Node.js 18 ChangeLog

LTS 'Hydrogen'	Current
18.16.1 18.16.0 18.15.0 18.14.2 18.14.1 18.14.0 18.13.0 18.12.1 18.12.0	18.11.0 18.10.0 18.9.1 18.9.0 18.8.0 18.7.0 18.6.0 18.5.0 18.4.0 18.3.0 18.2.0 18.1.0 18.0.0

Other Versions
- 20.x
- 19.x
- 17.x
- 16.x
- 15.x
- 14.x
- 13.x
- 12.x
- 11.x
- 10.x
- 9.x
- 8.x
- 7.x
- 6.x
- 5.x
- 4.x
- 0.12.x
- 0.10.x
- io.js
- Archive

2023-06-20, Version 18.16.1 'Hydrogen' (LTS), @RafaelGSS

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
OpenSSL Security Releases
c-ares vulnerabilities:

More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.

Commits

[bf3e2c8928] - crypto: handle cert with invalid SPKI gracefully (Tobias Nießen) nodejs-private/node-private#393
[70f9449072] - deps: set CARES_RANDOM_FILE for c-ares (Richard Lau) #48156
[35d4efb57b] - deps: update c-ares to 1.19.1 (RafaelGSS) #48115
[392dfedc77] - deps: update archs files for openssl-3.0.9-quic1 (Node.js GitHub Bot) #48402
[46cd5fe38b] - deps: upgrade openssl sources to quictls/openssl-3.0.9-quic1 (Node.js GitHub Bot) #48402
[7e3d2d85c2] - doc,test: clarify behavior of DH generateKeys (Tobias Nießen) nodejs-private/node-private#426
[4ff6ba050a] - http: disable request smuggling via rempty headers (Paolo Insogna) nodejs-private/node-private#428
[ab269129a6] - msi: do not create AppData\Roaming\npm (Tobias Nießen) nodejs-private/node-private#408
[925e8f5619] - policy: handle mainModule.__proto__ bypass (RafaelGSS) nodejs-private/node-private#416
[d6fae8e47e] - test: allow SIGBUS in signal-handler abort test (Michaël Zasso) #47851

2023-04-12, Version 18.16.0 'Hydrogen' (LTS), @danielleadams

Notable changes

Add initial support for single executable applications

Compile a JavaScript file into a single executable application:

$ echo 'console.log(`Hello, ${process.argv[2]}!`);' > hello.js

$ cp $(command -v node) hello

# On systems other than macOS:
$ npx postject hello NODE_JS_CODE hello.js \
    --sentinel-fuse NODE_JS_FUSE_fce680ab2cc467b6e072b8b5df1996b2

# On macOS:
$ npx postject hello NODE_JS_CODE hello.js \
    --sentinel-fuse NODE_JS_FUSE_fce680ab2cc467b6e072b8b5df1996b2 \
    --macho-segment-name NODE_JS

$ ./hello world
Hello, world!

Contributed by Darshan Sen in nodejs#45038

Replace url parser with Ada

Node.js gets a new URL parser called Ada that is compliant with the WHATWG URL Specification and provides more than 100% performance improvement to the existing implementation.

Contributed by Yagiz Nizipli in nodejs#46410

Other notable changes

buffer:
- (SEMVER-MINOR) add Buffer.copyBytesFrom(...) (James M Snell) #46500
doc:
- add marco-ippolito to collaborators (Marco Ippolito) #46816
- add debadree25 to collaborators (Debadree Chatterjee) #46716
- add deokjinkim to collaborators (Deokjin Kim) #46444
events:
- (SEMVER-MINOR) add listener argument to listenerCount (Paolo Insogna) #46523
lib:
- (SEMVER-MINOR) add AsyncLocalStorage.bind() and .snapshot() (flakey5) #46387
- (SEMVER-MINOR) add aborted() utility function (Debadree Chatterjee) #46494
src:
- (SEMVER-MINOR) allow optional Isolate termination in node::Stop() (Shelley Vohr) #46583
- (SEMVER-MINOR) allow embedder control of code generation policy (Shelley Vohr) #46368
stream:
- (SEMVER-MINOR) add abort signal for ReadableStream and WritableStream (Debadree Chatterjee) #46273
tls:
- (SEMVER-MINOR) support automatic DHE (Tobias Nießen) #46978
url:
- (SEMVER-MINOR) implement URLSearchParams size getter (James M Snell) #46308
worker:
- (SEMVER-MINOR) add support for worker name in inspector and trace_events (Debadree Chatterjee) #46832

Commits

[c742493b61] - assert: fix exception message for assert(0) on try catch block (hidecology) #46760
[0ddf73ae7c] - assert: remove deprecated getFunction() usage (Ruben Bridgewater) #46661
[97ad72f19f] - async_hooks: add async local storage propagation benchmarks (Chengzhong Wu) #46414
[b1bde69574] - async_hooks: remove experimental onPropagate option (James M Snell) #46386
[b5db3b579a] - benchmark: add a benchmark for URLSearchParams creation and toString() (Debadree Chatterjee) #46810
[ff94f9ffbe] - benchmark: replace table in docs with description of file tree structure (Theodor Steiner) #46991
[d4af671f09] - benchmark: split Buffer.byteLength benchmark (Joyee Cheung) #46616
[5f647fb7b4] - benchmark: add benchmark for EventTarget add and remove (Debadree Chatterjee) #46779
[d7d634bd67] - benchmark: fix worker startup benchmark (Joyee Cheung) #46680
[f7c4796c56] - benchmark: add trailing commas in benchmark/path (Antoine du Hamel) #46628
[9b0d5030a5] - benchmark: add trailing commas in benchmark/http (Antoine du Hamel) #46609
[e0f436041e] - benchmark: add trailing commas in benchmark/crypto (Antoine du Hamel) #46553
[a383aee386] - benchmark: add trailing commas in benchmark/url (Antoine du Hamel) #46551
[a10c3558c6] - benchmark: add trailing commas in benchmark/http2 (Antoine du Hamel) #46552
[8036583f1f] - benchmark: add trailing commas in benchmark/process (Antoine du Hamel) #46481
[1497244078] - benchmark: add trailing commas in benchmark/misc (Antoine du Hamel) #46474
[057e3f5309] - benchmark: add trailing commas in benchmark/buffers (Antoine du Hamel) #46473
[26e1a81243] - benchmark: add trailing commas in benchmark/module (Antoine du Hamel) #46461
[bd6c828cf3] - benchmark: add trailing commas in benchmark/net (Antoine du Hamel) #46439
[01cf87aca7] - benchmark: add trailing commas in benchmark/util (Antoine du Hamel) #46438
[f006b2f9dc] - benchmark: add trailing commas in benchmark/async_hooks (Antoine du Hamel) #46424
[f969cc30ab] - benchmark: add trailing commas in benchmark/fs (Antoine du Hamel) #46426
[5202b84382] - bootstrap: print stack trace during environment creation failure (Joyee Cheung) #46533
[c6e722aca4] - (SEMVER-MINOR) buffer: add Buffer.copyBytesFrom(...) (James M Snell) #46500
[886504fdf8] - build: fix Visual Studio installation detection for Arm64 (Radek Bartoň) #46420
[2b72a453cf] - build: add GitHub Action for coverage with --without-intl (Rich Trott) #37954
[ff07aa7fe3] - build: do not disable inspector when intl is disabled (Rich Trott) #37954
[4b25b98bd8] - build,test: add proper support for IBM i (Xu Meng) #46739
[535311097c] - child_process: add trailing commas in source files (Antoine du Hamel) #46758
[d2692c65df] - cluster: add trailing commas in source files (Antoine du Hamel) #46695
[effdca8b10] - crypto: don't assume FIPS is disabled by default (Michael Dawson) #46532
[bce37c60ce] - debugger: improve validations and documents for watch and unwatch (Eungyu Lee) #46947
[51253bae83] - debugger: add a command to set which lines to check for context (Eungyu Lee) #46812
[44375c6a3c] - debugger: add trailing commas in source files (Antoine du Hamel) #46714
[e5c4d69681] - deps: update ada to 1.0.4 (Node.js GitHub Bot) #46853
[94f83536d7] - deps: update ada to 1.0.3 (Node.js GitHub Bot) #46784
[484c4f6674] - deps: update ada to v1.0.1 (Yagiz Nizipli) #46550
[0bc4c17e57] - deps: add ada as a dependency (Yagiz Nizipli) #46410
[956f786499] - deps: update undici to 5.21.0 (Node.js GitHub Bot) #47063
[73be4f8ef5] - deps: update simdutf to 3.2.2 (Node.js GitHub Bot) #46841
[0e78fd5883] - deps: update corepack to 0.17.0 (Node.js GitHub Bot) #46842
[61c9433d8a] - deps: update simdutf to 3.2.1 (Node.js GitHub Bot) #46800
[63a62ed532] - deps: upgrade npm to 9.5.1 (npm team) #46783
[c8974d678a] - deps: update nghttp2 to 1.52.0 (Michaël Zasso) #46636
[2b439a2cdf] - deps: fix libuv for android (Julian Dropmann) #46746
[d5eb1df869] - deps: update simdutf to 3.2.0 (Node.js GitHub Bot) #46621
[dd97b05aeb] - deps: update corepack to 0.16.0 (Node.js GitHub Bot) #46710
[65b877de45] - deps: copy postject-api.h and LICENSE to the deps folder (Darshan Sen) #46582
[a918ac886e] - deps: update c-ares to 1.19.0 (Michaël Zasso) #46415
[1ac639a240] - deps: V8: cherry-pick 9ec4e9095a25 (Kleis Auke Wolthuizen) #47092
[f8d4bf8540] - deps,test: update postject to 1.0.0-alpha.5 (Node.js GitHub Bot) #46934
[8646b06c1b] - dgram: fix unhandled exception aborting a closed udp socket (Ramana Venkata) #46770
[e435199ccc] - doc: remove remaining SSL_OP_NETSCAPE_*_BUG (Tobias Nießen) #47066
[01d82670c7] - doc: fix typo in test.md (Victor Hiairrassary) #47053
[0e3077dc48] - doc: amend support tier qualifier (Gireesh Punathil) #42805
[a5bf6693b9] - doc: fix typo on esm loaders example (Ruy Adorno) #47015
[6a0c1d053e] - doc: add missing test runner flags to man page (Colin Ihrig) #46982
[43b94b0f13] - doc: fix history information for node:diagnostics_channel (Thomas Hunter II) #46984
[b37d53a1ba] - doc: fix myUrl is not defined in url (Youngmin Yoo) #46968
[257c5ac1fa] - doc: remove useless SSL_OP_* options (Tobias Nießen) #46954
[09c5e6a9f3] - doc: fix description of TLS dhparam option (Tobias Nießen) #46949
[8907732fcf] - doc: improve fs code example quality (jakecastelli) #46948
[17a25f1153] - doc: fix port of destination server is not defined in http2 (Deokjin Kim) #46940
[ad06168a5c] - doc: use number which is bigger than 1024 as port in http2 (Deokjin Kim) #46938
[4e6dda5be4] - doc: add release key for Juan Arboleda (Juan José) #46922
[f49c6e64ba] - doc: fix links to SSL_CTX_set_options (Tobias Nießen) #46953
[ea7fb16e5c] - doc: fix fs missing import (jakecastelli) #46907
[11885a7351] - doc: add request to hold off publicising sec releases (Michael Dawson) #46702
[0254fd1da6] - doc: fix stream iterator helpers examples (Benjamin Gruenbaum) #46897
[0a983f7125] - doc: add history info for node:test (Antoine du Hamel) #46851
[810d393ded] - doc: sort import order (jakecastelli) #46847
[6e03499437] - doc: use destructing import (jakecastelli) #46847
[8b636c3cd6] - doc: add marco-ippolito to collaborators (Marco Ippolito) #46816
[7e08ca125a] - doc: document how to use the tls.DEFAULT_CIPHERS (Andreas Martens) #46482
[3dae6f2f81] - doc: add document for profiling and heap snapshot (cola119) #46787
[eef30513b9] - doc: add test:coverage event to custom reporter examples (Richie McColl) #46752
[e6db6bedf7] - doc: include context on .toWeb() parameters (Debadree Chatterjee) #46617
[a24350e49f] - doc: add in security steward for recent release (Michael Dawson) #46701
[55360e9386] - doc: clarify semver-minor notable changes approach (Beth Griggs) #46592
[a384dd42ff] - doc: maintaining nghttp2 (Marco Ippolito) #46539
[45fccc9737] - doc: add emit to NodeEventTarget (Deokjin Kim) #46356
[760616890c] - doc: add debadree25 to collaborators (Debadree Chatterjee) #46716
[b9dd876e7c] - doc: move bcoe to emeriti (Benjamin Coe) #46703
[3afbb92bb4] - doc: add response.strictContentLength to documentation (Marco Ippolito) #46627
[2c0e1aa095] - doc: remove unused functions from example of streamConsumers.text (Deokjin Kim) #46581
[61268303fc] - doc: fix test runner examples (Richie McColl) #46565
[2b702c98c2] - doc: update test concurrency description / default values (richiemccoll) #46457
[f1de3f7a31] - doc: enrich test command with executable (Tony Gorez) #44347
[68b5cf8e38] - doc: fix wrong location of requestTimeout's default value (Deokjin Kim) #46423
[4d5d6d2193] - doc: add deokjinkim to collaborators (Deokjin Kim) #46444
[de7f6182be] - doc: fix -C flag usage (三咲智子 Kevin Deng) #46388
[4165cf34ba] - doc: add note about major release rotation (Rafael Gonzaga) #46436
[f088ce2dc7] - doc: update threat model based on discussions (Michael Dawson) #46373
[5b94e2bcdb] - esm: fix import assertion warning (Antoine du Hamel) #46971
[96a39d1a99] - esm: add a runtime warning when using import assertions (Antoine du Hamel) #46901
[320a8adb45] - esm: misc test refactors (Geoffrey Booth) #46631
[b08687f739] - events: add trailing commas in source files (Antoine du Hamel) #46759
[cc6deeaf7a] - (SEMVER-MINOR) events: add listener argument to listenerCount (Paolo Insogna) #46523
[efc24097a6] - fs: add trailing commas in source files (Antoine du Hamel) #46696
[80b4e6da53] - http: use listenerCount when adding noop event (Paolo Insogna) #46769
[3538521bf6] - http: correctly calculate strict content length (Robert Nagy) #46601
[9582c8ef3a] - http: fix validation of "Link" header (Steve Herzog) #46466
[23c1e2fa52] - http: unify header treatment (Marco Ippolito) #46528
[abeee994c4] - http: add note about clientError event (Paolo Insogna) #46584
[3d0602c96c] - http: use v8::Array::New() with a prebuilt vector (Joyee Cheung) #46447
[62cbddd86f] - lib: fix trailing commas and leftover function from rebasing (Danielle Adams) #47503
[c463f133bd] - lib: enforce use of trailing commas (Antoine du Hamel) #46881
[0f33bb0961] - lib: add trailing commas to all public core modules (Antoine du Hamel) #46848
[06e0dd3e15] - lib: rename internal module declaration as internal bindings (okmttdhr, okp) #46663
[31578ab1b4] - lib: add trailing commas to more internal files (Antoine du Hamel) #46811
[ad510d9029] - lib: update punycode to 2.3.0 (Yagiz Nizipli) #46719
[4cf3de8b02] - lib: add trailing commas in internal/perf (Antoine du Hamel) #46697
[f1b79828bc] - (SEMVER-MINOR) lib: add AsyncLocalStorage.bind() and .snapshot() (flakey5) #46387
[48cd712c0d] - lib: add trailing commas in internal/process (Antoine du Hamel) #46687
[46a22ab601] - lib: do not crash using workers with disabled shared array buffers (Ruben Bridgewater) #41023
[1395e36e64] - lib: delete module findPath unused params (sinkhaha) #45371
[c410572620] - lib: enforce use of trailing commas in more files (Antoine du Hamel) #46655
[36e080cd13] - lib: enforce use of trailing commas for functions (Antoine du Hamel) #46629
[71249a6c00] - lib: predeclare Event.isTrusted prop descriptor (Santiago Gimeno) #46527
[2b80d19c06] - lib: tighten AbortSignal.prototype.throwIfAborted implementation (Antoine du Hamel) #46521
[2f79f3fa38] - (SEMVER-MINOR) lib: add aborted() utility function (Debadree Chatterjee) #46494
[7f9e60aa1a] - lib,src: fix a few typos in comments (Tobias Nießen) #46835
[c4f192b592] - meta: add single-executable labels and code owners (Joyee Cheung) #47004
[abe1488f86] - meta: remove AUTHORS file (Rich Trott) #46845
[e53774c7bf] - meta: remove unnecessary onboarding step (Rich Trott) #46793
[55f1cfd7e4] - meta: update CODEOWNERS of url implementations (Yagiz Nizipli) #46775
[ccaa7cabdd] - meta: update AUTHORS (Node.js GitHub Bot) #46726
[260ddd5b0f] - meta: update AUTHORS (Node.js GitHub Bot) #46624
[5ef78e50a0] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #46513
[5efb829156] - meta: update AUTHORS (Node.js GitHub Bot) #46504
[f0705f7de1] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #46411
[331073a7aa] - node-api: add __wasm32__ guards on async works (Chengzhong Wu) #46633
[594bb9d558] - os: improve network interface performance (Ruben Bridgewater) #46598
[c231aae6c5] - process: print versions by sort (Himself65) #46428
[fe318dd095] - punycode: add pending deprecation (Antoine du Hamel) #46719
[34ba230d9b] - repl: remove lastInputPreview conditional check (Duy Mac Van) #46857
[09739a20b1] - repl: fix .load infinite loop caused by shared use of lineEnding RegExp (Theodor Steiner) #46742
[91fbad617d] - repl: add trailing commas in source files (Antoine du Hamel) #46757
[e4cd81b526] - src: use string_view for report and related code (Anna Henningsen) #46723
[8ea835419e] - (SEMVER-MINOR) src: add initial support for single executable applications (Darshan Sen) #45038
[4652dfdc88] - src: remove TLSEXT_TYPE_alpn guard (Tobias Nießen) #46956
[a4a433fc0b] - src: remove use of SSL_OP_SINGLE_DH_USE (Tobias Nießen) #46955
[339b52f3bc] - src: make util.h self-containted (Joyee Cheung) #46817
[b25ee523ea] - src: remove shadowed variable in OptionsParser (Shelley Vohr) #46672
[88baf98fa3] - src: do not track BaseObjects directly in Realm (Joyee Cheung) #46470
[03e8d824db] - src: fix cb scope bugs involved in termination (ywave620) #45596
[7fb32b43dc] - src: add SetFastMethodNoSideEffect() (Joyee Cheung) #46619
[ea411d6422] - (SEMVER-MINOR) src: allow optional Isolate termination in node::Stop() (Shelley Vohr) #46583
[f8d029183a] - src: remove icu usage from node_string.cc (Yagiz Nizipli) #46548
[95674360b2] - src: add fflush() to SnapshotData::ToFile() (Anna Henningsen) #46531
[9445a0a5f6] - src: make edge names in BaseObjects more descriptive in heap snapshots (Joyee Cheung) #46492
[483cd1922f] - src: avoid leaking snapshot fp on error (Tobias Nießen) #46497
[bc9a577625] - src: check return value of ftell() (Tobias Nießen) #46495
[b3b3b33799] - src: remove unused includes from main thread (Yagiz Nizipli) #46471
[b9ca302558] - src: use string_view instead of std::string& (Yagiz Nizipli) #46471
[f1c770065a] - src: use simdutf utf8 to utf16 instead of icu (Yagiz Nizipli) #46471
[aaf04f498a] - src: replace icu with simdutf for char counts (Yagiz Nizipli) #46472
[3aef68d079] - src: add additional utilities to crypto::SecureContext (James M Snell) #45912
[92fdb24fac] - src: add KeyObjectHandle::HasInstance (James M Snell) #45912
[a639e2a557] - src: add GetCurrentCipherName/Version to crypto_common (James M Snell) #45912
[8dfa748373] - src: back snapshot I/O with a std::vector sink (Joyee Cheung) #46463
[17eea1812e] - (SEMVER-MINOR) src: allow embedder control of code generation policy (Shelley Vohr) #46368
[dffe7d814e] - stream: enable usage of webstreams on compose() (Debadree Chatterjee) #46675
[654b7474e3] - stream: always delay construct callback by a nextTick (Matteo Collina) #46818
[ed2faa7c7c] - stream: fix respondWithNewView() errors when view.byteOffset != 0 (Debadree Chatterjee) #46465
[247caacc7a] - stream: fix pipeline callback not called on ended stream (Debadree Chatterjee) #46600
[c40eec3f3b] - stream: add trailing commas in webstream source files (Antoine du Hamel) #46685
[d669f22567] - stream: add trailing commas in stream source files (Antoine du Hamel) #46686
[c60816a68d] - (SEMVER-MINOR) stream: add abort signal for ReadableStream and WritableStream (Debadree Chatterjee) #46273
[17b4e9bc5f] - stream: refactor to use validateAbortSignal (Antoine du Hamel) #46520
[4d81124397] - stream: allow transfer of readable byte streams (MrBBot) #45955
[6c454af5ea] - stream: add pipeline() for webstreams (Debadree Chatterjee) #46307
[91a550e5a1] - stream: add suport for abort signal in finished() for webstreams (Debadree Chatterjee) #46403
[406ff320bf] - stream: dont access Object.prototype.type during TransformStream init (Debadree Chatterjee) #46389
[972bdee8c4] - test: update web-platform tests for url (Yagiz Nizipli) #46547
[ba340a0ddb] - test: move test-tls-autoselectfamily-servername to test/internet (Antoine du Hamel) #47029
[0edaf016cc] - test: fallback to IPv4 if IPv6 is unavailable (Abdirahim Musse) #47017
[ef6c86c59f] - test: simplify test-tls-ecdh-multiple (Tobias Nießen) #46963
[b8cdd1502f] - test: improve test coverage of lib/dns (Anderson Paiva) #46910
[33991954b6] - test: simplify test-tls-ecdh-auto (Tobias Nießen) #46911
[512f28fa8b] - test: move testPath from CWD to temporary directory (Livia Medeiros) #46890
[3fdcf7bef4] - test: assume priv ports start at 1024 if it can't be changed (KrayzeeKev) #46536
[966d0d8b16] - test: fix os-release check for Ubuntu in SEA test (Anna Henningsen) #46838
[b344e74bc1] - test: move socket from CWD to temporary directory (Livia Medeiros) #46863
[dfb566aec2] - test: fix test-net-connect-reset-until-connected (Vita Batrla) #46781
[364479644c] - test: simplify test-tls-alert (Tobias Nießen) #46805
[df149448b5] - test: update encoding WPTs (Filip Skokan) #46802
[928998dd2d] - test: remove useless WPT init scripts (Filip Skokan) #46801
[bb182461a3] - test: remove unreachable return (jakecastelli) #46807
[ea71a2ae1b] - test: fix test-v8-collect-gc-profile-in-worker.js (theanarkh) #46735
[25cab7eab5] - test: improve control flow in test-tls-dhe (Tobias Nießen) #46751
[3b70e7a34e] - test: include strace openat test (Rafael Gonzaga) #46150
[533170d456] - test: remove OpenSSL 1.0.2 error message compat (Tobias Nießen) #46709
[b8948996b4] - test: fix flaky test-watch-mode-files_watcher (Moshe Atlow) #46738
[931111609e] - test: use newish OpenSSL feature in test-tls-dhe (Tobias Nießen) #46708
[847d74005c] - test: fix assertions in test-snapshot-dns-lookup* (Tobias Nießen) #46618
[d7b995cd38] - test: cover publicExponent validation in OpenSSL (Tobias Nießen) #46632
[a2b103a761] - test: add trailing commas in test/pummel (Antoine du Hamel) #46610
[4fb2fc7536] - test: enable api-invalid-label.any.js in encoding WPTs (Filip Skokan) #46506
[b0f2415312] - test: add trailing commas in test/js-native-api (Antoine du Hamel) #46385
[534562f51d] - test: make more crypto tests work with BoringSSL (Shelley Vohr) #46429
[9bb08527f0] - test: add trailing commas in test/known_issues (Antoine du Hamel) #46408
[231f0ee9b2] - test: add trailing commas in test/internet (Antoine du Hamel) #46407
[5e008e7d38] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #47010
[99bfbed78a] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #46575
[8398f9fcb6] - test_runner: default to spec reporter when on TTY environment (Moshe Atlow) #46969
[16db3ad1f8] - test_runner: handle errors not bound to tests (Colin Ihrig) #46962
[d60eef25a1] - test_runner: throw if harness is not bootstrapped (Colin Ihrig) #46962
[ab5b3185f1] - test_runner: track bootstrapping process (Colin Ihrig) #46962
[413493cab9] - test_runner: avoid running twice tests in describe (Moshe Atlow) #46888
[524eaf5488] - test_runner: fix reconstruction of errors extracted from YAML (Moshe Atlow) #46872
[17fbfb23bd] - test_runner: reset count on watch mode (Moshe Atlow) #46577
[3b077a6885] - test_runner: remove root tracking set (Colin Ihrig) #46961
[15503ffd12] - test_runner: give the root test a harness reference (Colin Ihrig) #46962
[e52b169ef4] - test_runner: align behavior of it and test (Moshe Atlow) #46889
[9b58857630] - timers: cleanup no-longer relevant TODOs in timers/promises (James M Snell) #46499
[32c527d80f] - (SEMVER-MINOR) tls: support automatic DHE (Tobias Nießen) #46978
[6ff90270ca] - tls: add trailing commas in source files (Antoine du Hamel) #46715
[958da453dd] - tools: fix update-ada script (Yagiz Nizipli) #46550
[a3f272e667] - tools: automate cares update (Marco Ippolito) #46993
[77f5b69840] - tools: update lint-md-dependencies to rollup@3.18.0 (Node.js GitHub Bot) #46935
[36ea9e7f65] - tools: refactor dep_updaters (Tony Gorez) #46488
[c0b6794f82] - tools: update eslint to 8.35.0 (Node.js GitHub Bot) #46854
[307d096e21] - tools: create llhttp update action (Marco Ippolito) #46766
[fff31862ac] - tools: fix linter message when using global DOMException (Antoine du Hamel) #46822
[89c2e8ac97] - tools: update lint-md-dependencies to rollup@3.17.3 (Node.js GitHub Bot) #46843
[3bf54ff624] - tools: update lint-md-dependencies to rollup@3.17.2 (Node.js GitHub Bot) #46771
[4065e5cda6] - tools: run format-cpp on node-api test c files (Chengzhong Wu) #46694
[7349708527] - tools: use actions pinned by commit hash in coverage-linux (Gabriela Gutierrez) #46294
[f80e93d71f] - tools: fix regex strings in Python tools (Jan Osusky) #46671
[8fd176055f] - tools: fixed path (Marco Ippolito) #46700
[15b0e8b1aa] - tools: update nghttp2 action (Marco Ippolito) #46700
[4da3eecbd7] - tools: update-nghttp2 preserve config.h (Marco Ippolito) #46698
[3714d8f236] - tools: update lint-md-dependencies to rollup@3.17.1 (Node.js GitHub Bot) #46712
[474084e063] - tools: update lint-md-dependencies to rollup@3.17.0 (Node.js GitHub Bot) #46712
[665b7424eb] - tools: fix bug in prefer-primordials lint rule (Antoine du Hamel) #46659
[7eb1456892] - tools: update eslint to 8.34.0 (Node.js GitHub Bot) #46625
[678b8f53c1] - tools: update lint-md-dependencies to rollup@3.15.0 to-vfile@7.2.4 (Node.js GitHub Bot) #46623
[ee81da5883] - tools: update doc to remark-html@15.0.2 to-vfile@7.2.4 (Node.js GitHub Bot) #46622
[92e3e0e4e4] - tools: update lint-md-dependencies to rollup@3.13.0 vfile-reporter@7.0.5 (Node.js GitHub Bot) #46503
[728f96861e] - tools: update ESLint custom rules to not use the deprecated format (Antoine du Hamel) #46460
[78b79c0220] - typings: improve primordials typings (Antoine du Hamel) #46970
[a39dd37653] - url: simplify and improve url formatting (Yagiz Nizipli) #46736
[01b6525706] - url: improve performance by removing host (Yagiz Nizipli) #46547
[0c67a7ad57] - url: fix url spec compliance issues (Yagiz Nizipli) #46547
[e9263541a7] - url: replace url-parser with ada (Yagiz Nizipli) #46410
[4d0faf4ddc] - url: improve isURLThis detection (Yagiz Nizipli) #46866
[1ece4a72b7] - (SEMVER-MINOR) url: implement URLSearchParams size getter (James M Snell) #46308
[8f14002459] - url: remove unused URL::ToFilePath() (Yagiz Nizipli) #46487
[f57e7bcc11] - url: remove unused URL::toObject (Yagiz Nizipli) #46486
[04930562f8] - url: remove unused setURLConstructor function (Yagiz Nizipli) #46485
[b801873a8a] - vm: properly support symbols on globals (Nicolas DUBIEN) #46458
[f7423bdbaa] - (SEMVER-MINOR) worker: add support for worker name in inspector and trace_events (Debadree Chatterjee) #46832

2023-03-07, Version 18.15.0 'Hydrogen' (LTS), @BethGriggs prepared by @juanarbol

Notable Changes

[63563f8a7a] - doc,lib,src,test: rename --test-coverage (Colin Ihrig) #46017
[28a775b32f] - test_runner: add initial code coverage support (Colin Ihrig) #46017
[4d50db14b3] - (SEMVER-MINOR) test_runner: add reporters (Moshe Atlow) #45712
[643545ab79] - (SEMVER-MINOR) fs: add statfs() functions (Colin Ihrig) #46358
[110ead9abb] - (SEMVER-MINOR) vm: expose cachedDataRejected for vm.compileFunction (Anna Henningsen) #46320
[02632b42cf] - (SEMVER-MINOR) v8: support gc profile (theanarkh) #46255
[f09b838408] - (SEMVER-MINOR) src,lib: add constrainedMemory API for process (theanarkh) #46218
[cb5bb12422] - (SEMVER-MINOR) buffer: add isAscii method (Yagiz Nizipli) #46046

