #45778
[7f1daedf4c] - lib: update JSDoc of getOwnPropertyValueOrDefault (Deokjin Kim) #46010
[28f9089b83] - lib: use kEmptyObject as default value for options (Deokjin Kim) #46011
[f6c6673ec4] - lib: lazy-load deps in modules/run_main.js (Joyee Cheung) #45849
[e529ea4144] - lib: lazy-load deps in source_map_cache.js (Joyee Cheung) #45849
[943852ab83] - lib: add getLazy() method to internal/util (Joyee Cheung) #45849
[25d0a94453] - meta: update AUTHORS (Node.js GitHub Bot) #46040
[0a70316ecc] - meta: update AUTHORS (Node.js GitHub Bot) #45968
[86e30fcb4d] - meta: add nodejs/loaders to CODEOWNERS (Geoffrey Booth) #45940
[e95695654d] - meta: add nodejs/test_runner to CODEOWNERS (Antoine du Hamel) #45935
[353dab5bdf] - meta: update AUTHORS (Node.js GitHub Bot) #45899
[0b3512f690] - modules: move callbacks and conditions into modules/esm/utils.js (Joyee Cheung) #45849
[c6ab449d1b] - modules: move modules/cjs/helpers.js to modules/helpers.js (Joyee Cheung) #45849
[4d62b099b4] - net: handle socket.write(cb) edge case (Santiago Gimeno) #45922
[8e6b8dbb41] - net: add autoSelectFamily global getter and setter (Paolo Insogna) #45777
[f3bb6a38ae] - node-api: generalize finalizer second pass callback (Chengzhong Wu) #44141
[d71883e271] - (SEMVER-MINOR) os: add availableParallelism() (Colin Ihrig) #45895
[4c0850539a] - process,worker: ensure code after exit() effectless (ywave620) #45620
[24cae6b4a3] - repl: improve robustness wrt to prototype pollution (Antoine du Hamel) #45604
[af25c95b22] - src: fix typo in node_file.cc (Vadim) #45998
[261d6d0726] - src: fix crash on OnStreamRead on Windows (Santiago Gimeno) #45878
[6c5b7e660b] - src: add worker per-isolate binding initialization (Chengzhong Wu) #45547
[db535b6caa] - src: define per-isolate internal bindings registration callback (Chengzhong Wu) #45547
[ded87f6dc4] - src: fix creating Isolates from addons (Anna Henningsen) #45885
[c2ed0ccb28] - src: use string_view for FastStringKey implementation (Anna Henningsen) #45914
[b995138b96] - src: use CreateEnvironment instead of inlining its code where possible (Anna Henningsen) #45886
[4454f5fd71] - src: fix UB in overflow checks (Ben Noordhuis) #45882
[27d3201502] - src: check size of args before using for exec_path (A. Wilcox) #45902
[2f898f2983] - src: fix tls certificate root store data race (Ben Noordhuis) #45767
[eff92a61b9] - src: add undici and acorn to process.versions (Debadree Chatterjee) #45621
[ab22a8ff4b] - stream: refactor to use validateFunction (Deokjin Kim) #46007
[0858956f5f] - stream: fix typo in JSDoc (Deokjin Kim) #45991
[2807efaea6] - test: use process.hrtime.bigint instead of process.hrtime (Deokjin Kim) #45877
[0f5a145973] - test: print failed JS/parallel tests (Geoffrey Booth) #45960
[c6c094702b] - test: split parallel fs-watch-recursive tests (Yagiz Nizipli) #45865
[97a8e055be] - test: add all WebCryptoAPI globals to WPTRunner's loadLazyGlobals (Filip Skokan) #45857
[95ce16d8d9] - test: fix test broken under --node-builtin-modules-path (Geoffrey Booth) #45894
[97868befe7] - test: fix mock.method to support class instances (Erick Wendel) #45608
[71056daf76] - test: update encoding wpt to latest (Yagiz Nizipli) #45850
[10367c4cae] - test: update url wpt to latest (Yagiz Nizipli) #45852
[53f02cf631] - test: add CryptoKey transferring tests (Filip Skokan) #45811
[5de08ef275] - test: add postject to fixtures (Darshan Sen) #45298
[fea122d51e] - test: enable idlharness WebCryptoAPI WPTs (Filip Skokan) #45822
[3c2ce5635e] - test: remove use of --experimental-global-webcrypto flag (Filip Skokan) #45816
[b5e124537e] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #45860
[7ae24abd7b] - test_runner: use os.availableParallelism() (Colin Ihrig) #45969
[c5004d42af] - test_runner: run t.after() if test body throws (Colin Ihrig) #45870
[bdbb676bee] - test_runner: parse yaml (Moshe Atlow) #45815
[ca9b9b9ce6] - tls: don't treat fatal TLS alerts as EOF (David Benjamin) #44563
[d08a574ecf] - tls: fix re-entrancy issue with TLS close_notify (David Benjamin) #44563
[0f0d22a63e] - tools: update lint-md-dependencies to rollup@3.9.0 (Node.js GitHub Bot) #46039
[5a8d125fc4] - tools: update doc to unist-util-select@4.0.2 (Node.js GitHub Bot) #46038
[54776ffe80] - tools: add release host var to promotion script (Ruy Adorno) #45913
[f968fdb78a] - tools: add url to AUTHORS update automation (Antoine du Hamel) #45971
[7c518cbac1] - tools: update lint-md-dependencies to rollup@3.8.1 (Node.js GitHub Bot) #45967
[1282f7f656] - tools: update GitHub workflow action (Mohammed Keyvanzadeh) #45937
[f446af78e9] - tools: update lint-md dependencies (Node.js GitHub Bot) #45813
[794611ade9] - tools: enforce use of trailing commas in tools/ (Antoine du Hamel) #45889
[124c2b32d9] - tools: fix incorrect version history order (Fabien Michel) #45728
[27cf389c22] - tools: update eslint to 8.29.0 (Node.js GitHub Bot) #45733
[ae842a40b5] - util: add fast path for text-decoder fatal flag (Yagiz Nizipli) #45803
[389cc3e1d6] - vm: refactor to use validateStringArray (Deokjin Kim) #46020
[7bd6a2c258] - wasi: fast calls (snek) #43697

`v19.3.0`: 2022-12-14, Version 19.3.0 (Current), @targos

Compare Source

Notable Changes

Updated npm to 9.2.0

Based on the list of guidelines we've established on integrating npm and node, here is a grouped list of the breaking changes with the reasoning as to why they fit within the guidelines linked above. Note that all the breaking changes were made in 9.0.0. All subsequent minor and patch releases after npm@9.0.0 do not contain any breaking changes.

Engines

Explanation: the node engines supported by npm@9 make it safe to allow npm@9 as the default in any LTS version of 14 or 16, as well as anything later than or including 18.0.0

npm is now compatible with the following semver range for node: ^14.17.0 || ^16.13.0 || >=18.0.0

Filesystem

Explanation: when run as root previous versions of npm attempted to manage file ownership automatically on the user's behalf. this behavior was problematic in many cases and has been removed in favor of allowing users to manage their own filesystem permissions

npm will no longer attempt to modify ownership of files it creates.

Auth

Explanation: any errors thrown from users having unsupported auth configurations will show npm config fix in the remediation instructions, which will allow the user to automatically have their auth config fixed.

The presence of auth related settings that are not scoped to a specific registry found in a config file is no longer supported and will throw errors.

Login

Explanation: the default auth-type has changed and users can opt back into the old behavior with npm config set auth-type=legacy. login and adduser have also been seperated making each command more closely match it's name instead of being aliases for each other.

Legacy auth types sso, saml & legacy have been consolidated into "legacy".
auth-type defaults to "web"
login and adduser are now separate commands that send different data to the registry.
auth-type config values web and legacy only try their respective methods, npm no longer tries them all and waits to see which one doesn't fail.

Tarball Packing

Explanation: previously using multiple ignore/allow lists when packing was an undefined behavior, and now the order of operations is strictly defined when packing a tarball making it easier to follow and should only affect users relying on the previously undefined behavior.

npm pack now follows a strict order of operations when applying ignore rules. If a files array is present in the package.json, then rules in .gitignore and .npmignore files from the root will be ignored.

Display/Debug/Timing Info

Explanation: these changes center around the display of information to the terminal including timing and debug log info. We do not anticipate these changes breaking any existing workflows.

Links generated from git urls will now use HEAD instead of master as the default ref.
timing has been removed as a value for --loglevel.
--timing will show timing information regardless of --loglevel, except when --silent.
When run with the --timing flag, npm now writes timing data to a file alongside the debug log data, respecting the logs-dir option and falling back to <CACHE>/_logs/ dir, instead of directly inside the cache directory.
The timing file data is no longer newline delimited JSON, and instead each run will create a uniquely named <ID>-timing.json file, with the <ID> portion being the same as the debug log.
npm now outputs some json errors on stdout. Previously npm would output all json formatted errors on stderr, making it difficult to parse as the stderr stream usually has logs already written to it.

Config/Command Deprecations or Removals

Explanation: install-links is the only config or command in the list that has an effect on package installs. We fixed a number of issues that came up during prereleases with this change. It will also only be applied to new package trees created without a package-lock.json file. Any install with an existing lock file will not be changed.

Deprecate boolean install flags in favor of --install-strategy.
npm config set will no longer accept deprecated or invalid config options.
install-links config defaults to "true".
node-version config has been removed.
npm-version config has been removed.
npm access subcommands have been renamed.
npm birthday has been removed.
npm set-script has been removed.
npm bin has been removed (use npx or npm exec to execute binaries).

Other notable changes

[03db415540] - build: disable v8 snapshot compression by default (Joyee Cheung) #45716
[9f51b9e50d] - doc: add doc-only deprecation for headers/trailers setters (Rich Trott) #45697
[b010820c4e] - doc: add Rafael Gonzaga to the TSC (Michael Dawson) #45691
[b8b13dccd9] - (SEMVER-MINOR) net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options (Paolo Insogna) #44731
[5d7cd363ab] - (SEMVER-MINOR) src: add uvwasi version (Jithil P Ponnan) #45639
[4165dcddf0] - (SEMVER-MINOR) test_runner: add t.after() hook (Colin Ihrig) #45792
[d1bd7796ad] - (SEMVER-MINOR) test_runner: don't use a symbol for runHook() (Colin Ihrig) #45792
[691f58e76c] - tls: remove trustcor root ca certificates (Ben Noordhuis) #45776

Commits

[382efdf460] - benchmark: add variety of inputs to text-encoder (Yagiz Nizipli) #45787
[102c2dc071] - benchmark: make benchmarks runnable in older versions of Node.js (Joyee Cheung) #45746
[e2caf7ced9] - bootstrap: lazy load non-essential modules (Joyee Cheung) #45659
[49840d443c] - buffer: remove unnecessary lazy loading (Antoine du Hamel) #45807
[17847683dc] - buffer: make decodeUTF8 params loose (Yagiz Nizipli) #45610
[03db415540] - build: disable v8 snapshot compression by default (Joyee Cheung) #45716
[95a23e24f3] - build: add python 3.11 support for android (Mohammed Keyvanzadeh) #45765
[09bc89daba] - build: rework gyp files for zlib (Richard Lau) #45589
[b5b56b6b45] - crypto: simplify lazy loading of internal modules (Antoine du Hamel) #45809
[2e4d37e3f0] - crypto: fix CipherBase Update int32 overflow (Marco Ippolito) #45769
[573eab9235] - crypto: refactor ArrayBuffer to bigint conversion utils (Antoine du Hamel) #45567
[845f805490] - crypto: refactor verify acceptable key usage functions (Filip Skokan) #45569
[7cc9998737] - crypto: fix ECDH webcrypto public CryptoKey usages (Filip Skokan) #45569
[d030963f37] - crypto: validate CFRG webcrypto JWK import "d" and "x" are a pair (Filip Skokan) #45569
[9cd106efdc] - crypto: use DataError for CFRG webcrypto raw and jwk import key checks (Filip Skokan) #45569
[9e2e3de6ce] - crypto: use DataError for webcrypto keyData import failures (Filip Skokan) #45569
[40037b4e79] - crypto: fix X25519 and X448 webcrypto public CryptoKey usages (Filip Skokan) #45569
[de2b6b97b9] - crypto: ensure "x" is present when importing private CFRG webcrypto keys (Filip Skokan) #45569
[75dbce9a07] - deps: upgrade npm to 9.2.0 (npm team) #45780
[677eb62bf2] - deps: upgrade npm to 9.1.3 (npm team) #45693
[1d823a6d30] - Revert "deps: fix zlib compilation for CPUs without SIMD features" (Luigi Pinca) #45589
[6b15994597] - deps: update undici to 5.13.0 (Node.js GitHub Bot) #45634
[fbd2d27789] - deps: update corepack to 0.15.2 (Node.js GitHub Bot) #45635
[60c9ac5178] - deps: update nghttp2 to 1.51.0 (Yagiz Nizipli) #45537
[c8421204b0] - deps: patch V8 to 10.8.168.21 (Michaël Zasso) #45749
[c5277417c9] - diagnostics_channel: fix diagnostics channel memory leak (theanarkh) #45633
[8a90f5c784] - doc: buffer.fill empty value (Marco Ippolito) #45794
[9d6af617ea] - doc: add args of filter option of fs.cp (MURAKAMI Masahiko) #45739
[8c728d2f02] - doc: disambiguate native module to addon (Daeyeon Jeong) #45673
[7718ff82a4] - doc: using console.error for error cases in crypto and events (emirgoren) #45640
[029060e6e4] - doc: fix actual result of example is different in events (Deokjin Kim) #45656
[9f51b9e50d] - doc: add doc-only deprecation for headers/trailers setters (Rich Trott) #45697
[801fe30488] - doc: add detail on how api docs are published (Michael Dawson) #45626
[e124e2a6ee] - doc: use console.error for error case in child_process and dgram (Deokjin Kim) #45690
[1b920287b6] - doc: move streaming instruc to doc/contributing (Michael Dawson) #45582
[b010820c4e] - doc: add Rafael to the tsc (Michael Dawson) #45691
[4fb7cf88e2] - doc: add missing line in debugger (Deokjin Kim) #45632
[c0df265fea] - doc: fix actual result of example is different in stream (Deokjin Kim) #45619
[027e738064] - doc: add options parameter to eventTarget.removeEventListener (Deokjin Kim) #45667
[23ff5057b2] - doc: define "react-native" community condition (Alex Hunt) #45367
[2e767bf18b] - doc: move os.machine() docs to sorted position (Colin Ihrig) #45647
[aabfdef861] - doc: use console.error for error case in fs, https, net and process (Deokjin Kim) #45606
[3a02d50d35] - doc: add link to doc with social processes (Michael Dawson) #45584
[e4316124fa] - fs: fix nonNativeWatcher watching folder with existing files (Moshe Atlow) #45500
[d272faa54d] - fs: fix nonNativeWatcher leak of StatWatchers (Moshe Atlow) #45501
[d64e773168] - http: make OutgoingMessage more streamlike (Robert Nagy) #45672
[ed8ae88f30] - lib: remove unnecessary lazy loading in internal/encoding (Antoine du Hamel) #45810
[302c5240c5] - lib: allow Writeable.toWeb() to work on http.Outgoing message (Debadree Chatterjee) #45642
[e8745083b9] - lib: check number of arguments in EventTarget's function (Deokjin Kim) #45668
[9f7bb5ce0e] - lib: disambiguate native module to binding (Daeyeon Jeong) #45673
[353339a552] - lib: disambiguate native module to builtin module (Daeyeon Jeong) #45673
[99410efd19] - lib: added SuiteContext class (Debadree Chatterjee) #45687
[a79f37a0a7] - lib: add missing type of removeEventListener in question (Deokjin Kim) #45676
[e0750467e8] - meta: update AUTHORS (Node.js GitHub Bot) #45814
[376f3468b9] - meta: update AUTHORS (Node.js GitHub Bot) #45732
[a6e2cf2d6f] - meta: add .mailmap entry for Stefan Stojanovic (Rich Trott) #45703
[eb9a383d2a] - meta: update AUTHORS info for nstepien (Nicolas Stepien) #45692
[049ef342c6] - meta: update AUTHORS (Node.js GitHub Bot) #45637
[b9c2fc7623] - net: check autoSelectFamilyAttemptTimeout is positive (Deokjin Kim) #45740
[b8b13dccd9] - (SEMVER-MINOR) net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options (Paolo Insogna) #44731
[6962ef0df1] - readline: improve robustness against prototype mutation (Antoine du Hamel) #45614
[7892e23e68] - repl: do not define wasi on global with no flag (Kohei Ueno) #45595
[349b4f8817] - src: add internal isArrayBufferDetached (Yagiz Nizipli) #45568
[5d7cd363ab] - (SEMVER-MINOR) src: add uvwasi version (Jithil P Ponnan) #45639
[8a03684018] - src: simplify NodeBIO::GetMethod initialization (Anna Henningsen) #45799
[b35ebebc0e] - src: make structuredClone work for process.env (Ben Noordhuis) #45698
[81ab54035f] - src: mark generated snapshot_data as const (Anna Henningsen) #45786
[79edf257bb] - src: cleanup on disambiguating native modules (Michael Dawson) #45665
[c9cba2e873] - src: use enum class instead of enum in node_i18n (Deokjin Kim) #45646
[818028caba] - src: rename internal module declaration as internal bindings (Chengzhong Wu) #45551
[2fbe2f9f0a] - src,lib: group properties used as constants from util binding (Daeyeon Jeong) #45539
[56eee72abb] - stream: use structuredClone instead of v8 (Yagiz Nizipli) #45611
[b297dd5393] - test: remove flaky parallel/test-process-wrap test (Ben Noordhuis) #45806
[924f6ab3a1] - test: order list alphabetically in test-bootstrap-modules (Antoine du Hamel) #45808
[5c4475dab9] - test: fix invalid output TAP if there newline in test name (Pulkit Gupta) #45742
[4c51c5c97a] - test: fix -Wunused-variable on report-fatalerror (Santiago Gimeno) #45747
[764725040c] - test: fix test-watch-mode (Stefan Stojanovic) #45585
[cd36250fcb] - test: fix test-watch-mode-inspect (Stefan Stojanovic) #45586
[b55bd6e8c1] - test: fix typos in test/parallel (Deokjin Kim) #45583
[358e2fe217] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #45569
[424419c2b4] - test_runner: refactor tap_lexer to use more primordials (Antoine du Hamel) #45744
[ffc0f3d7be] - test_runner: refactor tap_parser to use more primordials (Antoine du Hamel) #45745
[4165dcddf0] - (SEMVER-MINOR) test_runner: add t.after() hook (Colin Ihrig) #45792
[d1bd7796ad] - (SEMVER-MINOR) test_runner: don't use a symbol for runHook() (Colin Ihrig) #45792
[6bc7b7e6f4] - test_runner: add resetCalls to MockFunctionContext (MURAKAMI Masahiko) #45710
[3e485365ec] - test_runner: don't parse TAP from stderr (Colin Ihrig) #45618
[efc44567c9] - test_runner: add getter and setter to MockTracker (MURAKAMI Masahiko) #45506
[c9cbd1d396] - test_runner: remove stdout and stderr from error (Colin Ihrig) #45592
[691f58e76c] - tls: remove trustcor root ca certificates (Ben Noordhuis) #45776
[d384b73f76] - tools: update lint-md-dependencies (Node.js GitHub Bot) #45730
[324ae3d5dd] - tools: add GitHub token permissions to label flaky-test issues (Gabriela Gutierrez) #45308
[418ae9be56] - tools: remove dependency vulnerability checker (Facundo Tuesca) #45675
[238fc64c38] - tools: update lint-md-dependencies to rollup@3.4.0 (Node.js GitHub Bot) #45638
[1b98f17876] - tools: update doc to highlight.js@11.7.0 (Node.js GitHub Bot) #45636
[470384e7be] - util: use private symbols in JS land directly (Joyee Cheung) #45379
[cee6f382d8] - watch: add CLI flag to preserve output (Debadree Chatterjee) #45717

`v19.2.0`: 2022-11-29, Version 19.2.0 (Current), @ruyadorno

Compare Source

Notable changes

Time zone update

Time zone data has been updated to 2022f. This includes changes to Daylight Savings Time (DST) for Fiji and Mexico. For more information, see https://mm.icann.org/pipermail/tz-announce/2022-October/000075.html.