Commits

[6f91c8e2ae] - benchmark: add trailing commas (Antoine du Hamel) #46370
[d0b9be21eb] - benchmark: remove buffer benchmarks redundancy (Brian White) #45735
[6468f30d0d] - benchmark: introduce benchmark combination filtering (Brian White) #45735
[cb5bb12422] - (SEMVER-MINOR) buffer: add isAscii method (Yagiz Nizipli) #46046
[ec61bb04c0] - build: export more OpenSSL symbols on Windows (Mohamed Akram) #45486
[7bae4333ce] - build: fix MSVC 2022 Release compilation (Vladimir Morozov (REDMOND)) #46228
[0f5f2d4470] - crypto: include hmac.h in crypto_util.h (Adam Langley) #46279
[91ece4161b] - crypto: avoid hang when no algorithm available (Richard Lau) #46237
[492fc95bdf] - deps: V8: cherry-pick 90be99fab31c (Michaël Zasso) #46646
[732c77e3d9] - deps: update acorn to 8.8.2 (Node.js GitHub Bot) #46363
[8582f99ffb] - deps: update to uvwasi 0.0.15 (Colin Ihrig) #46253
[5453cd9940] - deps: V8: cherry-pick bf0bd4868dde (Michaël Zasso) #45908
[3ea53c5dc8] - deps: V8: cherry-pick c875e86df1d7 (sepehrst) #46501
[c04808de4b] - doc: correct the sed command for macOS in release process docs (Juan José) #46397
[8113220690] - doc: pass string to textEncoder.encode as input (Deokjin Kim) #46421
[129dccf5d2] - doc: add tip for session.post function (theanarkh) #46354
[919e581732] - doc: add documentation for socket.destroySoon() (Luigi Pinca) #46337
[fc15ac95a5] - doc: fix commit message using test instead of deps (Tony Gorez) #46313
[d153a93200] - doc: add v8 fast api contribution guidelines (Yagiz Nizipli) #46199
[dbf082d082] - doc: fix small typo error (0xflotus) #46186
[94421b4cfe] - doc: mark some parameters as optional in webstreams (Deokjin Kim) #46269
[5adb743511] - doc: update output of example in events.getEventListeners (Deokjin Kim) #46268
[63563f8a7a] - doc,lib,src,test: rename --test-coverage (Colin Ihrig) #46017
[4e88c7c813] - esm: delete preload mock test (Geoffrey Booth) #46402
[643545ab79] - (SEMVER-MINOR) fs: add statfs() functions (Colin Ihrig) #46358
[5019b5473f] - http: res.setHeaders first implementation (Marco Ippolito) #46109
[76622c4c60] - inspector: allow opening inspector when NODE_V8_COVERAGE is set (Moshe Atlow) #46113
[92f0747e03] - meta: update AUTHORS (Node.js GitHub Bot) #46399
[795251bc6f] - meta: update AUTHORS (Node.js GitHub Bot) #46303
[8865424c31] - meta: add .mailmap entry (Rich Trott) #46303
[5ed679407b] - meta: move evanlucas to emeritus (Evan Lucas) #46274
[403df210ac] - module: move test reporter loading (Geoffrey Booth) #45923
[2f7319e387] - readline: fix detection of carriage return (Antoine du Hamel) #46306
[73a8f46c4d] - Revert "src: let http2 streams end after session close" (Santiago Gimeno) #46721
[30d783f91a] - src: stop tracing agent before shutting down libuv (Santiago Gimeno) #46380
[1508d90fda] - src: get rid of fp arithmetic in ParseIPv4Host (Tobias Nießen) #46326
[bdb793a082] - src: use UNREACHABLE instead of CHECK(falsy) (Tobias Nießen) #46317
[116a33649b] - src: add support for ETW stack walking (José Dapena Paz) #46203
[b06298c98e] - src: refactor EndsInANumber in node_url.cc and adds IsIPv4NumberValid (Miguel Teixeira) #46227
[26f41b041c] - src: fix c++ exception on bad command line arg (Ben Noordhuis) #46290
[14da89f41a] - src: remove unreachable UNREACHABLE (Tobias Nießen) #46281
[18c4dd004b] - src: replace custom ASCII validation with simdutf one (Anna Henningsen) #46271
[cde375510f] - src: replace unreachable code with static_assert (Tobias Nießen) #46250
[f389b2f3fc] - src: use explicit C++17 fallthrough (Tobias Nießen) #46251
[8adaa1333c] - src: use CreateEnvironment instead of inlining its code where possible (Anna Henningsen) #45886
[f09b838408] - (SEMVER-MINOR) src,lib: add constrainedMemory API for process (theanarkh) #46218
[63e92eae63] - stream: remove brandchecks from stream duplexify (Debadree Chatterjee) #46315
[3acfe9bf92] - stream: fix readable stream as async iterator function (Erick Wendel) #46147
[de64315ccb] - test: fix WPT title when no META title is present (Filip Skokan) #46804
[162e3400ff] - test: fix default WPT titles (Filip Skokan) #46778
[5f422c4d70] - test: add WPTRunner support for variants and generating WPT reports (Filip Skokan) #46498
[4f5aff2557] - test: fix tap parser fails if a test logs a number (Pulkit Gupta) #46056
[32b020cf84] - test: fix tap escaping with and without --test (Pulkit Gupta) #46311
[f2bba1bcdb] - test: add trailing commas in test/node-api (Antoine du Hamel) #46384
[f2ebe66fda] - test: add trailing commas in test/message (Antoine du Hamel) #46372
[ed564a9985] - test: add trailing commas in test/pseudo-tty (Antoine du Hamel) #46371
[e4437dd409] - test: set common.bits to 64 for loong64 (Shi Pujin) #45383
[9d40aef736] - test: s390x zlib test case fixes (Adam Majer) #46367
[ed3fb52716] - test: fix logInTimeout is not function (theanarkh) #46348
[d05b0771be] - test: avoid trying to call sysctl directly (Adam Majer) #46366
[041aac3bbd] - test: avoid left behind child processes (Richard Lau) #46276
[837ddcb322] - test: add failing test for readline with carriage return (Alec Mev) #46075
[75b8db41c6] - test: reduce fs-write-optional-params flakiness (LiviaMedeiros) #46238
[c0d3fdaf63] - test,crypto: add CFRG curve vectors to wrap/unwrap tests (Filip Skokan) #46406
[f328f7b15e] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #46267
[1ef3c53e24] - test_runner: better handle async bootstrap errors (Colin Ihrig) #46720
[0a690efb76] - test_runner: add describe.only and it.only shorthands (Richie McColl) #46604
[28a1317efe] - test_runner: bootstrap reporters before running tests (Moshe Atlow) #46737
[cd3aaa8fac] - test_runner: emit test-only diagnostic warning (Richie McColl) #46540
[c19fa45a65] - test_runner: centralize CLI option handling (Colin Ihrig) #46707
[0898145e37] - test_runner: display skipped tests in spec reporter output (Richie McColl) #46651
[894d7117fa] - test_runner: parse non-ascii character correctly (Mert Can Altın) #45736
[5b3c606626] - test_runner: flatten TAP output when running using --test (Moshe Atlow) #46440
[391ff0dba4] - test_runner: allow nesting test within describe (Moshe Atlow) #46544
[ba784e87b4] - test_runner: fix missing test diagnostics (Moshe Atlow) #46450
[c5f16fb5fb] - test_runner: top-level diagnostics not ommited when running with --test (Pulkit Gupta) #46441
[28a775b32f] - test_runner: add initial code coverage support (Colin Ihrig) #46017
[0d999e373a] - test_runner: make built in reporters internal (Colin Ihrig) #46092
[79f4b426fe] - test_runner: report file in test runner events (Moshe Atlow) #46030
[4d50db14b3] - (SEMVER-MINOR) test_runner: add reporters (Moshe Atlow) #45712
[5fdf374c74] - test_runner: avoid swallowing of asynchronously thrown errors (MURAKAMI Masahiko) #45264
[23b875806c] - test_runner: update comment to comply with eslint no-fallthrough rule (Antoine du Hamel) #46258
[00c5495aa3] - tools: update eslint to 8.33.0 (Node.js GitHub Bot) #46400
[37a6ce1120] - tools: update doc to unist-util-select@4.0.3 unist-util-visit@4.1.2 (Node.js GitHub Bot) #46364
[1eaafc7db4] - tools: update lint-md-dependencies to rollup@3.12.0 (Node.js GitHub Bot) #46398
[a97774603b] - tools: require more trailing commas (Antoine du Hamel) #46346
[03e244a59b] - tools: update lint-md-dependencies (Node.js GitHub Bot) #46302
[60d714e0c3] - tools: allow icutrim.py to run on python2 (Michael Dawson) #46263
[b7950f50de] - tools: update eslint to 8.32.0 (Node.js GitHub Bot) #46258
[08bafc84f6] - url: refactor to use more primordials (Antoine du Hamel) #45966
[02632b42cf] - (SEMVER-MINOR) v8: support gc profile (theanarkh) #46255
[110ead9abb] - (SEMVER-MINOR) vm: expose cachedDataRejected for vm.compileFunction (Anna Henningsen) #46320

2023-02-21, Version 18.14.2 'Hydrogen' (LTS), @MylesBorins

Notable Changes

[f864bef32a] - deps: upgrade npm to 9.5.0 (npm team) #46673

Commits

[880a65d7ff] - build: delete snapshot.blob file from the project (Juan José Arboleda) #46626
[cbea56efda] - deps: update undici to 5.20.0 (Node.js GitHub Bot) #46711
[f864bef32a] - deps: upgrade npm to 9.5.0 (npm team) #46673
[648041d568] - deps: upgrade npm to 9.4.0 (npm team) #46353
[5e1f213f3c] - deps: patch V8 to 10.2.154.26 (Michaël Zasso) #46446

2023-02-16, Version 18.14.1 'Hydrogen' (LTS), @RafaelGSS prepared by @juanarbol

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)
CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)

More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post.

This security release includes OpenSSL security updates as outlined in the recent OpenSSL security advisory.

Commits

[8393ebc72d] - build: build ICU with ICU_NO_USER_DATA_OVERRIDE (RafaelGSS) nodejs-private/node-private#379
[004e34d046] - crypto: clear OpenSSL error on invalid ca cert (RafaelGSS) #46572
[5e0142a852] - deps: cherry-pick Windows ARM64 fix for openssl (Richard Lau) #46572
[f71fe278a6] - deps: update archs files for quictls/openssl-3.0.8+quic (RafaelGSS) #46572
[2c6817e42b] - deps: upgrade openssl sources to quictls/openssl-3.0.8+quic (RafaelGSS) #46572
[f0afa0bfe5] - deps: update undici to 5.19.1 (Node.js GitHub Bot) #46634
[c26a34c13e] - deps: update undici to 5.18.0 (Node.js GitHub Bot) #46634
[db93ee4a15] - deps: update undici to 5.17.1 (Node.js GitHub Bot) #46634
[b4e49fb02c] - deps: update undici to 5.16.0 (Node.js GitHub Bot) #46634
[90994e6a2c] - deps: update undici to 5.15.1 (Node.js GitHub Bot) #46634
[00302fc7ac] - deps: update undici to 5.15.0 (Node.js GitHub Bot) #46634
[0e3b796cc5] - lib: makeRequireFunction patch when experimental policy (RafaelGSS) nodejs-private/node-private#371
[7cccd5565f] - policy: makeRequireFunction on mainModule.require (RafaelGSS) nodejs-private/node-private#371

2023-02-02, Version 18.14.0 'Hydrogen' (LTS), @BethGriggs prepared by @juanarbol

Notable changes

Updated npm to 9.3.1

Based on the list of guidelines we've established on integrating npm and node, here is a grouped list of the breaking changes with the reasoning as to why they fit within the guidelines linked above. Note that all the breaking changes were made in 9.0.0. All subsequent minor and patch releases after npm@9.0.0 do not contain any breaking changes.

Engines

Explanation: the node engines supported by npm@9 make it safe to allow npm@9 as the default in any LTS version of 14 or 16, as well as anything later than or including 18.0.0

npm is now compatible with the following semver range for node: ^14.17.0 || ^16.13.0 || >=18.0.0

Filesystem

Explanation: when run as root previous versions of npm attempted to manage file ownership automatically on the user's behalf. this behavior was problematic in many cases and has been removed in favor of allowing users to manage their own filesystem permissions

npm will no longer attempt to modify ownership of files it creates.

Auth

Explanation: any errors thrown from users having unsupported auth configurations will show npm config fix in the remediation instructions, which will allow the user to automatically have their auth config fixed.

The presence of auth related settings that are not scoped to a specific registry found in a config file is no longer supported and will throw errors.

Login

Explanation: the default auth-type has changed and users can opt back into the old behavior with npm config set auth-type=legacy. login and adduser have also been seperated making each command more closely match it's name instead of being aliases for each other.

Legacy auth types sso, saml & legacy have been consolidated into "legacy".
auth-type defaults to "web"
login and adduser are now separate commands that send different data to the registry.
auth-type config values web and legacy only try their respective methods, npm no longer tries them all and waits to see which one doesn't fail.

Tarball Packing

Explanation: previously using multiple ignore/allow lists when packing was an undefined behavior, and now the order of operations is strictly defined when packing a tarball making it easier to follow and should only affect users relying on the previously undefined behavior.

npm pack now follows a strict order of operations when applying ignore rules. If a files array is present in the package.json, then rules in .gitignore and .npmignore files from the root will be ignored.

Display/Debug/Timing Info

Explanation: these changes center around the display of information to the terminal including timing and debug log info. We do not anticipate these changes breaking any existing workflows.

Links generated from git urls will now use HEAD instead of master as the default ref.
timing has been removed as a value for --loglevel.
--timing will show timing information regardless of --loglevel, except when --silent.
When run with the --timing flag, npm now writes timing data to a file alongside the debug log data, respecting the logs-dir option and falling back to <CACHE>/_logs/ dir, instead of directly inside the cache directory.
The timing file data is no longer newline delimited JSON, and instead each run will create a uniquely named <ID>-timing.json file, with the <ID> portion being the same as the debug log.
npm now outputs some json errors on stdout. Previously npm would output all json formatted errors on stderr, making it difficult to parse as the stderr stream usually has logs already written to it.

Config/Command Deprecations or Removals

Explanation: install-links is the only config or command in the list that has an effect on package installs. We fixed a number of issues that came up during prereleases with this change. It will also only be applied to new package trees created without a package-lock.json file. Any install with an existing lock file will not be changed.

Deprecate boolean install flags in favor of --install-strategy.
npm config set will no longer accept deprecated or invalid config options.
install-links config defaults to "true".
node-version config has been removed.
npm-version config has been removed.
npm access subcommands have been renamed.
npm birthday has been removed.
npm set-script has been removed.
npm bin has been removed (use npx or npm exec to execute binaries).

Other notable changes

doc:
- add parallelism note to os.cpus() (Colin Ihrig) #45895
http:
- join authorization headers (Marco Ippolito) #45982
- improved timeout defaults handling (Paolo Insogna) #45778
stream:
- implement finished() for ReadableStream and WritableStream (Debadree Chatterjee) #46205

Commits

[1352f08778] - assert: remove assert.snapshot (Moshe Atlow) #46112
[4ee3238643] - async_hooks: refactor to use validateObject (Deokjin Kim) #46004
[79e0bf9b64] - benchmark: include webstreams benchmark (Rafael Gonzaga) #45876
[ed1ac82469] - benchmark,tools: use os.availableParallelism() (Deokjin Kim) #46003
[16ee02f2eb] - (SEMVER-MINOR) buffer: add buffer.isUtf8 for utf8 validation (Yagiz Nizipli) #45947
[3bf2371a57] - build: add extra semi check (Jiawen Geng) #46194
[560ee24157] - build: fix arm64 cross-compile from powershell (Stefan Stojanovic) #45890
[48e3ad3aca] - build: add option to disable shared readonly heap (Anna Henningsen) #45887
[52a7887b94] - (SEMVER-MINOR) crypto: add CryptoKey Symbol.toStringTag (Filip Skokan) #46042
[a558774a40] - crypto: add cipher update/final methods encoding validation (vitpavlenko) #45990
[599d1dc841] - crypto: ensure auth tag set for chacha20-poly1305 (Ben Noordhuis) #46185
[24a101698c] - crypto: return correct bit length in KeyObject's asymmetricKeyDetails (Filip Skokan) #46106
[2de50fef84] - (SEMVER-MINOR) crypto: add KeyObject Symbol.toStringTag (Filip Skokan) #46043
[782b6f6f9f] - crypto: ensure exported webcrypto EC keys use uncompressed point format (Ben Noordhuis) #46021
[7a97f3f43b] - crypto: fix CryptoKey prototype WPT (Filip Skokan) #45857
[1a8aa50aa2] - crypto: fix CryptoKey WebIDL conformance (Filip Skokan) #45855
[c6436450ee] - crypto: fix error when getRandomValues is called without arguments (Filip Skokan) #45854
[4cdf0002c5] - debugger: refactor console in lib/internal/debugger/inspect.js (Debadree Chatterjee) #45847
[b7fe8c70fa] - deps: update simdutf to 3.1.0 (Node.js GitHub Bot) #46257
[eaeb870cd7] - deps: upgrade npm to 9.3.1 (npm team) #46242
[7c03a3d676] - deps: upgrade npm to 9.3.0 (npm team) #46193
[340d76accb] - deps: cherrypick simdutf patch (Jiawen Geng) #46194
[cce2af4306] - deps: bump googletest to 2023.01.13 (Jiawen Geng) #46198
[d251a66bed] - deps: add /deps/**/.github/ to .gitignore (Luigi Pinca) #46091
[874054f469] - deps: add simdutf version to metadata (Mike Roth) #46145
[2497702b82] - deps: update simdutf to 2.1.0 (Node.js GitHub Bot) #46128
[c8492b7f4c] - deps: update corepack to 0.15.3 (Node.js GitHub Bot) #46037
[d148f357fd] - deps: update simdutf to 2.0.9 (Node.js GitHub Bot) #45975
[422a98199c] - deps: update to uvwasi 0.0.14 (Colin Ihrig) #45970
[7812752db0] - deps: fix updater github workflow job (Yagiz Nizipli) #45972
[4063cdcef6] - Revert "deps: disable avx512 for simutf on benchmark ci" (Yagiz Nizipli) #45948
[64d3e3f3ba] - deps: disable avx512 for simutf on benchmark ci (Yagiz Nizipli) #45803
[c9845fc334] - deps: add simdutf dependency (Yagiz Nizipli) #45803
[6963c96547] - deps: update timezone to 2022g (Node.js GitHub Bot) #45731
[874f6c340b] - deps: update undici to 5.14.0 (Node.js GitHub Bot) #45812
[7599b913d5] - deps: upgrade npm to 9.2.0 (npm team) #45780
[4844935ff3] - deps: upgrade npm to 9.1.3 (npm team) #45693
[8dce62c7fe] - deps: V8: cherry-pick 5fe919f78321 (Richard Lau) #45587
[8de642517e] - dgram: sync the old handle state to new handle (theanarkh) #46041
[de2b7a9640] - doc: fix mismatched arguments of NodeEventTarget (Deokjin Kim) #45678
[6317502d10] - doc: update events API example to have runnable code (Deokjin Kim) #45760
[a9db45eee1] - doc: add note to tls docs about secureContext availability (Tim Gerk) #46224
[5294371063] - doc: add text around collaborative expectations (Michael Dawson) #46121
[be85d5a6eb] - doc: update to match changed --dns-result-order default (Mordy Tikotzky) #46148
[4f2d9ea6da] - doc: add Node-API media link (Kevin Eady) #46189
[9bfd40466f] - doc: update http.setMaxIdleHTTPParsers arguments (Debadree Chatterjee) #46168
[d7a8c076e1] - doc: use "file system" instead of "filesystem" (Rich Trott) #46178
[e54483cd2b] - doc: https update default request timeout (Marco Ippolito) #46184
[335110b0fb] - doc: make options of readableStream.pipeTo as optional (Deokjin Kim) #46180
[ec34cad712] - doc: add PerformanceObserver.supportedEntryTypes to doc (theanarkh) #45962
[d0f905bd6f] - doc: duplex and readable from uncaught execption warning (Marco Ippolito) #46135
[512feaafa4] - doc: remove outdated sections from maintaining-v8 (Antoine du Hamel) #46137
[849a3e2ce7] - doc: fix (EC)DHE remark in TLS docs (Tobias Nießen) #46114
[a3c9c1b4e6] - doc: fix ERR_TLS_RENEGOTIATION_DISABLED text (Tobias Nießen) #46122
[1834e94ebb] - doc: fix spelling in SECURITY.md (Vaishno Chaitanya) #46124
[3968698af5] - doc: abort controller emits error in child process (Debadree Chatterjee) #46072
[1ec14c2c61] - doc: fix event.cancelBubble documentation (Deokjin Kim) #45986
[5539977f80] - doc: add personal pronouns option (Filip Skokan) #46118
[1fabef3a81] - doc: mention how to run ncu-ci citgm (Rafael Gonzaga) #46090
[84dc65ab87] - doc: include updating release optional step (Rafael Gonzaga) #46089
[76c7ea1e74] - doc: describe argument of Symbol.for (Deokjin Kim) #46019
[2307a74990] - doc: update isUtf8 description (Yagiz Nizipli) #45973
[fa5b65ea24] - doc: use console.error for error case in timers and tls (Deokjin Kim) #46002
[29d509c100] - doc: fix wrong output of example in url.protocol (Deokjin Kim) #45954
[61dbca2690] - doc: use os.availableParallelism() in async_context and cluster (Deokjin Kim) #45979
[86b2c8cea2] - doc: make EventEmitterAsyncResource's options as optional (Deokjin Kim) #45985
[335acf7748] - doc: replace single executable champion in strategic initiatives doc (Darshan Sen) #45956
[aab35a9388] - doc: update error message of example in repl (Deokjin Kim) #45920
[53a94a95ff] - doc: fix typos in packages.md (Eric Mutta) #45957
[83875f46cf] - doc: remove port from example in url.hostname (Deokjin Kim) #45927
[162d3a94e3] - doc: show output of example in http (Deokjin Kim) #45915
[53684e4506] - (SEMVER-MINOR) doc: add parallelism note to os.cpus() (Colin Ihrig) #45895
[546e083d36] - doc: fix wrong output of example in url.password (Deokjin Kim) #45928
[14c95ecd23] - doc: fix some history entries in deprecations.md (Antoine du Hamel) #45891
[d94dba973b] - doc: add tip for NODE_MODULE (theanarkh) #45797
[662f574c5b] - doc: reduce likelihood of mismerges during release (Richard Lau) #45864
[48ea28aa30] - doc: add backticks to webcrypto rsaOaepParams (Filip Skokan) #45883
[726b285163] - doc: remove release cleanup step (Michaël Zasso) #45858
[5eb93f1de9] - doc: add stream/promises pipeline and finished to doc (Marco Ippolito) #45832
[f874d0ba74] - doc: remove Juan Jose keys (Rafael Gonzaga) #45827
[67efe2a55e] - doc: fix wrong output of example in util (Deokjin Kim) #45825
[b709af31e0] - doc: sort http.createServer() options alphabetically (Luigi Pinca) #45680
[ebe292113a] - doc,crypto: fix WebCryptoAPI import keyData and export return (Filip Skokan) #46076
[204757719c] - errors: refactor to use a method that formats a list string (Daeyeon Jeong) #45793
[463bb9602e] - esm: mark importAssertions as required (Antoine du Hamel) #46164
[0bdf2db079] - esm: rewrite loader hooks test (Geoffrey Booth) #46016
[297773c6d1] - events: change status of event.returnvalue to legacy (Deokjin Kim) #46175
[d088d6e5c3] - events: change status of event.cancelBubble to legacy (Deokjin Kim) #46146
[36be0c4ee2] - events: change status of event.srcElement to legacy (Deokjin Kim) #46085
[b239f0684a] - events: fix violation of symbol naming convention (Deokjin Kim) #45978
[aec340b312] - fs: refactor to use validateInteger (Deokjin Kim) #46008
[e620de6444] - http: refactor to use validateHeaderName (Deokjin Kim) #46143
[3e70b7d863] - http: writeHead if statusmessage is undefined dont override headers (Marco Ippolito) #46173
[3d1dd96c4f] - http: refactor to use min of validateNumber for maxTotalSockets (Deokjin Kim) #46115
[4df1fcc9db] - (SEMVER-MINOR) http: join authorization headers (Marco Ippolito) #45982
[8c06e2f645] - http: replace var with const on code of comment (Deokjin Kim) #45951
[3c0c5e0567] - (SEMVER-MINOR) http: improved timeout defaults handling (Paolo Insogna) #45778
[edcd4fc576] - lib: use kEmptyObject and update JSDoc in webstreams (Deokjin Kim) #46183
[d6fc855b8a] - lib: refactor to use validate function (Deokjin Kim) #46101
[bc17f37b98] - lib: reuse invalid state errors on webstreams (Rafael Gonzaga) #46086
[86554bf27c] - lib: fix incorrect use of console intrinsic (Colin Ihrig) #46044
[7fc7b19124] - lib: update JSDoc of getOwnPropertyValueOrDefault (Deokjin Kim) #46010
[c1cc1f9e12] - lib: use kEmptyObject as default value for options (Deokjin Kim) #46011
[db617222da] - meta: update AUTHORS (Node.js GitHub Bot) #46215
[10afecd0d8] - meta: update AUTHORS (Node.js GitHub Bot) #46130
[d8ce990ce6] - meta: update comment in CODEOWNERS to better reflect current policy (Antoine du Hamel) #45944
[e3f0194168] - meta: update AUTHORS (Node.js GitHub Bot) #46040
[d31c478929] - meta: update AUTHORS (Node.js GitHub Bot) #45968
[10a276a3e0] - meta: add nodejs/loaders to CODEOWNERS (Geoffrey Booth) #45940
[56247d7c87] - meta: add nodejs/test_runner to CODEOWNERS (Antoine du Hamel) #45935
[3bef8bc743] - meta: update AUTHORS (Node.js GitHub Bot) #45899
[baf30ee935] - module: fix unintended mutation (Antoine du Hamel) #46108
[3ad584c357] - net: handle socket.write(cb) edge case (Santiago Gimeno) #45922
[2ab35cf0cc] - node-api: disambiguate napi_add_finalizer (Chengzhong Wu) #45401
[6e9676e986] - node-api: generalize finalizer second pass callback (Chengzhong Wu) #44141
[b2faceff0a] - (SEMVER-MINOR) os: add availableParallelism() (Colin Ihrig) #45895
[8fac4c5684] - perf_hooks: fix checking range of options.figures in createHistogram (Deokjin Kim) #45999
[ea73702847] - process,worker: ensure code after exit() effectless (ywave620) #45620
[784ed594ea] - repl: improve robustness wrt to prototype pollution (Antoine du Hamel) #45604
[fcfde3412e] - src: rename internal module declaration as internal bindings (Chengzhong Wu) #45551
[646cadccd0] - src: fix endianness of simdutf (Yagiz Nizipli) #46257
[94605b1665] - src: replace unreachable code with static_assert (Tobias Nießen) #46209
[3ce39bbcb7] - src: hide kMaxDigestMultiplier outside HKDF impl (Tobias Nießen) #46206
[9648b06e09] - src: distinguish env stopping flags (Chengzhong Wu) #45907
[53ecd20bbd] - src: remove return after abort (Shelley Vohr) #46172
[c4c8931b9d] - src: remove unnecessary semicolons (Shelley Vohr) #46171
[fab72b1677] - src: use simdutf for converting externalized builtins to UTF-16 (Anna Henningsen) #46119
[67729961e7] - src: use constant strings for memory info names (Chengzhong Wu) #46087
[0ac4e5dd34] - src: fix typo in node_snapshotable.cc (Vadim) #46103
[b454a7665d] - src: keep PipeWrap::Open function consistent with TCPWrap (theanarkh) #46064
[41f5a29cca] - src: speed up process.getActiveResourcesInfo() (Darshan Sen) #46014
[02a61dd6bd] - src: fix typo in node_file.cc (Vadim) #45998
[99c033ed98] - src: fix crash on OnStreamRead on Windows (Santiago Gimeno) #45878
[27d6a8b2b1] - src: fix creating Isolates from addons (Anna Henningsen) #45885
[9ca31cdba3] - src: use string_view for FastStringKey implementation (Anna Henningsen) #45914
[e4fc3abfd5] - src: fix UB in overflow checks (Ben Noordhuis) #45882
[574afac26a] - src: check size of args before using for exec_path (A. Wilcox) #45902
[f0692468cd] - src: fix tls certificate root store data race (Ben Noordhuis) #45767
[a749ceda2e] - src: add undici and acorn to process.versions (Debadree Chatterjee) #45621
[08a6a61575] - src,lib: the handle keeps loop alive in cluster rr mode (theanarkh) #46161
[a87963de6b] - stream: fix pipeline calling end on destination more than once (Debadree Chatterjee) #46226
[cde59606cd] - (SEMVER-MINOR) stream: implement finished() for ReadableStream and WritableStream (Debadree Chatterjee) #46205
[441d9de33e] - stream: refactor to use validateFunction (Deokjin Kim) #46007
[325fc08d48] - stream: fix typo in JSDoc (Deokjin Kim) #45991
[536322fa1c] - test: update postject to 1.0.0-alpha.4 (Node.js GitHub Bot) #46212
[a3056f4125] - test: refactor to avoid mutation of global by a loader (Michaël Zasso) #46220
[1790569518] - test: improve test coverage for WHATWG TextDecoder (Juan José) #45241
[896027c006] - test: add fix so that test exits if port 42 is unprivileged (Suyash Nayan) #45904
[257224da0e] - test: use os.availableParallelism() (Deokjin Kim) #46003
[7e1462dd02] - test: update Web Events WPT (Deokjin Kim) #46051
[40d52fbc5f] - test: add test to once() in event lib (Jonathan Diaz) #46126
[f3518f3337] - test: use process.hrtime.bigint instead of process.hrtime (Deokjin Kim) #45877
[4d6dd10464] - test: print failed JS/parallel tests (Geoffrey Booth) #45960
[7cb6fef6d6] - test: fix test broken under --node-builtin-modules-path (Geoffrey Booth) #45894
[55e4140c34] - test: fix mock.method to support class instances (Erick Wendel) #45608
[286acaa6fe] - test: update encoding wpt to latest (Yagiz Nizipli) #45850
[22c1e918ce] - test: update url wpt to latest (Yagiz Nizipli) #45852
[5fa6a70bbd] - test: add CryptoKey transferring tests (Filip Skokan) #45811
[4aaec07266] - test: add postject to fixtures (Darshan Sen) #45298
[da78f9cbb8] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #45860
[3269423032] - test,esm: validate more edge cases for dynamic imports (Antoine du Hamel) #46059
[cade2fccf4] - test_runner: run t.after() if test body throws (Colin Ihrig) #45870
[87a0e86604] - test_runner: parse yaml (Moshe Atlow) #45815
[757a022443] - tls: don't treat fatal TLS alerts as EOF (David Benjamin) #44563
[c6457cbf8d] - tls: fix re-entrancy issue with TLS close_notify (David Benjamin) #44563
[fcca2d5ea6] - tools: update lint-md-dependencies (Node.js GitHub Bot) #46214
[09adb86c19] - tools: fix macro name in update-undici (Almeida) #46217
[1b0cc79785] - tools: add automation for updating postject dependency (Darshan Sen) #46157
[38df662119] - tools: update create-or-update-pull-request-action (Michaël Zasso) #46169
[3f4c0c0de1] - tools: update eslint to 8.31.0 (Node.js GitHub Bot) #46131
[f3dc4329e6] - tools: update lint-md-dependencies to rollup@3.9.1 (Node.js GitHub Bot) #46129
[fafbd1ca72] - tools: move update-eslint.sh to dep_updaters/ (Luigi Pinca) #46088
[609df01fa9] - tools: make update-eslint.sh work with npm@9 (Luigi Pinca) #46088
[31b8cf1a4d] - tools: fix lint rule recommendation (Colin Ihrig) #46044
[0a80cbdcb1] - tools: update lint-md-dependencies to rollup@3.9.0 (Node.js GitHub Bot) #46039
[18503fa7ba] - tools: update doc to unist-util-select@4.0.2 (Node.js GitHub Bot) #46038
[b48e82ec1d] - tools: add release host var to promotion script (Ruy Adorno) #45913
[3b93b0c1f5] - tools: add url to AUTHORS update automation (Antoine du Hamel) #45971
[623b0eba81] - tools: update lint-md-dependencies to rollup@3.8.1 (Node.js GitHub Bot) #45967
[b0e88377fe] - tools: update GitHub workflow action (Mohammed Keyvanzadeh) #45937
[974442e69d] - tools: update lint-md dependencies (Node.js GitHub Bot) #45813
[5aaa8c3bbf] - tools: enforce use of trailing commas in tools/ (Antoine du Hamel) #45889
[1e32520f72] - tools: add ArrayPrototypeConcat to the list of primordials to avoid (Antoine du Hamel) #44445
[e0cda56204] - tools: fix incorrect version history order (Fabien Michel) #45728
[7438ff175a] - tools: update eslint to 8.29.0 (Node.js GitHub Bot) #45733
[1e11247b91] - Revert "tools: update V8 gypfiles for RISC-V" (Lu Yahan) #46156
[0defe4effa] - trace_events: refactor to use validateStringArray (Deokjin Kim) #46012
[f1dcbe7652] - util: add fast path for text-decoder fatal flag (Yagiz Nizipli) #45803
[277d9da876] - vm: refactor to use validate function (Deokjin Kim) #46176
[96f1b2e731] - vm: refactor to use validateStringArray (Deokjin Kim) #46020

2023-01-05, Version 18.13.0 'Hydrogen' (LTS), @danielleadams

Notable changes

Add support for externally shared js builtins

By default Node.js is built so that all dependencies are bundled into the Node.js binary itself. Some Node.js distributions prefer to manage dependencies externally. There are existing build options that allow dependencies with native code to be externalized. This commit adds additional options so that dependencies with JavaScript code (including WASM) can also be externalized. This addition does not affect binaries shipped by the Node.js project but will allow other distributions to externalize additional dependencies when needed.

Contributed by Michael Dawson in #44376

Introduce `File`

The File class is part of the FileAPI. It can be used anywhere a Blob can, for example in URL.createObjectURL and FormData. It contains two properties that Blobs do not have: lastModified, the last time the file was modified in ms, and name, the name of the file.

Contributed by Khafra in #45139

Support function mocking on Node.js test runner

The node:test module supports mocking during testing via a top-level mock object.

test('spies on an object method', (t) => {
  const number = {
    value: 5,
    add(a) {
      return this.value + a;
    },
  };
  t.mock.method(number, 'add');

  assert.strictEqual(number.add(3), 8);
  assert.strictEqual(number.add.mock.calls.length, 1);
});

Contributed by Colin Ihrig in #45326

Other notable changes

build:
- disable v8 snapshot compression by default (Joyee Cheung) #45716
crypto:
- update root certificates (Luigi Pinca) #45490
deps:
- update ICU to 72.1 (Michaël Zasso) #45068
doc:
- add doc-only deprecation for headers/trailers setters (Rich Trott) #45697
- add Rafael to the tsc (Michael Dawson) #45691
- deprecate use of invalid ports in url.parse (Antoine du Hamel) #45576
- add lukekarrys to collaborators (Luke Karrys) #45180
- add anonrig to collaborators (Yagiz Nizipli) #45002
- deprecate url.parse() (Rich Trott) #44919
lib:
- drop fetch experimental warning (Matteo Collina) #45287
net:
- (SEMVER-MINOR) add autoSelectFamily and autoSelectFamilyAttemptTimeout options (Paolo Insogna) #44731
src:
- (SEMVER-MINOR) add uvwasi version (Jithil P Ponnan) #45639
- (SEMVER-MINOR) add initial shadow realm support (Chengzhong Wu) #42869
test_runner:
- (SEMVER-MINOR) add t.after() hook (Colin Ihrig) #45792
- (SEMVER-MINOR) don't use a symbol for runHook() (Colin Ihrig) #45792
tls:
- (SEMVER-MINOR) add "ca" property to certificate object (Ben Noordhuis) #44935
- remove trustcor root ca certificates (Ben Noordhuis) #45776
tools:
- update certdata.txt (Luigi Pinca) #45490
util:
- add fast path for utf8 encoding (Yagiz Nizipli) #45412
- improve textdecoder decode performance (Yagiz Nizipli) #45294
- (SEMVER-MINOR) add MIME utilities (#21128) (Bradley Farias) #21128

Commits

[40123a6bb0] - (SEMVER-MINOR) async_hooks: add hook to stop propagation (Gerhard Stöbich) #45386
[9925d20ed8] - benchmark: add variety of inputs to text-encoder (Yagiz Nizipli) #45787
[5e167bd658] - benchmark: make benchmarks runnable in older versions of Node.js (Joyee Cheung) #45746
[a1421623ac] - benchmark: add v8 serialize benchmark (Yagiz Nizipli) #45476
[fcf61884cc] - benchmark: add text-encoder benchmark (Yagiz Nizipli) #45450
[762d285c98] - benchmark: add parameters to text-decoder benchmark (Yagiz Nizipli) #45363
[ab891ecbff] - benchmark: fix text-decoder benchmark (Yagiz Nizipli) #45363
[1ed312a737] - benchmark: add blob benchmark (Yagiz Nizipli) #44990
[2ee3d81277] - bootstrap: merge main thread and worker thread initializations (Joyee Cheung) #44869
[e638ea4f48] - bootstrap: check more metadata when loading the snapshot (Joyee Cheung) #44132
[bfcf4f0046] - buffer: make decodeUTF8 params loose (Yagiz Nizipli) #45610
[3a7f3d5993] - (SEMVER-MINOR) buffer: introduce File (Khafra) #45139
[345b847aa6] - buffer: fix validation of options in Blob constructor (Antoine du Hamel) #45156
[1ddc438444] - build: disable v8 snapshot compression by default (Joyee Cheung) #45716
[bd1a2fbd91] - build: add python 3.11 support for android (Mohammed Keyvanzadeh) #45765
[2b0ace302d] - build: rework gyp files for zlib (Richard Lau) #45589
[5ab7a30a06] - build: avoid redefined macro (Michaël Zasso) #45544
[f58b32c22e] - build: fix env.h for cpp20 (Jiawen Geng) #45516
[1de1f679ec] - Revert "build: remove precompiled header and debug information for host builds" (Stefan Stojanovic) #45432
[89d1eb58b0] - build: add --v8-disable-object-print flag (MURAKAMI Masahiko) #45458
[f2a4def232] - build: make scripts in gyp run with right python (Jiawen Geng) #45435
[473a879c91] - build: workaround for node-core-utils (Jiawen Geng) #45199
[abcc034c61] - build: fix icu-small build with ICU 72.1 (Steven R. Loomis) #45195
[8a99221a21] - build: remove unused language files (Ben Noordhuis) #45138
[3fb44f9413] - build: add GitHub token to auto-start-ci workflow (Richard Lau) #45185
[2aac993bb2] - build: add version info to timezone update PR (Darshan Sen) #45021
[0db19b3c60] - build: support Python 3.11 (Luigi Pinca) #45191
[fb008a2e9b] - build,deps,src: fix Intel VTune profiling support (Shi Lei) #45248
[61bc27a5b4] - build,win: pass --debug-nghttp2 to configure (Santiago Gimeno) #45209
[7b68c06988] - child_process: validate arguments for null bytes (Darshan Sen) #44782
[bac6b7d900] - crypto: simplify lazy loading of internal modules (Antoine du Hamel) #45809
[2fbf95662c] - crypto: fix CipherBase Update int32 overflow (Marco Ippolito) #45769
[0100fd445b] - crypto: refactor ArrayBuffer to bigint conversion utils (Antoine du Hamel) #45567
[fa0a2d8e5d] - crypto: refactor verify acceptable key usage functions (Filip Skokan) #45569
[ef64b86d0d] - crypto: fix ECDH webcrypto public CryptoKey usages (Filip Skokan) #45569
[b92b80424a] - crypto: validate CFRG webcrypto JWK import "d" and "x" are a pair (Filip Skokan) #45569
[621e3c9cd4] - crypto: use DataError for CFRG webcrypto raw and jwk import key checks (Filip Skokan) #45569
[8fcfbeffe1] - crypto: use DataError for webcrypto keyData import failures (Filip Skokan) #45569
[a976a63138] - crypto: fix X25519 and X448 webcrypto public CryptoKey usages (Filip Skokan) #45569
[27adcc9c4b] - crypto: ensure "x" is present when importing private CFRG webcrypto keys (Filip Skokan) #45569
[f27ebab56c] - crypto: clear OpenSSL error queue after calling X509_check_private_key() (Filip Skokan) #45495
[319ae095fb] - crypto: update root certificates (Luigi Pinca) #45490
[dae92e78d6] - crypto: clear OpenSSL error queue after calling X509_verify() (Takuro Sato) #45377
[1ba1809dfd] - crypto: handle more webcrypto errors with OperationError (Filip Skokan) #45320
[b54f8761ae] - crypto: handle unsupported AES ciphers in webcrypto (Filip Skokan) #45321
[57f507f1dd] - crypto: fix webcrypto HMAC "get key length" in deriveKey and generateKey (Filip Skokan) #44917
[7565a75ee5] - crypto: remove webcrypto HKDF and PBKDF2 default-applied lengths (Filip Skokan) #44945
[631421e8d0] - crypto: simplify webcrypto ECDH deriveBits (Filip Skokan) #44946
[c4f665f528] - deps: V8: cherry-pick d1d4c648e7ff (Danielle Adams) #46098
[c04e1df396] - Revert "deps: fix zlib compilation for CPUs without SIMD features" (Luigi Pinca) #45589
[34e708cded] - deps: update undici to 5.13.0 (Node.js GitHub Bot) #45634
[33b0664bbe] - deps: update corepack to 0.15.2 (Node.js GitHub Bot) #45635
[7b6d2a8ec0] - deps: update nghttp2 to 1.51.0 (Yagiz Nizipli) #45537
[02eabaf409] - deps: update base64 to 0.5.0 (Facundo Tuesca) #45509
[7d26bf3c08] - deps: V8: cherry-pick 9df5ef70ff18 (Yagiz Nizipli) #45474
[43419ad6bc] - deps: fix zlib compilation for CPUs without SIMD features (Anna Henningsen) #45387
[978cfad005] - deps: update zlib to upstream 8bbd6c31 (Luigi Pinca) #45387
[72362f348c] - deps: update acorn to 8.8.1 (Node.js GitHub Bot) #45441
[17a89d1f4e] - deps: V8: cherry-pick 031b98b25cba (Michaël Zasso) #45375
[bbe67c484a] - deps: upgrade npm to 8.19.3 (npm team) #45322
[a274d6bc0d] - deps: update corepack to 0.15.1 (Node.js GitHub Bot) #45331
[c9c958e188] - deps: upgrade to libuv 1.44.2 (Luigi Pinca) #42340
[07b47ad58c] - deps: update corepack to 0.15.0 (Node.js GitHub Bot) #45235
[bb6e8b1972] - deps: update undici to 5.12.0 (Node.js GitHub Bot) #45236
[596e3a8f2f] - deps: V8: cherry-pick c2792e58035f (Jiawen Geng) #44961
[2088cb4744] - deps: patch V8 to 10.2.154.23 (Michaël Zasso) #45997
[6ea555e8ac] - deps: V8: cherry-pick 2ada52cffbff (Michaël Zasso) #45573
[6d8c0f0efd] - deps: update timezone to 2022f (Node.js GitHub Bot) #45289
[3b73aa416f] - deps: update ICU to 72.1 (Michaël Zasso) #45068
[555d1723b1] - deps: update timezone (Node.js GitHub Bot) #44950
[5c0fcc13f7] - deps: patch V8 to 10.2.154.19 (Michaël Zasso) #45229
[1a47a7bbed] - diagnostics_channel: fix diagnostics channel memory leak (theanarkh) #45633
[40a29aabbc] - diagnostics_channel: built-in channels should remain experimental (Stephen Belanger) #45423
[2752f543bc] - diagnostics_channel: mark as stable (Stephen Belanger) #45290
[9ceed7a1cc] - dns: fix port validation (Antoine du Hamel) #45135
[108220cb05] - doc: buffer.fill empty value (Marco Ippolito) #45794
[b5ad92fea2] - doc: add args of filter option of fs.cp (MURAKAMI Masahiko) #45739
[899ba3d3c2] - doc: disambiguate native module to addon (Daeyeon Jeong) #45673
[6e35803789] - doc: using console.error for error cases in crypto and events (emirgoren) #45640
[fcd0f71979] - doc: fix actual result of example is different in events (Deokjin Kim) #45656
[8203c021dc] - doc: add doc-only deprecation for headers/trailers setters (Rich Trott) #45697
[c1f90a5b7b] - doc: add detail on how api docs are published (Michael Dawson) #45626
[90e9951d30] - doc: use console.error for error case in child_process and dgram (Deokjin Kim) #45690
[d9593ce98b] - doc: move streaming instruc to doc/contributing (Michael Dawson) #45582
[a3eb2dd9b4] - doc: add Rafael to the tsc (Michael Dawson) #45691
[fa8caa328f] - doc: add missing line in debugger (Deokjin Kim) #45632
[3fb5c6d3c5] - doc: fix actual result of example is different in stream (Deokjin Kim) #45619
[8a1e556899] - doc: add options parameter to eventTarget.removeEventListener (Deokjin Kim) #45667
[6881188f0f] - doc: define "react-native" community condition (Alex Hunt) #45367
[53e01f650f] - doc: move os.machine() docs to sorted position (Colin Ihrig) #45647
[0669712cbd] - doc: use console.error for error case in fs, https, net and process (Deokjin Kim) #45606
[ebc89f15fe] - doc: add link to doc with social processes (Michael Dawson) #45584
[b771fdb6f8] - doc: deprecate use of invalid ports in url.parse (Antoine du Hamel) #45576
[6a36159764] - doc: clarify changes in readableFlowing (Kohei Ueno) #45554
[30a8604143] - doc: use console.error for error case in http2 (Deokjin Kim) #45577
[8e94339891] - doc: add version description about fsPromise.constants (chlorine) #45556
[203ca494a1] - doc: add missing documentation for paramEncoding (Tobias Nießen) #45523
[31233b2064] - doc: fix typo in threat model (Tobias Nießen) #45558
[e851c43c54] - doc: add Node.js Threat Model (Rafael Gonzaga) #45223
[34c2876541] - doc: run license-builder (github-actions[bot]) #45553
[dde8740af3] - doc: add async_hooks migration note (Geoffrey Booth) #45335
[e304628fb5] - doc: fix RESOLVE_ESM_MATCH in modules.md (翠 / green) #45280
[8b44c6121e] - doc: add arm64 to os.machine() (Carter Snook) #45374
[009adc7e21] - doc: add lint rule to enforce trailing commas (Antoine du Hamel) #45471
[c6b89abc5f] - doc: adjust wording to eliminate awkward typography (Konv) #45398
[785817e341] - doc: fix typo in maintaining-dependencies.md (Tobias Nießen) #45428
[00e02bda3a] - doc: allow for holidays in triage response (Michael Dawson) #45267
[bef5206b84] - doc: include last security release date (Juan José Arboleda) #45368
[846b1aefac] - doc: fix email for Ashley (Michael Dawson) #45364
[913b669a2b] - doc: fix test runner's only tests section header (Colin Ihrig) #45343
[691da886f1] - doc: run license-builder (github-actions[bot]) #45349
[90a28920de] - doc: add more info for timer.setInterval (theanarkh) #45232
[d2fc2aa666] - doc: use module names in stability overview table (Filip Skokan) #45312
[3f69d21b5c] - doc: add node: prefix for examples (Daeyeon Jeong) #45328
[a5c9b3c112] - doc: update name of Node.js core Slack channel (Rich Trott) #45293
[2bfd60b06f] - doc: fix "task_processor.js" typo (andreysoktoev) #45257
[248de57278] - doc: add history section to fetch-related globals (Antoine du Hamel) #45198
[1f5975ef50] - doc: clarify moderation in onboarding.md (Benjamin Gruenbaum) #41930
[4e87c36570] - doc: change make lint to make lint-md (RafaelGSS) #45197
[3381a17d2c] - doc: add more lts update steps to release guide (Ruy Adorno) #45177
[64b0495310] - doc: add bmuenzenmeyer to triagers (Brian Muenzenmeyer) #45155
[6ebdb76727] - doc: update process.release (Filip Skokan) #45170
[05d89c4722] - doc: add link to triage guide (Brian Muenzenmeyer) #45154
[f1aa82fd3c] - doc: mark Node.js 12 as End-of-Life (Rafael Gonzaga) #45186
[da6f308612] - doc: add lukekarrys to collaborators (Luke Karrys) #45180
[17380a1e6a] - doc: update mark release line lts on release guide (Ruy Adorno) #45101
[3ddb6ccb2a] - doc: be more definite and present tense-y (Ben Noordhuis) #45120
[b09c386208] - doc: add major version note to release guide (Ruy Adorno) #45054
[896b48b549] - doc: fix v14.x link maintaining openssl guide (RafaelGSS) #45071
[33b3d8646b] - doc: add note about latest GitHub release (Michaël Zasso) #45111
[5e76bf5cd5] - doc: mention v18.x openssl maintaining guide (Rafael Gonzaga) #45070
[b4e3f3f095] - doc: fix display of "problematic" ASCII characters (John Gardner) #44373
[8bb23a4da3] - doc: mark Node.js v17.x as EOL (KaKa) #45110
[3f89dcabdb] - doc: update Node.js 16 End-of-Life date (Richard Lau) #45103
[7b23ec47b0] - doc: fix typo in parseArgs default value (Tobias Nießen) #45083
[7da66ef9e7] - doc: updated security stewards (Michael Dawson) #45005
[e5f9a520e2] - doc: fix http and http2 writeEarlyHints() parameter (Fabian Meyer) #45000
[e41a39c2b9] - doc: run license-builder (github-actions[bot]) #45034
[875de23ee9] - doc: improve the workflow to test release binaries (Rafael Gonzaga) #45004
[d7fc12f647] - doc: fix undici version in changelog (Michael Dawson) #44982
[4494cb2e82] - doc: add info on fixup to security release process (Michael Dawson) #44807
[88351b9758] - doc: add anonrig to collaborators (Yagiz Nizipli) #45002
[aebf7453d7] - doc: add notable changes to latest v18.x release changelog (Danielle Adams) #44996
[b4cc30e18c] - doc: deprecate url.parse() (Rich Trott) #44919
[4fcbc92788] - doc: fix backticks in fs API docs (Livia Medeiros) #44962
[cc1f41a57e] - doc, async_hooks: improve and add migration hints (Gerhard Stöbich) #45369
[6fb74a995d] - doc, http: add Uint8Array as allowed type (Gerhard Stöbich) #45167
[066993a10a] - esm: add JSDoc property descriptions for loader (Rich Trott) #45370
[fa210f91df] - esm: add JSDoc property descriptions for fetch (Rich Trott) #45370
[2f27d058c2] - esm: protect ESM loader from prototype pollution (Antoine du Hamel) #45175
[46ded6b96e] - esm: protect ESM loader from prototype pollution (Antoine du Hamel) #45044
[3bb764a58a] - events: add unique events benchmark (Yagiz Nizipli) #44657
[b305ad46fd] - fs: fix fs.rm support for loop symlinks (Nathanael Ruf) #45439
[c2f0377b8f] - fs: update todo message (Yagiz Nizipli) #45265
[1db20c84e1] - fs: fix opts.filter issue in cpSync (Tho) #45143
[da302ce15b] - fs: trace more fs api (theanarkh) #45095
[9ab00f5fbd] - gyp: fix v8 canary build on aix (Vasili Skurydzin) #45496
[cbd710bbf4] - http: make OutgoingMessage more streamlike (Robert Nagy) #45672
[209e7e3cff] - http: add debug log for ERR_UNESCAPED_CHARACTERS (Aidan Temple) #45420
[3937118f5e] - http: add JSDoc property descriptions (Rich Trott) #45370
[f222c95209] - http: add priority to common http headers (James M Snell) #45045
[2882e6042e] - Revert "http: do not leak error listeners" (Luigi Pinca) #44921
[b45878b2f1] - http2: improve session close/destroy procedures (Santiago Gimeno) #45115
[a534175aa5] - http2: fix crash on Http2Stream::diagnostic_name() (Santiago Gimeno) #45123
[0b9f11bcbe] - http2: fix debugStream method (Santiago Gimeno) #45129
[bbaca8442a] - lib: allow Writeable.toWeb() to work on http.Outgoing message (Debadree Chatterjee) #45642
[1284789371] - lib: check number of arguments in EventTarget's function (Deokjin Kim) #45668
[6297e77b1f] - lib: disambiguate native module to binding (Daeyeon Jeong) #45673
[f7c101555a] - lib: disambiguate native module to builtin module (Daeyeon Jeong) #45673
[55f800b806] - lib: added SuiteContext class (Debadree Chatterjee) #45687
[1ff8f689fa] - lib: add missing type of removeEventListener in question (Deokjin Kim) #45676
[2c595da5dc] - lib: do not throw if global property is no longer configurable (Antoine du Hamel) #45344
[b9d4ac2c7e] - lib: fix eslint early return (RafaelGSS) #45409
[4ef86b59b5] - lib: fix JSDoc issues (Rich Trott) #45243
[9ccf8b2ccc] - lib: use process.nextTick() instead of setImmediate() (Luigi Pinca) #42340
[8616e9b58b] - lib: drop fetch experimental warning (Matteo Collina) #45287
[57897f80cd] - lib: fix TypeError when converting a detached buffer source (Kohei Ueno) #44020
[ba0e7ae3dd] - lib: fix AbortSignal.timeout parameter validation (dnalborczyk) #42856
[385d795816] - lib: fix typo in pre_execution.js (Antoine du Hamel) #45039
[4ab1530b9b] - lib: promise version of streams.finished call clean up (Naor Tedgi (Abu Emma)) #44862
[2a3bd11edd] - lib: make properties on Blob and URL enumerable (Khafra) #44918
[f412834151] - lib: support more attributes for early hint link (Yagiz Nizipli) #44874
[1019209306] - meta: update AUTHORS (Node.js GitHub Bot) #45814
[dc862fe786] - meta: update AUTHORS (Node.js GitHub Bot) #45732
[dc5340018f] - meta: add .mailmap entry for Stefan Stojanovic (Rich Trott) #45703
[775f659380] - meta: update AUTHORS info for nstepien (Nicolas Stepien) #45692
[e2da381609] - meta: update AUTHORS (Node.js GitHub Bot) #45637
[29e51e72f9] - meta: update AUTHORS (Node.js GitHub Bot) #45531
[6f8759bc51] - meta: update VoltrexMaster's username (Mohammed Keyvanzadeh) #45503
[404172bb7c] - meta: update AUTHORS (Node.js GitHub Bot) #45443
[221f298078] - meta: be more proactive about removing from teams (Rich Trott) #45352
[28b937ae38] - meta: update AUTHORS (Node.js GitHub Bot) #45333
[255e89dc8c] - meta: update collaborator email address in README (Rich Trott) #45251
[1a726e9dff] - meta: fix email address typo in README (Rich Trott) #45250
[ffd059328b] - meta: remove dont-land-on-v12 auto labeling (Moshe Atlow) #45233
[d7fe2eac07] - meta: update AUTHORS (Node.js GitHub Bot) #45238
[5aa4ea931a] - meta: move a collaborator to emeritus (Rich Trott) #45160
[4fe060e957] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #45036
[9ec6117b65] - meta: update AUTHORS (Node.js GitHub Bot) #45020
[3197b913aa] - module: require.resolve.paths returns null with node schema (MURAKAMI Masahiko) #45147
[bf8d48a881] - module: ensure relative requires work from deleted directories (Bradley Farias) #42384
[2c0f7d47e4] - module: fix segment deprecation for imports field (Guy Bedford) #44883
[a1831dacbf] - net: check autoSelectFamilyAttemptTimeout is positive (Deokjin Kim) #45740
[048795dab0] - (SEMVER-MINOR) net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options (Paolo Insogna) #44731
[e4f7bcff8b] - net: remove _readableState from debug statement (Rich Trott) #45063
[cd4b0626c2] - node-api: address coverity warning (Michael Dawson) #45563
[581b38af13] - node-api: declare type napi_cleanup_hook (Chengzhong Wu) #45391
[44766c6522] - node-api: fix immediate napi_remove_wrap test (Chengzhong Wu) #45406
[746175a272] - node-api: handle no support for external buffers (Michael Dawson) #45181
[b5811c44cb] - node-api,test: fix test_reference_double_free crash (Vladimir Morozov) #44927
[bc5140383c] - os: convert uid and gid to 32-bit signed integers (Luigi Pinca) #42340
[ff03ed1c22] - readline: improve robustness against prototype mutation (Antoine du Hamel) #45614
[b999983c30] - repl: do not define wasi on global with no flag (Kohei Ueno) #45595
[a186a4d7ef] - report: add more memory info (theanarkh) #45254
[a880568afd] - report: add rss and use/kernel cpu usage fields (theanarkh) #45043
[49da5cd0ee] - report,doc: define report version semantics (Gireesh Punathil) #45050
[ae61740325] - src: add internal isArrayBufferDetached (Yagiz Nizipli) #45568
[a58bf148b3] - (SEMVER-MINOR) src: add uvwasi version (Jithil P Ponnan) #45639
[8e1138d354] - src: simplify NodeBIO::GetMethod initialization (Anna Henningsen) #45799
[b88ee545f2] - src: make structuredClone work for process.env (Ben Noordhuis) #45698
[94e6f08606] - src: mark generated snapshot_data as const (Anna Henningsen) #45786
[29f2dabca2] - src: cleanup on disambiguating native modules (Michael Dawson) #45665
[ed0a867a4e] - src: use enum class instead of enum in node_i18n (Deokjin Kim) #45646
[1e48a5a5b0] - src: address coverity warning in node_file.cc (Michael Dawson) #45565
[3f6f8f920f] - src: use qualified std::move call in node_http2 (Michaël Zasso) #45555
[5e63bf3726] - src: avoid unused variables and functions (Michaël Zasso) #45542
[3f5a23281c] - src: add missing include for std::all_of (Michaël Zasso) #45541
[0328208f6c] - src: set an appropriate thread pool size if given --v8-pool-size=0 (Daeyeon Jeong) #45513
[fbfd26da7d] - src: move FsStatsOffset and kFsStatsBufferLength to node_file.h (Joyee Cheung) #45498
[2c6a4fd6fa] - src: don't run tasks on isolate termination (Santiago Gimeno) #45444
[9c39b5ec48] - src: remove the unused PackageConfig class (Joyee Cheung) #45478
[70ca26a858] - src: add --max-semi-space-size to the options allowed in NODE_OPTIONS (Emanuel Hoogeveen) #44436
[5544ce4bdf] - src: condense experimental warning message (Rich Trott) #45424
[9ac7df1c6a] - src: track contexts in the Environment instead of AsyncHooks (Joyee Cheung) #45282
[89b3336120] - src: resolve TODO related to inspector CVEs (Tobias Nießen) #45341
[e05ebe8f9b] - src: print nghttp2 logs when using --debug-nghttp2 (Santiago Gimeno) #45209
[4634aa987d] - src: trace threadpool event (theanarkh) #44458
[bf028a66ef] - src: lock-free init_process_flags (Jérémy Lal) #45221
[8c4ac6dcf5] - src: call uv_library_shutdown before DisposePlatform (theanarkh) #45226
[614d646767] - src: fix crypto.privateEncrypt fails first time (liuxingbaoyu) #42793
[dee882e94f] - src: let http2 streams end after session close (Santiago Gimeno) #45153
[325254cc2c] - src: remap invalid file descriptors using dup2 (Obiwac) #44461
[f748f5df56] - src: remove unused contextify_global_private_symbol (Daeyeon Jeong) #45128
[169b33a24c] - src: forbid running watch mode in REPL (Moshe Atlow) #45058
[57b7023257] - src: fix test runner coverage (Moshe Atlow) #45055
[bf17f8dcb8] - src: optimize ALPN callback (Ben Noordhuis) #44875
[d433d34765] - src: simplify ALPN code, remove indirection (Ben Noordhuis) #44875
[33c78e2340] - src: iwyu in cleanup_queue.cc (Shelley Vohr) #44983
[23aa41394f] - (SEMVER-MINOR) src: add support for externally shared js builtins (Michael Dawson) #44376
[2d2e71c189] - src: refactor BaseObject methods (Joyee Cheung) #44796
[7b992cc229] - src: create BaseObject with node::Realm (Chengzhong Wu) #44348
[a7f3bc0dbc] - src: introduce node::Realm (Chengzhong Wu) #44179
[b11616be6b] - src: support WeakReference in snapshot (Joyee Cheung) #44193
[1ca575501a] - src: iterate over base objects to prepare for snapshot (Joyee Cheung) #44192
[f071028a45] - src: fix cppgc incompatibility in v8 (Shelley Vohr) #43521
[b8290ff7e9] - (SEMVER-MINOR) src: add initial shadow realm support (Chengzhong Wu) #42869
[90e8418e58] - src,lib: group properties used as constants from util binding (Daeyeon Jeong) #45539
[12779b3e02] - src,lib: retrieve parsed source map url from v8 (Chengzhong Wu) #44798
[c5630e2699] - src,node-api: update napi_is_detached_arraybuffer (Daeyeon Jeong) #45538
[122c51b595] - stream: use structuredClone instead of v8 (Yagiz Nizipli) #45611
[2bde576822] - stream: use ArrayBufferPrototypeGetByteLength (Yagiz Nizipli) #45528
[7984e066ca] - stream: add primordials to adapters (Yagiz Nizipli) #45511
[ac9a4aba5d] - stream: avoid premature close when will not emit close (Robert Nagy) #45301
[6f080e2968] - stream: fix typo in adapters.js (#45515) (Kohei Ueno) #45515
[d2998b6166] - stream: add fast path for utf8 (Yagiz Nizipli) #45483
[5f7d2b5c64] - stream: add compose operator (Raz Luvaton) #44937
[70244d0b57] - stream: fix duplexify premature destroy (Robert Nagy) #45133
[1fb6e82f84] - stream: fix web streams have no Symbol.toStringTag (Jithil P Ponnan) #45117
[c514751ff3] - stream: don't push null from closed promise #42694 (David Halls) #45026
[8c2d0f9294] - stream: fix size function returned from QueuingStrategies (Daeyeon Jeong) #44867
[7e386f8cb9] - test: remove flaky parallel/test-process-wrap test (Ben Noordhuis) #45806
[38fb2c1cc8] - test: fix invalid output TAP if there newline in test name (Pulkit Gupta) #45742
[c1162535ae] - test: fix -Wunused-variable on report-fatalerror (Santiago Gimeno) #45747
[13d2df3c20] - test: fix test-watch-mode (Stefan Stojanovic) #45585
[3a5a2ae2ea] - test: fix test-watch-mode-inspect (Stefan Stojanovic) #45586
[7dbc742bca] - test: fix typos in test/parallel (Deokjin Kim) #45583
[3e87834ac7] - test: add trailing commas in event tests (Rich Trott) #45466
[8f7109aea3] - test: add trailing commas in async-hooks tests (#45549) (Antoine du Hamel) #45549
[d5b0844fce] - test: add trailing commas in addons test (#45548) (Antoine du Hamel) #45548
[b1e17b4590] - test: add trailing commas in test/common (#45550) (Antoine du Hamel) #45550
[305d4de72f] - test: revise pull request guide text about code (Rich Trott) #45519
[9f1e5b6a89] - test: enable the WPT for structuredClone (Daeyeon Jeong) #45482
[fac1f1bcd6] - test: add lint rule to enforce trailing commas (Antoine du Hamel) #45468
[cac449f0a0] - test: update uses of _jabber._tcp.google.com (Colin Ihrig) #45451
[19eabd7870] - test: add test to validate changelogs for releases (Richard Lau) #45325
[85c634d899] - test: remove flaky designation for test-worker-http2-stream-terminate (Rich Trott) #45438
[4283af48b0] - test: fix flaky test-repl-sigint-nested-eval (Rich Trott) #45354
[7e0332a46b] - test: skip test-fs-largefile if not enough disk space (Rich Trott) #45339
[ad3b41c858] - test: fix catching failed assertion (Pavel Horal) #45222
[12764fc725] - test: defer invocation checks (Luigi Pinca) #42340
[facb606084] - test: fix test-socket-write-after-fin-error (Luigi Pinca) #42340
[ab9c2df11b] - test: make test-eventemitter-asyncresource.js shorter (Juan José) #45146
[03a3f30cb1] - test: convert test-debugger-pid to async/await (Luke Karrys) #45179
[d718c675d8] - test: improve test coverage in test-event-capture-rejections.js (Juan José) #45148
[fe91ac15be] - test: fix timeout of test-heap-prof.js in riscv devices (Yu Gu) #42674
[a110cac4f3] - test: deflake test-http2-empty-frame-without-eof (Santiago Gimeno) #45212
[c890136934] - test: use common/tmpdir in watch-mode ipc test (Richard Lau) #45211
[7b8380dd73] - test: use uv_sleep() where possible (Santiago Gimeno) #45124
[7a7dab4160] - test: fix typo in test/parallel/test-fs-rm.js (Tim Shilov) #44882
[c87770b39b] - test: remove a snapshot blob from test-inspect-address-in-use.js (Daeyeon Jeong) #45132
[a0f8d8b806] - test: add test for Module._stat (Darshan Sen) #44713
[a8030b9517] - test: watch mode inspect restart repeatedly (Moshe Atlow) #45060
[52808d7d71] - test: remove experimental-wasm-threads flag (Michaël Zasso) #45074
[b3c4265a95] - test: remove unnecessary noop function args to mustCall() (Antoine du Hamel) #45047
[868b4a3d67] - test: mark test-watch-mode* as flaky on all platforms (Pierrick Bouvier) #45049
[0d9ccc850e] - test: wrap missing common.mustCall (Moshe Atlow) #45064
[8fffd05b85] - test: remove mentions of --experimental-async-stack-tagging-api flag (Simon) #45051
[fc58b61e82] - test: improve assertions in test-repl-unsupported-option.js (Juan José) #44953
[e5928abef7] - test: remove unnecessary noop function args to mustCall() (Rich Trott) #45027
[d86fcbfd6e] - test: update WPT resources (Khaidi Chu) #44948
[d103d779d3] - test: skip test depending on overlapped-checker when not available (Antoine du Hamel) #45015
[5544c55600] - test: improve test coverage for os package (Juan José) #44959
[6e3227b0fd] - test: add test to improve coverage in http2-compat-serverresponse (Cesar Mario Diaz) #44970
[dfc2419ab4] - test: improve test coverage in test-child-process-spawn-argv0.js (Juan José) #44955
[89a1c57436] - test: use CHECK instead of EXPECT where necessary (Tobias Nießen) #44795
[657756fc06] - test: refactor promises to async/await (Madhuri) #44980
[55cf4b5042] - test: fix textdecoder test for small-icu builds (Richard Lau) #45225
[e2df332ea7] - test: add a test to ensure the correctness of timezone upgrades (Darshan Sen) #45299
[a2e5126227] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #45569
[69c1f2a021] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #45165
[24e2a4fbd7] - test_runner: refactor tap_lexer to use more primordials (Antoine du Hamel) #45744
[3cee3ca5ae] - test_runner: refactor tap_parser to use more primordials (Antoine du Hamel) #45745
[449326639d] - (SEMVER-MINOR) test_runner: add t.after() hook (Colin Ihrig) #45792
[370ad455d6] - (SEMVER-MINOR) test_runner: don't use a symbol for runHook() (Colin Ihrig) #45792
[500024384a] - test_runner: add resetCalls to MockFunctionContext (MURAKAMI Masahiko) #45710
[ed9246f6fc] - test_runner: don't parse TAP from stderr (Colin Ihrig) #45618
[a56560f6fc] - test_runner: add getter and setter to MockTracker (MURAKAMI Masahiko) #45506
[20f6fa3edd] - test_runner: remove stdout and stderr from error (Colin Ihrig) #45592
[16bedbabce] - test_runner: add initial TAP parser (Wassim Chegham) #43525
[55b64e0b14] - test_runner: support watch mode (Moshe Atlow) #45214
[92909f6855] - test_runner: support function mocking (Colin Ihrig) #45326
[0f69b6c26d] - test_runner: fix afterEach not running on test failures (Jithil P Ponnan) #45204
[a67da59313] - test_runner: report tap subtest in order (Moshe Atlow) #45220
[a59c907e14] - test_runner: call {before,after}Each() on suites (Colin Ihrig) #45161
[64860dd01f] - test_runner: add extra fields in AssertionError YAML (Bryan English) #44952
[979d8376bd] - tls: remove trustcor root ca certificates (Ben Noordhuis) #45776
[10cc827ebf] - (SEMVER-MINOR) tls: add "ca" property to certificate object (Ben Noordhuis) #44935
[8336e32713] - tools: update lint-md-dependencies (Node.js GitHub Bot) #45730
[aa57f6c362] - tools: add GitHub token permissions to label flaky-test issues (Gabriela Gutierrez) #45308
[79b3ee14a5] - tools: remove dependency vulnerability checker (Facundo Tuesca) #45675
[496a528149] - tools: update lint-md-dependencies to rollup@3.4.0 (Node.js GitHub Bot) #45638
[346132926d] - tools: update doc to highlight.js@11.7.0 (Node.js GitHub Bot) #45636
[610341f241] - tools: update eslint to 8.28.0 (Node.js GitHub Bot) #45532
[682a730131] - tools: add automation for updating libuv dependency (Facundo Tuesca) #45362
[360c7be315] - tools: add missing step in update-base64.sh script (Facundo Tuesca) #45509
[e52f0472bb] - tools: update certdata.txt (Luigi Pinca) #45490
[ad8c6c91b5] - tools: include current release in the list of released versions (Antoine du Hamel) #45463
[7641044eff] - tools: update lint-md-dependencies to rollup@3.3.0 (Node.js GitHub Bot) #45442
[f5a4c52278] - tools: do not run CQ on non-fast-tracked PRs open for less than 2 days (Moshe Atlow) #45407
[0f45c90533] - tools: simplify .eslintrc.js (Rich Trott) #45397
[172cbfefa8] - tools: simplify regex in ESLint config (Rich Trott) #45399
[456f048e0e] - tools: enable jsdoc/require-property-description rule (Rich Trott) #45370
[6fafec351a] - tools: dynamically determine parallelism on GitHub Actions macOS (Rich Trott) #45350
[2ca30cacee] - tools: add automation for updating acorn dependency (Facundo Tuesca) #45357
[04f213b44c] - tools: add documentation regarding our api tooling (Claudio Wunder) #45270
[c63d825681] - tools: allow scripts to run from anywhere (Luigi Pinca) #45361
[1b0b68037a] - tools: update eslint to 8.27.0 (Node.js GitHub Bot) #45358
[398ca2496b] - tools: update eslint to 8.26.0 (Node.js GitHub Bot) #45243
[3053c65fb1] - tools: update lint-md-dependencies to rollup@3.2.5 (Node.js GitHub Bot) #45332
[510506027b] - tools: fix stability index generation (Antoine du Hamel) #45346
[e0a8effbc1] - tools: increase macOS cores to 3 on GitHub CI (Rich Trott) #45340
[75a146f436] - tools: add automation for updating base64 dependency (Facundo Tuesca) #45300
[13390e94af] - tools: fix request-ci-failed comment (Antoine du Hamel) #45291
[a93c4f7e41] - tools: update lint-md-dependencies (Node.js GitHub Bot) #45237
[078be3ba21] - tools: fix request-ci-failed comment (Antoine du Hamel) #45218
[62c233c221] - tools: keep Emeriti lists case-insensitive alphabetic (Rich Trott) #45159
[d07a5e25b0] - tools: update actions/setup-python to v4 (Yagiz Nizipli) #45178
[48cf8905f7] - tools: update V8 gypfiles for RISC-V (Andreas Schwab) #45149
[0cbd2c6f8d] - tools: fix create-or-update-pull-request-action hash on GHA (Antoine du Hamel) #45166
[cd911d72ab] - tools: update gr2m/create-or-update-pull-request-action (Luigi Pinca) #45022
[ee78e2e0ec] - tools: do not use the set-output command in workflows (Luigi Pinca) #45024
[f98a6967e6] - tools: update lint-md-dependencies (Node.js GitHub Bot) #45019
[71433f3127] - tools: refactor dynamic strings creation in shell scripts (Antoine du Hamel) #45240
[f08c129144] - tools: use Python 3.11 in GitHub Actions workflows (Luigi Pinca) #45191
[76897430ed] - tools: have test-asan use ubuntu-20.04 (Filip Skokan) #45581
[210cbcbf89] - trace_events: add new categories (theanarkh) #45266
[20a39a34e0] - trace_events: fix getCategories (theanarkh) #45092
[597c7fcbab] - url: remove unnecessary object call to kFormat (Yagiz Nizipli) #45492
[5d964cd4d4] - url: remove \t \n \r in url.parse() similar to WHATWG (Rich Trott) #45116
[eb81b6f0fb] - url: improve url.parse() compliance with WHATWG URL (Rich Trott) #45011
[3f18a833ff] - util: use private symbols in JS land directly (Joyee Cheung) #45379
[32a3859a90] - util: add fast path for utf8 encoding (Yagiz Nizipli) #45412
[cd740d0b0d] - util: improve text decoder performance (Yagiz Nizipli) #45388
[1dc91abddf] - util: improve text-decoder performance (Yagiz Nizipli) #45363
[4730850972] - util: improve textdecoder decode performance (Yagiz Nizipli) #45294
[717b604da7] - (SEMVER-MINOR) util: add MIME utilities (#21128) (Bradley Farias) #21128
[39cf8b4f16] - vm: make ContextifyContext a BaseObject (Joyee Cheung) #44796
[09ea75823c] - watch: add CLI flag to preserve output (Debadree Chatterjee) #45717
[24bfe543c5] - watch: watch for missing dependencies (Moshe Atlow) #45348