Other notable changes

buffer
- (SEMVER-MINOR) introduce File class (Khafra) #45139
deps
- update V8 to 10.8.168.20 (Michaël Zasso) #45230
doc
- deprecate use of invalid ports in url.parse (Antoine du Hamel) #45576
util
- add fast path for utf8 encoding (Yagiz Nizipli) #45412

Commits

[7cff1e14ba] - (SEMVER-MINOR) async_hooks: add hook to stop propagation (Gerhard Stöbich) #45386
[f08f6a64a3] - benchmark: add v8 serialize benchmark (Yagiz Nizipli) #45476
[26ad54c1a2] - benchmark: add text-encoder benchmark (Yagiz Nizipli) #45450
[6c56c9722b] - (SEMVER-MINOR) buffer: introduce File (Khafra) #45139
[6e1e25d6dd] - build: avoid redefined macro (Michaël Zasso) #45544
[5c9b2a7c82] - build: fix env.h for cpp20 (Jiawen Geng) #45516
[54fd8a1966] - build: reset embedder string to "-node.0" (Michaël Zasso) #45230
[0f3cf7e5ce] - Revert "build: remove precompiled header and debug information for host builds" (Stefan Stojanovic) #45432
[62ef1eb4ff] - build: add --v8-disable-object-print flag (MURAKAMI Masahiko) #45458
[1ce2f56cf6] - build: make scripts in gyp run with right python (Jiawen Geng) #45435
[9ffe3c051a] - build,deps,src: fix Intel VTune profiling support (Shi Lei) #45248
[bd3accc7b2] - crypto: clear OpenSSL error queue after calling X509_check_private_key() (Filip Skokan) #45495
[724addb293] - crypto: update root certificates (Luigi Pinca) #45490
[efe19eb7f5] - crypto: clear OpenSSL error queue after calling X509_verify() (Takuro Sato) #45377
[f63ae525fa] - deps: V8: cherry-pick 2ada52c (Michaël Zasso) #45573
[43e002e3d4] - deps: update base64 to 0.5.0 (Facundo Tuesca) #45509
[aaa4ac7735] - deps: V8: cherry-pick 9df5ef7 (Yagiz Nizipli) #45230
[e70c3090ff] - deps: V8: cherry-pick f1c888e (Michaël Zasso) #45230
[51eb323c50] - deps: V8: cherry-pick 92a7385 (Michaël Zasso) #45230
[1370b1a769] - deps: fix V8 build on Windows with MSVC (Michaël Zasso) #45230
[3cd6367e6a] - deps: silence irrelevant V8 warning (Michaël Zasso) #45230
[9348bdd28d] - deps: V8: fix v8-cppgc.h for MSVC (Jiawen Geng) #45230
[e9292544b0] - deps: fix V8 build issue with inline methods (Jiawen Geng) #45230
[a3b9967553] - deps: update V8 to 10.8.168.20 (Michaël Zasso) #45230
[117efe98b0] - deps: V8: cherry-pick 9df5ef7 (Yagiz Nizipli) #45474
[628891d4dd] - deps: update timezone to 2022f (Node.js GitHub Bot) #45289
[45ba14b3be] - deps: fix zlib compilation for CPUs without SIMD features (Anna Henningsen) #45387
[c41e67fe1d] - deps: update zlib to upstream 8bbd6c3 (Luigi Pinca) #45387
[413bf9ad39] - deps: patch V8 to 10.7.193.22 (Michaël Zasso) #45460
[ad8da86b3f] - deps: update acorn to 8.8.1 (Node.js GitHub Bot) #45441
[17e6031bf0] - deps: V8: cherry-pick 031b98b (Michaël Zasso) #45375
[9e0e97c121] - diagnostics_channel: built-in channels should remain experimental (Stephen Belanger) #45423
[44886e55e1] - diagnostics_channel: mark as stable (Stephen Belanger) #45290
[b6b5b51687] - doc: deprecate use of invalid ports in url.parse (Antoine du Hamel) #45576
[d805d5a894] - doc: clarify changes in readableFlowing (Kohei Ueno) #45554
[015842f3d2] - doc: use console.error for error case in http2 (Deokjin Kim) #45577
[4345732900] - doc: add version description about fsPromise.constants (chlorine) #45556
[16643dbb19] - doc: add missing documentation for paramEncoding (Tobias Nießen) #45523
[246cd358b5] - doc: fix typo in threat model (Tobias Nießen) #45558
[5b1df22db0] - doc: add Node.js Threat Model (Rafael Gonzaga) #45223
[19d8493c92] - doc: run license-builder (github-actions[bot]) #45553
[6f0bc097ea] - doc: add async_hooks migration note (Geoffrey Booth) #45335
[118de4b44c] - doc: fix RESOLVE_ESM_MATCH in modules.md (翠 / green) #45280
[4de67d1ef4] - doc: add arm64 to os.machine() (Carter Snook) #45374
[1812a89c00] - doc: add lint rule to enforce trailing commas (Antoine du Hamel) #45471
[4128c27f66] - doc: include v19.1.0 in CHANGELOG.md (Rafael Gonzaga) #45462
[94a6a97ec6] - doc: adjust wording to eliminate awkward typography (Konv) #45398
[a6fe707b62] - doc: fix typo in maintaining-dependencies.md (Tobias Nießen) #45428
[8906a4e58e] - esm: add JSDoc property descriptions for loader (Rich Trott) #45370
[4e5ad9df50] - esm: add JSDoc property descriptions for fetch (Rich Trott) #45370
[2b760c339e] - fs: fix fs.rm support for loop symlinks (Nathanael Ruf) #45439
[e0a271e41b] - gyp: fix v8 canary build on aix (Vasili Skurydzin) #45496
[eac26c0793] - Revert "http: headers(Distinct), trailers(Distinct) setters to be no-op" (Rich Trott) #45527
[f208db70a0] - http: add debug log for ERR_UNESCAPED_CHARACTERS (Aidan Temple) #45420
[b72b2bab72] - http: add JSDoc property descriptions (Rich Trott) #45370
[4c9159a830] - lib: improve transferable abort controller exec (Yagiz Nizipli) #45525
[5745bcbb41] - lib: improve AbortController creation duration (Yagiz Nizipli) #45525
[38767b42fb] - lib: do not throw if global property is no longer configurable (Antoine du Hamel) #45344
[0d1b1c5df0] - meta: update AUTHORS (Node.js GitHub Bot) #45531
[208ea1a58c] - meta: update VoltrexMaster's username (Mohammed Keyvanzadeh) #45503
[d13ea68ef6] - meta: update AUTHORS (Node.js GitHub Bot) #45443
[6704e7814f] - meta: be more proactive about removing from teams (Rich Trott) #45352
[6fdd202c57] - module: require.resolve.paths returns null with node schema (MURAKAMI Masahiko) #45147
[38f1ede379] - node-api: address coverity warning (Michael Dawson) #45563
[4a4f2802ec] - node-api: declare type napi_cleanup_hook (Chengzhong Wu) #45391
[8ff16fd8c0] - node-api: fix immediate napi_remove_wrap test (Chengzhong Wu) #45406
[e7a5b3347b] - src: address coverity warning in node_file.cc (Michael Dawson) #45565
[128c9f6fac] - src: use qualified std::move call in node_http2 (Michaël Zasso) #45555
[57bca94cb1] - src: avoid unused variables and functions (Michaël Zasso) #45542
[649b31f5e5] - src: add missing include for std::all_of (Michaël Zasso) #45541
[56f22ea47c] - src: set an appropriate thread pool size if given --v8-pool-size=0 (Daeyeon Jeong) #45513
[cce9e11d2d] - src: move FsStatsOffset and kFsStatsBufferLength to node_file.h (Joyee Cheung) #45498
[5e5bf0c236] - src: don't run tasks on isolate termination (Santiago Gimeno) #45444
[10e7c2a62c] - src: remove the unused PackageConfig class (Joyee Cheung) #45478
[459d4481d4] - src: add --max-semi-space-size to the options allowed in NODE_OPTIONS (Emanuel Hoogeveen) #44436
[a483d1291e] - src: condense experimental warning message (Rich Trott) #45424
[42507e68ab] - src,node-api: update napi_is_detached_arraybuffer (Daeyeon Jeong) #45538
[f720c5880e] - stream: use ArrayBufferPrototypeGetByteLength (Yagiz Nizipli) #45528
[c00258e24b] - stream: add primordials to adapters (Yagiz Nizipli) #45511
[5274a8f7db] - stream: avoid premature close when will not emit close (Robert Nagy) #45301
[496912d722] - stream: fix typo in adapters.js (#45515) (Kohei Ueno) #45515
[8d96e2c723] - stream: add fast path for utf8 (Yagiz Nizipli) #45483
[c3fe9072c6] - test: add trailing commas in event tests (Rich Trott) #45466
[bb4c293873] - test: add trailing commas in async-hooks tests (#45549) (Antoine du Hamel) #45549
[731e8741b2] - test: add trailing commas in addons test (#45548) (Antoine du Hamel) #45548
[d6c68ce346] - test: add trailing commas in test/common (#45550) (Antoine du Hamel) #45550
[c9ba0b738d] - test: revise pull request guide text about code (Rich Trott) #45519
[076e9eeaeb] - test: fix test-trace-gc-flag (Tony Gorez) #45230
[72f2df2802] - test: adapt test-v8-stats for V8 update (Michaël Zasso) #45230
[b491504d77] - test: enable the WPT for structuredClone (Daeyeon Jeong) #45482
[1277ffcb55] - test: add lint rule to enforce trailing commas (Antoine du Hamel) #45468
[45b54eec55] - test: update uses of _jabber._tcp.google.com (Colin Ihrig) #45451
[51213c24bd] - test: add test to validate changelogs for releases (Richard Lau) #45325
[00a3b5f7d5] - test: remove flaky designation for test-worker-http2-stream-terminate (Rich Trott) #45438
[4fe5c4e167] - test: fix flaky test-repl-sigint-nested-eval (Rich Trott) #45354
[f79dd65333] - test: add a test to ensure the correctness of timezone upgrades (Darshan Sen) #45299
[016749ba5d] - test_runner: add initial TAP parser (Wassim Chegham) #43525
[e9760b4ae8] - test_runner: support watch mode (Moshe Atlow) #45214
[160c88ec77] - tools: have test-asan use ubuntu-20.04 (Filip Skokan) #45581
[81f63c2b28] - tools: update eslint to 8.28.0 (Node.js GitHub Bot) #45532
[f3f1aed01a] - tools: add automation for updating libuv dependency (Facundo Tuesca) #45362
[d4f30f07b3] - tools: add missing step in update-base64.sh script (Facundo Tuesca) #45509
[cca20330cf] - tools: update certdata.txt (Luigi Pinca) #45490
[39e873139b] - tools: include current release in the list of released versions (Antoine du Hamel) #45463
[8a34ef4897] - tools: update lint-md-dependencies to rollup@3.3.0 (Node.js GitHub Bot) #45442
[bb36acff42] - tools: do not run CQ on non-fast-tracked MRs open for less than 2 days (Moshe Atlow) #45407
[93bc2ba509] - tools: simplify .eslintrc.js (Rich Trott) #45397
[b7f8a44c64] - tools: simplify regex in ESLint config (Rich Trott) #45399
[36bf87fabf] - tools: enable jsdoc/require-property-description rule (Rich Trott) #45370
[7c6281a7d2] - tools: dynamically determine parallelism on GitHub Actions macOS (Rich Trott) #45350
[f441b04c11] - trace_events: add new categories (theanarkh) #45266
[6bdd2c3884] - Revert "url: improve port validation" (Rich Trott) #45517
[bbba42fcb2] - url: remove unnecessary object call to kFormat (Yagiz Nizipli) #45492
[7c79ba7b27] - util: add fast path for utf8 encoding (Yagiz Nizipli) #45412
[f86f90f839] - util: improve text decoder performance (Yagiz Nizipli) #45388
[3263ceb21a] - watch: watch for missing dependencies (Moshe Atlow) #45348

`v19.1.0`: 2022-11-14, Version 19.1.0 (Current), @RafaelGSS

Compare Source

Notable changes

Support function mocking on Node.js test runner

The node:test module supports mocking during testing via a top-level mock object.

test('spies on an object method', (t) => {
  const number = {
    value: 5,
    add(a) {
      return this.value + a;
    },
  };
  t.mock.method(number, 'add');

  assert.strictEqual(number.add(3), 8);
  assert.strictEqual(number.add.mock.calls.length, 1);
});

Contributed by Colin Ihrig in #45326

fs.watch recursive support on Linux

fs.watch supports recursive watch using the recursive: true option.

const watcher = fs.watch(testDirectory, { recursive: true });
watcher.on('change', function(event, filename) {
});

Contributed by Yagiz Nizipli in #45098

Other notable changes

deps
- update ICU to 72.1 (Michaël Zasso) #45068
doc
- add lukekarrys to collaborators (Luke Karrys) #45180
- add anonrig to collaborators (Yagiz Nizipli) #45002
lib
- drop fetch experimental warning (Matteo Collina) #45287
util
- (SEMVER-MINOR) add MIME utilities (Bradley Farias) #21128
- improve textdecoder decode performance (Yagiz Nizipli) #45294