2022-11-03, Version 18.12.1 'Hydrogen' (LTS), @juanarbol

This is a security release.

Notable changes

The following CVEs are fixed in this release:

CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High)
CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High)
CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium)

More detailed information on each of the vulnerabilities can be found in November 2022 Security Releases blog post.

Commits

[39f8a672e3] - deps: update archs files for quictls/openssl-3.0.7+quic nodejs/node#45286
[80218127c8] - deps: upgrade openssl sources to quictls/openssl-3.0.7+quic nodejs/node#45286
[165342beac] - inspector: harden IP address validation again (Tobias Nießen) nodejs-private/node-private#354

2022-10-25, Version 18.12.0 'Hydrogen' (LTS), @ruyadorno and @RafaelGSS

Notable Changes

This release marks the transition of Node.js 18.x into Long Term Support (LTS) with the codename 'Hydrogen'. The 18.x release line now moves into "Active LTS" and will remain so until October 2023. After that time, it will move into "Maintenance" until end of life in April 2025.

2022-10-13, Version 18.11.0 (Current), @danielleadams

Notable changes

watch mode (experimental)

Running in 'watch' mode using node --watch restarts the process when an imported file is changed.

Contributed by Moshe Atlow in #44366

Other notable changes

fs:
- (SEMVER-MINOR) add FileHandle.prototype.readLines (Antoine du Hamel) #42590
http:
- (SEMVER-MINOR) add writeEarlyHints function to ServerResponse (Wing) #44180
http2:
- (SEMVER-MINOR) make early hints generic (Yagiz Nizipli) #44820
lib:
- (SEMVER-MINOR) refactor transferable AbortSignal (flakey5) #44048
src:
- (SEMVER-MINOR) add detailed embedder process initialization API (Anna Henningsen) #44121
util:
- (SEMVER-MINOR) add default value option to parsearg (Manuel Spigolon) #44631

Commits

[27b4b782ce] - benchmark: add vm context global proxy benchmark (Joyee Cheung) #44796
[4e82521af1] - bootstrap: update comments in bootstrap/node.js (Joyee Cheung) #44726
[725be0ea50] - buffer: initialize TextDecoder once on blob.text() (Yagiz Nizipli) #44787
[653c3b1f62] - buffer,lib: update atob to align wpt's base64.json (Khaidi Chu) #43901
[37808b3355] - build: convert V8 test JSON to JUnit XML (Keyhan Vakil) #44049
[f92871a52b] - build: update timezone-update.yml (Alex) #44717
[f85d3471ee] - child_process: remove lookup of undefined property (Colin Ihrig) #44766
[2f5f41c315] - (SEMVER-MINOR) cli: add --watch (Moshe Atlow) #44366
[7fb9cc70f3] - cluster: use inspector utils (Moshe Atlow) #44592
[99a2c16040] - crypto: add causes to applicable webcrypto's OperationError (Filip Skokan) #44890
[e0fbba0939] - crypto: use EVP_PKEY_CTX_set_dsa_paramgen_q_bits when available (David Benjamin) #44561
[a90386b0a1] - deps: update undici to 5.11.0 (Node.js GitHub Bot) #44929
[aa68d40fbf] - deps: update corepack to 0.14.2 (Node.js GitHub Bot) #44775
[c892f35815] - deps: V8: fix debug build (Ben Noordhuis) #44392
[91514393dc] - dns: support dns module in the snapshot (Joyee Cheung) #44633
[ce3cb29319] - doc: add fsPromises.readFile() example (Tierney Cyren) #40237
[97df9b84a2] - doc: improve building doc for Android (BuShe Pie) #44888
[8c69da893b] - doc: mention corepack prepare supports tag or range (Michael Rienstra) #44646
[842bc64833] - doc: remove Legacy status from querystring (Rich Trott) #44912
[ddb5402f5f] - doc: fix label name in collaborator guide (Rich Trott) #44920
[d08b024a3d] - doc: fix typo in Node.js 12 changelog (Lorand Horvath) #42880
[b6b9c427c5] - doc: move release keys we don't use anymore in README (Rich Trott) #44899
[e92b074b32] - doc: fix grammar in dns docs (#44850) (Colin Ihrig) #44850
[780144c339] - doc: remove unnecessary leading commas (Colin Ihrig) #44854
[6ae9bc8fbc] - doc: add extra step for reporter pre-approval (Rafael Gonzaga) #44806
[ccf31d8bca] - doc: add anchor link for --preserve-symlinks (Kohei Ueno) #44858
[7c5c19ee54] - doc: update node prefix require.cache example (Simone Busoli) #44724
[2a5bce6318] - doc: include last security release date (Vladimir de Turckheim) #44794
[4efaf4265c] - doc: remove "currently" and comma splice from child_process.md (Rich Trott) #44789
[3627616b40] - doc,crypto: mark experimental algorithms more visually (Filip Skokan) #44892
[3c653cf23a] - doc,crypto: add missing CFRG curve algorithms to supported lists (Filip Skokan) #44876
[70f55020d3] - doc,crypto: add null length to crypto.subtle.deriveBits (Filip Skokan) #44876
[910fbd0ece] - esm: fix duplicated test (Geoffrey Booth) #44779
[bc00f3bde1] - fs: fix opts.filter issue in cp async (Tho) #44922
[11d1c23fa0] - (SEMVER-MINOR) fs: add FileHandle.prototype.readLines (Antoine du Hamel) #42590
[67fb76519a] - fs: improve promise based readFile performance for big files (Ruben Bridgewater) #44295
[dc6379bdc2] - fs: don't hard code name in validatePosition() (Colin Ihrig) #44767
[eb19b1e97c] - http: be more aggressive to reply 400, 408 and 431 (ywave620) #44818
[4c869c8d9e] - (SEMVER-MINOR) http: add writeEarlyHints function to ServerResponse (Wing) #44180
[9c7e66478c] - (SEMVER-MINOR) http2: make early hints generic (Yagiz Nizipli) #44820
[3f20e5b15c] - (SEMVER-MINOR) lib: refactor transferable AbortSignal (flakey5) #44048
[ada7d82b16] - lib: require JSDoc in internal validators code (Rich Trott) #44896
[67eaa303af] - lib: add cause to DOMException (flakey5) #44703
[0db86ee98e] - meta: update AUTHORS (Node.js GitHub Bot) #44930
[2efe4d985b] - meta: label test.js and test.md with test_runner label (Moshe Atlow) #44863
[fd9feb3a6c] - meta: update AUTHORS (Node.js GitHub Bot) #44857
[a854bb39c9] - node-api: create reference only when needed (Gerhard Stöbich) #44827
[fd5c26b8db] - path: change basename() argument from ext to suffix (Rich Trott) #44774
[803fbfb168] - process: fix uid/gid validation to avoid crash (Tobias Nießen) #44910
[9f2dd48fc3] - src: remove uid_t/gid_t casts (Tobias Nießen) #44914
[3abb607f3a] - src: remove UncheckedMalloc(0) workaround (Tobias Nießen) #44543
[0606f9298f] - src: deduplicate setting RSA OAEP label (Tobias Nießen) #44849
[daf3152f7e] - src: implement GetDetachedness() in MemoryRetainerNode (Joyee Cheung) #44803
[7ca77dd4ef] - src: avoid X509_free in loops in crypto_x509.cc (Tobias Nießen) #44855
[781ad96227] - src: use OnScopeLeave instead of multiple free() (Tobias Nießen) #44852
[b27b336a7a] - src: remove ParseIP() in cares_wrap.cc (Tobias Nießen) #44771
[f99f5d3c01] - (SEMVER-MINOR) src: add detailed embedder process initialization API (Anna Henningsen) #44121
[281fd7a09a] - src,stream: improve DoWrite() and Write() (ywave620) #44434
[a33cc22bf7] - src,worker: fix race of WorkerHeapSnapshotTaker (ywave620) #44745
[f300f197da] - stream: handle enqueuing chunks when a pending BYOB pull request exists (Daeyeon Jeong) #44770
[9ac029ea11] - test: bump memory limit for abort fatal error (Danielle Adams) #44984
[b9b671f25f] - test: debug watch mode inspect (Moshe Atlow) #44861
[2308b71d09] - test: don't clobber RegExp.$_ on startup (Ben Noordhuis) #44864
[fe91bebb67] - test: loosen test for negative timestamps in test-fs-stat-date (Livia Medeiros) #44707
[a080608552] - test: check --test is disallowed in NODE_OPTIONS (Kohei Ueno) #44846
[dc2af265d7] - test: improve lib/internal/source_map/source_map.js coverage (MURAKAMI Masahiko) #42771
[60a05d6dea] - test: skip some binding tests on IBMi PASE (Richard Lau) #44810
[8dacedaa3d] - test: remove unused variable in addon test (Joyee Cheung) #44809
[c54cee1c3f] - test: check server status in test-tls-psk-client (Richard Lau) #44824
[ee3c6a4dc5] - test: use async/await in test-debugger-exceptions (pete3249) #44690
[9f14625fe5] - test: use async/await in test-debugger-help (Chandana) #44686
[8033ad846b] - test: update test-debugger-scripts to use await/async (mmeenapriya) #44692
[f4f08be384] - test: use await in test-debugger-invalid-json (Anjana Krishnakumar Vellore) #44689
[d2f36169f3] - test: use async/await in test-debugger-random-port-with-inspect-port (Monu-Chaudhary) #44695
[ddf029725b] - test: use async/await in test-debugger-heap-profiler (Brinda Ashar) #44693
[117f068250] - test: use async/await in test-debugger-auto-resume (samyuktaprabhu) #44675
[143c428cae] - test: migrated from Promise chains to Async/Await (Rathi N Das) #44674
[e609a3309c] - test: change promises to async/await in test-debugger-backtrace.js (Juliet Zhang) #44677
[eeabd23ca6] - test: use async/await in test-debugger-sb-before-load (Hope Olaidé) #44697
[5c63d1464e] - test: add extra tests for basename with ext option (Connor Burton) #44772
[f8b2d7a059] - test: refactor to async/await (Divya Mohan) #44694
[9864bde9ab] - test: modify test-debugger-custom-port.js to use async-await (Priya Shastri) #44680
[af30823881] - test: upgrade all 1024 bit RSA keys to 2048 bits (Momtchil Momtchev) #44498
[0fb669e31f] - test: update test-debugger-breakpoint-exists.js to use async/await (Archana Kamath) #44682
[cca253503e] - test: use async/await in test-debugger-preserve-breaks (poorvitusam) #44696
[0b2e8b1681] - test: use async/await in test-debugger-profile (surbhirjain) #44684
[4db72a65cf] - test: change the promises to async/await in test-debugger-exec-scope.js (Ankita Khiratkar) #44685
[56c9c98963] - test: fix test-runner-inspect (Moshe Atlow) #44620
[36227ed862] - test: fix watch mode test flake (Moshe Atlow) #44739
[3abd71a0ea] - test: deflake watch mode tests (Moshe Atlow) #44621
[0c9f38f2be] - test: split watch mode inspector tests to sequential (Moshe Atlow) #44551
[d762a34128] - test_runner: add --test-name-pattern CLI flag (Colin Ihrig)
[c7ece464a1] - test_runner: remove runtime experimental warning (Colin Ihrig) #44844
[3c1e9d41c8] - test_runner: support using --inspect with --test (Moshe Atlow) #44520
[4bdef48732] - tools: remove faulty early termination logic from update-timezone.mjs (Darshan Sen) #44870
[19d8574996] - tools: fix timezone update tool (Darshan Sen) #44870
[ad8b8ae7d3] - tools: update eslint to 8.25.0 (Node.js GitHub Bot) #44931
[fd99b17a4d] - tools: make utils.SearchFiles deterministic (Bruno Pitrus) #44496
[131adece37] - tools: fix typo in tools/update-authors.mjs (Darshan Sen) #44780
[ab22777e65] - tools: refactor deprecated format in no-unescaped-regexp-dot (Madhuri) #44763
[3ad0fae89d] - tools: update eslint-check.js to object style (andiemontoyeah) #44706
[e9d572a9bd] - tools: update eslint to 8.24.0 (Node.js GitHub Bot) #44778
[984b0b4a6c] - tools: update lint-md-dependencies to rollup@2.79.1 (Node.js GitHub Bot) #44776
[db5aeed702] - (SEMVER-MINOR) util: add default value option to parsearg (Manuel Spigolon) #44631
[576ccdf125] - util: increase robustness with primordials (Jordan Harband) #41212

2022-09-28, Version 18.10.0 (Current), @RafaelGSS

Notable changes

doc:
- (SEMVER-MINOR) deprecate modp1, modp2, and modp5 groups (Tobias Nießen) #44588
- add legendecas to TSC list (Michael Dawson) #44662
- move policy docs to the permissions scope (Rafael Gonzaga) #44222
gyp:
- libnode for ios app embedding (chexiongsheng) #44210
http:
- (SEMVER-MINOR) throw error on content-length mismatch (sidwebworks) #44588
stream:
- (SEMVER-MINOR) add ReadableByteStream.tee() (Daeyeon Jeong) #44505

Commits

[f497368679] - benchmark: fix startup benchmark (Evan Lucas) #44727
[0c9a94684e] - benchmark: add stream destroy benchmark (SindreXie) #44533
[9c5c1459a8] - bootstrap: clean up inspector console methods during serialization (Joyee Cheung) #44279
[19f67dba8a] - bootstrap: remove unused global parameter in per-context scripts (Joyee Cheung) #44472
[9da11426f6] - build: remove redundant entry in crypto (Jiawen Geng) #44604
[70898b4e67] - build: rewritten the Android build system (BuShe Pie) #44207
[a733f7faac] - Revert "build: go faster, drop -fno-omit-frame-pointer" (Ben Noordhuis) #44566
[1315a83333] - build: fix bad upstream merge (Stephen Gallagher) #44642
[993bd9b134] - crypto: restrict PBKDF2 args to signed int (Tobias Nießen) #44575
[ca5fb67b4e] - deps: update to ngtcp2 0.8.1 and nghttp3 0.7.0 (Tobias Nießen) #44622
[8da1d6ebc4] - deps: update corepack to 0.14.1 (Node.js GitHub Bot) #44704
[d36c4a3088] - deps: update ngtcp2 update instructions (Tobias Nießen) #44619
[7129106aa0] - deps: upgrade npm to 8.19.2 (npm team) #44632
[3cc8f4bb56] - deps: update to uvwasi 0.0.13 (Colin Ihrig) #44524
[4686579d4b] - dns: remove unnecessary parameter from validateOneOf (Yagiz Nizipli) #44635
[729dd95f1f] - dns: refactor default resolver (Joyee Cheung) #44541
[6dc038262a] - doc: mention git node backport (RafaelGSS) #44764
[fd971f5176] - doc: ensure to revert node_version changes (Rafael Gonzaga) #44760
[f274b08f8e] - doc: fix description for napi_get_cb_info() in n-api.md (Daeyeon Jeong) #44761
[2502f2353d] - doc: update the deprecation for exit code to clarify its scope (Daeyeon Jeong) #44714
[064543d0ae] - doc: update guidance for adding new modules (Michael Dawson) #44576
[33a2f17534] - doc: add registry number for Electron 22 (Keeley Hammond) #44748
[10a0d75c26] - doc: include code examples for webstreams consumers (Lucas Santos) #44387
[4dbe4a010c] - doc: mention where to push security commits (RafaelGSS) #44691
[82cb8151ad] - doc: remove extra space on threadpool usage (Connor Burton) #44734
[6ef9af2748] - doc: make legacy banner slightly less bright (Rich Trott) #44665
[b209c83e66] - doc: improve building doc for Windows Powershell (Brian Muenzenmeyer) #44625
[05b17e9250] - doc: maintain only one list of MODP groups (Tobias Nießen) #44644
[ec1cbdb69b] - doc: add legendecas to TSC list (Michael Dawson) #44662
[9341fb4446] - doc: remove comma in README.md (Taha-Chaudhry) #44599
[3dabb44dda] - doc: use serial comma in report docs (Daeyeon Jeong) #44608
[226d90a95a] - doc: use serial comma in stream docs (Daeyeon Jeong) #44609
[3f710fa636] - doc: remove empty line in YAML block (Claudio Wunder) #44617
[4ad1b0abc3] - (SEMVER-MINOR) doc: deprecate modp1, modp2, and modp5 groups (Tobias Nießen) #44588
[2d92610525] - doc: remove old OpenSSL ENGINE constants (Tobias Nießen) #44589
[03705639c4] - doc: fix heading levels for test runner hooks (Fabian Meyer) #44603
[6c557346a7] - doc: fix errors in http.md (Luigi Pinca) #44587
[48d944b71c] - doc: fix vm.Script createCachedData example (Chengzhong Wu) #44487
[2813323120] - doc: mention how to get commit release (Rafael Gonzaga) #44572
[ea7b44d474] - doc: fix link in process.md (Antoine du Hamel) #44594
[39b65d2fb7] - doc: do not use weak MODP group in example (Tobias Nießen) #44585
[f5549afd90] - doc: remove ebpf from supported tooling list (Rafael Gonzaga) #44549
[a3360b1f4f] - doc: emphasize that createCipher is never secure (Tobias Nießen) #44538
[4e6f7862ba] - doc: document attribute Script.cachedDataRejected (Chengzhong Wu) #44451
[01e584ecab] - doc: move policy docs to the permissions scope (Rafael Gonzaga) #44222
[57dac53c22] - doc,crypto: cleanup removed pbkdf2 behaviours (Filip Skokan) #44733
[c209bd6fb9] - doc,inspector: document changes of inspector.close (Chengzhong Wu) #44628
[9b3b7d6978] - esm,loader: tidy ESMLoader internals (Jacob Smith) #44701
[daf63d2fa3] - fs: fix typo in mkdir example (SergeyTsukanov) #44791
[85ab2f857f] - fs: remove unused option in fs.fstatSync() (Livia Medeiros) #44613
[a6091f5496] - gyp: libnode for ios app embedding (chexiongsheng) #44210
[f158656e4c] - (SEMVER-MINOR) http: throw error on content-length mismatch (sidwebworks) #44378
[1b160517f5] - inspector: expose inspector.close on workers (Chengzhong Wu) #44489
[a2eb55a2c9] - lib: don't match sourceMappingURL in strings (Alan Agius) #44658
[2baf532518] - lib: fix reference leak (falsandtru) #44499
[d8d34ae6bc] - lib: reset RegExp statics before running user code (Antoine du Hamel) #44247
[eb3635184b] - lib,test: fix bug in InternalSocketAddress (Tobias Nießen) #44618
[74dc4d198f] - meta: update AUTHORS (Node.js GitHub Bot) #44777
[97d2ed7296] - meta: add mailmap entry for dnlup (Rich Trott) #44716
[35fbd2cc14] - meta: update AUTHORS (Node.js GitHub Bot) #44705
[c5c1bc40a2] - meta: move dnlup to emeriti (dnlup) #44667
[c62dfe0427] - meta: update test_runner in label-pr-config (Shrujal Shah) #44615
[fe56efd0bc] - meta: update AUTHORS (Node.js GitHub Bot) #44591
[4436ffb536] - module: open stat/readPackage to mutations (Maël Nison) #44537
[f8ec946c82] - module: exports & imports map invalid slash deprecation (Guy Bedford) #44477
[64cb43a2b6] - node-api: add deprecation code of uncaught exception (Chengzhong Wu) #44624
[ce1704c2c7] - src: avoid using v8 on Isolate termination (Santiago Gimeno) #44669
[3036b85d71] - src: remove <unistd.h> from node_os.cc (Tobias Nießen) #44668
[29f57b7899] - src: avoid copy when creating Blob (Tobias Nießen) #44616
[75cfb13ea6] - src: make ReqWrap weak (Rafael Gonzaga) #44074
[c12abb5ece] - src: make NearHeapLimitCallback() more robust (Joyee Cheung) #44581
[81ea507e8e] - src: dump isolate stats when process exits (daomingq) #44534
[687844822f] - src: consolidate environment cleanup queue (Chengzhong Wu) #44379
[3d42aaaac0] - stream: handle a pending pull request from a released reader (Daeyeon Jeong) #44702
[73ad9db6c5] - stream: refactor use es2020 statement (SindreXie) #44533
[0af6e420b3] - stream: remove abortReason from WritableStreamDefaultController (Daeyeon Jeong) #44540
[2f2f8d5821] - (SEMVER-MINOR) stream: add ReadableByteStream.tee() (Daeyeon Jeong) #44505
[667e8bf3fb] - stream: fix writableStream.abort() (Daeyeon Jeong) #44327
[3112d5dae0] - test: verify napi_remove_wrap with napi_delete_reference (Chengzhong Wu) #44754
[b512436841] - test: change promises to async/await (Madhulika Sharma) #44683
[858631f720] - test: use async/await in test-debugger-invalid-args (Nupur Chauhan) #44678
[6c9ded810c] - test: update test-debugger-low-level to use await/async (Meghana Ramesh) #44688
[945aa74e57] - test: check that sysconf returns a positive value (Tobias Nießen) #44666
[79f0f48a6f] - test: change promise to async/await in debugger-watcher (“Pooja) #44687
[a56cb65bd6] - test: fix addon tests compilation with OpenSSL 1.1.1 (Adam Majer) #44725
[8a68a80a06] - test: fix test-performance-measure (smitley) #44637
[55de0136b3] - test: improve lib/readline.js coverage (MURAKAMI Masahiko) #42686
[a3095d217f] - test: fix test-repl not validating leaked globals properly (Antoine du Hamel) #44640
[7db2974692] - test: ignore stale process cleanup failures on Windows (Joyee Cheung) #44480
[6c35f338c3] - test: use python3 instead of python (Luigi Pinca) #44545
[20e04c6d44] - test: fix DebugSymbolsTest.ReqWrapList on PPC64LE (Daniel Bevenius) #44341
[eb25fe73b0] - test: add more cases for parse-encoding (Tony Gorez) #44427
[5ab3bc9419] - test_runner: include stack of uncaught exceptions (Moshe Atlow) #44614
[752e1472e1] - tls: fix out-of-bounds read in ClientHelloParser (Tobias Nießen) #44580
[0cddb0af99] - tools: add update-llhttp.sh (Paolo Insogna) #44652
[ef0dc47df9] - tools: fix typo in update-nghttp2.sh (Luigi Pinca) #44664
[0df181a5a1] - tools: add timezone update workflow (Lenvin Gonsalves) #43988
[dd4348900d] - tools: update eslint to 8.23.1 (Node.js GitHub Bot) #44639
[b9cfb71e12] - tools: update lint-md-dependencies to @rollup/plugin-node-resolve@14.1.0 (Node.js GitHub Bot) #44638
[5ae142d7ad] - tools: update gyp-next to v0.13.0 (Jiawen Geng) #44605
[5dd86c3faf] - tools: update lint-md-dependencies to @rollup/plugin-node-resolve@14.0.1 (Node.js GitHub Bot) #44590
[caad4748cf] - tools: increase timeout of running WPT (Joyee Cheung) #44574
[5db9779f14] - tools: fix shebang to use python3 by default (Himself65) #44531
[9aa6a560e9] - v8: add setHeapSnapshotNearHeapLimit (theanarkh) #44420
[360b74e94f] - win: fix fs.realpath.native for long paths (StefanStojanovic) #44536

2022-09-23, Version 18.9.1 (Current), @RafaelGSS

This is a security release.

Notable changes

The following CVEs are fixed in this release:

CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
- Insufficient fix for macOS devices on v18.5.0
CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium)
CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)
- Insufficient fix on v18.5.0
CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)
- Insufficient fix on v18.5.0
CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)
CVE-2022-35255: Weak randomness in WebCrypto keygen

More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post.

llhttp updated to 6.0.10

llhttp is updated to 6.0.10 which includes fixes for the following vulnerabilities.

HTTP Request Smuggling - CVE-2022-32213 bypass via obs-fold mechanic (Medium)(CVE-2022-32213 ): The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215): The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)(CVE-35256): The llhttp parser in the http does not correctly handle header fields that are not terminated with CLRF. This can lead to HTTP Request Smuggling (HRS).

Commits

[0c2a5723be] - crypto: fix weak randomness in WebCrypto keygen (Ben Noordhuis) nodejs-private/node-private#
[ffb6f4d51d] - deps: MacOS - fix location of OpenSSL config file (Michael Dawson) nodejs-private/node-private#345
[01bffcdd93] - http: disable chunked encoding when OBS fold is used (Paolo Insogna) nodejs-private/node-private#341
[2c379d341d] - src: fix IPv4 non routable validation (RafaelGSS) nodejs-private/node-private#337

2022-09-08, Version 18.9.0 (Current), @RafaelGSS

Notable changes

doc
- add daeyeon to collaborators (Daeyeon Jeong) #44355
lib
- (SEMVER-MINOR) add diagnostics channel for process and worker (theanarkh) #44045
os
- (SEMVER-MINOR) add machine method (theanarkh) #44416
report
- (SEMVER-MINOR) expose report public native apis (Chengzhong Wu) #44255
src
- (SEMVER-MINOR) expose environment RequestInterrupt api (Chengzhong Wu) #44362
vm
- include vm context in the embedded snapshot (Joyee Cheung) #44252

Commits

[e27e709d3c] - build: add --libdir flag to configure (Stephen Gallagher) #44361
[30da2b4d89] - build: added NINJA env to customize ninja binary (Jeff Dickey) #44293
[3c5354869e] - cluster: fix cluster rr distribute error (theanarkh) #44202
[5cefd02618] - crypto: handle invalid prepareAsymmetricKey JWK inputs (Filip Skokan) #44475
[c868e36385] - crypto: add digest name to INVALID_DIGEST errors (Tobias Nießen) #44468
[35cbe1ad85] - crypto: use actual option name in error message (Tobias Nießen) #44455
[c3dbe18e4c] - crypto: simplify control flow in HKDF (Tobias Nießen) #44272
[28781a1f7e] - crypto: improve RSA-PSS digest error messages (Tobias Nießen) #44307
[b1eafe14fd] - debugger: decrease timeout used to wait for the port to be free (Joyee Cheung) #44359
[8ef5c40a83] - deps: update corepack to 0.14.0 (Node.js GitHub Bot) #44509
[cf19a79dfc] - deps: upgrade npm to 8.19.1 (npm team) #44486
[c5630ad1a7] - deps: V8: backport ff8d67c88449 (Michaël Zasso) #44423
[255e7fbd08] - deps: update Acorn to v8.8.0 (Michaël Zasso) #44437
[754d26a53e] - deps: patch V8 to 10.2.154.15 (Michaël Zasso) #44294
[1b50ff2600] - deps: update icu tzdata to 2022b (Matías Zúñiga) #44283
[1e451dca99] - deps: upgrade llhttp to 6.0.9 (Paolo Insogna) #44344
[57da3db522] - deps: update undici to 5.10.0 (Node.js GitHub Bot) #44319
[1c87a7e8f6] - doc: add missing parenthesis in TLSSocket section (Tobias Nießen) #44512
[05006eddb2] - doc: do not use "Returns:" for crypto.constants (Tobias Nießen) #44481
[54b6ed58bc] - doc: use serial comma in addons docs (Tobias Nießen) #44482
[11452a97b3] - doc: add --update-assert-snapshot to node.1 (Colin Ihrig) #44429
[ae028e8ac3] - doc: improve assert.snapshot() docs (Colin Ihrig) #44429
[71c869688a] - doc: add missing imports in events sample code (Brian Evans) #44337
[92046e8027] - doc: apply scroll-margin-top to h2, h3 elements (metonym) #44414
[3e6cde5931] - doc: fix spacing issue in --build-snapshot help text (Shohei YOSHIDA) #44435
[8e41dbb81b] - doc: mention cherry-pick edge-case on release (RafaelGSS) #44408
[cef30f9afc] - doc: note on release guide to update main branch (Ruy Adorno) #44384
[21437f7a7f] - doc: fix release guide example consistency (Ruy Adorno) #44385
[ed52bd0a18] - doc: fix style of n-api.md (theanarkh) #44377
[65c1f4015f] - doc: add history for net.createServer() options (Luigi Pinca) #44326
[4a0f750a6c] - doc: add daeyeon to collaborators (Daeyeon Jeong) #44355
[8cc5556f76] - doc: fix typo in test runner code examples (Moshe Atlow) #44351
[b660b7467d] - doc,worker: document resourceLimits overrides (Keyhan Vakil) #43992
[2ed3b30696] - inspector: prevent integer overflow in open() (Tobias Nießen) #44367
[b8f08e5e7e] - lib: codify findSourceMap return value when not found (Chengzhong Wu) #44397
[a86ef1ba3e] - lib: use safe Promise alternatives when available (Antoine du Hamel) #43476
[e519ac7842] - meta: update AUTHORS (Node.js GitHub Bot) #44511
[c03f28b960] - meta: update AUTHORS (Node.js GitHub Bot) #44422
[ef08cbddac] - node-api: avoid calling virtual methods in base's dtor (Chengzhong Wu) #44424
[256340197c] - node-api: cleanup redundant static modifiers (Chengzhong Wu) #44301
[6714736706] - (SEMVER-MINOR) os: add machine method (theanarkh) #44416
[807b1e5533] - report: get stack trace with cross origin contexts (Chengzhong Wu) #44398
[b17cc877d0] - report: fix missing section javascriptHeap on OOMError (Chengzhong Wu) #44398
[1f23c17ae0] - (SEMVER-MINOR) report: expose report public native apis (Chengzhong Wu) #44255
[df259005d9] - report: add queue info for udp (theanarkh) #44345
[fc17b808c9] - src: rename misleading arg in ClientHelloParser (Tobias Nießen) #44500
[125ab7da2a] - src: improve error handling in CloneSSLCerts (Tobias Nießen) #44410
[aa34f7347b] - src: fix incorrect comments in crypto (Tobias Nießen) #44470
[18b720805f] - src: avoid casting std::trunc(... / ...) to size_t (Tobias Nießen) #44467
[4331bbe2af] - (SEMVER-MINOR) src: expose environment RequestInterrupt api (Chengzhong Wu) #44362
[c5413a1146] - src: simplify enable_if logic of ToStringHelper::BaseConvert (Feng Yu) #44306
[dcc1cf4f4e] - src: add error handling to uv_uptime call (Juan José Arboleda) #44386
[fd611cc272] - src: remove base64_select_table and base64_table (Tobias Nießen) #44425
[4776b4767b] - src: fix uv_err_name memory leak (theanarkh) #44421
[8db2e66d3a] - src: make Endianness an enum class (Tobias Nießen) #44411
[048e440878] - src: fix ssize_t error from nghttp2.h (Darshan Sen) #44393
[dc1c95ede3] - src: trace fs async api (theanarkh) #44057
[0f4e98ba2c] - src: restore context default IsCodeGenerationFromStringsAllowed value (Chengzhong Wu) #44324
[05fb650b54] - src: simplify and optimize GetOpenSSLVersion() (Tobias Nießen) #44395
[7f16177f96] - src: use if constexpr where appropriate (Anna Henningsen) #44291
[2be8acad18] - src: simplify ECDH::GetCurves() (Tobias Nießen) #44309
[3eb7918f8e] - src: make minor improvements to EnabledDebugList (Tobias Nießen) #44350
[88d9566593] - src: remove KeyObjectData::symmetric_key_len_ (Tobias Nießen) #44346
[768c9cb872] - src: fix multiple format string bugs (Tobias Nießen) #44314
[6857ee8299] - src: make minor improvements to SecureBuffer (Tobias Nießen) #44302
[2facf8b8e0] - stream: fix setting abort reason in ReadableStream.pipeTo() (Daeyeon Jeong) #44418
[65134d696b] - stream: fix ReadableStreamReader.releaseLock() (Daeyeon Jeong) #44292
[4c33e5d4ce] - test: avoid race in file write stream handle tests (Joyee Cheung) #44380
[0d77342a39] - test: style updates for assert.snapshot() (Colin Ihrig) #44429
[e36ed44b26] - test: deflake child process exec timeout tests (Joyee Cheung) #44390
[0af15c71fb] - test: make the vm timeout escape tests more lenient (Joyee Cheung) #44433
[0f071b800e] - test: split heap prof tests (Joyee Cheung) #44388
[2dd88b8425] - test: fix multiple incorrect mustNotCall() uses (Tobias Nießen) #44022
[4ae1f4990c] - test: split report OOM tests (Joyee Cheung) #44389
[3a5fdacdc2] - test: fix WPT runner result (Daeyeon Jeong) #44238
[e001aafee3] - test: raise sleep times in child process tests (Joyee Cheung) #44375
[8e2dcafc24] - test: remove duplicate test (Luigi Pinca) #44313
[c65d7fb1fa] - test: add OpenSSL 3.x providers test (Richard Lau) #44148
[11e9d6e173] - test: make tmpdir.js importable from esm (Geoffrey Booth) #44322
[a35c2f9ef4] - test_runner: fix duration_ms to be milliseconds (Moshe Atlow) #44450
[8175c65b4d] - test_runner: support programmatically running --test (Moshe Atlow) #44241
[1cdccbc845] - tls: remove SecureContext setFreeListLength (Tobias Nießen) #44300
[70399166f3] - tls: use OpenSSL constant for client random size (Tobias Nießen) #44305
[6fe189b62a] - tools: update lint-md-dependencies to rollup@2.79.0 (Node.js GitHub Bot) #44510
[1e62bb14dd] - tools: fix typo in avoid-prototype-pollution lint rule (Antoine du Hamel) #44446
[78c6827688] - tools: don't use f-strings in test.py (Santiago Gimeno) #44407
[443730c419] - tools: update doc to unist-util-visit@4.1.1 (Node.js GitHub Bot) #44370
[96df99375e] - tools: update eslint to 8.23.0 (Node.js GitHub Bot) #44419
[b6709544e9] - tools: refactor avoid-prototype-pollution lint rule (Antoine du Hamel) #43476
[8b0a4afcae] - tty: fix TypeError when stream is closed (Antoine du Hamel) #43803
[c4a45a93f3] - vm: avoid unnecessary property getter interceptor calls (Joyee Cheung) #44252
[736a04aa13] - vm: include vm context in the embedded snapshot (Joyee Cheung) #44252
[bce827e5d1] - vm: make ContextifyContext template context-independent (Joyee Cheung) #44252

2022-08-24, Version 18.8.0 (Current), @ruyadorno

Notable changes

bootstrap: implement run-time user-land snapshots via --build-snapshot and --snapshot-blob

This patch introduces --build-snapshot and --snapshot-blob options for creating and using user land snapshots.

To generate a snapshot using snapshot.js as an entry point and write the snapshot blob to snapshot.blob:

echo "globalThis.foo = 'I am from the snapshot'" > snapshot.js
node --snapshot-blob snapshot.blob --build-snapshot snapshot.js

To restore application state from snapshot.blob, with index.js as the entry point script for the deserialized application:

echo "console.log(globalThis.foo)" > index.js
node --snapshot-blob snapshot.blob index.js
# => I am from the snapshot

Users can also use the v8.startupSnapshot API to specify an entry point at snapshot building time, thus avoiding the need of an additional entry script at deserialization time:

echo "require('v8').startupSnapshot.setDeserializeMainFunction(() => console.log('I am from the snapshot'))" > snapshot.js
node --snapshot-blob snapshot.blob --build-snapshot snapshot.js
node --snapshot-blob snapshot.blob
# => I am from the snapshot

Contributed by Joyee Cheung in #38905

Other notable changes

crypto:
- (SEMVER-MINOR) allow zero-length IKM in HKDF and in webcrypto PBKDF2 (Filip Skokan) #44201
- (SEMVER-MINOR) allow zero-length secret KeyObject (Filip Skokan) #44201
deps:
- upgrade npm to 8.18.0 (npm team) #44263 - Adds a new npm query command
doc:
- add Erick Wendel to collaborators (Erick Wendel) #44088
- add theanarkh to collaborators (theanarkh) #44131
- add MoLow to collaborators (Moshe Atlow) #44214
- add cola119 to collaborators (cola119) #44248
- deprecate --trace-atomics-wait (Keyhan Vakil) #44093
http:
- (SEMVER-MINOR) make idle http parser count configurable (theanarkh) #43974
net:
- (SEMVER-MINOR) add local family (theanarkh) #43975
src:
- (SEMVER-MINOR) print source map error source on demand (Chengzhong Wu) #43875
tls:
- (SEMVER-MINOR) pass a valid socket on tlsClientError (Daeyeon Jeong) #44021

Commits

[0e20072e32] - assert: add getCalls and reset to callTracker (Moshe Atlow) #44191
[126fbbab74] - assert: add assert.Snapshot (Moshe Atlow) #44095
[87d7845b4f] - bootstrap: fixup Error.stackTraceLimit for user-land snapshot (Joyee Cheung) #44203
[597a5171ee] - (SEMVER-MINOR) bootstrap: clean up warning setup during serialization (Joyee Cheung) #38905
[3561514ff5] - (SEMVER-MINOR) bootstrap: implement --snapshot-blob and --build-snapshot (Joyee Cheung) #38905
[123b2d6795] - bootstrap: turn on FunctionCodeHandling::kKeep in the snapshot builder (Joyee Cheung) #44104
[e7d101fbd4] - bootstrap: support more builtins in the embedded code cache (Joyee Cheung) #44018
[2ae2828040] - build: enable pointer authentication for branch protection on arm64 (Jeremiah Gowdy) #43200
[fecec4d3ba] - build: add workflow to label flaky-test platform (Rafael Gonzaga) #44042
[c975c4f674] - build: optimized and fixed building configuration to Android (BuShe) #44016
[ec1b31e6ad] - build: allow test-internet on forks if not scheduled (Rich Trott) #44073
[ea48c5673b] - build: skip test-internet run on forks (Rich Trott) #44054
[1c0d66e927] - (SEMVER-MINOR) crypto: allow zero-length IKM in HKDF and in webcrypto PBKDF2 (Filip Skokan) #44201
[07d90c8a71] - (SEMVER-MINOR) crypto: allow zero-length secret KeyObject (Filip Skokan) #44201
[ac2b10e0c7] - crypto: fix webcrypto deriveBits validations (Filip Skokan) #44173
[4c902be5a5] - crypto: fix webcrypto EC key namedCurve validation errors (Filip Skokan) #44172
[81e1ec4f6f] - crypto: fix webcrypto generateKey() AES key length validation error (Filip Skokan) #44170
[ad8ef3a56c] - crypto: fix webcrypto operation errors to be OperationError (Filip Skokan) #44171
[c270b9a0aa] - deps: update corepack to 0.13.0 (Node.js GitHub Bot) #44318
[bce8041d67] - deps: upgrade npm to 8.18.0 (npm team) #44263
[a26997263b] - deps: update corepack to 0.12.3 (Node.js GitHub Bot) #44229
[b1590bbca2] - deps: upgrade npm to 8.17.0 (npm team) #44205
[818271c1c3] - deps: update undici to 5.8.2 (Node.js GitHub Bot) #44187
[d09bc5402d] - deps: update undici to 5.8.1 (Node.js GitHub Bot) #44158
[a92d90b482] - deps: update corepack to 0.12.2 (Node.js GitHub Bot) #44159
[52a516a281] - deps: V8: cherry-pick 9861ce1deae2 (Milad Fa) #44115
[763b956f07] - deps: remove unnecessary file (Brian White) #44133
[194587e767] - deps: upgrade npm to 8.16.0 (npm team) #44119
[116dcccc79] - deps: upgrade base64 to dc6a41ce36e (Brian White) #44032
[b7aaf3d4ca] - deps: upgrade npm to 8.15.1 (npm team) #44013
[a0c57837c4] - deps: cherry-pick 00704f5a from V8 upstream (Keyhan Vakil) #43921
[19557ad6a4] - dgram: add dgram send queue info (theanarkh) #44149
[a93371205b] - doc: fix optionality of callback arg of checkPrime (Tobias Nießen) #44311
[d3f3bf602d] - doc: fix typo (Hana) #44262
[7a567875b0] - doc: add TypeScript execution requirements (Michael Dawson) #44030
[e8916fa758] - doc: add cola119 to collaborators (cola119) #44248
[8c1fe86026] - doc: fix added version for readable.closed/destroyed (Matthew Peveler) #44033
[f39a0514d3] - doc: improved building doc for Android (BuShe) #44166
[4d26cb9bb2] - doc: add MoLow to collaborators (Moshe Atlow) #44214
[6bff14b6f1] - doc: update tags in adding-new-napi-api.md (Chengzhong Wu) #44190
[721639a1d4] - doc: fix typo in diagnostics_channel (Evan Lucas) #44199
[0fffc24caa] - doc: add Retry CI in collaborator guide (Livia Medeiros) #44130
[fb11643e31] - doc: add performance note to --enable-source-maps docs (Saurabh Daware) #43817
[cb7a9e78fd] - doc: remove unused code in call tracker example (Colin Ihrig) #44127
[8c26daff7c] - doc: add theanarkh to collaborators (theanarkh) #44131
[46f8fb8e53] - doc: clarify tls.tlsSocket.getCipher().version (Adam Majer) #44086
[02236032f0] - doc: update repository list in onboarding doc (Rich Trott) #44089
[58f2739e32] - doc: add Erick Wendel to collaborators (Erick Wendel) #44088
[fe83d514b2] - doc: update collaborator email (Ruy Adorno) #44044
[76011dd7f7] - doc: copyedit test.md (Antoine du Hamel) #44061
[1d6029aa3d] - doc: add kvakil to triagers (Keyhan Vakil) #43996
[7f7a0eb2f5] - doc: clarify part of onboarding guide regarding adding to teams (Darshan Sen) #44024
[2ae5d853a7] - doc: fix code examples in crypto.md (Antoine du Hamel) #44053
[1b9537b6a5] - doc: claim ABI version for Electron 21 (Keeley Hammond) #44034
[d23dfa4dcb] - doc: remove old reference from crypto/README.md (Tobias Nießen) #44012
[222ecd6e14] - doc: add missing env vars to man page (cola119) #43492
[374b77619b] - doc: list supported MODP groups explicitly (Tobias Nießen) #43986
[72a9ecf94f] - doc: fix typo in packages.md (Dominic Saadi) #44005
[1b328305f0] - doc: fix typos in test.md (Antoine du Hamel) #43997
[7af55dbc40] - doc: add missing test runner option (Moshe Atlow) #43989
[e8441a2864] - doc,report: document special filenames (Chengzhong Wu) #44257
[da7bc5acdf] - doc,worker: deprecate --trace-atomics-wait (Keyhan Vakil) #44093
[37a9d7a754] - errors: refactor to use optional chaining (SindreXie) #44184
[a6dccc969f] - esm: do not bind loader hook functions (Antoine du Hamel) #44122
[5e9c197d85] - esm: fix loader hooks accepting too many arguments (Jacob Smith) #44109
[e072c3aa70] - esm: move package config helpers (Geoffrey Booth) #43967
[d57178cdfc] - events: use bitset to save memory (Basit Chonka) #43700
[4ec3f671af] - fs: add encoding parameter to benchmarks (Yagiz Nizipli) #44278
[851264ca90] - http: add max for http keepalive (theanarkh) #44217
[340ca4d8fe] - http: fix error message when specifying headerTimeout for createServer (Nick Sia) #44163
[c340344641] - http: trace http request / response (theanarkh) #44102
[a2cd8b316c] - (SEMVER-MINOR) http: make idle http parser count configurable (theanarkh) #43974
[5dc39a10bd] - http: reuse socket only when it is drained (ywave620) #43902
[8c2d19b2d6] - http: do not leak error listeners (Paolo Insogna) #43587
[1a44fbc19e] - lib: add diagnostics channel and perf hooks detail (Danielle Adams) #43984
[8cfc8b0e7b] - lib: refactor to avoid prototype pollution (Antoine du Hamel) #43474
[04007f2f51] - lib: fix diagnostics channel (theanarkh) #44154
[c02bbdd921] - lib: pass env variables to child process on z/OS (alexcfyung) #42255
[617ea4af1c] - lib: add missing env vars to --help (cola119) #43492
[94912bb09c] - lib: add Promise methods to avoid-prototype-pollution lint rule (Antoine du Hamel) #43849
[8977a87504] - meta: update AUTHORS (Node.js GitHub Bot) #44321
[f7be92fe86] - meta: update web streams in label-pr-config (Daeyeon Jeong) #44235
[2c72ded880] - meta: update AUTHORS (Node.js GitHub Bot) #44231
[c59dc7a4c1] - meta: update AUTHORS (Node.js GitHub Bot) #44161
[e0efd9af50] - meta: add codeowner for src/node_snapshot* (Chengzhong Wu) #44113
[a996f53c78] - meta: update AUTHORS (Node.js GitHub Bot) #44065
[697dbfb174] - meta: shorten PowerShell snippet for bug-report template (NicoNekoru) #44011
[05802c2877] - module: protect against prototype mutation (Antoine du Hamel) #44007
[1b3fcf765f] - (SEMVER-MINOR) net: create diagnostics channels lazily (Joyee Cheung) #38905
[aa7c053926] - net: remove unused callback (theanarkh) #44204
[b6b632c09c] - (SEMVER-MINOR) net: add local family (theanarkh) #43975
[c3d87564d4] - net, dns: socket should handle its output as input (Adam Majer) #44083
[3ba75b341b] - (SEMVER-MINOR) net,tls: pass a valid socket on tlsClientError (Daeyeon Jeong) #44021
[0e38fba552] - perf_hooks: add resourcetiming buffer limit (Chengzhong Wu) #44220
[b9fd240f63] - perf_hooks: fix gc elapsed time (theanarkh) #44058
[8cf64998e2] - report: print javascript stack on fatal error (Chengzhong Wu) #44242
[c842ab36b6] - report: skip report if uncaught exception is handled (Chengzhong Wu) #44208
[ab73cc8706] - src: disambiguate terms used to refer to builtins and addons (Joyee Cheung) #44135
[e9d19ac64c] - src: use imported namespaces in node_contextify.cc (Juan José) #44299
[3dadc95cd2] - src: refactor to avoid using a moved object (Tobias Nießen) #44269
[3765c6335b] - src: extract common context embedder tag checks (Chengzhong Wu) #44258
[d2dce59729] - src: avoid copying BaseObjectPtrs in loop (Tobias Nießen) #44270
[9614907104] - src: remove usage on ScriptCompiler::CompileFunctionInContext (Chengzhong Wu) #44198
[4e1ffd932e] - src: fix --heapsnapshot-near-heap-limit error hint (Chengzhong Wu) #44216
[960a20928f] - src: prevent copying ArrayBufferViewContents (Keyhan Vakil) #44091
[4755ad5495] - src: remove usages of GetBackingStore in crypto (Keyhan Vakil) #44079
[a2022e5aff] - src: remove unowned usages of GetBackingStore (Keyhan Vakil) #44080
[8e1b7e2b8f] - src: remove usages of GetBackingStore in node-api (Keyhan Vakil) #44075
[cddf3eda28] - src: remove usages of GetBackingStore in modules (Keyhan Vakil) #44076
[a54e4d4170] - src: remove usages of GetBackingStore in WASI (Keyhan Vakil) #44077
[38cdb1f9b6] - src: remove usages of GetBackingStore in startup (Keyhan Vakil) #44078
[c4783e37d7] - src: nest namespace report in namespace node (Chengzhong Wu) #44069
[04bcdf63a0] - src: use a typed array internally for process._exiting (Darshan Sen) #43883
[b90b8abdd5] - src: fix bug in GetErrorSource() (Tobias Nießen) #44019
[728e18e025] - src: fix to use replacement character (Kohei Ueno) #43999
[cc6e0fc8ff] - src: improve SPKAC::ExportChallenge() (Tobias Nießen) #44002
[9763e2fba9] - src: fix typo in src/README.md (Anna Henningsen) #44009
[460397709b] - src: remove unnecessary cast in crypto_sig.cc (Tobias Nießen) #44001
[68ee8e9089] - src: split property helpers from node::Environment (Chengzhong Wu) #44056
[9990dc7d18] - src,buffer: remove unused chars_written parameter (Keyhan Vakil) #44092
[ecf82186e0] - src,fs: refactor duplicated code in fs.readdir (Daeyeon Jeong) #43204
[ee6412a992] - src,lib: print prinstine source when source map source not found (Chengzhong Wu) #44052
[4249276783] - (SEMVER-MINOR) src,lib: print source map error source on demand (Chengzhong Wu) #43875
[1dabdbf05c] - src,test: fix typos (SADIK KUZU) #44110
[a3ac445198] - stream: fix isDetachedBuffer validations (Daeyeon Jeong) #44114
[c079abe017] - stream: improve views validation on BYOBRequest (Daeyeon Jeong) #44155
[2f904bc8bf] - stream: update TextEncoderStream to align the latest spec (Kohei Ueno) #44101
[40b817cfb9] - (SEMVER-MINOR) test: test snapshotting TypeScript compiler (Joyee Cheung) #38905
[d4189ab609] - (SEMVER-MINOR) test: add UMD module test with marked (Joyee Cheung) #38905
[514e5162d2] - test: deflake test-diagnostics-channel-net (Keyhan Vakil) #44144
[a2707d0f48] - test: add coverage for invalid RSA-PSS digests (Tobias Nießen) #44271
[7b6126a59a] - test: update Web Streams WPT (Daeyeon Jeong) #44234
[a02492f96c] - test: move "errors" test to "parallel" (Michaël Zasso) #44233
[b4224dd192] - test: reduce http-server-request-timeouts-mixed flakiness (Nick Sia) #44169
[f5e2f6c362] - test: remove cjs loader from stack traces (Geoffrey Booth) #44197
[e37314497a] - test: add filesystem check to test-fs-stat-date.mjs (Livia Medeiros) #44174
[9755b1f979] - test: mark connection leak test flaky on IBM i (Richard Lau) #44215
[beaf5f5776] - test: use mustSucceed instead of mustCall with assert.ifError (MURAKAMI Masahiko) #44196
[11f74e72a7] - test: update WPT runner (Filip Skokan) #43455
[b2a15b6275] - test: update wpt url status (Kohei Ueno) #44175
[6b84451d70] - test: update wasm/jsapi web platform tests (Yagiz Nizipli) #44100
[537d52fa0f] - test: update hr-time web platform tests (Yagiz Nizipli) #44100
[79445cb215] - test: update console web platform tests (Yagiz Nizipli) #44100
[70267a0eeb] - test: move tests with many workers to sequential (Keyhan Vakil) #44139
[86a7fb0c8a] - test: deflake gc-http-client tests by restricting number of requests (Nick Sia) #44146
[e17117dfda] - test: move test-vm-break-on-sigint to sequential (Keyhan Vakil) #44140
[e5113fab05] - test: remove test-http-client-response-timeout flaky designation (Luigi Pinca) #44145
[f1b5f933d7] - test: s390x z15 accelerated zlib fixes (Adam Majer) #44117
[86bbd5e61a] - test: tune down parallelism for some flaky tests (Keyhan Vakil) #44090
[40e2ca7f66] - test: fix internet/test-inspector-help-page (Daeyeon Jeong) #44025
[b19564b9d2] - test: refactor ESM tests to improve performance (Jacob Smith) #43784
[d964b308ae] - test: remove test-gc-http-client-timeout from flaky list (Feng Yu) #43971
[2cab7bb791] - test: reduce loop times for preventing test from timeout (theanarkh) #43981
[9244d6d416] - test: fix test-cluster-concurrent-disconnect (Daeyeon Jeong) #43961
[3c8037a9fa] - test: change misleading variable name (Tobias Nießen) #43990
[82164344e2] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #44223
[c0b160c842] - test_runner: fix test runner hooks failure stack (Moshe Atlow) #44284
[8ed39397d5] - test_runner: refactor to use more primordials (Antoine du Hamel) #44062
[d8749c3b87] - test_runner: verbous error when entire test tree is canceled (Moshe Atlow) #44060
[0d007471fa] - test_runner: empty pending tests queue post running (Moshe Atlow) #44059
[c3fa82f007] - test_runner: add before/after/each hooks (Moshe Atlow) #43730
[50c854bbfe] - test_runner: fix top level describe queuing (Moshe Atlow) #43998
[04fdc3e1fa] - test_runner: graceful termination on --test only (Moshe Atlow) #43977
[51a0310398] - test_runner: validate concurrency option (Antoine du Hamel) #43976
[ecf7b0720a] - tls: use logical OR operator (Mohammed Keyvanzadeh) #44236
[f7c1b838ba] - tools: update lint-md-dependencies to rollup@2.78.1 (Node.js GitHub Bot) #44320
[36b39db74d] - tools: update ESLint to 8.22.0 (Luigi Pinca) #44243
[87f75a27fb] - tools: update lint-md-dependencies to rollup@2.78.0 (Node.js GitHub Bot) #44244
[a3cc8ce959] - tools: update lint-md-dependencies to rollup@2.77.3 (Node.js GitHub Bot) #44230
[873941a43e] - tools: update eslint to 8.21.0 (Node.js GitHub Bot) #44162
[6be7e6d136] - tools: update lint-md-dependencies to @rollup/plugin-commonjs@22.0.2 (Node.js GitHub Bot) #44160
[b252f389d7] - tools: update undici CPE in vuln checking script (Facundo Tuesca) #44128
[3eacf25789] - tools: update lint-md-dependencies to rollup@2.77.2 (Node.js GitHub Bot) #44064
[1175d9036a] - tools: add verbose flag to find-inactive-collaborators (Rich Trott) #43964
[2cf3ce83d8] - trace_events: add example (theanarkh) #43253
[2efce0fe5b] - typings: add JSDoc for internal/validators (Yagiz Nizipli) #44181