Commits

[c9cf399ec7] - benchmark: add parameters to text-decoder benchmark (Yagiz Nizipli) #45363
[79f6bb061d] - benchmark: fix text-decoder benchmark (Yagiz Nizipli) #45363
[a27c994ced] - benchmark: add blob benchmark (Yagiz Nizipli) #44990
[c45b6aee78] - bootstrap: merge main thread and worker thread initializations (Joyee Cheung) #44869
[33691208df] - buffer: fix validation of options in Blob constructor (Antoine du Hamel) #45156
[7b938df296] - build: support Python 3.11 (Luigi Pinca) #45191
[75e0a2d109] - build: workaround for node-core-utils (Jiawen Geng) #45199
[f598edbdf4] - build: fix icu-small build with ICU 72.1 (Steven R. Loomis) #45195
[29b9f4f90c] - build: remove unused language files (Ben Noordhuis) #45138
[3a1ee940d1] - build: add GitHub token to auto-start-ci workflow (Richard Lau) #45185
[17349a2f42] - build: restore Windows resource file (Richard Lau) #45042
[24e24bd063] - build: add version info to timezone update MR (Darshan Sen) #45021
[8d7aa53e6b] - build,win: pass --debug-nghttp2 to configure (Santiago Gimeno) #45209
[b2e60480f3] - child_process: validate arguments for null bytes (Darshan Sen) #44782
[1f0edde412] - crypto: handle more webcrypto errors with OperationError (Filip Skokan) #45320
[13fb05e12b] - crypto: handle unsupported AES ciphers in webcrypto (Filip Skokan) #45321
[c168cbfbb3] - deps: V8: cherry-pick 56816d7 (Shi Pujin) #45353
[1432474abf] - deps: upgrade npm to 8.19.3 (npm team) #45322
[f35d56200d] - deps: update corepack to 0.15.1 (Node.js GitHub Bot) #45331
[44de2321aa] - deps: patch V8 to 10.7.193.20 (Michaël Zasso) #45228
[bfe3819f08] - deps: upgrade to libuv 1.44.2 (Luigi Pinca) #42340
[0d41df96b3] - deps: update corepack to 0.15.0 (Node.js GitHub Bot) #45235
[0d241638ca] - deps: update undici to 5.12.0 (Node.js GitHub Bot) #45236
[f58996188a] - Revert "deps: make V8 compilable with older glibc" (Michaël Zasso) #45162
[8cda730e58] - deps: update ICU to 72.1 (Michaël Zasso) #45068
[0a6ed6f710] - Revert "deps: V8: forward declaration of Rtl*FunctionTable" (Michaël Zasso) #45119
[2f7518ada2] - deps: update timezone (Node.js GitHub Bot) #44950
[3bfba6df79] - deps: patch V8 to 10.7.193.16 (Michaël Zasso) #45023
[b5baaa61b3] - dns: fix port validation (Antoine du Hamel) #45135
[0e9bad97cc] - doc: allow for holidays in triage response (Michael Dawson) #45267
[d4aabb9d3d] - doc: include last security release date (Juan José Arboleda) #45368
[ba45373164] - doc: fix email for Ashley (Michael Dawson) #45364
[d5e5c75b13] - doc: fix test runner's only tests section header (Colin Ihrig) #45343
[a7c5f31c47] - doc: run license-builder (github-actions[bot]) #45349
[3de125743e] - doc: add more info for timer.setInterval (theanarkh) #45232
[5a1252d9b4] - doc: use module names in stability overview table (Filip Skokan) #45312
[4d38bf2c5f] - doc: add node: prefix for examples (Daeyeon Jeong) #45328
[b4b6b95f48] - doc: update name of Node.js core Slack channel (Rich Trott) #45293
[7d7e7c316b] - doc: fix "task_processor.js" typo (andreysoktoev) #45257
[b9039a54af] - doc: add history section to fetch-related globals (Antoine du Hamel) #45198
[d9163f1632] - doc: clarify moderation in onboarding.md (Benjamin Gruenbaum) #41930
[c179c1478b] - doc: change make lint to make lint-md (RafaelGSS) #45197
[58bec56fab] - doc: add more lts update steps to release guide (Ruy Adorno) #45177
[8f8d7e76ac] - doc: add bmuenzenmeyer to triagers (Brian Muenzenmeyer) #45155
[de2df550f6] - doc: update process.release (Filip Skokan) #45170
[916e8760ba] - doc: add link to triage guide (Brian Muenzenmeyer) #45154
[54d806853e] - doc: mark Node.js 12 as End-of-Life (Rafael Gonzaga) #45186
[3a26347649] - doc: add lukekarrys to collaborators (Luke Karrys) #45180
[85cb4d795c] - doc: update mark release line lts on release guide (Ruy Adorno) #45101
[c23e023a2d] - doc: be more definite and present tense-y (Ben Noordhuis) #45120
[519002152b] - doc: add major version note to release guide (Ruy Adorno) #45054
[809e8dcbd2] - doc: fix v14.x link maintaining openssl guide (RafaelGSS) #45071
[9d449d389d] - doc: add note about latest GitHub release (Michaël Zasso) #45111
[ee34a3a1bc] - doc: mention v18.x openssl maintaining guide (Rafael Gonzaga) #45070
[3e4033a90d] - doc: fix display of "problematic" ASCII characters (John Gardner) #44373
[533e38b0b8] - doc: mark Node.js v17.x as EOL (KaKa) #45110
[93a34faa39] - doc: update Node.js 16 End-of-Life date (Richard Lau) #45103
[b4beddef79] - doc: fix typo in parseArgs default value (Tobias Nießen) #45083
[e8103fd33b] - doc: updated security stewards (Michael Dawson) #45005
[5fbccae4f0] - doc: fix http and http2 writeEarlyHints() parameter (Fabian Meyer) #45000
[d47f83251a] - doc: run license-builder (github-actions[bot]) #45034
[e6bbc5033d] - doc: improve the workflow to test release binaries (Rafael Gonzaga) #45004
[f0c18f04f0] - doc: fix undici version in changelog (Michael Dawson) #44982
[ffba3218ec] - doc: add info on fixup to security release process (Michael Dawson) #44807
[edb92f4510] - doc: add anonrig to collaborators (Yagiz Nizipli) #45002
[58334a38e8] - doc, async_hooks: improve and add migration hints (Gerhard Stöbich) #45369
[7225a7d46b] - doc, http: add Uint8Array as allowed type (Gerhard Stöbich) #45167
[40a5e22328] - esm: protect ESM loader from prototype pollution (Antoine du Hamel) #45175
[2e5d8e7239] - esm: protect ESM loader from prototype pollution (Antoine du Hamel) #45044
[c3dd696081] - events: add unique events benchmark (Yagiz Nizipli) #44657
[daff3b8b09] - fs: update todo message (Yagiz Nizipli) #45265
[670def3d6f] - fs: fix opts.filter issue in cpSync (Tho) #45143
[34bfef91a9] - (SEMVER-MINOR) fs: add recursive watch to linux (Yagiz Nizipli) #45098
[d89ca1b443] - fs: trace more fs api (theanarkh) #45095
[1a04881494] - http: headers(Distinct), trailers(Distinct) setters to be no-op (Madhuri) #45176
[8abc3f732a] - http: add priority to common http headers (James M Snell) #45045
[316354e3d3] - http2: improve session close/destroy procedures (Santiago Gimeno) #45115
[1635140952] - http2: fix crash on Http2Stream::diagnostic_name() (Santiago Gimeno) #45123
[94b7f5338c] - http2: fix debugStream method (Santiago Gimeno) #45129
[3db37e7d1b] - inspector: refactor inspector/promises to be more robust (Antoine du Hamel) #45041
[0478e4063f] - lib: add options to the heap snapshot APIs (Joyee Cheung) #44989
[a8e901555a] - lib: fix JSDoc issues (Rich Trott) #45243
[74352842bc] - lib: use process.nextTick() instead of setImmediate() (Luigi Pinca) #42340
[9f3d2f6879] - lib: drop fetch experimental warning (Matteo Collina) #45287
[e2181e057b] - lib: fix eslint early return (RafaelGSS) #45409
[d1726692ee] - lib: fix TypeError when converting a detached buffer source (Kohei Ueno) #44020
[d7470ad986] - lib: fix AbortSignal.timeout parameter validation (dnalborczyk) #42856
[c7b7f2bec2] - lib: add lint rule to protect against Object.prototype.then pollution (Antoine du Hamel) #45061
[9ed9aa8233] - lib: add ability to add separate event name to defineEventHandler (James M Snell) #45032
[8b4a41e23d] - lib: fix typo in pre_execution.js (Antoine du Hamel) #45039
[cc2393c9fe] - lib: promise version of streams.finished call clean up (Naor Tedgi (Abu Emma)) #44862
[17ef1bbc8e] - lib: make properties on Blob and URL enumerable (Khafra) #44918
[8199841e9c] - lib: support more attributes for early hint link (Yagiz Nizipli) #44874
[88c3bb609b] - meta: update AUTHORS (Node.js GitHub Bot) #45333
[a866e8c163] - meta: update collaborator email address in README (Rich Trott) #45251
[bfbfacad79] - meta: fix email address typo in README (Rich Trott) #45250
[0d58bb9531] - meta: remove dont-land-on-v12 auto labeling (Moshe Atlow) #45233
[b41b5ba658] - meta: update AUTHORS (Node.js GitHub Bot) #45238
[ad9a5bb61f] - meta: move a collaborator to emeritus (Rich Trott) #45160
[ec8683052b] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #45036
[7900810fb3] - meta: update AUTHORS (Node.js GitHub Bot) #45020
[738144c311] - module: ensure relative requires work from deleted directories (Bradley Farias) #42384
[36acf8a13e] - net: remove _readableState from debug statement (Rich Trott) #45063
[aaca54c5c0] - node-api: handle no support for external buffers (Michael Dawson) #45181
[2105f099ea] - node-api,test: fix test_reference_double_free crash (Vladimir Morozov) #44927
[2fcf851a91] - os: convert uid and gid to 32-bit signed integers (Luigi Pinca) #42340
[dfe4237d77] - perf_hooks: align toStringTag with other Web Performance implementations (Daeyeon Jeong) #45157
[9d15da3341] - report: add more memory info (theanarkh) #45254
[a2620acad7] - report: add rss and use/kernel cpu usage fields (theanarkh) #45043
[66e1dc4979] - report,doc: define report version semantics (Gireesh Punathil) #45050
[86e22b4e19] - src: track contexts in the Environment instead of AsyncHooks (Joyee Cheung) #45282
[326d19af3d] - src: resolve TODO related to inspector CVEs (Tobias Nießen) #45341
[4e45585ca2] - src: revert is_release to 0 (RafaelGSS) #45315
[5d480118fb] - src: print nghttp2 logs when using --debug-nghttp2 (Santiago Gimeno) #45209
[3e46ebda3c] - src: trace threadpool event (theanarkh) #44458
[97547bcd14] - src: lock-free init_process_flags (Jérémy Lal) #45221
[42db84913b] - src: call uv_library_shutdown before DisposePlatform (theanarkh) #45226
[aa4152a1b6] - src: fix crypto.privateEncrypt fails first time (liuxingbaoyu) #42793
[243c141b69] - src: clarify OptionEnvvarSettings member names (Chengzhong Wu) #45057
[5335e29ce7] - src: let http2 streams end after session close (Santiago Gimeno) #45153
[8d5682266e] - src: remap invalid file descriptors using dup2 (Obiwac) #44461
[4e14ed8878] - src: remove unused contextify_global_private_symbol (Daeyeon Jeong) #45128
[a8412f5677] - src: forbid running watch mode in REPL (Moshe Atlow) #45058
[162bf0ddff] - src: fix test runner coverage (Moshe Atlow) #45055
[e5b1179630] - src: optimize ALPN callback (Ben Noordhuis) #44875
[9dc21a1f86] - src: simplify ALPN code, remove indirection (Ben Noordhuis) #44875
[5fce8e3495] - src: iwyu in cleanup_queue.cc (Shelley Vohr) #44983
[824dcfc422] - src: return void in InitializeInspector() (Joyee Cheung) #44903
[7a31ae8ab1] - src,lib: retrieve parsed source map url from v8 (Chengzhong Wu) #44798
[ccb1c1e9a2] - stream: add compose operator (Raz Luvaton) #44937
[e60d9053bc] - stream: fix duplexify premature destroy (Robert Nagy) #45133
[bc0ae3e74e] - stream: fix web streams have no Symbol.toStringTag (Jithil P Ponnan) #45117
[1655532fd2] - stream: don't push null from closed promise #42694 (David Halls) #45026
[717db1d46a] - test: skip test-fs-largefile if not enough disk space (Rich Trott) #45339
[4a80aff16e] - test: fix catching failed assertion (Pavel Horal) #45222
[66e7821506] - test: defer invocation checks (Luigi Pinca) #42340
[43db0fbd49] - test: fix test-socket-write-after-fin-error (Luigi Pinca) #42340
[d5f4d98847] - test: make test-eventemitter-asyncresource.js shorter (Juan José) #45146
[7428651100] - test: convert test-debugger-pid to async/await (Luke Karrys) #45179
[f10f2c1121] - test: fix textdecoder test for small-icu builds (Richard Lau) #45225
[eed799bd31] - test: improve test coverage in test-event-capture-rejections.js (Juan José) #45148
[069747bfdd] - test: fix timeout of test-heap-prof.js in riscv devices (Yu Gu) #42674
[ddb7df76de] - test: deflake test-http2-empty-frame-without-eof (Santiago Gimeno) #45212
[02ebde39d3] - test: use common/tmpdir in watch-mode ipc test (Richard Lau) #45211
[f9bc40a1fc] - test: use uv_sleep() where possible (Santiago Gimeno) #45124
[3c7ea23b8f] - test: fix typo in test/parallel/test-fs-rm.js (Tim Shilov) #44882
[b39dcde056] - test: remove a snapshot blob from test-inspect-address-in-use.js (Daeyeon Jeong) #45132
[fabed9bdc8] - test: add test for Module._stat (Darshan Sen) #44713
[2b3b291c97] - test: watch mode inspect restart repeatedly (Moshe Atlow) #45060
[17e86e4188] - test: remove experimental-wasm-threads flag (Michaël Zasso) #45074
[f0480d68e9] - test: remove unnecessary noop function args to mustCall() (Antoine du Hamel) #45047
[82e6043118] - test: mark test-watch-mode* as flaky on all platforms (Pierrick Bouvier) #45049
[26a2ae2489] - test: wrap missing common.mustCall (Moshe Atlow) #45064
[8662399cda] - test: remove mentions of --experimental-async-stack-tagging-api flag (Simon) #45051
[71b8d506ed] - test: improve assertions in test-repl-unsupported-option.js (Juan José) #44953
[dbc696d363] - test: remove unnecessary noop function args to mustCall() (Rich Trott) #45027
[c1ca19fb06] - test: update WPT resources (Khaidi Chu) #44948
[43677e5a34] - test: skip test depending on overlapped-checker when not available (Antoine du Hamel) #45015
[3519d74e87] - test: improve test coverage for os package (Juan José) #44959
[ea0cfc9a83] - test: add test to improve coverage in http2-compat-serverresponse (Cesar Mario Diaz) #44970
[482578682c] - test: improve test coverage in test-child-process-spawn-argv0.js (Juan José) #44955
[a618dc3c3e] - test: use CHECK instead of EXPECT where necessary (Tobias Nießen) #44795
[c59d3b76e6] - test: refactor promises to async/await (Madhuri) #44980
[36c5927c60] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #45165
[6158d740f3] - test_runner: support function mocking (Colin Ihrig) #45326
[920804dc46] - test_runner: avoid swallowing of asynchronously thrown errors (MURAKAMI Masahiko) #45264
[8e7f9de45e] - test_runner: fix afterEach not running on test failures (Jithil P Ponnan) #45204
[0040030443] - test_runner: report tap subtest in order (Moshe Atlow) #45220
[afa8291c7c] - test_runner: call {before,after}Each() on suites (Colin Ihrig) #45161
[ff174b0937] - test_runner: add extra fields in AssertionError YAML (Bryan English) #44952
[bf868fdfab] - (SEMVER-MINOR) tls: add "ca" property to certificate object (Ben Noordhuis) #44935
[e8075fd1f8] - tools: add automation for updating acorn dependency (Facundo Tuesca) #45357
[9aa305ff3e] - tools: add documentation regarding our api tooling (Claudio Wunder) #45270
[76cbc07f9b] - tools: allow scripts to run from anywhere (Luigi Pinca) #45361
[aa875a4d6a] - tools: update eslint to 8.27.0 (Node.js GitHub Bot) #45358
[4b71db13ae] - tools: update eslint to 8.26.0 (Node.js GitHub Bot) #45243
[63267dfefb] - tools: update lint-md-dependencies to rollup@3.2.5 (Node.js GitHub Bot) #45332
[e275859138] - tools: fix stability index generation (Antoine du Hamel) #45346
[97fe8bacb1] - tools: increase macOS cores to 3 on GitHub CI (Rich Trott) #45340
[eda4ae51ca] - tools: add automation for updating base64 dependency (Facundo Tuesca) #45300
[2ee052f794] - tools: fix request-ci-failed comment (Antoine du Hamel) #45291
[e118dd88fd] - tools: refactor dynamic strings creation in shell scripts (Antoine du Hamel) #45240
[ba89cea683] - tools: update lint-md-dependencies (Node.js GitHub Bot) #45237
[786f086800] - tools: use Python 3.11 in GitHub Actions workflows (Luigi Pinca) #45191
[0738d14fa4] - tools: fix request-ci-failed comment (Antoine du Hamel) #45218
[49be13ccd8] - tools: keep Emeriti lists case-insensitive alphabetic (Rich Trott) #45159
[6e30d2231b] - tools: update actions/setup-python to v4 (Yagiz Nizipli) #45178
[a4158692d7] - tools: update V8 gypfiles for RISC-V (Andreas Schwab) #45149
[c43bc2169f] - tools: fix create-or-update-pull-request-action hash on GHA (Antoine du Hamel) #45166
[2ccc03ec32] - tools: update gr2m/create-or-update-pull-request-action (Luigi Pinca) #45022
[a70b27629f] - tools: do not use the set-output command in workflows (Luigi Pinca) #45024
[025e616662] - tools: update lint-md-dependencies (Node.js GitHub Bot) #45019
[732f9a78d3] - trace_events: fix getCategories (theanarkh) #45092
[1bc84ce52c] - url: remove \t \n \r in url.parse() similar to WHATWG (Rich Trott) #45116
[84e7388160] - url: improve port validation (Rich Trott) #45012
[02cff4a3d3] - url: improve url.parse() compliance with WHATWG URL (Rich Trott) #45011
[89390a6be2] - util: improve text-decoder performance (Yagiz Nizipli) #45363
[0deed8daeb] - util: improve textdecoder decode performance (Yagiz Nizipli) #45294
[d41f8ffc36] - (SEMVER-MINOR) util: add MIME utilities (#21128) (Bradley Farias) #21128

`v19.0.1`: 2022-11-04, Version 19.0.1 (Current), @RafaelGSS

Compare Source

This is a security release.

Notable changes

The following CVEs are fixed in this release:

CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High)
CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High)
CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium)

More detailed information on each of the vulnerabilities can be found in November 2022 Security Releases blog post.

Commits

[e58e8d70a8] - deps: update archs files for quictls/openssl-3.0.7+quic (RafaelGSS) #45286
[85f4548d57] - deps: upgrade openssl sources to quictls/openssl-3.0.7+quic (RafaelGSS) #45286
[43403f56f7] - inspector: harden IP address validation again (Tobias Nießen) nodejs-private/node-private#354

`v19.0.0`: 2022-10-18, Version 19.0.0 (Current), @RafaelGSS and @ruyadorno

Compare Source

Node.js 19 is here! Highlights include the update of the V8 JavaScript engine to 10.7, HTTP(s)/1.1 KeepAlive enabled by default, and ESM Resolution adjustments.

Node.js 19 will replace Node.js 18 as our ‘Current’ release line when Node.js 18 enters long-term support (LTS) later this month. As per the release schedule, Node.js 19 will be ‘Current' release for the next 6 months, until April 2023.