2022-07-26, Version 18.7.0 (Current), @danielleadams

Notable changes

doc:
- add F3n67u to collaborators (Feng Yu) #43953
- deprecate coercion to integer in process.exit (Daeyeon Jeong) #43738
- (SEMVER-MINOR) deprecate diagnostics_channel object subscribe method (Stephen Belanger) #42714
events:
- (SEMVER-MINOR) expose CustomEvent on global with CLI flag (Daeyeon Jeong) #43885
- (SEMVER-MINOR) add CustomEvent (Daeyeon Jeong) #43514
http:
- (SEMVER-MINOR) add drop request event for http server (theanarkh) #43806
lib:
- (SEMVER-MINOR) improved diagnostics_channel subscribe/unsubscribe (Stephen Belanger) #42714
util:
- (SEMVER-MINOR) add tokens to parseArgs (John Gee) #43459

Commits

[0aa255ab72] - bootstrap: handle snapshot errors gracefully (Joyee Cheung) #43531
[0783ddf57e] - buffer: do not leak memory if buffer is too big (Keyhan Vakil) #43938
[12657accdd] - build: add .gitattributes for npm and other shims (Hrishikesh Kadam) #43879
[c2db4f4581] - build: make GitPod less noisy (Rich Trott) #43829
[364deeadcd] - build: add GitHub token permissions for workflows (Varun Sharma) #43743
[8b83b4d5be] - child_process: do not need to count length when maxBuffer is Infinity (theanarkh) #43822
[c1893b7a7c] - child_process: avoid repeated calls to normalizeSpawnArguments (木杉) #43345
[7b276b89b9] - cluster: send connection to other server when worker drop it (theanarkh) #43747
[e8c66f92a5] - crypto: remove unneeded guard (Rich Trott) #43856
[c95132e9ea] - deps: cherry-pick libuv/libuv@3a7b955 (Ben Noordhuis) #43950
[cc8d5426d2] - deps: cherry-pick libuv/libuv@abb109f (Ben Noordhuis) #43950
[7762e463d6] - deps: update corepack to 0.12.1 (Node.js GitHub Bot) #43965
[1256c4dad5] - deps: update hast-util-raw (Moshe Atlow) #43927
[aac97c2d2a] - deps: update undici to 5.8.0 (Node.js GitHub Bot) #43886
[cdff61917d] - deps: clean archs files for OpenSSL (RafaelGSS) #43735
[fc936a84e4] - deps: remove not used architectures (RafaelGSS) #43735
[361a643d8b] - deps: V8: backport f3cad8cec656 (Joyee Cheung) #43531
[2e1732ebd0] - deps: V8: backport 22698d267667 (Chengzhong Wu) #43751
[979f469d3a] - deps: upgrade npm to 8.15.0 (npm team) #43917
[4096d81988] - deps: upgrade npm to 8.14.0 (npm team) #43826
[2ec8092e2c] - deps,src: use SIMD for normal base64 encoding (Brian White) #39775
[67b4edde37] - dns: fix getServers return undefined (jiahao.si) #43922
[7c75539a88] - dns: fix cares memory leak (theanarkh) #43912
[1f80b88da5] - doc: update email and mailmap for BethGriggs (Beth Griggs) #43985
[8a2a6e16eb] - doc: add 15.x - 18.x to Other Versions section (shhh7612) #43940
[51cb0d42ca] - doc: inspector.close undefined in worker threads (Keyhan Vakil) #43867
[c789c0f5f7] - doc: improve documentation for safe Promise statics alternatives (Antoine du Hamel) #43759
[cb9b0e0011] - doc: recommend git-node-v8 (Keyhan Vakil) #43934
[d7e9bd1830] - doc: clarify subprocess.stdout/in/err property (Kohei Ueno) #43910
[808793ebb5] - doc: fix typo in src/crypto/README.md (Jianru Lin) #43968
[bbc455c4f9] - doc: remind backporter about v8_embedder_string (Keyhan Vakil) #43924
[a86b66c8b4] - doc: fix typo in http.md (Airing) #43933
[a96af37233] - doc: add F3n67u to collaborators (Feng Yu) #43953
[aa7d4e59f7] - doc: improve test runner timeout docs (Tobias Nießen) #43836
[80c2fa8212] - doc: mention Win 32-bit openssl build issue (RafaelGSS) #43853
[8b8c55df7e] - doc: add security release specifics to releases.md (Beth Griggs) #43835
[42693aaf9f] - doc: add history info for global.performance (Antoine du Hamel) #43841
[140d6af572] - doc: add platform-windows-arm to who to CC (Michael Dawson) #43808
[976093efe3] - doc: document ES2022's Error "cause" property (James Ide) #43830
[ec7e45e4a2] - doc: include make clean to openssl arch (RafaelGSS) #43735
[d64dfd53c9] - doc: add link to diagnostic tools (Rafael Gonzaga) #43736
[2910136920] - doc: update links to MDN page about dynamic imports (Jannis R) #43847
[d88a9fae79] - doc: deprecate coercion to integer in process.exit (Daeyeon Jeong) #43738
[fc843e103d] - doc: add MoLow to triagers (Moshe Atlow) #43799
[8c8c97da61] - (SEMVER-MINOR) doc: deprecate diagnostics_channel object subscribe method (Stephen Belanger) #42714
[9b53a694b5] - doc: revert anachronistic 'node:' module require()s in API history notes (DeeDeeG) #43768
[2815bd3002] - doc: clarify release process for new releasers (Rafael Gonzaga) #43739
[50b3750e67] - doc: fix typo in ngtcp2 readme (Dan Castillo) #43767
[6bcd40dd85] - domain: fix vm promise tracking while keeping isolation (Stephen Belanger) #43556
[e89e0b470b] - esm: remove superfluous argument (Rich Trott) #43884
[0d2921f396] - esm: fix erroneous re-initialization of ESMLoader (Jacob Smith) #43763
[9b5b8d78c3] - esm: throw on any non-2xx response (LiviaMedeiros) #43742
[dfc4832ef1] - (SEMVER-MINOR) events: expose CustomEvent on global with CLI flag (Daeyeon Jeong) #43885
[e4473952ae] - (SEMVER-MINOR) events: add CustomEvent (Daeyeon Jeong) #43514
[100f6deb09] - fs: use signed types for stat data (LiviaMedeiros) #43714
[25ec71db63] - http: fix http server connection list when close (theanarkh) #43949
[ca658c8afe] - (SEMVER-MINOR) http: add drop request event for http server (theanarkh) #43806
[9c699bd8a8] - http: wait for pending responses in closeIdleConnections (Paolo Insogna) #43890
[781d5e54e3] - inspector: set sampling interval before start (Shelley Vohr) #43779
[0b5dbb2a56] - lib: refactor PriorityQueue to use private field (Finn Yu) #43889
[324473ca32] - (SEMVER-MINOR) lib: improved diagnostics_channel subscribe/unsubscribe (Stephen Belanger) #42714
[5aa3b213ac] - meta: update AUTHORS (Node.js GitHub Bot) #43966
[e707552357] - meta: update node-api in label-pr-config (Daeyeon Jeong) #43794
[8a8de94034] - meta: update AUTHORS (Node.js GitHub Bot) #43872
[7d49fc766c] - meta: use platform dropdown on flaky template (Rafael Gonzaga) #43855
[e4aa50fc3f] - meta: enable blank issues (Matteo Collina) #43775
[ceb7c150ec] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #43770
[29bcd47738] - net: fix socket._getpeername (Daeyeon Jeong) #43010
[380659daf1] - process: use defineProperty instead of assignment (Mark S. Miller) #43907
[aba9c8ebea] - repl: fix overzealous top-level await (Tobias Nießen) #43827
[1deb6b73b7] - repl: use SafePromiseAll and SafePromiseRace (Antoine du Hamel) #43758
[bf8f2e23ff] - src: refactor DH groups to delete crypto_groups.h (Tobias Nießen) #43896
[9435fbf8cd] - src: remove dead code in base64_encode (Tobias Nießen) #43979
[2c47e58ea0] - src: fix regression that a source marker is lost (cola119) #43086
[d084150320] - src: per-isolate eternal template properties (Chengzhong Wu) #43802
[9f9d00ccbb] - src: merge NativeModuleEnv into NativeModuleLoader (Joyee Cheung) #43824
[bb512904e9] - src: use named struct instead of typedef (Tobias Nießen) #43881
[bb5511e8cc] - src: use named enum instead of typedef (Tobias Nießen) #43880
[5db0c8f667] - src: pass only Isolate* and env_vars to EnabledDebugList::Parse() (Darshan Sen) #43668
[249365524e] - src: fix node watchdog race condition (theanarkh) #43780
[17cb27237d] - src: deduplicate SetALPN implementations (Tobias Nießen) #43756
[b4c75a96be] - src: fix napi_check_object_type_tag() (Daeyeon Jeong) #43788
[8432d6596f] - src: slim down env-inl.h (Ben Noordhuis) #43745
[2266a4b6d6] - stream: improve respondWithNewView() (Daeyeon Jeong) #43866
[bf3991b406] - stream: fix 0 transform hwm backpressure (Robert Nagy) #43685
[a057510037] - stream: initial approach to include strategy options on Readable.toWeb() (txxnano) #43515
[198cf59d2c] - test: update WPT encoding tests (Kohei Ueno) #43958
[f0ed1aed8d] - test: remove test-whatwg-events-add-event-listener-options-once.js (Feng Yu) #43877
[88505556fe] - test: work scheduled in process.nextTick can keep the event loop alive (Andreu Botella) #43787
[81a21946eb] - test: simplify test-tls-set-secure-context (Tobias Nießen) #43878
[61cd11a8a7] - test: use common.mustNotMutateObjectDeep() in fs tests (LiviaMedeiros) #43819
[b1081dbe12] - test: fix test http upload timeout (theanarkh) #43935
[efd5e0e925] - test: simplify ReplStream.wait() (Tobias Nießen) #43857
[ef21ad2996] - test: merge test-crypto-dh-hash with modp18 test (Tobias Nießen) #43891
[e502c50a90] - test: refactor test/es-module/test-esm-resolve-type (Antoine du Hamel) #43178
[c782c3dc69] - test: ensure NODE_EXTRA_CA_CERTS not set before tests (KrayzeeKev) #43858
[bb6787cb57] - test: add check to test-fs-readfile-tostring-fail (Richard Lau) #43850
[7571704186] - test: complete TODO in test/wpt/test-url.js (Kohei Ueno) #43797
[6f1d2dfb9d] - test: add test on worker process.exit in async modules (Chengzhong Wu) #43751
[776cc3abbd] - test: use common.mustNotMutateObjectDeep() in immutability tests (LiviaMedeiros) #43196
[42f2deb3a0] - test: add common.mustNotMutateObjectDeep() (LiviaMedeiros) #43196
[f3fc51c508] - test: fix coverity warning in test (Michael Dawson) #43631
[a9ecba2fa8] - test: mark test-http-client-response-timeout flaky (Tobias Nießen) #43792
[cd0d9ddb7c] - test_runner: add support for boolean values for concurrency option (Lenvin Gonsalves) #43887
[f98020138a] - test_runner: validate timeout option (Antoine du Hamel) #43843
[58d15b3687] - test_runner: pass signal on timeout (Moshe Atlow) #43911
[8b0248506f] - test_runner: do not report an error when tests are passing (Antoine du Hamel) #43919
[aa8053e1fa] - test_runner: recieve and pass AbortSignal (Moshe Atlow) #43554
[f13e4c1be9] - test_runner: fix it concurrency (Moshe Atlow) #43757
[e404a3ef6d] - test_runner: support timeout for tests (Moshe Atlow) #43505
[f28198cc05] - test_runner: catch errors thrown within describe (Moshe Atlow) #43729
[bfe0ac6cd0] - tools: add more options to track flaky tests (Antoine du Hamel) #43954
[17a4e5e775] - tools: add verbose flag to inactive TSC finder (Rich Trott) #43913
[373304b0c7] - tools: add support for using API key to vuln checking script (Facundo Tuesca) #43909
[ed45088c14] - tools: support versioned node shared libs on z/OS (alexcfyung) #42256
[c9ecd6d21f] - tools: update doc to highlight.js@11.6.0 (Node.js GitHub Bot) #43870
[c92135aa0f] - tools: update lint-md-dependencies to rollup@2.77.0 (Node.js GitHub Bot) #43871
[e12bf40fd1] - tools: update eslint to 8.20.0 (Node.js GitHub Bot) #43873
[09fe9b30a9] - tools: add script for vulnerability checking (Facundo Tuesca) #43362
[19e8876877] - trace_events: trace net connect event (theanarkh) #43903
[1af7f24143] - util: remove unicode support todo for perf implications (Rhys) #43762
[acfc33ca8c] - (SEMVER-MINOR) util: add tokens to parseArgs (John Gee) #43459
[f32aec8a6d] - util: refactor to use validateObject (Kohei Ueno) #43769
[d7cfd0c5ba] - v8: serialize BigInt64Array and BigUint64Array (Ben Noordhuis) #43571

2022-07-13, Version 18.6.0 (Current), @targos

Notable Changes

Experimental ESM Loader Hooks API

Node.js ESM Loader hooks now support multiple custom loaders, and composition is achieved via "chaining": foo-loader calls bar-loader calls qux-loader (a custom loader must now signal a short circuit when intentionally not calling the next). See the ESM docs for details.

Real-world use-cases are laid out for end-users with working examples in the article Custom ESM loaders: Who, what, when, where, why, how.

Contributed by Jacob Smith, Geoffrey Booth, and Bradley Farias - nodejs#42623

Commits

Semver-minor commits

[0bca7b722e] - (SEMVER-MINOR) dns: export error code constants from dns/promises (Feng Yu) #43176
[da61e2330f] - (SEMVER-MINOR) esm: add chaining to loaders (Jacob Smith) #42623
[8c97f63401] - (SEMVER-MINOR) http: add diagnostics channel for http client (theanarkh) #43580
[b27856d3d4] - (SEMVER-MINOR) http: add perf_hooks detail for http request and client (theanarkh) #43361
[9d918d9923] - (SEMVER-MINOR) module: add isBuiltIn method (hemanth.hm) #43396
[a0e7b9983c] - (SEMVER-MINOR) net: add drop event for net server (theanarkh) #43582
[4bda6e02a3] - (SEMVER-MINOR) test_runner: expose describe and it (Moshe Atlow) #43420
[34e83312a4] - (SEMVER-MINOR) v8: add v8.startupSnapshot utils (Joyee Cheung) #43329

Semver-patch commits

[ef174eac87] - assert: callTracker throw a specific error message when possible (Moshe Atlow) #43640
[07836637af] - bootstrap: move global initialization to js (Alena Khineika) #43625
[e9ee7e44be] - build,test: increase stack size limit on Windows (Tobias Nießen) #43632
[3ca9e653a6] - child_process: improve ipc write performance (rubikscraft) #42931
[cad6d990ec] - child_process: speed up 'advanced' ipc receiving (rubikscraft) #42931
[ce3a22a9e3] - cluster: fix closing dgram sockets in cluster workers throws errors (Ouyang Yadong) #43709
[5d8ee519db] - cluster: fix fd leak (theanarkh) #43650
[fa5c4643e2] - cluster, net: fix listen pipe with readable and writable in cluster (theanarkh) #43634
[4df96b501d] - crypto: don't disable TLS 1.3 without suites (Adam Majer) #43427
[a43928ae78] - crypto: use ByteSource::Builder in To*Copy (Tobias Nießen) #43477
[bb326f7ece] - crypto: handle webcrypto generateKey() usages edge case (Filip Skokan) #43454
[9bd13bbb3a] - crypto: update Wrapping and unwrapping keys webcrypto example (Filip Skokan) #43452
[679f19128e] - crypto: fix webcrypto generateKey() with empty usages (Filip Skokan) #43431
[64a9dd7b83] - crypto: fix webcrypto digest() invalid algorithm (Filip Skokan) #43431
[dedb22e965] - crypto: fix webcrypto RSA generateKey() use of publicExponent (Filip Skokan) #43431
[018f61cb4f] - crypto: fix webcrypto AES-KW keys accepting encrypt/decrypt usages (Filip Skokan) #43431
[3ee0bb8d03] - crypto: fix webcrypto deriveBits for non-byte lengths (Filip Skokan) #43431
[7fc075b23a] - deps: update undici to 5.7.0 (Node.js GitHub Bot) #43790
[d6a9e93426] - deps: patch V8 to 10.2.154.13 (Michaël Zasso) #43727
[428d03cb94] - deps: update corepack to 0.12.0 (Node.js GitHub Bot) #43748
[74914698e5] - deps: upgrade npm to 8.13.2 (npm team) #43622
[0636f86ecc] - deps: upgrade npm to 8.13.1 (npm team) #43552
[2149acda60] - dns: make promise API fully constructed from lib/internal/dns/promises (Feng Yu) #43227
[79ea19e5e2] - errors: extract type detection & use in ERR_INVALID_RETURN_VALUE (Jacob Smith) #43558
[80ced1ae31] - esm: treat 307 and 308 as redirects in HTTPS imports (Kid) #43689
[953fefe77b] - esm: restore next<HookName>'s context as optional arg (Jacob Smith) #43553
[10bcad5c6e] - esm: fix chain advances when loader calls next<HookName> multiple times (Jacob Smith) #43303
[50d64edd49] - esm: refactor responseURL handling (Guy Bedford) #43164
[254efd9e3b] - esm: fix http(s) import via custom loader (Jacob Smith) #43130
[061ed0e76b] - events: improve Event compatibility (Daeyeon Jeong) #43461
[66fb059547] - events: improve EventListener validation (Daeyeon Jeong) #43491
[12a591a676] - fs: refactor realpath with Map and Set (LiviaMedeiros) #43569
[df501316c1] - fs: don't end fs promises on Isolate termination (Santiago Gimeno) #42910
[e6d4837fad] - http: fix failing test (Paolo Insogna) #43641
[491c7619c4] - http: defer reentrant execution of Parser::Execute (Paolo Insogna) #43369
[d71ba322b0] - http: fix http agent keep alive (theanarkh) #43380
[1f4f811de5] - http2: log debug only when in debug mode (Basit) #43626
[c8cbec4cef] - lib: make validateObject less affected by prototype tampering (Antoine du Hamel) #42929
[dc484b6f6f] - lib: implement safe alternatives to Promise static methods (Antoine du Hamel) #43728
[2233567331] - lib: use null-prototype objects for property descriptors (Antoine du Hamel) #43473
[b9198d977f] - lib: refactor to avoid unsafe regex primordials (Antoine du Hamel) #43475
[deaf4bb5cd] - lib: fix TODO in freeze_intrinsics (Antoine du Hamel) #43472
[61e6d7858a] - lib,src: add source map support for global eval (Chengzhong Wu) #43428
[58646eaad6] - loader: make require.resolve throw for unknown builtin modules (木杉) #43336
[e914185c44] - module: cjs-module-lexer WebAssembly fallback (Guy Bedford) #43612
[3ad4d37b3c] - module: also enable subpath imports in REPL (Ray) #43450
[bf4ac4c55f] - net: remove redundant connecting assignment (Ouyang Yadong) #43710
[ad1d0541c5] - net: fix net keepalive and noDelay (theanarkh) #43561
[f8bdc53e4f] - net: prevent /32 ipv4 mask from matching all ips (supriyo-biswas) #43381
[47a252257b] - net: fix net.Server keepalive and noDelay (theanarkh) #43497
[d834d216f2] - perf_hooks: add initiatorType getter (Rafael Gonzaga) #43593
[02009b7069] - perf_hooks: fix miscounted gc performance entry starttime (#43066) (Xuguang Mei) #43066
[e9574f3009] - readline: fix to not access a property on an undefined value (Kohei Ueno) #43543
[fe1f740f61] - src: merge RunInThisContext() with RunInContext() (Daeyeon Jeong) #43225
[0f6d19489a] - src: fix crash on FSReqPromise destructor (Santiago Gimeno) #43533
[4e6a844207] - src: delegate NodeArrayBufferAllocator to v8's allocator (Jeremy Rose) #43594
[5ae30bf17a] - src: remove a stale comment in async_hooks (Daeyeon Jeong) #43317
[0b432b957e] - src: fix compiler warning in src/heap_utils.cc (Darshan Sen) #43579
[d3fc791c3d] - src: improve and update ByteSource description (Tobias Nießen) #43478
[4e0afa4133] - src: remove CopyBuffer (Tobias Nießen) #43463
[0659d5e3b0] - src: change FormatSize to actually accept a size_t (Tobias Nießen) #43464
[66ee1f1e3c] - src: register StreamBase while registering LibuvStreamWrap (Darshan Sen) #43321
[48ee6b9dc9] - src,bootstrap: remove NodeMainInstance::registry_ (Darshan Sen) #43392
[2e181f68a3] - src,stream: change return type to Maybe (Daeyeon Jeong) #43575
[0f07abc80d] - stream: finish pipeline if dst closes before src (Robert Nagy) #43701
[1617a4621e] - stream: pass error on legacy destroy (Giacomo Gregoletto) #43519
[40f51d8e83] - test_runner: protect internals against prototype tampering (Antoine du Hamel) #43578
[ddf7518520] - test_runner: cancel on termination (Moshe Atlow) #43549
[e51d8c6004] - test_runner: wait for stderr and stdout to complete (Moshe Atlow) #43666
[dda64ddfbd] - test_runner: add Subtest to tap protocol output (Moshe Atlow) #43417
[a1f1d3a7b3] - url: update WHATWG URL parser to align with latest spec (Feng Yu) #43190
[5a5c4be5a3] - util: add AggregateError.prototype.errors to inspect output (LiviaMedeiros) #43646
[bdca4d3ccf] - util: remove unnecessary template string (Ruben Bridgewater) #41082
[6b16836448] - util: mark cwd grey while inspecting errors (Ruben Bridgewater) #41082
[baa22a7b7d] - util: avoid inline access to Symbol.iterator (Kohei Ueno) #43683
[a1f581a61e] - util: fix TypeError of symbol in template literals (cola119) #42790
[ba9b2f021f] - wasi: use WasmMemoryObject handle for perf (#43544) (snek) #43544

Documentation commits

[e0769554a5] - doc: remove bullet point referring to Node.js 12 (Luigi Pinca) #43744
[7ffcd85ace] - doc: include last security release date (Rafael Gonzaga) #43774
[4569d6ebcb] - doc: add details for July 2022 security releases (Beth Griggs) #43733
[1bd56339c5] - doc: remove openssl 1.x reference (Rafael Gonzaga) #43734
[bf62ffd848] - doc: remove node-report from support tiers (RafaelGSS) #43737
[ca5af0dbf7] - doc: update changelog-maker to the new flags (RafaelGSS) #43696
[088b9266d0] - doc: remove extra 'in's (Colin Ihrig) #43705
[7679c77347] - doc: add Geoffrey Booth to TSC (Rich Trott) #43706
[d46261ceed] - doc: improve readability of dns.md (0xSanyam) #43694
[ca0fbfd87f] - doc: add note regarding special case of 0 stat.size (Douglas Wilson) #43690
[267f66b5cc] - doc: fix default of duplex.allowHalfOpen (Vincent Weevers) #43665
[46ad2061db] - doc: fix typo in errors.md (Kazuma Ohashi) #43677
[3a8edb363e] - doc: improve description of --input-type (cola119) #43507
[b4b15b71d7] - doc: add daeyeon to triagers (Daeyeon Jeong) #43637
[cb77b3e3f7] - doc: remove appmetrics from tierlist (Tony Gorez) #43608
[0fe825ac07] - doc: remove systemtap from tierlist (Tony Gorez) #43605
[6fc5a13fe0] - doc: add single executable application initiative (Michael Dawson) #43611
[350e6ae04c] - doc: remove windows xperf from tierlist (Tony Gorez) #43607
[a6e98dfd65] - doc: remove lttng from tierlist (Tony Gorez) #43604
[22512427b3] - doc: remove dtrace from tierlist (Tony Gorez) #43606
[a3659e3547] - doc: promote 0x to tier 4 (Tony Gorez) #43609
[6ede1c2162] - doc: include CVSS mention (Rafael Gonzaga) #43602
[23c5de3579] - doc: fix icu-small example (Michael Dawson) #43591
[54a8a0c9c7] - doc: add backport-open-vN.x step to backporting guide (LiviaMedeiros) #43590
[60b949d8ff] - doc: move MylesBorins to TSC Emeritus (Myles Borins) #43524
[08ed28c31e] - doc: add Juan as a security steward (Michael Dawson) #43512
[2e799bcd35] - doc: update link to MDN page about dynamic imports (James Scott-Brown) #43530
[c8aafe2036] - doc: fix Visual Studio 2019 download link (Feng Yu) #43236
[d0c78d21e0] - doc: update link of ICU data slicer (Feng Yu) #43483
[324728094c] - doc: update v8 doc link to v8.dev (Feng Yu) #43482
[b111331c9c] - doc: add ESM version examples to events api doc (Feng Yu) #43226
[038decfbc3] - doc: update default branch name in test/** (Luigi Pinca) #43445
[a23051af84] - doc: add new useful V8 option (JialuZhang-intel) #42575
[7f406fd77b] - doc: remove branch name mention in src/README.md (Feng Yu) #43442
[06fe60a6f9] - doc: update default branch name in Makefile (Feng Yu) #43441
[9d61da0aef] - doc: update main branch name in release guide (Richard Lau) #43437
[739d3a35ed] - doc: update main branch name in onboarding.md (Feng Yu) #43443
[e0fedcfb18] - doc: fixup after rename of primary nodejs branch (Michael Dawson) #43453
[429e0f433b] - doc: update main branch name in doc/contributing/* (Luigi Pinca) #43438
[cbaf1207f4] - doc: add code examples to node test runner (Wassim Chegham) #43359
[462e526237] - doc,test: clarify timingSafeEqual semantics (Tobias Nießen) #43228

Other commits

[7ee0be71f9] - benchmark: fix output regression (Brian White) #43635
[d90a6f9bda] - benchmark: fix fork detection (Paolo Insogna) #43601
[f9c30abcdc] - benchmark: forcefully close processes (Paolo Insogna) #43557
[ebf962c053] - build: enable GitPod prebuilds (Rich Trott) #43698
[482bd53357] - build: clarify missing clang-format tool (Tobias Nießen) #42762
[919c5ee5c2] - build: update main branch name in GH workflow (Feng Yu) #43481
[3b08dfdc5d] - meta: update AUTHORS (Node.js GitHub Bot) #43750
[508cbbcbf9] - meta: update AUTHORS (Node.js GitHub Bot) #43660
[d650c9c6b0] - meta: update AUTHORS (Node.js GitHub Bot) #43573
[b9204c9be8] - meta: update AUTHORS (Node.js GitHub Bot) #43480
[294f0ef4df] - test: mark test-net-connect-reset-until-connected flaky on freebsd (Feng Yu) #43613
[f2f7d7b207] - test: remove unnecessary .toString() calls in HTTP tests (Anna Henningsen) #43731
[38e92fd88f] - test: mark test-gc-http-client-timeout as flaky on arm (Chengzhong Wu) #43754
[b164848c55] - test: fix typo in file name (Antoine du Hamel) #43764
[a0b799f645] - test: add test for profile command of node inspect (Kohei Ueno) #43058
[c4d88b3345] - test: use Object for tests variable in fs trace test (Feng Yu) #43585
[c9f130e1cf] - test: improve code coverage for performance_entry (Kohei Ueno) #43434
[0b4956079a] - test: add test to ensure repl doesn't support --input-type (cola119) #43507
[2adf4e7727] - test: fix flaky test-perf-hooks-histogram (Santiago Gimeno) #43567
[043756d540] - test: fill DOMException names (LiviaMedeiros) #43615
[e718a6e913] - test: fix Buffer.from(ArrayBufferView) call (LiviaMedeiros) #43614
[ac72f4e812] - test: mark test-worker-http2-stream-terminate flaky on all platforms (Finn Yu) #43620
[dabccef69f] - test: mark flaky tests on smartos (Feng Yu) #43596
[705e85e736] - test: improve code coverage for SourceMap class (italo jose) #43285
[7c6f548382] - test: mark test-http-server-request-timeouts-mixed flaky on macOS (F3n67u) #43597
[bd91337988] - test: refactor to top-level await (Meek Simbule) #43500
[9940dc38c1] - test: skip test-v8-serialize-leak on IBM i (Richard Lau) #43511
[17b92f0679] - test: use unique file names in fs trace test (Ben Noordhuis) #43504
[7ca58b8ee7] - test: allow EOVERFLOW errors in fs position tests (Richard Lau) #43510
[eece34cddb] - test: add WPT tests for dom/events (Daiki Nishikawa) #43151
[70d297c271] - test: replace gc(true) with gc({ type: 'minor' }) (Tobias Nießen) #43493
[1022c0d0d4] - test: fix flaky test-https-server-close- tests (Santiago Gimeno) #43216
[a9ab41cb38] - test: refactor to top-level await (Meek Simbule) #43366
[b1a7798821] - test: skip test-net-connect-reset-until-connected on SmartOS (Filip Skokan) #43449
[3b0703fd0d] - test: rename test-eventtarget-whatwg-*.js (Daeyeon Jeong) #43467
[5c0a24d5be] - test: mark test-worker-http2-stream-terminate flaky on Windows (Darshan Sen) #43425
[48ae00c0b1] - test: improve coverage for load hooks (Antoine du Hamel) #43374
[2b55b606f7] - Revert "test: mark test_buffer/test_finalizer flaky" (Matteo Collina) #43418
[3948accbf4] - test: make node-api/test_buffer/test_finalizer not flaky (Matteo Collina) #43418
[c954bcd20b] - tools: remove rpm build scripts (Ben Noordhuis) #43647
[8a06b7b9d0] - tools: update lint-md-dependencies to rollup@2.76.0 (Node.js GitHub Bot) #43749
[aafdf1239e] - tools: refactor tools/license2rtf to ESM (Feng Yu) #43232
[99ffabf2dd] - tools: update eslint to 8.19.0 (Node.js GitHub Bot) #43662
[c6396c179f] - tools: update lint-md-dependencies (Node.js GitHub Bot) #43572
[8d14d6e215] - tools: fix CJS/ESM toggle on small screens (Antoine du Hamel) #43506
[59d4da699e] - tools: update eslint to 8.18.0 (Node.js GitHub Bot) #43479
[752380a959] - tools: update main branch name (Feng Yu) #43440
[06c367ef8b] - tools: update lint-md-dependencies to rollup@2.75.6 (Node.js GitHub Bot) #43386

2022-07-07, Version 18.5.0 (Current), @RafaelGSS

This is a security release.

Notable changes

The following CVEs are fixed in this release:

CVE-2022-2097: OpenSSL - AES OCB fails to encrypt some bytes (Medium)
CVE-2022-32212: DNS rebinding in --inspect via invalid IP addresses (High)
CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)
CVE-2022-32214: HTTP Request Smuggling - Improper Delimiting of Header Fields (Medium)
CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)
CVE-2022-32222: Attempt to read openssl.cnf from /home/iojs/build/ upon startup (Medium)
CVE-2022-32223: DLL Hijacking on Windows (High)

More detailed information on each of the vulnerabilities can be found in July 7th 2022 Security Releases blog post.

llhttp updated to 6.0.7

llhttp is updated to 6.0.7 which includes fixes for the following vulnerabilities.

HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)(CVE-2022-32213 ): The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
HTTP Request Smuggling - Improper Delimiting of Header Fields (Medium)(CVE-2022-32214): The llhttp parser in the http module does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling.
- Note: This can be considered a breaking change due to disabling LF header delimiting. To enable LF header delimiting you can specify the --insecure-http-parser command-line flag, but note that this will additionally enable other insecure behaviours.
HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215): The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).

Some of these fixes required breaking changes, so you may be impacted by this update.

Default OpenSSL Configuration

To resolve CVE-2022-32223: DLL Hijacking on Windows (High), changes were made to how Node.js loads OpenSSL configuration by default.

CVE-2022-32223 could be exploited if the victim has the following dependencies on Windows machine:

OpenSSL has been installed and C:\Program Files\Common Files\SSL\openssl.cnf exists.

Whenever the above conditions are present, node.exe will search for providers.dll in the current user directory. After that, node.exe will try to search for providers.dll by the DLL Search Order in Windows. An attacker can place the malicious file providers.dll under a variety of paths to exploit this vulnerability.

Node.js can use an OpenSSL configuration file by specifying the environment variable OPENSSL_CONF, or using the command-line option --openssl-conf, and if none of those are specified will default to reading the default OpenSSL configuration file openssl.cnf.

From this release, Node.js will only read a section that is, by default, named nodejs_conf. If you were previously relying on the configuration specified in the shared section of the openssl.cnf file, you may be affected by this change. You can fall back to the previous behavior to read the default section by:

Specifying the --openssl-shared-config command-line flag; or
Creating a new nodejs_conf section in that file and copying the contents of the default section into the new nodejs_conf section.

Note that when specifying --openssl-shared-config or defining nodejs_conf in your openssl.cnf, you should be cautious and review your configuration as it could lead to you being vulnerable to similar DLL exploit attacks.

Commits

[dc7af13486] - deps: update archs files for quictls/openssl-3.0.5+quic (RafaelGSS) #43693
[fa72c534eb] - deps: upgrade openssl sources to quictls/openssl-3.0.5+quic (RafaelGSS) #43693
[a5fc2deb43] - deps: update default openssl.cnf directory (Michael Dawson) nodejs-private/node-private#335
[f2407748e3] - (SEMVER-MAJOR) http: stricter Transfer-Encoding and header separator parsing (Paolo Insogna) nodejs-private/node-private#315
[e4af5eba95] - src: fix IPv4 validation in inspector_socket (Tobias Nießen) nodejs-private/node-private#320
[3f0c3e142d] - (SEMVER-MAJOR) src,deps,build,test: add OpenSSL config appname (Daniel Bevenius) #43124
[9578158ff8] - (SEMVER-MINOR) src,doc,test: add --openssl-shared-config option (Daniel Bevenius) #43124

2022-06-16, Version 18.4.0 (Current), @danielleadams

Notable Changes

crypto:
- remove Node.js-specific webcrypto extensions (Filip Skokan) #43310
- add CFRG curves to Web Crypto API (Filip Skokan) #42507
dns:
- accept 'IPv4' and 'IPv6' for family (Antoine du Hamel) #43054
report:
- add more heap infos in process report (theanarkh) #43116

Commits

[702bfa0b7c] - async_hooks: use kEmptyObject (LiviaMedeiros) #43159
[f7c4015fd8] - bootstrap: consolidate global properties definition (Chengzhong Wu) #43357
[8d892f5259] - build: add nonpm and nocorepack to vcbuild.bat (Darshan Sen) #43219
[4109ddc005] - child_process: use kEmptyObject (LiviaMedeiros) #43159
[7b5cb14f0c] - cluster: use kEmptyObject (LiviaMedeiros) #43159
[9f1de2c005] - crypto: fix webcrypto import of cfrg raw public keys (Filip Skokan) #43404
[7f02e22998] - crypto: test webcrypto ec raw public key import (Filip Skokan) #43405
[0a075cb548] - crypto: fix webcrypto JWK EC and OKP import crv check (Filip Skokan) #43346
[df0903c8e8] - crypto: use kEmptyObject (LiviaMedeiros) #43159
[6d0053345e] - (SEMVER-MINOR) crypto: remove Node.js-specific webcrypto extensions (Filip Skokan) #43310
[28c034d6b5] - (SEMVER-MINOR) crypto: add CFRG curves to Web Crypto API (Filip Skokan) #42507
[fe7fd85109] - deps: update Corepack to 0.11.2 (Maël Nison) #43402
[517f17b214] - deps: update undici to 5.5.1 (Node.js GitHub Bot) #43412
[f4c830fbe4] - deps: upgrade npm to 8.12.1 (npm CLI robot) #43301
[0bb84b09a5] - (SEMVER-MINOR) dns: accept 'IPv4' and 'IPv6' for family (Antoine du Hamel) #43054
[f91babe494] - doc: packages documentation updates for 12 EOL (Guy Bedford) #43375
[066f963ec1] - doc: add initial doc on how to update cjs-module-lexer (Michael Dawson) #43255
[36e5684ae0] - doc: clarify use of deps/icu-small (Michael Dawson) #43287
[b9634e7ef3] - doc: remove llnode from diag tierlist (Tony Gorez) #43289
[4caeb10e7b] - doc: remove ETW from diag tierlist (Tony Gorez) #43295
[41955e5ce5] - doc: use serial comma in report docs (Tobias Nießen) #43394
[e30d4c1cb0] - doc: add fspromises mkdir example (Tierney Cyren) #40843
[adec5fa929] - doc: add F3n67u to triagers (Feng Yu) #43350
[cc3505b192] - doc: fix typo in globals.md (Daeyeon Jeong) #43365
[052c8eaf6a] - doc: use serial comma in webstreams docs (Tobias Nießen) #43353
[b824a0b7d0] - doc: fix specifier example in esm.md (hiroki osame) #43351
[d558b3c028] - doc: add undici to glossary (F3n67u) #43327
[f9ad98f5cb] - doc: change glossary link in pull request guide to node's glossary doc (Feng Yu) #43318
[02944a6783] - doc: fix typo in util.parseArgs usage example (Michael Ficarra) #43332
[f2bc6a3f71] - doc: improve description of TZ (Tobias Nießen) #43334
[9335ea6c35] - doc: use serial comma in net docs (Tobias Nießen) #43335
[05f38c6c3e] - doc: make clear the result of comparison between Symbol.for (Kohei Ueno) #43309
[c9aed9de9f] - doc: add missing require to stream api doc (Feng Yu) #43237
[f3188c1c9c] - doc: add CIGTM to glossary.md (Feng Yu) #43316
[c572d2d115] - doc: use serial comma in pull request doc (Feng Yu) #43319
[8a4e1fa002] - doc: use serial comma in ESM docs (Tobias Nießen) #43322
[fff0560a66] - doc: promote cdt to tier 3 (Tony Gorez) #43290
[7d0f6da97f] - doc: fix chromium document link in pull-requests.md (rikapo) #43265
[4674b0d2a5] - doc: fix 404 link of BUILDING.md (Feng Yu) #43234
[ee392c5c0b] - doc: update CHANGELOG_V18.md (Filip Skokan) #43298
[5a3a2a197f] - doc: add src/crypto to CC list for nodejs/crypto (Tobias Nießen) #43286
[69ce50396c] - doc: use serial comma in console docs (Tobias Nießen) #43257
[0c5092c51c] - events: fix adding abort listener in events.once (Daeyeon Jeong) #43373
[fda2105481] - events: use kEmptyObject (LiviaMedeiros) #43159
[63bf49b143] - fs: use kEmptyObject (LiviaMedeiros) #43159
[9b764531b9] - fs: export constants from fs/promises (Feng Yu) #43177
[a4409f85f8] - http: use kEmptyObject (LiviaMedeiros) #43159
[2ffd54105a] - http2: use kEmptyObject (LiviaMedeiros) #43159
[b468b8fe51] - https: use kEmptyObject (LiviaMedeiros) #43159
[d2a98dc6cf] - inspector: add missing initialization (Michael Dawson) #43254
[3b2f7eed39] - lib: use kEmptyObject in various places (LiviaMedeiros) #43159
[4a9511d971] - lib: give names to promisified methods (LiviaMedeiros) #43218
[b8644606eb] - lib: use null-prototype objects for property descriptors (Antoine du Hamel) #43270
[64edd6cbc3] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #43399
[b05cea57ba] - meta: update AUTHORS (Node.js GitHub Bot) #43387
[a8ecec57e3] - meta: move one or more collaborators to emeritus (#43183) (Node.js GitHub Bot) #43183
[60dc36244a] - meta: update AUTHORS (Node.js GitHub Bot) #43312
[9803b82ac7] - net,dns: move hasObserver out of perf function (theanarkh) #43217
[112518fb1d] - perf_hooks: fix function wrapped by timerify to work correctly (Kohei Ueno) #43330
[a3310d13bf] - perf_hooks: use kEmptyObject (LiviaMedeiros) #43159
[7e8a00a26d] - readline: fix question stack overflow (Eugene Chapko) #43320
[5e98cacf77] - readline: use kEmptyObject (LiviaMedeiros) #43159
[66d956ca49] - repl: make autocomplete case-insensitive (Sergey Petushkov) #41632
[201f3d7f56] - (SEMVER-MINOR) report: add more heap infos in process report (theanarkh) #43116
[a0568409b6] - src: fix json utils escapes for U+000B (Chengzhong Wu) #43206
[931ecfa033] - src: fix memory leaks and refactor ByteSource (Tobias Nießen) #43202
[5e65c1f3da] - src: convey potential exceptions during StreamPipe construction (Darshan Sen) #43240
[b200a5ff67] - stream: use kEmptyObject (LiviaMedeiros) #43159
[1cc1a57cdb] - test: remove unused argument in test-util-inspect.js (Colin Ihrig) #43395
[42c2115a82] - test: mark test_buffer/test_finalizer flaky (Michael Dawson) #43414
[71802c32d0] - test: fix address in use error (Caleb Everett) #43199
[e1b8c85a7a] - test: add test for short-option followed by its value (Kohei Ueno) #43358
[f8d26c6011] - test: fix common.mustNotCall error message (Antoine du Hamel) #42917
[18fffe6108] - test: convert then to async/await (Meek Simbule) #43292
[acd96d80eb] - test: add BigInts to common.getArrayBufferViews() (LiviaMedeiros) #43235
[e576a7fa50] - test_runner: use kEmptyObject (LiviaMedeiros) #43159
[fecad7a3a5] - timers: use kEmptyObject (LiviaMedeiros) #43159
[e31baca76a] - tls: use kEmptyObject (LiviaMedeiros) #43159
[7f8f61a749] - tls: fix performance regression in convertALPNProtocols() (LiviaMedeiros) #43250
[ac9599a718] - tools: report unsafe string and regex primordials as lint errors (Antoine du Hamel) #43393
[b69d874592] - tools: fix create-or-update-pull-request-action hash on GHA (Antoine du Hamel) #43378
[cf8a115983] - tools: add avoid-prototype-pollution lint rule (Antoine du Hamel) #43308
[8c0fe1e184] - tools: fix find-inactive actions (LiviaMedeiros) #43377
[7f45d69f83] - tools: update lint-md-dependencies to rollup@2.75.5 (Node.js GitHub Bot) #43313
[d5d0f01c5a] - tools: update eslint to 8.17.0 (Node.js GitHub Bot) #43314
[f598fe1585] - tools: use hashes instead of tags for external actions (#43284) (Antoine du Hamel) #43284
[10f79947d9] - tools: update codecov/codecov-action version (Antoine du Hamel) #43297
[f93848fa50] - tools: update lint-md-dependencies to rollup@2.75.3 (Node.js GitHub Bot) #43261
[b3d7dc1de8] - tools: update clang-format 1.7.0 to 1.8.0 (Darshan Sen) #43241
[812140c65a] - tools,doc: add guards against prototype pollution when creating proxies (Antoine du Hamel) #43391
[56b8cc5cef] - util: freeze kEnumerableProperty (LiviaMedeiros) #43390
[b187d55b6d] - util: add kEmptyObject to internal/util (LiviaMedeiros) #43159
[024b396275] - vm: use kEmptyObject (LiviaMedeiros) #43159
[7fc432fa35] - wasi: use kEmptyObject (LiviaMedeiros) #43159
[44b65d0ca7] - worker: use kEmptyObject (LiviaMedeiros) #43159

2022-06-01, Version 18.3.0 (Current), @bengl

Notable Changes

[dc3b91f351] - deps: update undici to 5.4.0 (Node.js GitHub Bot) #43262
[d6cf409d78] - (SEMVER-MINOR) util: add parseArgs module (Benjamin Coe) #42675
[9539cfa358] - (SEMVER-MINOR) http: add uniqueHeaders option to request and createServer (Paolo Insogna) #41397
[41fdc2617d] - deps: upgrade npm to 8.11.0 (npm team) #43210
[0000654e47] - deps: patch V8 to 10.2.154.4 (Michaël Zasso) #43067
[b3c8e609fd] - (SEMVER-MINOR) deps: update V8 to 10.2.154.2 (Michaël Zasso) #42740
[3e89b7336d] - (SEMVER-MINOR) fs: make params in writing methods optional (LiviaMedeiros) #42601
[9539cfa358] - (SEMVER-MINOR) http: add uniqueHeaders option to request and createServer (Paolo Insogna) #41397
[8f5b4570e5] - (SEMVER-MINOR) net: add ability to reset a tcp socket (pupilTong) #43112
[5eff7b4a6a] - (SEMVER-MINOR) Revert "build: make x86 Windows support temporarily experimental" (Michaël Zasso) #42740
- This means 32-bit Windows binaries are back with this release.

Commits

[aefc9dda9a] - benchmark: add node-error benchmark (RafaelGSS) #43077
[85d81a764f] - bootstrap: include code cache in the embedded snapshot (Joyee Cheung) #43023
[5eff7b4a6a] - (SEMVER-MINOR) Revert "build: make x86 Windows support temporarily experimental" (Michaël Zasso) #42740
[d6634707c5] - (SEMVER-MINOR) build: run V8 tests with detected Python version (Richard Lau) #42740
[b8b5e6df67] - (SEMVER-MINOR) build: reset embedder string to "-node.0" (Michaël Zasso) #42740
[285ef30877] - console: fix console.dir crash on a revoked proxy (Daeyeon Jeong) #43100
[920d8c5300] - crypto: align webcrypto RSA key import/export with other implementations (Filip Skokan) #42816
[c76caadf2e] - debugger: throw a more useful error when the frame is missing (Kohei Ueno) #42776
[dc3b91f351] - deps: update undici to 5.4.0 (Node.js GitHub Bot) #43262
[35250bf2f6] - deps: regenerate OpenSSL archs files (Daniel Bevenius) #42973
[ecacc3a727] - deps: exclude linker scripts for windows builds (Daniel Bevenius) #42973
[41fdc2617d] - deps: upgrade npm to 8.11.0 (npm team) #43210
[87b248e27e] - deps: update undici to 5.3.0 (Node.js GitHub Bot) #43197
[d42de132a7] - deps: upgrade npm to 8.10.0 (npm team) #43061
[0000654e47] - deps: patch V8 to 10.2.154.4 (Michaël Zasso) #43067
[742ffefb44] - (SEMVER-MINOR) deps: make V8 10.2 ABI-compatible with 10.1 (Michaël Zasso) #42740
[c626a533c7] - deps: make V8 compilable with older glibc (Michaël Zasso) #42657
[76546b12a2] - deps: V8: fix v8-cppgc.h for MSVC (Jiawen Geng) #42657
[45e1fd4473] - deps: silence V8's warning on CompileFunction (Michaël Zasso) #40907
[2130891a9a] - (SEMVER-MINOR) deps: disable trap handler for Windows cross-compiler (Michaël Zasso) #40488
[e678b6c63d] - deps: fix V8 build issue with inline methods (Jiawen Geng) #38807
[f83323f304] - deps: V8: forward declaration of Rtl*FunctionTable (Refael Ackermann) #32116
[4be7584ca6] - deps: V8: un-cherry-pick bd019bd (Refael Ackermann) #32116
[b3c8e609fd] - (SEMVER-MINOR) deps: update V8 to 10.2.154.2 (Michaël Zasso) #42740
[0afdc3e9a8] - doc: use serial comma in errors docs (Tobias Nießen) #43242
[00989338b3] - doc: add note regarding %Array.prototype.concat% in primordials.md (Antoine du Hamel) #43166
[badf72dd0a] - doc: use serial comma in worker_threads docs (Tobias Nießen) #43220
[776e746f0a] - doc: fix napi version for node_api_symbol_for (Danielle Adams) #42878
[76b46801f8] - doc: document signal option for EventTarget#addEventListener (Antoine du Hamel) #43170
[3082c75efd] - doc: make minor adjustments (LiviaMedeiros) #43175
[598c1f102e] - doc: use serial comma in dgram docs (Tobias Nießen) #43191
[b772c13a62] - doc: use serial comma in process docs (Tobias Nießen) #43179
[f90a3d7a54] - doc: improved parallel specification (mawaregetsuka) #42679
[71074eedef] - doc: improve callback params for fs.mkdir (Daeyeon Jeong) #43016
[2b8b224077] - doc: remove outdated footnote (Python 2 --> 3 for V8 tests) (DeeDeeG) #43105
[945f228cf1] - doc: add release key for RafaelGSS (Rafael Gonzaga) #43131
[56fc712f93] - doc: use serial comma in assert docs (Tobias Nießen) #43154
[093a3cf2f1] - doc: fix errors in Performance hooks doc (OneNail) #43152
[4d9f43a8a7] - doc: use serial comma in dns docs (Tobias Nießen) #43145
[4e9393e32f] - doc: use ASCII apostrophes consistently (Tobias Nießen) #43114
[b3181851d7] - doc: add strategic initiative for shadow realm (Chengzhong Wu) #43037
[6f48dfb499] - fs: add trailing commas (LiviaMedeiros) #43127
[3e89b7336d] - (SEMVER-MINOR) fs: make params in writing methods optional (LiviaMedeiros) #42601
[9539cfa358] - (SEMVER-MINOR) http: add uniqueHeaders option to request and createServer (Paolo Insogna) #41397
[b187060f76] - http2: set origin name correctly when servername is empty (ofirbarak) #42838
[a07f5f28f3] - http2: improve tests and docs (Daeyeon Jeong) #42858
[701d40496d] - lib: refactor validateInt32 and validateUint32 (mawaregetsuka) #43071
[09da76493a] - meta: update AUTHORS (Node.js GitHub Bot) #43231
[1da6b7c32b] - meta: add mailmap entry for legendecas (Chengzhong Wu) #43156
[1be254b24e] - meta: add mailmap entry for npm team (Luigi Pinca) #43143
[7d8d9d625a] - meta: add mailmap entry for Morgan Roderick (Luigi Pinca) #43144
[8f5b4570e5] - (SEMVER-MINOR) net: add ability to reset a tcp socket (pupilTong) #43112
[11c783fa63] - net: remoteAddress always undefined called before connected (OneNail) #43011
[9c4e070567] - (SEMVER-MINOR) node-api: emit uncaught-exception on unhandled tsfn callbacks (Chengzhong Wu) #36510
[54d68b1afd] - perf_hooks: fix start_time of perf_hooks (theanarkh) #43069
[baa5d0005a] - src: refactor GetCipherValue and related functions (Tobias Nießen) #43171
[6ee9fb14e4] - src: make SecureContext fields private (Tobias Nießen) #43173
[1e2552ba6c] - src: reuse GetServerName (Tobias Nießen) #43168
[d8a14a2486] - src: fix static analysis warning and use smart ptr (Tobias Nießen) #43117
[72a767b7ca] - src: remove SecureContext::operator* (Tobias Nießen) #43121
[82fb037388] - src: move context snapshot index to SnapshotData (Joyee Cheung) #43023
[9577878258] - src: replace TraceEventScope with sync events (Chengzhong Wu) #42977
[41b69e3cf4] - src,lib: migrate to console on context's extra binding (Chengzhong Wu) #43142
[3e1ed1ee0c] - test: improve code coverage for inspector connection errors (Kohei Ueno) #42310
[d7ca2234dc] - test: use mustSucceed instead of mustCall with assert.ifError (MURAKAMI Masahiko) #43188
[9cc5ce6a24] - test: improve readline/emitKeypressEvents.js coverage (OneNail) #42908
[447bbd0d66] - tls: fix convertALPNProtocols accepting ArrayBufferViews (LiviaMedeiros) #43211
[df691464aa] - tools: update lint-md-dependencies to rollup@2.75.1 (Node.js GitHub Bot) #43230
[d9fb25c936] - tools: refactor build-addons.js to ESM (Feng Yu) #43099
[0efeceb4a6] - tools: update lint-md-dependencies to rollup@2.74.1 (Node.js GitHub Bot) #43172
[ed352a945c] - tools: update eslint to 8.16.0 (Node.js GitHub Bot) #43174
[1183058908] - tools: refactor update-authors.js to ESM (Feng Yu) #43098
[5228028962] - (SEMVER-MINOR) tools: update V8 gypfiles for 10.2 (Michaël Zasso) #42740
[d6cf409d78] - (SEMVER-MINOR) util: add parseArgs module (Benjamin Coe) #42675
[d91b489784] - worker: fix heap snapshot crash on exit (Chengzhong Wu) #43123

2022-05-17, Version 18.2.0 (Current), @BethGriggs prepared by @RafaelGSS

Notable Changes

OpenSSL 3.0.3

This update can be treated as a security release as the issues addressed in OpenSSL 3.0.3 slightly affect Node.js 18. See https://nodejs.org/en/blog/vulnerability/openssl-fixes-in-regular-releases-may2022/ for more information on how the May 2022 OpenSSL releases affect other Node.js release lines.

[8e54c19a6e] - deps: update archs files for quictls/openssl-3.0.3+quic (RafaelGSS) #43022
[6365bf808e] - deps: upgrade openssl sources to quictls/openssl-3.0.3 (RafaelGSS) #43022

Other Notable Changes

[13c333e533] - Revert "deps: add template for generated headers" (Daniel Bevenius) #42978
[d128356a7f] - deps: update undici to 5.2.0 (Node.js GitHub Bot) #43059
[2df1624f80] - deps: upgrade npm to 8.9.0 (npm team) #42968
[6365bf808e] - deps: upgrade openssl sources to quictls/openssl-3.0.3 (RafaelGSS) #43022
[4a3f678e70] - doc: add LiviaMedeiros to collaborators (LiviaMedeiros) #43039
[686c4c1f6f] - doc: add release key for Juan Arboleda (Juan José) #42961
[784d84cf34] - (SEMVER-MINOR) fs: add read(buffer[, options]) versions (LiviaMedeiros) #42768
[2f192c4be0] - (SEMVER-MINOR) http: added connection closing methods (Paolo Insogna) #42812
[c92e291beb] - (SEMVER-MINOR) perf_hooks: add PerformanceResourceTiming (RafaelGSS) #42725

Commits

[7cac7bb806] - assert: fix CallTracker wraps the function causes the length to be lost (OneNail) #42909
[e74a8da287] - assert: make assert.fail less affected by prototype tampering (Antoine du Hamel) #42918
[1146806673] - bootstrap: stop delaying instantiation of maps in per-context scripts (Darshan Sen) #42934
[a20310d171] - bootstrap: use a context snapshotted with primordials in workers (Joyee Cheung) #42867
[9ee7d9eb15] - bootstrap: fix wasm_web_api external reference registration (Joyee Cheung) #42903
[cec678a00e] - build: set ASAN workaround (Richard Lau) #43085
[7c4df42caa] - build: disable windows-2022 temporarily (Jiawen Geng) #43093
[0eb32ed976] - build: fix various shared library build issues (William Marlow) #41850
[48f4a714b2] - build: fix indeterminacy of icu_locales value (Sergey Nazaryev) #42865
[19c060fd84] - crypto: adjust minimum length in generateKey('hmac', ...) (LiviaMedeiros) #42944
[183bcc0699] - crypto: clean up parameter validation in HKDF (Tobias Nießen) #42924
[946f57c7bc] - debugger: fix inconsistent inspector output of exec new Map() (Kohei Ueno) #42423
[d128356a7f] - deps: update undici to 5.2.0 (Node.js GitHub Bot) #43059
[a9703a55ef] - deps: remove opensslconf template headers (Daniel Bevenius) #43035
[a4a4f7134b] - deps: fix llhttp version number (Michael Dawson) #43029
[8e54c19a6e] - deps: update archs files for quictls/openssl-3.0.3+quic (RafaelGSS) #43022
[6365bf808e] - deps: upgrade openssl sources to quictls/openssl-3.0.3 (RafaelGSS) #43022
[e8121ae7fe] - deps: regenerate OpenSSL archs files (Daniel Bevenius) #42978
[13c333e533] - Revert "deps: add template for generated headers" (Daniel Bevenius) #42978
[2df1624f80] - deps: upgrade npm to 8.9.0 (npm team) #42968
[f53ed9d1bb] - doc: use serial comma in fs docs (Tobias Nießen) #43104
[839824aca8] - doc: use serial comma in events docs (Tobias Nießen) #43113
[9629c74080] - doc: use serial comma in modules docs (Tobias Nießen) #43103
[76096c2d4a] - doc: use serial comma in util docs (Tobias Nießen) #43063
[1e9de0dd5a] - doc: remove git:// protocol, adjust nits in onboarding.md (LiviaMedeiros) #43045
[eb630d7ef9] - doc: add maintaining info for shared libary option (Michael Dawson) #42517
[3816a97bae] - doc: add detail for how to update llhttp (Michael Dawson) #43028
[330e267a57] - doc: use serial comma in buffer docs (Tobias Nießen) #43048
[0957212390] - doc: use consistent method symbol (Paolo Insogna) #42974
[22cb7104cb] - doc: add Rafael to the security steward for NearForm (Matteo Collina) #42966
[ef177da3f1] - doc: mark some node-api functions as experimental (NickNaso) #42987
[4a3f678e70] - doc: add LiviaMedeiros to collaborators (LiviaMedeiros) #43039
[c988a0ed26] - doc: use serial comma in http docs (Tobias Nießen) #43026
[4de918b4c1] - doc: add the preferred name for @himself65 (Himself65) #43024
[686c4c1f6f] - doc: add release key for Juan Arboleda (Juan José) #42961
[64e0aa116d] - doc: rename N-API to Node-API in test/README.md (Daeyeon Jeong) #42946
[65d64553c0] - doc: use serial comma in tls docs (Tobias Nießen) #43001
[840e61e745] - doc: improve commit message example for releases (Juan José) #42954
[ba3ad7c665] - doc: use serial comma in cluster docs (Tobias Nießen) #42989
[3ab3086008] - doc: fix errors in Web Streams doc (OneNail) #42862
[1fbfee2497] - doc: fix examples in cluster.md (OneNail) #42889
[1237c742f4] - doc: add additional step to security release process (Michael Dawson) #42916
[88692d8fd6] - doc: add section regarding property definition in primordials.md (Antoine du Hamel) #42921
[924670f3af] - doc: clarify some default values in fs.md (LiviaMedeiros) #42892
[becca06f9b] - fs: remove unnecessary ?? operator (Morgan Roderick) #43073
[784d84cf34] - (SEMVER-MINOR) fs: add read(buffer[, options]) versions (LiviaMedeiros) #42768
[2f192c4be0] - (SEMVER-MINOR) http: added connection closing methods (Paolo Insogna) #42812
[bfbf965eb0] - http2: compat support for array headers (OneNail) #42901
[46a44b3011] - lib: move WebAssembly Web API into separate file (Tobias Nießen) #42993
[c64b8d3282] - lib,test: enable wasm/webapi/empty-body WPT (Tobias Nießen) #42960
[ddd271ec2b] - meta: add mailmap entry for ShogunPanda (Paolo Insogna) #43094
[174ff972f0] - meta: update .mailmap for recent README name change (Rich Trott) #43027
[16df8ad7c3] - meta: update AUTHORS (Node.js GitHub Bot) #43004
[0ec32d0715] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #42937
[037ff3da6d] - node-api: explicitly set __cdecl for API functions (Vladimir Morozov) #42780
[e2462a2f98] - node-api: fix napi_get_all_property_names (Vladimir Morozov) #42463
[c92e291beb] - (SEMVER-MINOR) perf_hooks: add PerformanceResourceTiming (RafaelGSS) #42725
[c535db1195] - src: delete AllocatedBuffer (Darshan Sen) #43008
[5dc79298e1] - src: remove unnecessary comment (Kohei Ueno) #42952
[38e4c15534] - src: always signal V8 for intercepted properties (Michaël Zasso) #42963
[cacff07e75] - src: fix memory leak for v8.serialize (liuxingbaoyu) #42695
[8cfc18e4db] - src,crypto: remove uses of AllocatedBuffer from crypto_rsa.cc (Darshan Sen) #42852
[0670843b24] - test: fix dangerous .map in test/parallel/test-http-set-trailers.js (LiviaMedeiros) #43087
[9eb8bf1d26] - test: reduce flakiness of test-fs-read-position-validation.mjs (LiviaMedeiros) #42999
[41d2f6e8c5] - test: rename handlewrap.hasref tests (Daeyeon Jeong) #42754
[e058f47277] - test: improve observable ICU behaviour coverage (LiviaMedeiros) #42683
[d23debb4cb] - test: validate webstream encoder/decoder inspector (Yoshiki Kurihara) #42747
[b1c18edaa9] - test: usemustSucceed instead of mustCall with assert.ifError (MURAKAMI Masahiko) #42806
[2dc795687a] - test: improve lib/internal/webstreams/readablestream.js coverage (MURAKAMI Masahiko) #42823
[d746207dc2] - test: fix test-crypto-fips.js under shared OpenSSL (Vita Batrla) #42947
[56c47b5101] - test: use consistent timeouts (Paolo Insogna) #42893
[68ed3c88d9] - test: add test for position validation in fs.read() and fs.readSync() (LiviaMedeiros) #42837
[72b90fd5f5] - test: reduce impact of flaky HTTP server tests (Tobias Nießen) #42926
[531a0a9980] - tools: update lint-md-dependencies to rollup@2.73.0 (Node.js GitHub Bot) #43107
[64daaca46d] - tools: update eslint to 8.15.0 (Node.js GitHub Bot) #43005
[79872382ef] - tools: refactor lint-sh.js to esm module (Feng Yu) #42942
[265ecdfe07] - tools: update lint-md-dependencies (Node.js GitHub Bot) #43003
[e9e1f1e194] - typings: fix os.cpus invalid return type (Himself65) #43006
[55ef6e81cb] - wasm: add missing init reported by coverity (Michael Dawson) #42897
[5470578008] - worker: fix stream racing with terminate (Keyhan Vakil) #42874