Notable Changes

Deprecations and Removals

[7dd2f41c73] - (SEMVER-MAJOR) module: runtime deprecate exports double slash maps (Guy Bedford) #44495
[ada2d053ae] - (SEMVER-MAJOR) process: runtime deprecate coercion to integer in process.exit() (Daeyeon Jeong) #44711

HTTP(S)/1.1 KeepAlive by default

Starting with this release, Node.js sets keepAlive to true by default. This means that any outgoing HTTP(s) connection will automatically use HTTP 1.1 Keep-Alive. The default waiting window is 5 seconds. Enable keep-alive will deliver better throughput as connections are reused by default.

Additionally, the agent is now able to parse the response Keep-Alive which the servers might send. This header instructs the client on how much to stay connected. On the other side, the Node.js HTTP server will now automatically disconnect idle clients (which are using HTTP Keep-Alive to reuse the connection) when close() is invoked).

Node.js HTTP(S)/1.1 requests may experience a better throughput/performance by default.

Contributed by Paolo Insogna in #43522

DTrace/SystemTap/ETW Support were removed

The main reason is the lack of resources from the Node.js team. The complexity to keep the support up-to-date has proved not worth it without a clear plan to support those tools. Hence, an issue was raised in the Node.js repository to assess better support, for DTrace in specific.

Contributed by Ben Noordhuis in #43651 and #43652

V8 10.7

The V8 engine is updated to version 10.7, which is part of Chromium 107. This version include a new feature to the JavaScript API: Intl.NumberFormat.

Intl.NumberFormat v3 API is a new TC39 ECMA402 stage 3 proposal extend the pre-existing Intl.NumberFormat.

The V8 update was a contribution by Michaël Zasso in #44741.

llhttp 8.1.0

llhttp has been updated to version 8.1.0. Collectively, this version brings many updates to the llhttp API, introducing new callbacks and allow all callback to be pausable.

Contributed by Paolo Insogna in #44967

Other Notable Changes

[46a3afb579] - doc: graduate webcrypto to stable (Filip Skokan) #44897
[f594cc85b7] - esm: remove specifier resolution flag (Geoffrey Booth) #44859

Semver-Major Commits

[53f73d1cfe] - (SEMVER-MAJOR) build: enable V8's trap handler on Windows (Michaël Zasso) #44741
[06aaf8a1c4] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #44741
[aa3a572e6b] - (SEMVER-MAJOR) build: remove dtrace & etw support (Ben Noordhuis) #43652
[38f1e2793c] - (SEMVER-MAJOR) build: remove systemtap support (Ben Noordhuis) #43651
[2849283c4c] - (SEMVER-MAJOR) crypto: remove non-standard webcrypto.Crypto.prototype.CryptoKey (Antoine du Hamel) #42083
[a1653ac715] - (SEMVER-MAJOR) crypto: do not allow to call setFips from the worker thread (Sergey Petushkov) #43624
[fd36a8dadb] - (SEMVER-MAJOR) deps: update llhttp to 8.1.0 (Paolo Insogna) #44967
[89ecdddaab] - (SEMVER-MAJOR) deps: bump minimum ICU version to 71 (Michaël Zasso) #44741
[66fe446efd] - (SEMVER-MAJOR) deps: V8: cherry-pick 0cccb6f (Michaël Zasso) #44741
[88ed027d57] - (SEMVER-MAJOR) deps: V8: cherry-pick 7ddb839 (Michaël Zasso) #44741
[26c651c34e] - (SEMVER-MAJOR) deps: V8: cherry-pick 1b3a4f0 (Michaël Zasso) #44741
[c8ff2dfd11] - (SEMVER-MAJOR) deps: V8: cherry-pick b161a08 (Michaël Zasso) #44741
[7a8fa2d517] - (SEMVER-MAJOR) deps: fix V8 build on Windows with MSVC (Michaël Zasso) #44741
[83b0aaa800] - (SEMVER-MAJOR) deps: fix V8 build on SmartOS (Michaël Zasso) #44741
[7a952e8ea5] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #44741
[6bd756d7c6] - (SEMVER-MAJOR) deps: update V8 to 10.7.193.13 (Michaël Zasso) #44741
[03fb789fb9] - (SEMVER-MAJOR) events: add null check for the signal of EventTarget (Masashi Hirano) #43153
[a4fa526ddc] - (SEMVER-MAJOR) fs: add directory autodetection to fsPromises.symlink() (Livia Medeiros) #42894
[bb4891d8d4] - (SEMVER-MAJOR) fs: add validateBuffer to improve error (Hirotaka Tagawa / wafuwafu13) #44769
[950a4411fa] - (SEMVER-MAJOR) fs: remove coercion to string in writing methods (Livia Medeiros) #42796
[41a6d82968] - (SEMVER-MAJOR) fs: harden fs.readSync(buffer, options) typecheck (LiviaMedeiros) #42772
[2275faac2b] - (SEMVER-MAJOR) fs: harden fs.read(params, callback) typecheck (LiviaMedeiros) #42772
[29953a0b88] - (SEMVER-MAJOR) fs: harden filehandle.read(params) typecheck (LiviaMedeiros) #42772
[4267b92604] - (SEMVER-MAJOR) http: use Keep-Alive by default in global agents (Paolo Insogna) #43522
[0324529e0f] - (SEMVER-MAJOR) inspector: introduce inspector/promises API (Erick Wendel) #44250
[80270994d6] - (SEMVER-MAJOR) lib: enable global CustomEvent by default (Daeyeon Jeong) #44860
[f529f73bd7] - (SEMVER-MAJOR) lib: brand check event handler property receivers (Chengzhong Wu) #44483
[6de2673a9f] - (SEMVER-MAJOR) lib: enable global WebCrypto by default (Antoine du Hamel) #42083
[73ba8830d5] - (SEMVER-MAJOR) lib: use private field in AbortController (Joyee Cheung) #43820
[7dd2f41c73] - (SEMVER-MAJOR) module: runtime deprecate exports double slash maps (Guy Bedford) #44495
[22c39b1ddd] - (SEMVER-MAJOR) path: the dot will be added(path.format) if it is not specified in ext (theanarkh) #44349
[587367d107] - (SEMVER-MAJOR) perf_hooks: expose webperf global scope interfaces (Chengzhong Wu) #44483
[364c0e196c] - (SEMVER-MAJOR) perf_hooks: fix webperf idlharness (Chengzhong Wu) #44483
[ada2d053ae] - (SEMVER-MAJOR) process: runtime deprecate coercion to integer in process.exit() (Daeyeon Jeong) #44711
[e0ab8dd637] - (SEMVER-MAJOR) process: make process.config read only (Sergey Petushkov) #43627
[481a959adb] - (SEMVER-MAJOR) readline: remove question method from InterfaceConstructor (Antoine du Hamel) #44606
[c9602ce212] - (SEMVER-MAJOR) src: use new v8::OOMErrorCallback API (Michaël Zasso) #44741
[19a70c11e4] - (SEMVER-MAJOR) src: override CreateJob instead of PostJob (Clemens Backes) #44741
[fd52c62bee] - (SEMVER-MAJOR) src: use V8_ENABLE_SANDBOX macro (Michaël Zasso) #44741
[c10988db44] - (SEMVER-MAJOR) src: use non-deprecated V8 inspector API (Michaël Zasso) #44741
[3efe901dd6] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 111 (Michaël Zasso) #44741
[77e585657f] - (SEMVER-MAJOR) src: turn embedder api overload into default argument (Alena Khineika) #43629
[dabda03ea9] - (SEMVER-MAJOR) src: per-environment time origin value (Chengzhong Wu) #43781
[2e49b99cc2] - (SEMVER-MAJOR) src,test: disable freezing V8 flags on initialization (Clemens Backes) #44741
[2b32985c62] - (SEMVER-MAJOR) stream: use null for the error argument (Luigi Pinca) #44312
[36805e8524] - (SEMVER-MAJOR) test: adapt test-repl for V8 update (Michaël Zasso) #44741
[96ef25793d] - (SEMVER-MAJOR) test: adapt test-repl-pretty-*stack to V8 changes (Michaël Zasso) #44741
[71c193e581] - (SEMVER-MAJOR) test: adapt to new JSON SyntaxError messages (Michaël Zasso) #44741
[b5f1564880] - (SEMVER-MAJOR) test: rename always-opt flag to always-turbofan (Michaël Zasso) #44741
[1acf0339dd] - (SEMVER-MAJOR) test: fix test-hash-seed for new V8 versions (Michaël Zasso) #44741
[57ff476c33] - (SEMVER-MAJOR) test: remove duplicate test (Luigi Pinca) #44051
[77def91bf9] - (SEMVER-MAJOR) tls,http2: send fatal alert on ALPN mismatch (Tobias Nießen) #44031
[4860ad99b9] - (SEMVER-MAJOR) tools: update V8 gypfiles for 10.7 (Michaël Zasso) #44741

Semver-Minor Commits

[af0921d877] - (SEMVER-MINOR) esm: add --import flag (Moshe Atlow) #43942
[0633e9a0b5] - (SEMVER-MINOR) lib: add diagnostics channel for process and worker (theanarkh) #44045
[ca5be26b31] - (SEMVER-MINOR) src: add support for externally shared js builtins (Michael Dawson) #44376
[e86a638305] - (SEMVER-MINOR) src: add initial shadow realm support (Chengzhong Wu) #42869
[71ca6d7d6a] - (SEMVER-MINOR) util: add maxArrayLength option to Set and Map (Kohei Ueno) #43576

Semver-Patch Commits

[78508028e3] - bootstrap: generate bootstrapper arguments in BuiltinLoader (Joyee Cheung) #44488
[5291096ca2] - bootstrap: check more metadata when loading the snapshot (Joyee Cheung) #44132
[d0f73d383d] - build: go faster, drop -fno-omit-frame-pointer (Ben Noordhuis) #44452
[214354fc9f] - crypto: fix webcrypto HMAC "get key length" in deriveKey and generateKey (Filip Skokan) #44917
[40a0757b21] - crypto: remove webcrypto HKDF and PBKDF2 default-applied lengths (Filip Skokan) #44945
[eeec3eb16a] - crypto: simplify webcrypto ECDH deriveBits (Filip Skokan) #44946
[0be1c57281] - deps: V8: cherry-pick c2792e5 (Jiawen Geng) #44961
[488474618c] - deps: V8: cherry-pick c3dffe6 (Michaël Zasso) #44958
[34ba631a0b] - deps: V8: cherry-pick e7f0f26 (Michaël Zasso) #44958
[690a837f4f] - deps: V8: cherry-pick 3d59a3c (Michaël Zasso) #44958
[bab8b3aad6] - deps: V8: cherry-pick 8b87039 (Michaël Zasso) #44958
[37e5152245] - doc: add notable changes to latest v18.x release changelog (Danielle Adams) #44996
[19a909902a] - doc: deprecate url.parse() (Rich Trott) #44919
[6686d9000b] - doc: fix backticks in fs API docs (Livia Medeiros) #44962
[46a3afb579] - doc: graduate webcrypto to stable (Filip Skokan) #44897
[6e3c55cc35] - doc: fix v16.17.1 security release changelog (Ruy Adorno) #44759
[77cb88b91c] - doc: mark --import as experimental (Moshe Atlow) #44067
[46dcfb3c7b] - doc,crypto: update webcrypto docs for global access (Filip Skokan) #44723
[f594cc85b7] - esm: remove specifier resolution flag (Geoffrey Booth) #44859
[3c040348fe] - Revert "esm: convert resolve hook to synchronous" (Jacob Smith) #43526
[90b634a5a5] - esm: convert resolve hook to synchronous (Jacob Smith) #43363
[7c06eab1dc] - Revert "http: do not leak error listeners" (Luigi Pinca) #44921
[464d1c1558] - lib: reset RegExp statics before running user code (Antoine du Hamel) #43741
[15f10515e3] - module: fix segment deprecation for imports field (Guy Bedford) #44883
[7cdf745fdd] - perf_hooks: convert maxSize to IDL value in setResourceTimingBufferSize (Chengzhong Wu) #44902
[be525d7d04] - src: consolidate exit codes in the code base (Joyee Cheung) #44746
[d5ce285c8b] - src: refactor BaseObject methods (Joyee Cheung) #44796
[717465433c] - src: create BaseObject with node::Realm (Chengzhong Wu) #44348
[45f2258f74] - src: restore IS_RELEASE to 0 (Bryan English) #44758
[1f54fc25cb] - src: use automatic memory mgmt in SecretKeyGen (Tobias Nießen) #44479
[7371d335ac] - src: use V8 entropy source if RAND_bytes() != 1 (Tobias Nießen) #44493
[81d9cdb8cd] - src: introduce node::Realm (Chengzhong Wu) #44179
[ad41c919df] - src: remove v8abbr.h (Tobias Nießen) #44402
[fddc701d3c] - src: support diagnostics channel in the snapshot (Joyee Cheung) #44193
[d70aab663c] - src: support WeakReference in snapshot (Joyee Cheung) #44193
[4ca398a617] - src: iterate over base objects to prepare for snapshot (Joyee Cheung) #44192
[8b0e5b19bd] - src: fix cppgc incompatibility in v8 (Shelley Vohr) #43521
[3fdf6cfad9] - stream: fix size function returned from QueuingStrategies (Daeyeon Jeong) #44867
[331088f4a4] - Revert "tools: refactor tools/license2rtf to ESM" (Richard Lau) #43214
[30cb1bf8b8] - tools: refactor tools/license2rtf to ESM (Feng Yu) #43101
[a3ff4bfc66] - url: revert "validate ipv4 part length" (Antoine du Hamel) #42940
[87d0d7a069] - url: validate ipv4 part length (Yagiz Nizipli) #42915
[5b1bcf82f1] - vm: make ContextifyContext a BaseObject (Joyee Cheung) #44796

`v18.18.0`: 2023-09-18, Version 18.18.0 'Hydrogen' (LTS), @ruyadorno

Compare Source

Notable Changes

[7dc731d4bf] - build: sync libuv header change (Jiawen Geng) #48078
[490fc004b0] - crypto: update root certificates to NSS 3.93 (Node.js GitHub Bot) #49341
[dd8cd97d4d] - crypto: update root certificates to NSS 3.90 (Node.js GitHub Bot) #48416
[ea23870bec] - deps: add missing thread-common.c in uv.gyp (Santiago Gimeno) #48078
[88855e0b1b] - deps: upgrade to libuv 1.46.0 (Santiago Gimeno) #48078
[fb2b80fca0] - deps: upgrade to libuv 1.45.0 (Santiago Gimeno) #48078
[249879e46c] - doc: add atlowChemi to collaborators (atlowChemi) #48757
[e8dc7bde6a] - doc: add vmoroz to collaborators (Vladimir Morozov) #48527
[a30f2fbcc1] - doc: add kvakil to collaborators (Keyhan Vakil) #48449
[c39b7c240e] - (SEMVER-MINOR) esm: add --import flag (Moshe Atlow) #43942
[a68a67f54d] - (SEMVER-MINOR) events: allow safely adding listener to abortSignal (Chemi Atlow) #48596
[3a8586bee2] - fs, stream: initial Symbol.dispose and Symbol.asyncDispose support (Moshe Atlow) #48518
[863bdb785d] - net: add autoSelectFamily global getter and setter (Paolo Insogna) #45777
[c59ae86ba0] - (SEMVER-MINOR) url: add value argument to has and delete methods (Sankalp Shubham) #47885

Commits

[d1f43317ea] - benchmark: add bar.R (Rafael Gonzaga) #47729
[4f74be3c92] - benchmark: refactor crypto oneshot (Filip Skokan) #48267
[fe9da9df0f] - benchmark: add crypto.create*Key (Filip Skokan) #48284
[9cb18b3e9d] - build: do not pass target toolchain flags to host toolchain (Ivan Trubach) #48597
[7dc731d4bf] - build: sync libuv header change (Jiawen Geng) #48078
[211a4f88a9] - build: update action to close stale MRs (Michael Dawson) #48196
[cc33a1864b] - child_process: harden against prototype pollution (Livia Medeiros) #48726
[b5df084e1e] - child_process: use addAbortListener (atlowChemi) #48550
[611db8df1a] - child_process: support Symbol.dispose (Moshe Atlow) #48551
[490fc004b0] - crypto: update root certificates to NSS 3.93 (Node.js GitHub Bot) #49341
[dd8cd97d4d] - crypto: update root certificates to NSS 3.90 (Node.js GitHub Bot) #48416
[b2bc839d4c] - crypto: remove OPENSSL_FIPS guard for OpenSSL 3 (Richard Lau) #48392
[c8da8c80b9] - deps: update nghttp2 to 1.55.0 (Node.js GitHub Bot) #48746
[7e04242dcb] - deps: update minimatch to 9.0.3 (Node.js GitHub Bot) #48704
[ea23870bec] - deps: add missing thread-common.c in uv.gyp (Santiago Gimeno) #48078
[88855e0b1b] - deps: upgrade to libuv 1.46.0 (Santiago Gimeno) #48078
[fb2b80fca0] - deps: upgrade to libuv 1.45.0 (Santiago Gimeno) #48078
[59fca4e09a] - deps: update acorn to 8.10.0 (Node.js GitHub Bot) #48713
[bcb255d5a8] - deps: V8: cherry-pick cb00db4 (Keyhan Vakil) #48671
[65a6c90fc6] - deps: update acorn to 8.9.0 (Node.js GitHub Bot) #48484
[6b6d5d91e9] - deps: update zlib to 1.2.13.1-motley-f81f385 (Node.js GitHub Bot) #48541
[56249b0770] - deps: update googletest to ec4fed9 (Node.js GitHub Bot) #48538
[8914a5204a] - deps: update minimatch to 9.0.2 (Node.js GitHub Bot) #48542
[1b960d9988] - deps: update icu to 73.2 (Node.js GitHub Bot) #48502
[f0e2e3c549] - deps: update zlib to 1.2.13.1-motley-3ca9f16 (Node.js GitHub Bot) #48413
[9cf8fe6b93] - deps: upgrade npm to 9.8.1 (npm team) #48838
[d9ff473ff3] - deps: upgrade npm to 9.8.0 (npm team) #48665
[4a6177daad] - deps: upgrade npm to 9.7.2 (npm team) #48514
[104b58feb1] - deps: update ada to 2.6.0 (Node.js GitHub Bot) #48896
[7f7a125d78] - deps: update corepack to 0.19.0 (Node.js GitHub Bot) #48540
[5e1eb451d1] - deps: update corepack to 0.18.1 (Node.js GitHub Bot) #48483
[3be53358bc] - deps: add loong64 config into openssl gypi (Shi Pujin) #48043
[555982c59e] - deps: upgrade npm to 9.7.1 (npm team) #48378
[3c03ec0832] - deps: update simdutf to 3.2.14 (Node.js GitHub Bot) #48344
[a2964a4583] - deps: update ada to 2.5.1 (Node.js GitHub Bot) #48319
[38f6e0d8cd] - deps: update zlib to 982b036 (Node.js GitHub Bot) #48327
[f4617a4f81] - deps: add loongarch64 into openssl Makefile and gen openssl-loongarch64 (Shi Pujin) #46401
[573eb4be12] - dgram: socket add asyncDispose (atlowChemi) #48717
[f3c4300e00] - dgram: use addAbortListener (atlowChemi) #48550
[d3041df738] - doc: expand on squashing and rebasing to land a MR (Chengzhong Wu) #48751
[249879e46c] - doc: add atlowChemi to collaborators (atlowChemi) #48757
[42ecd46d1f] - doc: fix ambiguity in http.md and https.md (an5er) #48692
[e78824e053] - doc: add release key for Ulises Gascon (Ulises Gascón) #49196
[1aa798d69f] - doc: clarify transform._transform() callback argument logic (Rafael Sofi-zada) #48680
[d723e870a2] - doc: mention git node release prepare (Rafael Gonzaga) #48644
[a9a1394388] - doc: fix options order (Luigi Pinca) #48617
[989ea6858f] - doc: update security release stewards (Rafael Gonzaga) #48569
[f436ac1803] - doc: update return type for describe (Shrujal Shah) #48572
[fbe89e6320] - doc: run license-builder (github-actions[bot]) #48552
[f18b287bc3] - doc: add description of autoAllocateChunkSize in ReadableStream (Debadree Chatterjee) #48004
[e2f3ed1444] - doc: fix filename type in watch result (Dmitry Semigradsky) #48032
[1fe75dc2b0] - doc: unnest mime and MIMEParams from MIMEType constructor (Dmitry Semigradsky) #47950
[e1339d58e8] - doc: update security-release-process.md (Rafael Gonzaga) #48504
[e8dc7bde6a] - doc: add vmoroz to collaborators (Vladimir Morozov) #48527
[f8ba672c7b] - doc: link to Runtime Keys in export conditions (Jacob Hummer) #48408
[0056cb93e9] - doc: update fs flags documentation (sinkhaha) #48463
[3cf3fb9479] - doc: revise error.md introduction (Antoine du Hamel) #48423
[7575d8b90e] - doc: add preveen-stack to triagers (Preveen P) #48387
[820aa550a4] - doc: refine when file is undefined in test events (Moshe Atlow) #48451
[a30f2fbcc1] - doc: add kvakil to collaborators (Keyhan Vakil) #48449
[239b4ea66f] - doc: mark --import as experimental (Moshe Atlow) #44067
[2a561aefe2] - doc: add additional info on TSFN dispatch (Michael Dawson) #48367
[5cc6eee30d] - doc: add link for news from security wg (Michael Dawson) #48396
[ffece88452] - doc: fix typo in events.md (Darshan Sen) #48436
[06513585dc] - doc: run license-builder (github-actions[bot]) #48336
[d9a800ee5c] - esm: fix emit deprecation on legacy main resolve (Antoine du Hamel) #48664
[c39b7c240e] - (SEMVER-MINOR) esm: add --import flag (Moshe Atlow) #43942
[a00464ee06] - esm: fix specifier resolution and symlinks (Zack Newsham) #47674
[3b8ec348b0] - events: fix bug listenerCount don't compare wrapped listener (yuzheng14) #48592
[a68a67f54d] - (SEMVER-MINOR) events: allow safely adding listener to abortSignal (Chemi Atlow) #48596
[5354af3dab] - fs: call the callback with an error if writeSync fails (killa) #47949
[c3a27d1d3d] - fs: remove unneeded return statement (Luigi Pinca) #48526
[3a8586bee2] - fs, stream: initial Symbol.dispose and Symbol.asyncDispose support (Moshe Atlow) #48518
[01746c71df] - http: null the joinDuplicateHeaders property on cleanup (Luigi Pinca) #48608
[d47eb73a85] - http: remove useless ternary in test (geekreal) #48481
[977e9a38b4] - http: fix for handling on boot timers headers and request (Franciszek Koltuniuk) #48291
[be88f7cd22] - http2: use addAbortListener (atlowChemi) #48550
[7c7230a85c] - http2: send RST code 8 on AbortController signal (Devraj Mehta) #48573
[f74c2fc72a] - lib: use addAbortListener (atlowChemi) #48550
[db355d1f37] - lib: add option to force handling stopped events (Chemi Atlow) #48301
[5d682c55a5] - lib: reduce url getters on makeRequireFunction (Yagiz Nizipli) #48492
[5260f53e55] - lib: add support for inherited custom inspection methods (Antoine du Hamel) #48306
[69aaf8b1d1] - lib: remove invalid parameter to toASCII (Yagiz Nizipli) #48878
[51863b80e4] - meta: bump actions/checkout from 3.5.2 to 3.5.3 (dependabot[bot]) #48625
[7ec370991d] - meta: bump step-security/harden-runner from 2.4.0 to 2.4.1 (dependabot[bot]) #48626
[34b8e980d4] - meta: bump ossf/scorecard-action from 2.1.3 to 2.2.0 (dependabot[bot]) #48628
[dfed9a7da9] - meta: bump github/codeql-action from 2.3.6 to 2.20.1 (dependabot[bot]) #48627
[071eaadc5a] - module: add SourceMap.findOrigin (Isaac Z. Schlueter) #47790
[bf1525c549] - module: reduce url invocations in esm/load.js (Yagiz Nizipli) #48337
[f8921630a2] - net: server add asyncDispose (atlowChemi) #48717
[b5f53d9a0b] - net: fix family autoselection SSL connection handling (Paolo Insogna) #48189
[267439fc34] - net: rework autoSelectFamily implementation (Paolo Insogna) #46587
[d3637cdbbf] - net: fix address iteration with autoSelectFamily (Fedor Indutny) #48258
[e8289a83f1] - net: fix family autoselection timeout handling (Paolo Insogna) #47860
[863bdb785d] - net: add autoSelectFamily global getter and setter (Paolo Insogna) #45777
[04dc090bfa] - node-api: provide napi_define_properties fast path (Gabriel Schulhof) #48440
[feb6a54dc3] - node-api: implement external strings (Gabriel Schulhof) #48339
[121f74c463] - perf_hooks: convert maxSize to IDL value in setResourceTimingBufferSize (Chengzhong Wu) #44902
[804d880589] - permission: fix data types in PrintTree (Tobias Nießen) #48770
[7aaecce9bf] - permission: add debug log when inserting fs nodes (Rafael Gonzaga) #48677
[cb51ef2905] - readline: use addAbortListener (atlowChemi) #48550
[07065d0814] - report: disable js stack when no context is entered (Chengzhong Wu) #48495
[572b82ffef] - src: make BaseObject iteration order deterministic (Joyee Cheung) #48702
[3f65598a41] - src: remove kEagerCompile for CompileFunction (Keyhan Vakil) #48671
[f43eacac9b] - src: deduplicate X509 getter implementations (Tobias Nießen) #48563
[0c19621bdc] - src: fix uninitialized field access in AsyncHooks (Jan Olaf Krems) #48566
[0c38184d62] - src: fix Coverity issue regarding unnecessary copy (Yagiz Nizipli) #48565
[0d73009ba3] - src: refactor SplitString in util (Yagiz Nizipli) #48491
[6c72622df9] - src: handle wasm out of bound in osx will raise SIGBUS correctly (Congcong Cai) #46561
[e4261809b0] - src: replace idna functions with ada::idna (Yagiz Nizipli) #47735
[3dd82b1820] - stream: use addAbortListener (atlowChemi) #48550
[786fbdb824] - stream: fix premature pipeline end (Robert Nagy) #48435
[c224e1b255] - stream: fix deadlock when pipeing to full sink (Robert Nagy) #48691
[2c75b9ece2] - test: fix flaky test-string-decode.js on x86 (Stefan Stojanovic) #48750
[279c4f64c1] - test: mark test-http-regr-gh-2928 as flaky (Joyee Cheung) #49565
[01eacccd9a] - test: deflake test-net-throttle (Luigi Pinca) #48599
[33886b271c] - test: move test-net-throttle to parallel (Luigi Pinca) #48599
[a79112b5f4] - Revert "test: remove test-crypto-keygen flaky designation" (Luigi Pinca) #48652
[6ec57984db] - test: add missing assertions to test-runner-cli (Moshe Atlow) #48593
[dd1805e802] - test: remove test-crypto-keygen flaky designation (Luigi Pinca) #48575
[df9a9afc99] - test: remove test-timers-immediate-queue flaky designation (Luigi Pinca) #48575
[3ae96ae380] - test: make IsolateData per-isolate in cctest (Joyee Cheung) #48450
[f2ce8e0c06] - test: define NAPI_VERSION before including node_api.h (Chengzhong Wu) #48376
[13ac0a5e26] - test: remove unnecessary noop function args to mustNotCall() (Antoine du Hamel) #48513
[8fdd4c55b3] - test: skip test-runner-watch-mode on IBMi (Moshe Atlow) #48473
[9d90409241] - test: fix flaky test-watch-mode (Moshe Atlow) #48147
[27a4bc7c32] - test: add missing <algorithm> include for std::find (Sam James) #48380
[cb92c4b9fe] - test: update url web-platform tests (Yagiz Nizipli) #48319
[f35c4d3190] - test: ignore the copied entry_point.c (Luigi Pinca) #48297
[41d1e6888f] - test: refactor test-gc-http-client-timeout (Luigi Pinca) #48292
[125bca621a] - test: update encoding web-platform tests (Yagiz Nizipli) #48320
[e9ac111d02] - test: update FileAPI web-platform tests (Yagiz Nizipli) #48322
[3da57d17f5] - test: update user-timing web-platform tests (Yagiz Nizipli) #48321
[c728b8a29b] - test: fix test-net-autoselectfamily for kernel without IPv6 support (Livia Medeiros) #45856
[6de7aa1d19] - test: move test-tls-autoselectfamily-servername to test/internet (Antoine du Hamel) #47029
[2de9868292] - test: validate host with commas on url.parse (Yagiz Nizipli) #48878
[e7d2e8ef2a] - test: delete test-net-bytes-per-incoming-chunk-overhead (Michaël Zasso) #48811
[f5494fa1b0] - test_runner: fixed test shorthands return type (Shocker) #48555
[7051cafdfa] - test_runner: make --test-name-pattern recursive (Moshe Atlow) #48382
[f302286442] - test_runner: refactor coverage report output for readability (Damien Seguin) #47791
[7822a541e5] - timers: support Symbol.dispose (Moshe Atlow) #48633
[3eeca52db1] - tls: fix bugs of double TLS (rogertyang) #48969
[4826379516] - tools: run fetch_deps.py with Python 3 (Richard Lau) #48729
[e2688c8d79] - tools: update doc to unist-util-select@5.0.0 unist-util-visit@5.0.0 (Node.js GitHub Bot) #48714
[7399481096] - tools: update lint-md-dependencies to rollup@3.26.2 (Node.js GitHub Bot) #48705
[31c07153ce] - tools: update eslint to 8.44.0 (Node.js GitHub Bot) #48632
[4e53f51e24] - tools: update lint-md-dependencies to rollup@3.26.0 (Node.js GitHub Bot) #48631
[7d52950a96] - tools: update lint-md-dependencies (Node.js GitHub Bot) #48544
[e168eab3ee] - tools: update lint-md-dependencies (Node.js GitHub Bot) #48486
[9711bc24f6] - tools: replace sed with perl (Luigi Pinca) #48499
[9c1937c0a7] - tools: update eslint to 8.43.0 (Node.js GitHub Bot) #48487
[9449f05ab1] - tools: update doc to to-vfile@8.0.0 (Node.js GitHub Bot) #48485
[79dcd968b1] - tools: prepare tools/doc for to-vfile 8.0.0 (Rich Trott) #48485
[538f388ac0] - tools: update lint-md-dependencies (Node.js GitHub Bot) #48417
[01bc10dcd5] - tools: update create-or-update-pull-request-action (Richard Lau) #48398
[590a072657] - tools: update eslint-plugin-jsdoc (Richard Lau) #48393
[6a5805491e] - tools: update eslint to 8.42.0 (Node.js GitHub Bot) #48328
[2eb13e3986] - tools: disable jsdoc/no-defaults rule (Luigi Pinca) #48328
[3363cfa6c7] - typings: remove unused primordials (Yagiz Nizipli) #48509
[c59ae86ba0] - (SEMVER-MINOR) url: add value argument to has and delete methods (Sankalp Shubham) #47885
[f59c9636f4] - url: conform to origin getter spec changes (Yagiz Nizipli) #48319
[0beb5ab93d] - url: ensure getter access do not mutate observable symbols (Antoine du Hamel) #48897
[0a022c496d] - util: use primordials.ArrayPrototypeIndexOf instead of mutable method (DaisyDogs07) #48586

`v18.17.1`: 2023-08-09, Version 18.17.1 'Hydrogen' (LTS), @RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-32002: Policies can be bypassed via Module._load (High)
CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
OpenSSL Security Releases

More detailed information on each of the vulnerabilities can be found in August 2023 Security Releases blog post.

Commits

[fe3abdf82e] - deps: update archs files for openssl-3.0.10+quic1 (Node.js GitHub Bot) #49036
[2c5a522d9c] - deps: upgrade openssl sources to quictls/openssl-3.0.10+quic1 (Node.js GitHub Bot) #49036
[15bced0bde] - policy: handle Module.constructor and main.extensions bypass (RafaelGSS) nodejs-private/node-private#417
[d4570fae35] - policy: disable process.binding() when enabled (Tobias Nießen) nodejs-private/node-private#460

`v18.17.0`: 2023-07-18, Version 18.17.0 'Hydrogen' (LTS), @danielleadams

Compare Source

Notable Changes

Ada 2.0

Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url.

Contributed by Yagiz Nizipli and Daniel Lemire in #47339

Web Crypto API

Contributed by Filip Skokan in #46067

crypto:
- update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659
dns:
- (SEMVER-MINOR) expose getDefaultResultOrder (btea) #46973
doc:
- add ovflowd to collaborators (Claudio Wunder) #47844
- add KhafraDev to collaborators (Matthew Aitken) #47510
events:
- (SEMVER-MINOR) add getMaxListeners method (Matthew Aitken) #47039
fs:
- (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084
- (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) #41439
- (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084
- (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) #46933
http:
- (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732
- (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) #47723
- (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) #47405
lib:
- (SEMVER-MINOR) add webstreams to Duplex.from() (Debadree Chatterjee) #46190
- (SEMVER-MINOR) implement AbortSignal.any() (Chemi Atlow) #47821
module:
- change default resolver to not throw on unknown scheme (Gil Tayar) #47824
node-api:
- (SEMVER-MINOR) define version 9 (Chengzhong Wu) #48151
- (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) #46319
stream:
- (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) #47413
- (SEMVER-MINOR) add setter & getter for default highWaterMark (#46929) (Robert Nagy) #46929
test:
- unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #48078
test_runner:
- (SEMVER-MINOR) add shorthands to test (Chemi Atlow) #47909
- (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) #47686
- (SEMVER-MINOR) execute before hook on test (Chemi Atlow) #47586
- (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) #47238
tools:
- update LICENSE and license-builder.sh (Santiago Gimeno) #48078
url:
- (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) #47179
wasi:
- (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) #47286

Commits

[2ba08ac002] - benchmark: use cluster.isPrimary instead of cluster.isMaster (Deokjin Kim) #48002
[60ca69d96c] - benchmark: add eventtarget creation bench (Rafael Gonzaga) #47774
[d8233d96bb] - benchmark: add a benchmark for defaultResolve (Antoine du Hamel) #47543
[a1aabb6912] - benchmark: fix invalid requirementsURL (Deokjin Kim) #47378
[394c61caf9] - bootstrap: support namespaced builtins in snapshot scripts (Joyee Cheung) #47467
[0165a765a0] - bootstrap: do not expand process.argv[1] for snapshot entry points (Joyee Cheung) #47466
[cca557cdd9] - buffer: combine checking range of sourceStart in buf.copy (Deokjin Kim) #47758
[4c69be467c] - buffer: use private properties for brand checks in File (Matthew Aitken) #47154
[d002f9b6e2] - build: revert unkonwn ruff selector (Moshe Atlow) #48753
[93f77cb762] - build: set v8_enable_webassembly=false when lite mode is enabled (Cheng Shao) #48248
[1662e894f3] - build: add action to close stale MRs (Michael Dawson) #48051
[5ca437b288] - build: use pathlib for paths (Mohammed Keyvanzadeh) #47581
[72443bc54b] - build: refactor configure.py (Mohammed Keyvanzadeh) #47667
[d4eecb5be9] - build: add devcontainer configuration (Tierney Cyren) #40825
[803ed41144] - build: bump ossf/scorecard-action from 2.1.2 to 2.1.3 (dependabot[bot]) #47367
[48468c4413] - build: replace Python linter flake8 with ruff (Christian Clauss) #47519
[3ceb2c4387] - build: add node-core-utils to setup (Jiawen Geng) #47442
[fdc59b8e14] - build: bump github/codeql-action from 2.2.6 to 2.2.9 (dependabot[bot]) #47366
[3924893023] - build: update stale action from v7 to v8 (Rich Trott) #47357
[753185c5b0] - build: remove Python pip --no-user option (Christian Clauss) #47372
[67af0a6a2b] - build: avoid usage of pipes library (Mohammed Keyvanzadeh) #47271
[db910dd6b2] - build, deps, tools: avoid excessive LTO (Konstantin Demin) #47313
[35d1def891] - child_process: use signal.reason in child process abort (Debadree Chatterjee) #47817
[7692d2e7b9] - cluster: use ObjectPrototypeHasOwnProperty (Daeyeon Jeong) #48141
[7617772762] - crypto: use openssl's own memory BIOs in crypto_context.cc (GauriSpears) #47160
[8cabfe7c6e] - crypto: fix setEngine() when OPENSSL_NO_ENGINE set (Tobias Nießen) #47977
[de1338da05] - crypto: fix webcrypto private/secret import with empty usages (Filip Skokan) #47877
[27a696fda9] - crypto: update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659
[e2292f936e] - crypto: remove INT_MAX restriction in randomBytes (Tobias Nießen) #47559
[a5f214c00c] - crypto: replace THROW with CHECK for scrypt keylen (Tobias Nießen) #47407
[dd42214fd4] - crypto: unify validation of checkPrime checks (Tobias Nießen) #47165
[76e4d12fb3] - crypto: re-add padding for AES-KW wrapped JWKs (Filip Skokan) #46563
[9d894c17dd] - crypto: use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067
[6f3a8b45a5] - deps: update ada to 2.5.0 (Node.js GitHub Bot) #48223
[075b6db919] - deps: update ada to 2.4.2 (Node.js GitHub Bot) #48092
[a4ee1f652c] - deps: update ada to 2.4.1 (Node.js GitHub Bot) #48036
[81b514d3f0] - deps: update ada to 2.4.0 (Node.js GitHub Bot) #47922
[575ddf694f] - deps: update ada to 2.3.1 (Node.js GitHub Bot) #47893
[2d03d5f458] - deps: update ada to 2.3.0 (Node.js GitHub Bot) #47737
[42e690f2d5] - deps: update ada to 2.2.0 (Node.js GitHub Bot) #47678
[08dd271521] - deps: update ada to 2.1.0 (Node.js GitHub Bot) #47598
[96c50ba71f] - deps: update ada to 2.0.0 (Node.js GitHub Bot) #47339
[4d1c38b758] - deps: update zlib to 337322d (Node.js GitHub Bot) #48218
[74206b2549] - deps: update histogram 0.11.8 (Marco Ippolito) #47742
[fbb4b3775d] - deps: update histogram to 0.11.7 (Marco Ippolito) #47742
[e88c079022] - deps: update simdutf to 3.2.12 (Node.js GitHub Bot) #48118
[48bd1248b9] - deps: update minimatch to 9.0.1 (Node.js GitHub Bot) #48094
[d4572d31fa] - deps: update corepack to 0.18.0 (Node.js GitHub Bot) #48091
[8090d29dc4] - deps: update uvwasi to 0.0.18 (Node.js GitHub Bot) #47866
[169c8eea2e] - deps: update uvwasi to 0.0.17 (Node.js GitHub Bot) #47866
[6acbb23380] - deps: upgrade npm to 9.6.7 (npm team) #48062
[e8f2c0a58b] - deps: update undici to 5.22.1 (Node.js GitHub Bot) #47994
[9309fd3120] - deps: update simdutf to 3.2.9 (Node.js GitHub Bot) #47983
[b796d3560a] - deps: upgrade npm to 9.6.6 (npm team) #47862
[cce372e14e] - deps: V8: cherry-pick c5ab3e4 (Richard Lau) #47736
[7283486adb] - deps: update undici to 5.22.0 (Node.js GitHub Bot) #47679
[2ea6e03003] - deps: add minimatch as a dependency (Moshe Atlow) #47499
[261e1d23d1] - deps: update ICU to 73.1 release (Steven R. Loomis) #47456
[f532f9df5f] - deps: update undici to 5.21.2 (Node.js GitHub Bot) #47508
[dcb8c038b9] - deps: update simdutf to 3.2.8 (Node.js GitHub Bot) #47507
[6c8456d61f] - deps: update undici to 5.21.1 (Node.js GitHub Bot) #47488
[d3b2e8a438] - deps: update simdutf to 3.2.7 (Node.js GitHub Bot) #47473
[64a5fe0499] - deps: update corepack to 0.17.2 (Node.js GitHub Bot) #47474
[6f0f61a7d3] - deps: upgrade npm to 9.6.4 (npm team) #47432
[443a72e207] - deps: update zlib to upstream 5edb52d (Luigi Pinca) #47151
[dc3bc46914] - deps: update simdutf to 3.2.3 (Node.js GitHub Bot) #47331
[b2f2bebbc2] - deps: update timezone to 2023c (Node.js GitHub Bot) #47302
[c10729ffa7] - deps: upgrade npm to 9.6.3 (npm team) #47325
[420deac1de] - deps: update corepack to 0.17.1 (Node.js GitHub Bot) #47156
[966ba28491] - deps: V8: cherry-pick 3e4952c (Richard Lau) #47236
[fc6ab26824] - deps: update timezone to 2023b (Node.js GitHub Bot) #47256
[2700e70215] - deps: upgrade npm to 9.6.2 (npm team) #47108
[29ba98a0a5] - deps: V8: cherry-pick 975ff4d (Debadree Chatterjee) #47209
[be34777be8] - deps: cherry-pick win/arm64/clang fixes (Cheng Zhao) #47011
[b52aacb614] - deps: update uvwasi to v0.0.16 (Michael Dawson) #46434
[27a76cf5e0] - deps,test: update postject to 1.0.0-alpha.6 (Node.js GitHub Bot) #48072
[b171c1a3a4] - dgram: convert macro to template (Tobias Nießen) #47891
[709bf1c758] - (SEMVER-MINOR) dns: expose getDefaultResultOrder (btea) #46973
[2f202c93e7] - doc: clarify array args to Buffer.from() (Bryan English) #48274
[27f195f8d8] - doc: document watch option for node:test run() (Moshe Atlow) #48256
[7558ef350a] - doc: update documentation for FIPS support (Richard Lau) #48194
[f2bb1919e5] - doc: improve the documentation of the stdio option (Kumar Arnav) #48110
[a2aa52ba92] - doc: update Buffer.allocUnsafe description (sinkhaha) #48183
[19ad471d52] - doc: update codeowners with website team (Claudio Wunder) #48197
[67b2c2a98f] - doc: fix broken link to new folder doc/contributing/maintaining (Andrea Fassina) #48205
[795ca70815] - doc: add atlowChemi to triagers (Chemi Atlow) #48104
[e437a0aff1] - doc: fix typo in readline completer function section (Vadym) #48188
[92e0ea496d] - doc: remove broken link for keygen (Rich Trott) #48176
[fe15dae8e6] - doc: add auto intrinsic height to prevent jitter/flicker (Daniel Holbert) #48195
[230335e21f] - doc: add version info on the SEA docs (Antoine du Hamel) #48173
[e6f37d1b80] - doc: add Ruy to list of TSC members (Michael Dawson) #48172
[69205a250c] - doc: update socket.remote* properties documentation (Saba Kharanauli) #48139
[e4a5d6298c] - doc: update outdated section on TLSv1.3-PSK (Tobias Nießen) #48123
[d14018ed99] - doc: improve HMAC key recommendations (Tobias Nießen) #48121
[e9d4baf770] - doc: clarify mkdir() recursive behavior (Stephen Odogwu) #48109
[3e4a469139] - doc: fix typo in crypto legacy streams API section (Tobias Nießen) #48122
[bdf366ab88] - doc: update SEA source link (Rich Trott) #48080
[2a4f79a75f] - doc: clarify tty.isRaw (Roberto Vidal) #48055
[98c6e4be03] - doc: use secure key length for HMAC generateKey (Tobias Nießen) #48052
[8ae5c8cf9d] - doc: update broken EVP_BytesToKey link (Rich Trott) #48064
[3c713e7caa] - doc: update broken spkac link (Rich Trott) #48063
[c22f739e94] - doc: document node-api version process (Chengzhong Wu) #47972
[ce859f9f9f] - doc: fix typo in binding functions (Deokjin Kim) #48003
[070c3457b7] - doc: mark Node.js 14 as End-of-Life (Richard Lau) #48023
[3611027d8e] - doc: clarify CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED (Tobias Nießen) #47976
[dbffad958c] - doc: add missing deprecated blocks to cluster (Tobias Nießen) #47981
[035356f711] - doc: update description of global (Tobias Nießen) #47969
[081a6ffaea] - doc: update measure memory rejection information (Yash Ladha) #41639
[3460cf9c23] - doc: fix broken link to TC39 import attributes proposal (Rich Trott) #47954
[3b018c8aa9] - doc: fix broken link (Rich Trott) #47953
[244db960a9] - doc: remove broken link (Rich Trott) #47942
[2cc8715bb9] - doc: document make lint-md-clean (Matteo Collina) #47926
[b80e006c17] - doc: mark global object as legacy (Mert Can Altın) #47819
[bf4eb058f3] - doc: ntfs junction points must link to directories (Ben Noordhuis) #47907
[49875f0d69] - doc: fix params names (Dmitry Semigradsky) #47853
[94b5eaaf17] - doc: update supported version of FreeBSD to 12.4 (Michaël Zasso) #47838
[0114201825] - doc: swap Matteo with Rafael in the stewards (Rafael Gonzaga) #47841
[8bcfcc0af9] - doc: add valgrind suppression details (Kevin Eady) #47760
[75d397ecab] - doc: replace EOL versions in README (Tobias Nießen) #47833
[2b0c57cb80] - doc: add ovflowd to collaborators (Claudio Wunder) #47844
[be4966977c] - doc: update BUILDING.md previous versions links (Tobias Nießen) #47835
[a9e8a20fb8] - doc: create maintaining folder for deps (Marco Ippolito) #47589
[fd0f362d7c] - doc: remove MoLow from Triagers (Moshe Atlow) #47792
[0927c67ab6] - doc: fix typo in webstreams.md (Christian Takle) #47766
[994be578da] - doc: move BethGriggs to regular member (Rich Trott) #47776
[64d19f4678] - doc: move addaleax to TSC emeriti (Anna Henningsen) #47752
[33ec10e6b8] - doc: add link to news for Node.js core (Michael Dawson) #47704
[2a682b5efe] - doc: async_hooks asynchronous content example add mjs code (btea) #47401
[4f541c3ca3] - doc: clarify concurrency model of test runner (Tobias Nießen) #47642
[ffcff68f0d] - doc: fix typos (Mohammed Keyvanzadeh) #47685
[290b2b7afc] - doc: fix capitalization of ASan (Mohammed Keyvanzadeh) #47676
[b4ca788878] - doc: fix typos in SECURITY.md (Mohammed Keyvanzadeh) #47677
[971c545a47] - doc: update error code of buffer (Deokjin Kim) #47617
[ec5c919928] - doc: change offset of example in Buffer.copyBytesFrom (Deokjin Kim) #47606
[980bf052c7] - doc: remove markdown link from heading (Tobias Nießen) #47585
[e96451ec5e] - doc: fix release-post script location (Rafael Gonzaga) #47517
[61ea15339c] - doc: add link for news from uvwasi team (Michael Dawson) #47531
[d40bcdd73e] - doc: add missing setEncoding call in ESM example (Anna Henningsen) #47558
[924dc909b3] - doc: fix typo in util.types.isNativeError() (Julian Dax) #47532
[a24d72a6fb] - doc: add KhafraDev to collaborators (Matthew Aitken) #47510
[b0196378b6] - doc: create maintaining-brotli.md (Marco Ippolito) #47380
[3902be8fe8] - doc: info on handling unintended breaking changes (Michael Dawson) #47426
[670f9a591d] - doc: add performance initiative (Yagiz Nizipli) #47424
[89a5d04a8e] - doc: do not create a backup file (Luigi Pinca) #47151
[7f2bccc5d6] - doc: add MoLow to the TSC (Colin Ihrig) #47436
[7db2e889ac] - doc: add a note about os.cpus() returning an empty list (codedokode) #47363
[289a8e30d6] - doc: clarify reports are only evaluated on active versions (Rafael Gonzaga) #47341
[dc22edb4d2] - doc: remove Vladimir de Turckheim from Security release stewards (Vladimir de Turckheim) #47318
[3e74a74da3] - doc: add importing util to example of `process.report.getReport' (Deokjin Kim) #47298
[ece029f64e] - doc: vm.SourceTextModule() without context option (Axel Kittenberger) #47295
[c7227204cc] - doc: document process for sharing project news (Michael Dawson) #47189
[2865cbb4bd] - doc: revise example of assert.CallTracker (Deokjin Kim) #47252
[81ebaf2670] - doc: fix typo in SECURITY.md (Rich Trott) #47282
[faabd48f11] - doc: use serial comma in cli docs (Tobias Nießen) #47262
[3a85794089] - doc: improve example for Error.captureStackTrace() (Julian Dax) #46886
[2114fa472b] - doc: clarify http error events after calling destroy() (Zach Bjornson) #46903
[d15f522d1f] - doc: update output of example in AbortController (Deokjin Kim) #47227
[ab6588e343] - doc: drop one-week branch sync on major releases (Rafael Gonzaga) #47149
[6ac52e3061] - doc: fix grammar in the collaborator guide (Mohammed Keyvanzadeh) #47245
[13175774a6] - doc: update stream.reduce concurrency note (Raz Luvaton) #47166
[1e97ccd6d4] - doc: remove use of DEFAULT_ENCODING in PBKDF2 docs (Tobias Nießen) #47181
[d562a7c461] - doc: fix typos in async_context.md (Shubham Sharma) #47155
[9a11788cdf] - doc: update collaborator guide to reflect TSC changes (Rich Trott) #47126
[5fc2bb763f] - doc: clarify that fs.create{Read,Write}Stream support AbortSignal (Antoine du Hamel) #47122
[2dd3b0213e] - doc: improve documentation for util.types.isNativeError() (Julian Dax) #46840
[ce4636e36b] - doc: rename the startup performance initiative to startup snapshot (#47111) (Joyee Cheung)
[309d017f15] - doc: fix "maintaining dependencies" heading typos (Keyhan Vakil) #47082
[230a984eb3] - doc: include webstreams in finished() and Duplex.from() parameters (Debadree Chatterjee) #46312
[8651ea822e] - doc,fs: update description of fs.stat() method (Mert Can Altın) #47654
[e4539e1f19] - doc,test: update the v8.startupSnapshot doc and test the example (Joyee Cheung) #47468
[3dddc0175f] - doc,test: fix concurrency option of test() (Tobias Nießen) #47734
[563f9fe06a] - doc,vm: clarify usage of cachedData in vm.compileFunction() (Darshan Sen) #48193
[316016ffac] - esm: avoid accessing lazy getters for urls (Yagiz Nizipli) #47542
[e5e385d2b2] - esm: increase test coverage of edge cases (Antoine du Hamel) #47033
[061fb20660] - (SEMVER-MINOR) events: add getMaxListeners method (Matthew Aitken) #47039
[ed0b62cc01] - (SEMVER-MINOR) fs: add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084
[9b44c56c9a] - fs: make readdir recursive algorithm iterative (Ethan Arrowood) #47650
[7273ef53b3] - (SEMVER-MINOR) fs: add recursive option to readdir and opendir (Ethan Arrowood) #41439
[3f0636d2c1] - (SEMVER-MINOR) fs: add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084
[a0b9853251] - (SEMVER-MINOR) fs: implement byob mode for readableWebStream() (Debadree Chatterjee) #46933
[709e368708] - http: send implicit headers on HEAD with no body (Matteo Collina) #48108
[dc318f26c0] - (SEMVER-MINOR) http: prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732
[4b2a015642] - (SEMVER-MINOR) http: remove internal error in assignSocket (Matteo Collina) #47723
[7cef6aa721] - (SEMVER-MINOR) http: add highWaterMark opt in http.createServer (HinataKah0) #47405
[9186f3a0ef] - http2: improve nghttp2 error callback (Tobias Nießen) #47840
[cc7e5dd4cd] - inspector: add tips for Session (theanarkh) #47195
[70c0e882d3] - inspector: log response and requests in the inspector for debugging (Joyee Cheung) #46941
[6099d2d08b] - inspector: fix session.disconnect crash (theanarkh) #46942
[156292d44a] - lib: create weakRef only if any signals provided (Chemi Atlow) #48448
[efaa073303] - (SEMVER-MINOR) lib: implement AbortSignal.any() (Chemi Atlow) #47821
[c46b31f3bf] - lib: support FORCE_COLOR for non TTY streams (Moshe Atlow) #48034
[286c358832] - lib: do not disable linter for entire files (Antoine du Hamel) #48299
[a2552ab7c0] - lib: use existing isWindows variable (sinkhaha) #48134
[2b65625281] - lib: update comment (sinkhaha) #47884
[fa447b5120] - lib: use webidl DOMString converter in EventTarget (Matthew Aitken) #47514
[33f32dc318] - lib: define Event.isTrusted in the prototype (Santiago Gimeno) #46974
[50789a5e4a] - lib: refactor to use validateBuffer (Deokjin Kim) #46489
[3658abea26] - (SEMVER-MINOR) lib: add webstreams to Duplex.from() (Debadree Chatterjee) #46190
[fcf3781d22] - lib,src,test: lint codebase according new rules for v18.x (Juan José Arboleda) #48697
[b55dc53422] - meta: bump github/codeql-action from 2.3.3 to 2.3.6 (dependabot[bot]) #48287
[8ac4579d85] - meta: bump actions/setup-python from 4.6.0 to 4.6.1 (dependabot[bot]) #48286
[b1854fe9c1] - meta: bump codecov/codecov-action from 3.1.3 to 3.1.4 (dependabot[bot]) #48285
[d9448b8d93] - meta: remove dont-land-on-v14 auto labeling (Shrujal Shah) #48031
[bb859768b6] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #48010
[af90fb939b] - meta: bump step-security/harden-runner from 2.3.1 to 2.4.0 (Rich Trott) #47980
[4dcf5e2052] - meta: bump github/codeql-action from 2.3.2 to 2.3.3 (Rich Trott) #47979
[dab3186ea2] - meta: bump actions/setup-python from 4.5.0 to 4.6.0 (Rich Trott) #47968
[546224c13c] - meta: add security-wg ping to permission.js (Rafael Gonzaga) #47941
[353dfbd2d6] - meta: bump step-security/harden-runner from 2.2.1 to 2.3.1 (dependabot[bot]) #47808
[20a5cc27ec] - meta: bump actions/setup-python from 4.5.0 to 4.6.0 (dependabot[bot]) #47806
[eef6442d8d] - meta: bump actions/checkout from 3.3.0 to 3.5.2 (dependabot[bot]) #47805
[e30e6a718a] - meta: remove extra space in scorecard workflow (Mestery) #47805
[2d13cdebc4] - meta: bump github/codeql-action from 2.2.9 to 2.3.2 (dependabot[bot]) #47809
[f0d8352ed8] - meta: bump codecov/codecov-action from 3.1.1 to 3.1.3 (dependabot[bot]) #47807
[7e95fba0ff] - meta: fix dependabot commit message (Mestery) #47810
[d31d9c7c28] - meta: ping nodejs/startup for startup test changes (Joyee Cheung) #47771
[077686055b] - meta: add mailmap entry for KhafraDev (Rich Trott) #47512
[e50eb6570a] - meta: ping security-wg team on permission model changes (Rafael Gonzaga) #47483
[2df1a36214] - meta: ping startup and realm team on src/node_realm* changes (Joyee Cheung) #47448
[c7dc6e321b] - meta: fix notable-change comment label url (Filip Skokan) #47300
[e859ca44d5] - meta: clarify the threat model to explain the JSON.parse case (Matteo Collina) #47276
[1f08f4848d] - meta: update link to collaborators discussion page (Michaël Zasso) #47211
[3b524cbf86] - meta: automate description requests when notable change label is added (Danielle Adams) #47078
[da16ca7c59] - meta: move TSC voting member(s) to regular member(s) (Node.js GitHub Bot) #47180
[0c80e60d7e] - meta: move TSC voting member to regular membership (Node.js GitHub Bot) #46985
[0edcfed895] - meta: update GOVERNANCE.md to reflect TSC charter changes (Rich Trott) #47126
[baada5d035] - meta: ask expected behavior reason in bug template (Ben Noordhuis) #47049
[5d75ec402e] - module: reduce the number of URL initializations (Yagiz Nizipli) #48272
[c5af5a4f4f] - module: change default resolver to not throw on unknown scheme (Gil Tayar) #47824
[cf8845d001] - module: block requiring test/reporters without scheme (Moshe Atlow) #47831
[ce7e6c6765] - (SEMVER-MINOR) node-api: define version 9 (Chengzhong Wu) #48151
[53c02b20b8] - node-api: add status napi_cannot_run_js (Gabriel Schulhof) #47986
[4b280d5361] - node-api: napi_ref on all types is experimental (Vladimir Morozov) #47975
[e2553b12e7] - (NODE-API-SEMVER-MAJOR) node-api: get Node API version used by addon (Vladimir Morozov) #45715
[beaad7f692] - node-api: test passing NULL to napi_define_class (Gabriel Schulhof) #47567
[6ab892780c] - node-api: test passing NULL to number APIs (Gabriel Schulhof) #47549
[a67e5ea89c] - node-api: remove unused mark_arraybuffer_as_untransferable (Chengzhong Wu) #47557
[7019d48ba1] - (SEMVER-MINOR) node-api: deprecate napi_module_register (Vladimir Morozov) #46319
[395c56bd7c] - node-api: extend type-tagging to externals (Gabriel Schulhof) #47141
[6e66371eee] - node-api: document node-api shutdown finalization (Chengzhong Wu) #45903
[d8d2d33efb] - node-api: verify cleanup hooks order (Chengzhong Wu) #46692
[b34eaf393e] - path: indicate index of wrong resolve() parameter (sosoba) #47660
[13bc5488a1] - permission: remove unused function declaration (Deokjin Kim) #47957
[5f8aef477e] - quic: address recent coverity warning (Michael Dawson) #47753
[75d7024ecd] - quic: add more QUIC implementation (James M Snell) #47494
[24840832bd] - quic: add more QUIC impl (James M Snell) #47348
[114b8479b4] - readline: fix issue with newline-less last line (Ian Harris) #47317
[e668efac6b] - repl: preserve preview on ESCAPE key press (Xuguang Mei) #46878
[7306b0f733] - sea: fix memory leak detected by asan (Darshan Sen) #47309
[1f2c91f98a] - src: use std::array for passing argv in node::url (Anna Henningsen) #47035
[36bf06904f] - src: add Realm document in the src README.md (Chengzhong Wu) #47932
[5445835671] - src: check node_extra_ca_certs after openssl cfg (Raghu Saxena) #48159
[eb96856555] - src: include missing header in node_sea.h (Joyee Cheung) #48152
[2a35462045] - src: deduplicate X509Certificate::Fingerprint* (Tobias Nießen) #47978
[4c556816bd] - src: move BlobSerializerDeserializer to a separate header file (Darshan Sen) #47933
[4bad757012] - src: rename SKIP_CHECK_SIZE to SKIP_CHECK_STRLEN (Tobias Nießen) #47845
[33daa89dac] - src: register ext reference for Fingerprint512 (Tobias Nießen) #47892
[30b7133008] - src: clarify the parameter name in Permission::Apply (Daeyeon Jeong) #47874
[274c0f2e0a] - src: avoid strcmp() with Utf8Value (Tobias Nießen) #47827
[559c98f468] - src: prefer data accessor of string and vector (Mohammed Keyvanzadeh) #47750
[933673de61] - src: avoid copying string in fs_permission (Yagiz Nizipli) #47746
[77f2b97197] - src: fix typo in comment in quic/sessionticket.cc (Tobias Nießen) #47754
[8e6af9fcf4] - src: mark fatal error functions as noreturn (Chengzhong Wu) #47695
[d0ad873b0e] - src: prevent changing FunctionTemplateInfo after publish (Shelley Vohr) #46979
[71fb476781] - src: use v8::Boolean(b) over b ? True() : False() (Tobias Nießen) #47554
[175b78bc02] - src: fix typo in process.env accessor error message (Moritz Raho) #47014
[2c2b6d1661] - src: replace static const string_view by static constexpr (Daniel Lemire) #47524
[3840bb586e] - src: fix CSMRNG when length exceeds INT_MAX (Tobias Nießen) #47515
[f6aa38dc5f] - src: use correct variable in node_builtins.cc (Michaël Zasso) #47343
[e88e249838] - src: slim down stream_base-inl.h (lilsweetcaligula) #46972
[b34de64442] - src: allow simdutf::convert_* functions to return zero (Daniel Lemire) #47471
[ded4a5eb8f] - src: remove usage of std::shared_ptr<T>::unique() (Darshan Sen) #47315
[0fbfb28cf5] - src: use stricter compile-time guidance (Tobias Nießen) #46509
[a8430ad211] - src: remove unused variable in crypto_x509.cc (Michaël Zasso) #47344
[24dabf8965] - src: don't reset embeder signal handlers (Dmitry Vyukov) #47188
[4add36872c] - src: replace impossible THROW with CHECK (Tobias Nießen) #47168
[e1007ff6a8] - src: remove dead comments about return_code_cache (Keyhan Vakil) #47083
[5501d12713] - src: remove SSL_CTX_get_tlsext_ticket_keys guards (Tobias Nießen) #47068
[716d289874] - src: fix clang 14 linker error (Keyhan Vakil) #47057
[8809adfdb6] - src: clarify OptionEnvvarSettings member names (Chengzhong Wu) #45057
[05f5c79574] - src: per-realm binding data (Chengzhong Wu) #46556
[a7620d19c8] - src,http2: ensure cleanup if a frame is not sent (ywave620) #47244
[585d62848e] - stream: deprecate asIndexedPairs (Chemi Atlow) #48102
[d3449ca010] - stream: prevent pipeline hang with generator functions (Debadree Chatterjee) #47712
[5e4b2434a6] - (SEMVER-MINOR) stream: preserve object mode in compose (Raz Luvaton) #47413
[912eb308ab] - (SEMVER-MINOR) stream: add setter & getter for default highWaterMark (#46929) (Robert Nagy) #46929
[c59887744a] - stream: expose stream symbols (Robert Nagy) #45671
[4edc1abf0b] - stream: dont wait for next item in take when finished (Raz Luvaton) #47132
[cfb18d816d] - stream: remove brandchecks from stream duplexify (Debadree Chatterjee) #46315
[9d4025c411] - test: mark test-child-process-pipe-dataflow as flaky (Moshe Atlow) #48334
[c29b6874d4] - test: unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #48078
[0e3312b01b] - test: fix zlib version regex (Luigi Pinca) #48227
[a9d0b8d005] - test: use lower security level in s_client (Luigi Pinca) #48192
[7250d8c2f1] - Revert "test: unskip negative-settimeout.any.js WPT" (Filip Skokan) #48182
[18476697bd] - test: mark test_cannot_run_js as flaky (Keyhan Vakil) #48181
[446f6118ff] - test: fix flaky test-runner-watch-mode (Moshe Atlow) #48144
[7fa144e3fe] - test: skip test-http-pipeline-flood on IBM i (Abdirahim Musse) #48048
[5c5b1d2867] - test: ignore helper files in WPTs (Filip Skokan) #48079
[3b2cee071b] - test: move test-cluster-primary-error flaky test (Yagiz Nizipli) #48039
[7b816b4922] - test: fix suite signal (Benjamin Gruenbaum) #47800
[ca4a0e3717] - test: fix parsing test flags (Daeyeon Jeong) #48012
[a3f0504556] - test: mark test-esm-loader-http-imports as flaky (Tobias Nießen) #47987
[ab36a30143] - test: unskip negative-settimeout.any.js WPT (Filip Skokan) #47946
[7c80439b21] - test: use appropriate usages for a negative import test (Filip Skokan) #47878
[81d8d95ba0] - test: fix webcrypto wrap unwrap tests (Filip Skokan) #47876
[1b84e85576] - test: fix output tests when path includes node version (Moshe Atlow) #47843
[95972aac8d] - test: migrate a pseudo_tty test to use assertSnapshot (Moshe Atlow) #47803
[f1e131283d] - test: fix WPT state when process exits but workers are still running (Filip Skokan) #47826
[03dcf7bc94] - test: migrate message tests to use assertSnapshot (Moshe Atlow) #47498
[dedbeee336] - test: refactor to use getEventListeners in timers (Deokjin Kim) #47759
[11a2d1c4e4] - test: add and use tmpdir.hasEnoughSpace() (Tobias Nießen) #47767
[d669714e57] - test: remove spaces from test runner test names (Tobias Nießen) #47733
[3a9c43a6d7] - test: mark test-cluster-primary-error flaky on asan (Yagiz Nizipli) #47422
[bd1eb14cb0] - test: remove unnecessary status check on test-release-npm (RafaelGSS) #47516
[914f68d953] - test: mark test/parallel/test-file-write-stream4 as flaky (Yagiz Nizipli) #47423
[7c4178cb11] - test: remove unused callback variables (angellovc) #47167
[d0bda902dc] - test: migrate test runner message tests to snapshot (Moshe Atlow) #47392
[095ca5ccf2] - test: remove stale entry from known_issues.status (Richard Lau) #47454
[8820d5415b] - test: move more inspector sequential tests to parallel (Joyee Cheung) #47412
[f6ef5c4ad3] - test: use random port in test-inspector-enabled (Joyee Cheung) #47412
[e97ceeca69] - test: use random port in test-inspector-debug-brk-flag (Joyee Cheung) #47412
[a2e4643981] - test: use random port in NodeInstance.startViaSignal() (Joyee Cheung) #47412
[a779261732] - test: fix flaky test-watch-mode-inspect (Moshe Atlow) #47403
[116df2ad3e] - test: move debugger tests with --port=0 to parallel (Joyee Cheung) #47274
[016b8bd27d] - test: use --port=0 in debugger tests that do not have to work on 9229 (Joyee Cheung) #47274
[3c157cb7a3] - test: run doctool tests in parallel (Joyee Cheung) #47273
[44f08ed941] - test: move test-shadow-realm-gc.js to known_issues (Joyee Cheung) #47355
[e2b5d968c3] - test: update wasm/jsapi WPT (Michaël Zasso) #47210
[53d9eb5950] - test: skip test-wasm-web-api on ARM (Michaël Zasso) #47299
[b620f5fcd6] - test: skip instantiateStreaming-bad-imports WPT (Michaël Zasso) #47292
[1e6fe56333] - test: fix test-child-process-exec-cwd (Stefan Stojanovic) #47235
[0dc4971aab] - test: skip broken tests win arm64 (Stefan Stojanovic) #47020
[6fee6050e3] - test: fix 'checks' validation test for checkPrime (Tobias Nießen) #47139
[6b85472f01] - test: update URL web-platform-tests (Yagiz Nizipli) #47135
[732a98e1ba] - test: reduce flakiness of test-http-remove-header-stays-removed.js (Debadree Chatterjee) #46855
[713b412ee9] - test: mark test-http-max-sockets as flaky on win32 (Tobias Nießen) #47134
[b3b7dbc395] - test: update web-platform tests for url (Xuguang Mei) #46860
[2edd0fdb5b] - test: mark test-child-process-stdio-reuse-readable-stdio flaky (Luigi Pinca) #48537
[fae240e492] - test: mark test-child-process-pipe-dataflow as flaky (Moshe Atlow) #48334
[9ca3cc0f2a] - test: remove useless require('../common') from WPTs (Filip Skokan) #46796
[4bece055a5] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #47921
[7ef169b706] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #47222
[873606b355] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #47131
[8f1fc0bc99] - test,doc,sea: run SEA tests on ppc64 (Darshan Sen) #48111
[5d910ca389] - test_runner: add enqueue and dequeue events (Moshe Atlow) #48428
[d795c0ab0c] - test_runner: dont split lines on test:stdout (Moshe Atlow) #48057
[04eb1f85da] - test_runner: pass FORCE_COLOR to child process (Moshe Atlow) #48057
[2262653148] - test_runner: apply runOnly on suites (Moshe Atlow) #48279
[033d0bb3e1] - test_runner: emit test:watch:drained event (Moshe Atlow) #48259
[618a9e1c09] - test_runner: stop watch mode when abortSignal aborted (Moshe Atlow) #48259
[6a82fbd006] - test_runner: fix global after hook (Moshe Atlow) #48231
[d1295d7b10] - test_runner: remove redundant check from coverage (Colin Ihrig) #48070
[47602fe73b] - test_runner: fix test deserialize edge cases (Moshe Atlow) #48106
[b18a78cd0b] - test_runner: delegate stderr and stdout formatting to reporter (Shiba) #48045
[e0d0b19c30] - test_runner: display dot report as wide as the terminal width (Raz Luvaton) #48038
[bdca468a79] - test_runner: use v8.serialize instead of TAP (Moshe Atlow) #47867
[866ed6a887] - (SEMVER-MINOR) test_runner: add shorthands to test (Chemi Atlow) #47909
[4737314865] - test_runner: fix ordering of test hooks (Phil Nash) #47931
[ea543d95f6] - test_runner: omit inaccessible files from coverage (Colin Ihrig) #47850
[8398bca842] - test_runner: fix --require with --experimental-loader (Moshe Atlow) #47751
[4c0036ba1b] - (SEMVER-MINOR) test_runner: support combining coverage reports (Colin Ihrig) #47686
[cb3abda9aa] - test_runner: remove no-op validation (Colin Ihrig) #47687
[323881f60b] - test_runner: fix test runner concurrency (Moshe Atlow) #47675
[3bbb1fc990] - test_runner: fix test counting (Moshe Atlow) #47675
[0ea63717ba] - test_runner: fix nested hooks (Moshe Atlow) #47648
[fa18b17d88] - test_runner: add testNamePatterns to run api (atlowChemi) #47648
[2033691bfc] - test_runner: support coverage of unnamed functions (Colin Ihrig) #47652
[882c6127ae] - test_runner: move coverage collection to root.postRun() (Colin Ihrig) #47651
[e97eefa538] - (SEMVER-MINOR) test_runner: execute before hook on test (Chemi Atlow) #47586
[4bce39108c] - test_runner: avoid reporting parents of failing tests in summary (Moshe Atlow) #47579
[688078b93a] - test_runner: fix spec skip detection (Moshe Atlow) #47537
[0b32a8c8a3] - test_runner: color errors only when colors are available (Moshe Atlow) #47394
[d5fc8236bf] - test_runner: hide failing tests title when all tests pass (Moshe Atlow) #47370
[1d453e4d31] - test_runner: stringify AssertError expected and actual (Moshe Atlow) #47088
[99312a55f2] - test_runner: add code coverage support to spec reporter (Pulkit Gupta) #46674
[2091b4718f] - (SEMVER-MINOR) test_runner: expose reporter for use in run api (Chemi Atlow) #47238
[9cbf89717e] - test_runner: report failing tests after summary (HinataKah0) #47164
[460bcc042e] - test_runner: count nested tests (Moshe Atlow) #47094
[c62e6b2e54] - test_runner: accept \x1b as a escape symbol (Debadree Chatterjee) #47050
[ddf819f810] - test_runner: support defining test reporter in NODE_OPTIONS (Steve Herzog) #46688
[e049ce296a] - tls: reapply servername on happy eyeballs connect (Fedor Indutny) #48255
[19b0f244b2] - tls: accept SecureContext object in server.addContext() (HinataKah0) #47570
[7786d7cece] - tools: pin ruff version number (Rich Trott) #48505
[a2bfe02289] - tools: remove non-existing file from CODEOWNERS file (Juan José Arboleda) #48697
[87562c9af0] - tools: update rollup lint-md-dependencies (Node.js GitHub Bot) #48329
[1cde4a4299] - Revert "tools: open issue when update workflow fails" (Marco Ippolito) #48312
[361cf8cffc] - tools: don't gitignore base64 config.h (Ben Noordhuis) #48174
[0cfdb3affa] - tools: update LICENSE and license-builder.sh (Santiago Gimeno) #48078
[715cf81b4a] - tools: automate histogram update (Marco Ippolito) #48171
[d9afffab03] - tools: use shasum instead of sha256sum (Luigi Pinca) #48229
[1a5cddfc1f] - tools: harmonize dep_updaters scripts (Antoine du Hamel) #48201
[24abe07dda] - tools: log and verify sha256sum (Andrea Fassina) #48088
[9aed8683aa] - tools: open issue when update workflow fails (Marco Ippolito) #48018
[4c5c63fd82] - tools: alphabetize CODEOWNERS (Rich Trott) #48124
[9b849a7270] - tools: use latest upstream commit for zlib updates (Andrea Fassina) #48054
[e18c1258ae] - tools: add security-wg as dep updaters owner (Marco Ippolito) #48113
[999a289dd9] - tools: fix race condition when npm installing (Tobias Nießen) #48101
[25b0033b86] - tools: refloat 7 Node.js patches to cpplint.py (Rich Trott) #48098
[87b36b3a8a] - tools: update cpplint to 1.6.1 (Yagiz Nizipli) #48098
[64ff6fe443] - tools: update eslint to 8.41.0 (Node.js GitHub Bot) #48097
[739c314851] - tools: update lint-md-dependencies (Node.js GitHub Bot) #48096
[6674ed1901] - tools: update doc to remark-parse@10.0.2 (Node.js GitHub Bot) #48095
[0b0818caab] - tools: add debug logs (Marco Ippolito) #48060
[168d080f40] - tools: fix zconf.h path (Luigi Pinca) #48089
[ccd2795f42] - tools: update remark-preset-lint-node to 4.0.0 (Node.js GitHub Bot) #47995
[89e068a550] - tools: debug log for nghttp3 (Marco Ippolito) #47992
[3bf2bd4ec6] - tools: automate icu-small update (Marco Ippolito) #47727
[fdf9681dc0] - tools: update lint-md-dependencies to rollup@3.21.5 (Node.js GitHub Bot) #47903
[52532c2cb1] - tools: update eslint to 8.40.0 (Node.js GitHub Bot) #47906
[951cc7b624] - tools: update eslint to 8.39.0 (Node.js GitHub Bot) #47789
[706c87db50] - tools: fix jsdoc lint (Moshe Atlow) #47789
[8eef5f5f5f] - tools: update doc to highlight.js@11.8.0 (Node.js GitHub Bot) #47786
[899eea6237] - tools: update lint-md-dependencies to rollup@3.21.1 (Node.js GitHub Bot) #47787
[8ca50b6ac9] - tools: move update-npm to dep updaters (Marco Ippolito) #47619
[5ee554397d] - tools: fix update-v8-patch cache (Marco Ippolito) #47725
[4e0d19e1bd] - tools: automate v8 patch update (Marco Ippolito) #47594
[64c3154bdf] - tools: fix skip message in update-cjs-module-lexer (Tobias Nießen) #47701
[6535ab90d9] - tools: update lint-md-dependencies to @rollup/plugin-commonjs @24.1.0 (Node.js GitHub Bot) #47577
[7cfc00d072] - tools: keep MR titles/description up-to-date (Tobias Nießen) #47621
[d6b555e2c8] - tools: fix updating root certificates (Richard Lau) #47607
[0d3e3ddea6] - tools: update MR label config (Mohammed Keyvanzadeh) #47593
[fa52c472b8] - tools: add execution permission to uvwasi script (Mert Can Altın) #47600
[f6955a6b0c] - tools: add update script for googletest (Tobias Nießen) #47482
[4e1d87e752] - tools: add option to run workflow with specific tool id (Michaël Zasso) #47591
[e605402590] - tools: automate zlib update (Marco Ippolito) #47417
[b6ca57e8d0] - tools: add url and whatwg-url labels automatically (Yagiz Nizipli) #47545
[d5c9bc4f8e] - tools: add performance label to benchmark changes (Yagiz Nizipli) #47545
[c5227628a9] - tools: automate uvwasi dependency update (Ranieri Innocenti Spada) #47509
[5ffdb57302] - tools: add missing pinned dependencies (Mateo Nunez) #47346
[c7b898d4e4] - tools: automate ngtcp2 and nghttp3 update (Marco Ippolito) #47402
[e696a48225] - tools: move update-undici.sh to dep_updaters and create maintain md (Marco Ippolito) #47380
[056067286a] - tools: make js2c.py usable for other build systems (Cheng Zhao) #46930
[d11c6ba2eb] - tools: move update-acorn.sh to dep_updaters and create maintaining md (Marco Ippolito) #47382
[0a65c7c300] - tools: update eslint to 8.38.0 (Node.js GitHub Bot) #47475
[60dc249cd5] - tools: update eslint to 8.38.0 (Node.js GitHub Bot) #47475
[1271b0eded] - tools: automate cjs-module-lexer dependency update (Marco Ippolito) #47446
[26905572d4] - tools: fix notify-on-push Slack messages (Antoine du Hamel) #47453
[3c62663797] - tools: update lint-md-dependencies to @rollup/plugin-node-resolve @15.0.2 (Node.js GitHub Bot) #47431
[c57dabe360] - tools: add root certificate update script (Richard Lau) #47425
[f27680e37c] - tools: fix update-openssl.yml compare version (Marco Ippolito) #47384
[35e6cf2944] - tools: use ref_name to get branch pushed on (Debadree Chatterjee) #47358
[28935a86f8] - tools: add a at here tag for slack messages (Debadree Chatterjee) #47358
[e1846ee4f1] - tools: disable Codecov commit statuses (Michaël Zasso) #47306
[d1c8229da4] - tools: update eslint to 8.37.0 (Node.js GitHub Bot) #47333
[6ab22151c4] - tools: fix duration_ms to be milliseconds (Moshe Atlow) #44490
[5d46c594a7] - tools: automate brotli update (Marco Ippolito) #47205
[d324c15227] - tools: fix typo in nghttp2 path (Marco Ippolito) #47330
[b1bcdceef5] - tools: add scorecard workflow (Mateo Nunez) #47254
[281362bcc2] - tools: pin actions by hash for auto-start-ci.yml (Gabriela Gutierrez) #46820
[6cae1bd377] - tools: standardize base64 update (Marco Ippolito) #47201
[a682bd0714] - tools: update codecov branch (Rich Trott) #47285
[1061e17c66] - tools: standardize update-llhttp.sh (Marco Ippolito) #47198
[9781185943] - tools: upgrade Windows digital signature to SHA256 (Tobias Nießen) #47206
[37638e43c5] - tools: add button to copy code example to clipboard (jakecastelli) #46928
[05cb503f02] - tools: standardize update-nghttp2.sh (Marco Ippolito) #47197
[816e215701] - tools: fix Slack notification action (Antoine du Hamel) #47237
[9ac01ecc59] - tools: notify on Slack when invalid commit lands (Antoine du Hamel) #47178
[13eb029b4f] - tools: update daily wpt actions summary (Filip Skokan) #47138
[e0a00ebfc5] - tools: allow test tap output to include unicode characters (Moshe Atlow) #47175
[fca3391d0b] - tools: update lint-md-dependencies to rollup@3.19.1 (Node.js GitHub Bot) #47045
[c0fd6a3721] - tools: update eslint to 8.36.0 (Node.js GitHub Bot) #47046
[7d971daf29] - tools,meta: update README and tools to reflect changes in TSC charter (Rich Trott) #47126
[d078d66bdc] - typings: fix syntax error in tsconfig (Mohammed Keyvanzadeh) #47584
[889730512c] - url: handle URL.canParse without base parameter (Yagiz Nizipli) #47547
[0dc485eb28] - url: drop ICU requirement for parsing hostnames (Yagiz Nizipli) #47339
[b395b16c40] - url: use ada::url_aggregator for parsing urls (Yagiz Nizipli) #47339
[11f48e02a8] - (SEMVER-MINOR) url: implement URL.canParse (Matthew Aitken) #47179
[977a8bad35] - url: fix array overrun in node:url::SetArgs() (Yagiz Nizipli) #47001
[4784e64850] - url: allow extension of user provided URL objects (Antoine du Hamel) #46989
[f495cb6bf4] - url: backport non-major changes from #46904 (Yagiz Nizipli) #46904
[aa4f485388] - url: set formatUrl method as no side effect (Yagiz Nizipli) #46884
[c79e1b72f2] - url: offload URLSearchParams initialization (Yagiz Nizipli) #46867
[3db235b822] - url: remove unused kFormat from url (Yagiz Nizipli) #46867
[b9df1a9668] - url: clean vertical alignment of docs (Robin Ury) #48037
[9a2354d4a9] - url: do not use object as hashmap (Timothy Gu) #47415
[4850ba4bd4] - url: improve URLSearchParams creation performance (Yagiz Nizipli) #47190
[7fb1980fd9] - url: add pending-deprecation to url.parse() (Yagiz Nizipli) #47203
[b04ea5aa9b] - url: allow extension of user provided URL objects (Antoine du Hamel) #46989
[972c851918] - url: remove unnecessary call to FunctionPrototypeBind (Antoine du Hamel) #46870
[87ef1b2859] - util: fix inspecting error with a throwing getter for cause (Antoine du Hamel) #47163
[4729d30c1e] - v8: fix ERR_NOT_BUILDING_SNAPSHOT is not a constructor (Chengzhong Wu) #47721
[d9a68b821e] - vm: properly handle defining symbol props (Nicolas DUBIEN) #47572
[0d0fad8f0a] - vm: fix crash when setting __proto__ on context's globalThis (Feng Yu) #47939
[fb90b6b3fb] - vm: properly handle defining props on any value (Nicolas DUBIEN) #46615
[4b2aa3d27c] - vm,lib: refactor microtaskQueue assignment logic (Khaidi Chu) #47765
[58afcc27f6] - (SEMVER-MINOR) wasi: no longer require flag to enable wasi (Michael Dawson) #47286
[407af51cf5] - wasi: add wasi sock_accept stub (Michael Dawson) #46434
[d3e0229948] - watch: fix watch path with equals (Moshe Atlow) #47369
[78972d4696] - worker: support more cases when (de)serializing errors (Moshe Atlow) #47925

`v18.16.1`: 2023-06-20, Version 18.16.1 'Hydrogen' (LTS), @RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
OpenSSL Security Releases
c-ares vulnerabilities:

More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.

Commits

[bf3e2c8928] - crypto: handle cert with invalid SPKI gracefully (Tobias Nießen) nodejs-private/node-private#393
[70f9449072] - deps: set CARES_RANDOM_FILE for c-ares (Richard Lau) #48156
[35d4efb57b] - deps: update c-ares to 1.19.1 (RafaelGSS) #48115
[392dfedc77] - deps: update archs files for openssl-3.0.9-quic1 (Node.js GitHub Bot) #48402
[46cd5fe38b] - deps: upgrade openssl sources to quictls/openssl-3.0.9-quic1 (Node.js GitHub Bot) #48402
[7e3d2d85c2] - doc,test: clarify behavior of DH generateKeys (Tobias Nießen) nodejs-private/node-private#426
[4ff6ba050a] - http: disable request smuggling via rempty headers (Paolo Insogna) nodejs-private/node-private#428
[ab269129a6] - msi: do not create AppData\Roaming\npm (Tobias Nießen) nodejs-private/node-private#408
[925e8f5619] - policy: handle mainModule.__proto__ bypass (RafaelGSS) nodejs-private/node-private#416
[d6fae8e47e] - test: allow SIGBUS in signal-handler abort test (Michaël Zasso) #47851

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about these updates again.

If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Edited 1 year ago by Renovate Bot

Merge request reports

Assignee

0 Reviewers

Request review from

Labels

None

Select labels

Manage project labels

Milestone

None

Time tracking

Participants

Admin message

chore(deps): update node.js to v20

Release Notes

v20.8.0: 2023-09-28, Version 20.8.0 (Current), @​ruyadorno

Notable Changes

Stream performance improvements

Rework of memory management in vm APIs with the importModuleDynamically option

Other notable changes

Commits

v20.7.0: 2023-09-18, Version 20.7.0 (Current), @​UlisesGascon

Notable Changes

Commits

v20.6.1: 2023-09-08, Version 20.6.1 (Current), @​ruyadorno and @​RafaelGSS

Commit

v20.6.0: 2023-09-04, Version 20.6.0 (Current), @​juanarbol prepared by @​UlisesGascon

Notable changes

built-in .env file support

import.meta.resolve unflagged

New node:module API register for module customization hooks; new initialize hook

Module customization load hook can now support CommonJS

Node.js C++ addons now have experimental support for cppgc (Oilpan), a C++ garbage collection library in V8.

Other notable changes

Commits

v20.5.1: 2023-08-09, Version 20.5.1 (Current), @​RafaelGSS

Notable Changes

Commits

v20.5.0: 2023-07-18, Version 20.5.0 (Current), @​juanarbol

Notable Changes

Commits

v20.4.0: 2023-07-05, Version 20.4.0 (Current), @​RafaelGSS

Notable Changes

Mock Timers

Support to the explicit resource management proposal

Other notable changes

Commits

v20.3.1: 2023-06-20, Version 20.3.1 (Current), @​RafaelGSS

Notable Changes

Commits

v20.3.0: 2023-06-08, Version 20.3.0 (Current), @​targos

Notable Changes

Commits

v20.2.0: 2023-05-16, Version 20.2.0 (Current), @​targos

Notable Changes

Commits

v20.1.0: 2023-05-03, Version 20.1.0 (Current), @​targos

Notable Changes

Commits

v20.0.0: 2023-04-18, Version 20.0.0 (Current), @​RafaelGSS

Notable Changes

Permission Model

Custom ESM loader hooks run on dedicated thread

V8 11.3

Stable Test Runner

Ada 2.0

Preparing single executable apps now requires injecting a Blob

Web Crypto API

Official support for ARM64 Windows

WASI version must now be specified

Deprecations and Removals

Semver-Major Commits

Semver-Minor Commits

Semver-Patch Commits

v19.9.0: 2023-04-10, Version 19.9.0 (Current), @​RafaelGSS

Notable Changes

Tracing Channel in diagnostic_channel

New URL.canParse API

Other notable changes

Commits

v19.8.1: 2023-03-15, Version 19.8.1 (Current), @​targos

Notable Changes

Commits

v19.7.0: 2023-02-21, Version 19.7.0 (Current), @​MylesBorins

Notable Changes

Commits

v19.6.1: 2023-02-16, Version 19.6.1 (Current), @​RafaelGSS

Notable Changes

Commits

v19.6.0: 2023-02-02, Version 19.6.0 (Current), @​ruyadorno

Notable changes

ESM: Leverage loaders when resolving subsequent loaders

`v20.8.0`: 2023-09-28, Version 20.8.0 (Current), @ruyadorno

Rework of memory management in `vm` APIs with the `importModuleDynamically` option

`v20.7.0`: 2023-09-18, Version 20.7.0 (Current), @UlisesGascon

`v20.6.1`: 2023-09-08, Version 20.6.1 (Current), @ruyadorno and @RafaelGSS

`v20.6.0`: 2023-09-04, Version 20.6.0 (Current), @juanarbol prepared by @UlisesGascon

built-in `.env` file support

`import.meta.resolve` unflagged

New `node:module` API `register` for module customization hooks; new `initialize` hook

Module customization `load` hook can now support CommonJS

`v20.5.1`: 2023-08-09, Version 20.5.1 (Current), @RafaelGSS

`v20.5.0`: 2023-07-18, Version 20.5.0 (Current), @juanarbol

`v20.4.0`: 2023-07-05, Version 20.4.0 (Current), @RafaelGSS

`v20.3.1`: 2023-06-20, Version 20.3.1 (Current), @RafaelGSS

`v20.3.0`: 2023-06-08, Version 20.3.0 (Current), @targos

`v20.2.0`: 2023-05-16, Version 20.2.0 (Current), @targos

`v20.1.0`: 2023-05-03, Version 20.1.0 (Current), @targos

`v20.0.0`: 2023-04-18, Version 20.0.0 (Current), @RafaelGSS

`v19.9.0`: 2023-04-10, Version 19.9.0 (Current), @RafaelGSS

`v19.8.1`: 2023-03-15, Version 19.8.1 (Current), @targos

`v19.7.0`: 2023-02-21, Version 19.7.0 (Current), @MylesBorins

`v19.6.1`: 2023-02-16, Version 19.6.1 (Current), @RafaelGSS

`v19.6.0`: 2023-02-02, Version 19.6.0 (Current), @ruyadorno

`v19.5.0`: 2023-01-24, Version 19.5.0 (Current), @RafaelGSS

`v19.4.0`: 2023-01-06, Version 19.4.0 (Current), @RafaelGSS

`v19.3.0`: 2022-12-14, Version 19.3.0 (Current), @targos

`v19.2.0`: 2022-11-29, Version 19.2.0 (Current), @ruyadorno

`v19.1.0`: 2022-11-14, Version 19.1.0 (Current), @RafaelGSS

`v19.0.1`: 2022-11-04, Version 19.0.1 (Current), @RafaelGSS

`v19.0.0`: 2022-10-18, Version 19.0.0 (Current), @RafaelGSS and @ruyadorno

`v18.18.0`: 2023-09-18, Version 18.18.0 'Hydrogen' (LTS), @ruyadorno

`v18.17.1`: 2023-08-09, Version 18.17.1 'Hydrogen' (LTS), @RafaelGSS

`v18.17.0`: 2023-07-18, Version 18.17.0 'Hydrogen' (LTS), @danielleadams

`v18.16.1`: 2023-06-20, Version 18.16.1 'Hydrogen' (LTS), @RafaelGSS