2022-05-03, Version 18.1.0 (Current), @targos

Notable Changes

[c46e7bbf69] - doc: add @kuriyosh to collaborators (Yoshiki Kurihara) #42824
[b0f7c4c8f9] - (SEMVER-MINOR) lib,src: implement WebAssembly Web API (Tobias Nießen) #42701
[78a860ae58] - (SEMVER-MINOR) test_runner: add initial CLI runner (Colin Ihrig) #42658
[bf9240ae8c] - (SEMVER-MINOR) worker: add hasRef() to MessagePort (Darshan Sen) #42849

Commits

[4694f5bb96] - async_hooks: avoid decrementing iterator after erase (Gabriel Bota) #42749
[459546b4f0] - benchmark: fix misc/startup failure (Antoine du Hamel) #42746
[6bd24204ea] - bootstrap: use the isolate snapshot in workers (Joyee Cheung) #42702
[29c8411f99] - bootstrap: move embedded snapshot to SnapshotBuilder (Joyee Cheung) #42702
[4050b0d64f] - build: enable V8's shared read-only heap (Michaël Zasso) #42809
[f9994e2029] - build: improve reliability of find_python.cmd script (Luigi Pinca) #42810
[5d15eb1a14] - build: fix format-cpp (Darshan Sen) #42764
[7c973474bf] - build: improve the format-cpp error message (Darshan Sen) #42765
[7681e60829] - crypto: validate this in all webcrypto methods and getters (Filip Skokan) #42815
[2a4c8263c3] - deps: update undici to 5.1.1 (Michaël Zasso) #42939
[1102922ef9] - deps: upgrade npm to 8.8.0 (npm team) #42886
[279892987b] - deps: remove linux-ppc64 architecture (Daniel Bevenius) #42616
[4abe9879ae] - deps: remove linux-ppc architecture (Daniel Bevenius) #42616
[8dc71f2266] - deps: remove aix-gcc architecture (Daniel Bevenius) #42616
[6dc1f82384] - deps: remove archs/aix64-gcc (Daniel Bevenius) #42616
[e8734a4771] - deps: add note about removing asm archs (Daniel Bevenius) #42616
[7fae2c9d6e] - deps: add template for generated headers (Daniel Bevenius) #42616
[294664e32c] - deps: upgrade npm to 8.7.0 (npm team) #42744
[60e461c45d] - doc: reword "test directory" (LiviaMedeiros) #42817
[227a45ba60] - doc: remove legacy -J test.py option from BUILDING.md (LiviaMedeiros) #42817
[e313dc6ed9] - doc: http2.createServer options as optional (Daeyeon Jeong) #42832
[8f2b2280cd] - doc: record March 2022 security release steward (Richard Lau) #42876
[e15d22c024] - doc: initial version of security-model-strategy.md (Michael Dawson) #42709
[fe65996790] - doc: clarify guide on testing internal errors (Livia Medeiros) #42813
[2f849a460f] - doc: fix markdown formatting in primordials.md (Tobias Nießen) #42877
[cd2f5a4fd4] - doc: add primordials guidelines (Antoine du Hamel) #38635
[2d76f72665] - doc: elevate node-clinic diagnostic tier (RafaelGSS) #42802
[9b61ac2617] - doc: update WebAssembly strategy with Wasm Web API (Tobias Nießen) #42836
[c6c1dc5833] - doc: order vm.Module linker arguments correctly (Simen Bekkhus) #42797
[c46e7bbf69] - doc: add @kuriyosh to collaborators (Yoshiki Kurihara) #42824
[59da1339b4] - doc: add maintaining-webassembly.md (Michael Dawson) #42660
[d9f3f05cab] - doc: fix outdated documentation for family property (Antoine du Hamel) #42789
[6fa080cb48] - doc: delete heapdump from diagnostic tooling support tiers (Tony Gorez) #42783
[c32f76d49e] - doc: fix example in assert.md (Livia Medeiros) #42786
[6225370b2e] - doc: fix version history for Loaders API (Antoine du Hamel) #42778
[3d65a3b13e] - doc: add node: prefix for all core modules (Antoine du Hamel) #42752
[46c880b99b] - doc: clarify core modules that can be loaded without a prefix (Antoine du Hamel) #42753
[025b3e786a] - doc: consolidate use of multiple-byte units (Antoine du Hamel) #42587
[962d80b7a1] - doc: add documentation for inherited methods (Luigi Pinca) #42691
[222b3e6674] - doc: close tag in n-api.md (Livia Medeiros) #42751
[4c30936065] - doc: copyedit http.OutgoingMessage documentation (Luigi Pinca) #42733
[d77c59d0f2] - doc: improve fragment (:target) anchors behavior on HTML version (Antoine du Hamel) #42739
[c50309cb39] - doc: fix added: info for outgoingMessage.writable* (Luigi Pinca) #42737
[6b7c35e807] - doc: delete mdb_v8 from diagnostic tooling support tiers (Tony Gorez) #42626
[2a07a9fc3a] - doc: document the 'close' and 'finish' events (Luigi Pinca) #42704
[ef5ab8179b] - doc: fix added: info for outgoingMessage.{,un}cork() (Luigi Pinca) #42711
[a6e1e7a5d7] - doc,test: add tests and docs for duplex.fromWeb and duplex.toWeb (Erick Wendel) #42738
[336242a7c6] - errors,console: refactor to use ES2021 syntax (小菜) #42872
[0e16120d0d] - errors,vm: update error and use cause (Gus Caplan) #42820
[a0638a23b0] - esm: fix imports from non-file module (Antoine du Hamel) #42881
[dab15f69e3] - esm: graduate top-level-await to stable (Antoine du Hamel) #42875
[48bbb73f36] - fs: fix mkdirSync so ENOSPC is correctly reported (Santiago Gimeno) #42811
[d33cbabd79] - lib: remove experimental warning from FormData (Xuguang Mei) #42807
[ad8269450a] - lib,src: use Response URL as WebAssembly location (Tobias Nießen) #42842
[b0f7c4c8f9] - (SEMVER-MINOR) lib,src: implement WebAssembly Web API (Tobias Nießen) #42701
[fdc65032a7] - meta: update AUTHORS (Node.js GitHub Bot) #42848
[33ac027fdf] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #42769
[14893c5984] - meta: update AUTHORS (Node.js GitHub Bot) #42760
[2f38b4812c] - meta: move mmarchini to emeritus (mary marchini) #42750
[718d11fdb0] - perf_hooks: return different functions in timerify (Himself65) #42854
[e8083664e1] - src: turn SSL_CTX_new CHECK/segfault into JS exception (Anna Henningsen) #42799
[37ca1102c4] - src: make --no-node-snapshot a per-process option (Joyee Cheung) #42864
[1976284a92] - src: define fs.constants.S_IWUSR & S_IRUSR for Win (Liviu Ionescu) #42757
[b7e9dd0278] - src: use node: prefix in example (Antoine du Hamel) #42794
[1a7af6364d] - src: large page attributing an id on Linux (David CARLIER) #42644
[494650c09f] - src,crypto: remove uses of AllocatedBuffer from crypto_ec.cc (Darshan Sen) #42766
[8e0e576669] - test: add tests for extracting function name (Kohei Ueno) #42399
[fbda87d966] - test: simplify test-gc-{http-client,net}-* (Luigi Pinca) #42782
[3c796f8328] - test: fix parallel/test-dgram-udp6-link-local-address (Antoine du Hamel) #42795
[b85a11c28e] - test: improve lib/internal/test_runner/test.js coverage (MURAKAMI Masahiko) #42745
[59c07a99fb] - test: check ecdsa psychic signature (Filip Skokan) #42863
[0725064695] - test: fix port in net-perf_hooks (Livia Medeiros) #42761
[7b701442de] - test: skip test that cannot pass under --node-builtin-modules-path (Geoffrey Booth) #42834
[37364abc58] - test: fix flaky HTTP server tests (Tobias Nießen) #42846
[8476ffb85a] - test: use assert.match() instead of assert(regex.test()) (Antoine du Hamel) #42803
[d311916f37] - test: fix calculations in test-worker-resource-limits (Joyee Cheung) #42702
[deb3cf49c7] - test: remove the legacy url parser function (Kohei Ueno) #42656
[be44b1ffcb] - test: improve test coverage of internal/blob (Yoshiki Kurihara) #41513
[78a860ae58] - (SEMVER-MINOR) test_runner: add initial CLI runner (Colin Ihrig) #42658
[1e7479d34c] - tools: update lint-md-dependencies (Node.js GitHub Bot) #42932
[c3c5fe78dc] - tools: bump jsdoccomment from 0.22.1 to 0.29.0 (Rich Trott) #42857
[97fc00a06e] - tools: update eslint to 8.14.0 (Node.js GitHub Bot) #42845
[93fd77a16f] - tools: update doc to highlight.js@11.5.1 (Node.js GitHub Bot) #42758
[47c04813f7] - tools: update lint-md-dependencies (Node.js GitHub Bot) #42759
[18ae2c39d5] - tools: lint osx shell scripts (Livia Medeiros) #42712
[4af0fbd41e] - v8: export cpu_profiler_metadata_size in getHeapCodeStatistics (theanarkh) #42818
[a19fb609d8] - v8: export more fields in getHeapStatistics (theanarkh) #42784
[1b5856a2a9] - wasi: remove unecessary null check (Michael Dawson) #42819
[bf9240ae8c] - (SEMVER-MINOR) worker: add hasRef() to MessagePort (Darshan Sen) #42849
[c3922afa1c] - worker: add hasRef() to the handle object (Darshan Sen) #42756

2022-04-19, Version 18.0.0 (Current), @BethGriggs

Node.js 18 is here! Highlights include the update of the V8 JavaScript engine to 10.1, global fetch enabled by default, and a core test runner module.

Initially, Node.js 18 will replace Node.js 17 as our ‘Current’ release line. As per the release schedule, Node.js 18 will be the ‘Current’ release for the next 6 months and then promoted to Long-term Support (LTS) in October 2022. Once promoted to long-term support the release will be designated the codename ‘Hydrogen’. Node.js 18 will be supported until April 2025.

Notable Changes

Deprecations and Removals

(SEMVER-MAJOR) fs: runtime deprecate string coercion in fs.write, fs.writeFileSync (Livia Medeiros) #42607
(SEMVER-MAJOR) dns: remove dns.lookup and dnsPromises.lookup options type coercion (Antoine du Hamel) #41431
(SEMVER-MAJOR) process: runtime deprecate multipleResolves (Benjamin Gruenbaum) #41896
(SEMVER-MAJOR) stream: remove thenable support (Robert Nagy) #40773
(SEMVER-MAJOR) tls: move tls.parseCertString to end-of-life (Tobias Nießen) #41479

fetch (experimental)

An experimental fetch API is available on the global scope by default. The implementation is based upon undici, an HTTP/1.1 client written for Node.js by contributors to the project.

const res = await fetch('https://nodejs.org/api/documentation.json');
if (res.ok) {
  const data = await res.json();
  console.log(data);
}

Through this addition, the following globals are made available: fetch, FormData, Headers, Request, Response.

Disable this API with the --no-experimental-fetch command-line flag.

Contributed by Michaël Zasso in #41811.

HTTP Timeouts

server.headersTimeout which limits the amount of time the parser will wait to receive the complete HTTP headers is now set to 60000 (60 seconds) by default.

server.requestTimeout which sets the timeout value in milliseconds for receiving the entire request from the client is now set to 300000 (5 minutes) by default.

If these timeouts expire, the server responds with status 408 without forwarding the request to the request listener and then closes the connection.

Both timeouts must be set to a non-zero value to protect against potential Denial-of-Service attacks in case the server is deployed without a reverse proxy in front.

Contributed by Paolo Insogna in #41263.

Test Runner module (experimental)

The node:test module facilitates the creation of JavaScript tests that report results in TAP format. To access it:

import test from 'node:test';

This module is only available under the node: scheme.

The following is an example implementation of a parent test with two subtests:

test('top level test', async (t) => {
  await t.test('subtest 1', (t) => {
    assert.strictEqual(1, 1);
  });

  await t.test('subtest 2', (t) => {
    assert.strictEqual(2, 2);
  });
});

Contributed by Colin Ihrig in #42325.

Toolchain and Compiler Upgrades

Prebuilt binaries for Linux are now built on Red Hat Enterprise Linux (RHEL) 8 and are compatible with Linux distributions based on glibc 2.28 or later, for example, Debian 10, RHEL 8, Ubuntu 20.04.
Prebuilt binaries for macOS now require macOS 10.15 or later.
For AIX the minimum supported architecture has been raised from Power 7 to Power 8.

Prebuilt binaries for 32-bit Windows will initially not be available due to issues building the V8 dependency in Node.js. We hope to restore 32-bit Windows binaries for Node.js 18 with a future V8 update.

Node.js does not support running on operating systems that are no longer supported by their vendor. For operating systems where their vendor has planned to end support earlier than April 2025, such as Windows 8.1 (January 2023) and Windows Server 2012 R2 (October 2023), support for Node.js 18 will end at the earlier date.

Full details about the supported toolchains and compilers are documented in the Node.js BUILDING.md file.

Contributed by Richard Lau in #42292, #42604 and #42659,and Michaël Zasso in #42105 and #42666.

V8 10.1

The V8 engine is updated to version 10.1, which is part of Chromium 101. Compared to the version included in Node.js 17.9.0, the following new features are included:

The findLast and findLastIndex array methods.
Improvements to the Intl.Locale API.
The Intl.supportedValuesOf function.
Improved performance of class fields and private class methods (the initialization of them is now as fast as ordinary property stores).

The data format returned by the serialization API (v8.serialize(value)) has changed, and cannot be deserialized by earlier versions of Node.js. On the other hand, it is still possible to deserialize the previous format, as the API is backwards-compatible.

Contributed by Michaël Zasso in nodejs#42657.

Web Streams API (experimental)

Node.js now exposes the experimental implementation of the Web Streams API on the global scope. This means the following APIs are now globally available:

ReadableStream, ReadableStreamDefaultReader, ReadableStreamBYOBReader, ReadableStreamBYOBRequest, ReadableByteStreamController, ReadableStreamDefaultController, TransformStream, TransformStreamDefaultController, WritableStream, WritableStreamDefaultWriter, WritableStreamDefaultController, ByteLengthQueuingStrategy, CountQueuingStrategy, TextEncoderStream, TextDecoderStream, CompressionStream, DecompressionStream.

Contributed James Snell in nodejs#39062, and Antoine du Hamel in nodejs#42225.

Other Notable Changes

(SEMVER-MAJOR) buffer: expose Blob as a global (James M Snell) #41270
(SEMVER-MAJOR) child_process: improve argument validation (Rich Trott) #41305
doc: add RafaelGSS to collaborators (RafaelGSS) #42718
(SEMVER-MAJOR) http: make TCP noDelay enabled by default (Paolo Insogna) #42163
(SEMVER-MAJOR) net: make server.address() return an integer for family (Antoine du Hamel) #41431
(SEMVER-MAJOR) worker: expose BroadcastChannel as a global (James M Snell) #41271
(SEMVER-MAJOR) worker: graduate BroadcastChannel to supported (James M Snell) #41271

Semver-Major Commits

[dab8ab2837] - (SEMVER-MAJOR) assert,util: compare RegExp.lastIndex while using deep equal checks (Ruben Bridgewater) #41020
[cff14bcaef] - (SEMVER-MAJOR) buffer: refactor byteLength to remove outdated optimizations (Rongjian Zhang) #38545
[cea76dbf33] - (SEMVER-MAJOR) buffer: expose Blob as a global (James M Snell) #41270
[99c18f4786] - (SEMVER-MAJOR) buffer: graduate Blob from experimental (James M Snell) #41270
[35d72bf4ec] - (SEMVER-MAJOR) build: make x86 Windows support temporarily experimental (Michaël Zasso) #42666
[1134d8faf8] - (SEMVER-MAJOR) build: bump macOS deployment target to 10.15 (Richard Lau) #42292
[27eb91d378] - (SEMVER-MAJOR) build: downgrade Windows 8.1 and server 2012 R2 to experimental (Michaël Zasso) #42105
[26c973d4b3] - (SEMVER-MAJOR) child_process: improve argument validation (Rich Trott) #41305
[38007df999] - (SEMVER-MAJOR) cluster: make kill to be just process.kill (Bar Admoni) #34312
[aed18dfe59] - (SEMVER-MAJOR) crypto: cleanup validation (Mohammed Keyvanzadeh) #39841
[e1fb6ae02f] - (SEMVER-MAJOR) crypto: prettify othername in PrintGeneralName (Tobias Nießen) #42123
[36fb79030e] - (SEMVER-MAJOR) crypto: fix X509Certificate toLegacyObject (Tobias Nießen) #42124
[563b2ed000] - (SEMVER-MAJOR) crypto: use RFC2253 format in PrintGeneralName (Tobias Nießen) #42002
[18365d8ee6] - (SEMVER-MAJOR) crypto: change default check(Host|Email) behavior (Tobias Nießen) #41600
[58f3fdcccd] - (SEMVER-MAJOR) deps: V8: cherry-pick semver-major commits from 10.2 (Michaël Zasso) #42657
[fd4f80ce54] - (SEMVER-MAJOR) deps: update V8 to 10.1.124.6 (Michaël Zasso) #42657
[974ab4060f] - (SEMVER-MAJOR) deps: update V8 to 9.8.177.9 (Michaël Zasso) #41610
[270253c4e2] - (SEMVER-MAJOR) deps: update V8 to 9.7.106.18 (Michaël Zasso) #40907
[08773e3c04] - (SEMVER-MAJOR) dns: remove dns.lookup and dnsPromises.lookup options type coercion (Antoine du Hamel) #41431
[3671cc0432] - (SEMVER-MAJOR) doc: update minimum glibc requirements for Linux (Richard Lau) #42659
[646e057680] - (SEMVER-MAJOR) doc: update AIX minimum supported arch (Richard Lau) #42604
[0bac5478eb] - (SEMVER-MAJOR) fs: runtime deprecate string coercion in fs.write, fs.writeFileSync (Livia Medeiros) #42607
[3caa2c1a00] - (SEMVER-MAJOR) http: refactor headersTimeout and requestTimeout logic (Paolo Insogna) #41263
[eacd45656a] - (SEMVER-MAJOR) http: make TCP noDelay enabled by default (Paolo Insogna) #42163
[4944ad0b9e] - (SEMVER-MAJOR) lib: enable fetch by default (Michaël Zasso) #41811
[8c4b8b201a] - (SEMVER-MAJOR) lib: replace validator and error (Mohammed Keyvanzadeh) #41678
[3c4ee5267a] - (SEMVER-MAJOR) module,repl: support 'node:'-only core modules (Colin Ihrig) #42325
[3a26db9697] - (SEMVER-MAJOR) net: make server.address() return an integer for family (Antoine du Hamel) #41431
[e6a7300a10] - (SEMVER-MAJOR) process: disallow some uses of Object.defineProperty() on process.env (Himself65) #28006
[60b8e79599] - (SEMVER-MAJOR) process: runtime deprecate multipleResolves (Benjamin Gruenbaum) #41896
[d36b60e69a] - (SEMVER-MAJOR) readline: fix question still called after closed (Xuguang Mei) #42464
[58e645de63] - (SEMVER-MAJOR) stream: remove thenable support (Robert Nagy) #40773
[560cbc5849] - (SEMVER-MAJOR) stream: expose web streams globals, remove runtime experimental warning (Antoine du Hamel) #42225
[9fb7ac3bbd] - (SEMVER-MAJOR) stream: need to cleanup event listeners if last stream is readable (Xuguang Mei) #41954
[ceaa299958] - (SEMVER-MAJOR) stream: revert revert map spec compliance (Benjamin Gruenbaum) #41933
[fe7ca085a7] - (SEMVER-MAJOR) stream: throw invalid arg type from End Of Stream (Jithil P Ponnan) #41766
[48e784043d] - (SEMVER-MAJOR) stream: don't emit finish after destroy (Robert Nagy) #40852
[f2170253b6] - (SEMVER-MAJOR) stream: add errored and closed props (Robert Nagy) #40696
[432d1b50e0] - (SEMVER-MAJOR) test: add initial test module (Colin Ihrig) #42325
[92567283f4] - (SEMVER-MAJOR) timers: refactor internal classes to ES2015 syntax (Rabbit) #37408
[65910c0d6c] - (SEMVER-MAJOR) tls: represent registeredID numerically always (Tobias Nießen) #41561
[807c7e14f4] - (SEMVER-MAJOR) tls: move tls.parseCertString to end-of-life (Tobias Nießen) #41479
[f524306077] - (SEMVER-MAJOR) url: throw on NULL in IPv6 hostname (Rich Trott) #42313
[0187bc5cdc] - (SEMVER-MAJOR) v8: make v8.writeHeapSnapshot() error codes consistent (Darshan Sen) #42577
[74b9baa426] - (SEMVER-MAJOR) v8: make writeHeapSnapshot throw if fopen fails (Antonio Román) #41373
[ce4d3adf50] - (SEMVER-MAJOR) worker: expose BroadcastChannel as a global (James M Snell) #41271
[6486a304d3] - (SEMVER-MAJOR) worker: graduate BroadcastChannel to supported (James M Snell) #41271

Semver-Minor Commits

[415726b8c4] - (SEMVER-MINOR) stream: add writableAborted (Robert Nagy) #40802
[54819f08e0] - (SEMVER-MINOR) test_runner: support 'only' tests (Colin Ihrig) #42514

Semver-Patch Commits

[7533d08b94] - buffer: fix atob input validation (Austin Kelleher) #42662
[96673bcb96] - build: run clang-format on CI (Darshan Sen) #42681
[d5462e4558] - build: reset embedder string to "-node.0" (Michaël Zasso) #42657
[aa52873887] - build: add configure option --v8-enable-short-builtin-calls (daomingq) #42109
[7ee8a7a463] - build: reset embedder string to "-node.0" (Michaël Zasso) #41610
[a189dee52a] - build: reset embedder string to "-node.0" (Michaël Zasso) #40907
[e8697cfe38] - crypto: improve prime size argument validation (Tobias Nießen) #42234
[a9c0689786] - crypto: fix return type prob reported by coverity (Michael Dawson) #42135
[e938515b41] - deps: patch V8 to 10.1.124.8 (Michaël Zasso) #42730
[eba7d2db7f] - deps: V8: cherry-pick ad21d212fc14 (Michaël Zasso) #42657
[004137e269] - deps: V8: cherry-pick 4c29cf1b7885 (Michaël Zasso) #42657
[a052c03033] - deps: V8: cherry-pick ca2a787a0b49 (Michaël Zasso) #42657
[01cea9a8d8] - deps: V8: cherry-pick a2cae2180a7a (Michaël Zasso) #42657
[d9d26b08ef] - deps: V8: cherry-pick 87ce4f5d98a5 (Michaël Zasso) #42657
[64a6328505] - deps: make V8 compilable with older glibc (Michaël Zasso) #42657
[fde59217b9] - deps: V8: fix v8-cppgc.h for MSVC (Jiawen Geng) #42657
[cdcc82cced] - deps: silence V8's warning on CompileFunction (Michaël Zasso) #40907
[2f51e121da] - deps: update Acorn to v8.7.0 (Michaël Zasso) #42667
[6d4b01774b] - deps: update ICU to 71.1 (Michaël Zasso) #42655
[2d84620f86] - deps: upgrade npm to 8.6.0 (npm team) #42550
[c7ac11fa25] - deps: update undici to 5.0.0 (Node.js GitHub Bot) #42583
[468fffdf66] - deps: V8: cherry-pick 50d5fb7a457c (Michaël Zasso) #41610
[48708be57b] - deps: V8: cherry-pick 79a9d2eb3477 (Michaël Zasso) #41610
[3c8782f70e] - deps: silence V8's warning on CompileFunction (Michaël Zasso) #40907
[9318408c49] - deps: silence V8's warning on CompileFunction (Michaël Zasso) #40907
[e23e345b6c] - deps: V8: cherry-pick 80bbbb143c24 (Michaël Zasso) #40907
[696ce7df26] - deps: V8: cherry-pick 1cc12b278e22 (Michaël Zasso) #40907
[aa88e5e4b9] - doc: revise data imports and node: imports sections (Rich Trott) #42734
[a058cefe29] - doc: fix ESM JSON/data URL import example (Rich Trott) #42728
[e61b62b9d4] - doc: improve doc for http.ServerResponse inheritance (Luigi Pinca) #42693
[6669b3857f] - doc: add RafaelGSS to collaborators (RafaelGSS) #42718
[f825341bab] - doc: add NodeEdKeyGenParams to CryptoKey.algorithm (Tobias Nießen) #42629
[d4d78361f2] - doc: fix the example for embedders (Momtchil Momtchev) #42671
[6706be1cdb] - doc: change AES-GCM IV recommendation in WebCrypto (Tobias Nießen) #42611
[4508c8caa4] - doc: fix added: info for some methods (Luigi Pinca) #42661
[951dbc045a] - doc: remove unneeded new in Buffer example (Niklas Mischkulnig) #42682
[65e838071b] - doc: mark worker.id as integer in cluster docs (Tobias Nießen) #42684
[a82713cbb6] - doc: recommend fh.createWriteStream for fsPromises methods (Antoine du Hamel) #42653
[13ad8d4e09] - doc: fix outgoingMessage.removeHeader() signature (Luigi Pinca) #42652
[a0461255c0] - doc: mark tlsSocket.authorized as boolean property (Tobias Nießen) #42647
[3ac7f86c2b] - doc: add missing punctuation in Web Streams doc (Tobias Nießen) #42672
[b98386c977] - doc: add missing article in session ticket section (Tobias Nießen) #42632
[a113468383] - doc: link to dynamic import function (Tobias Nießen) #42634
[dfc2dc8b65] - doc: add note about header values encoding (Shogun) #42624
[ec5a359ffd] - doc: add missing word in rootCertificates section (Tobias Nießen) #42633
[c08a361f70] - doc: add history entries for DEP0162 on fs.md (Antoine du Hamel) #42608
[4fade6acb4] - doc: fix brackets position (Livia Medeiros) #42649
[8055c7ba5d] - doc: copyedit corepack.md (Rich Trott) #42620
[85a65c3260] - doc: delete chakra tt from diagnostic tooling support tiers (Tony Gorez) #42627
[63bb6dcf0f] - doc: align links in table to top (nikoladev) #41396
[28d8614add] - http: document that ClientRequest inherits from OutgoingMessage (K.C.Ashish Kumar) #42642
[c37fdacb34] - lib: use class fields in observe.js (Joyee Cheung) #42361
[ea0668a27e] - lib: use class fields in Event and EventTarget (Joyee Cheung) #42361
[eb7b89c829] - lib: update class fields TODO in abort_controller.js (Joyee Cheung) #42361
[d835b1f1c1] - meta: update AUTHORS (Node.js GitHub Bot) #42677
[29492496e8] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #42599
[93c4dc5e5a] - module: ensure 'node:'-only modules can access node_modules (Colin Ihrig) #42430
[3a26db9697] - net: make server.address() return an integer for family (Antoine du Hamel) #41431
[44fdf953ba] - node-api,src: fix module registration in MSVC C++ (Vladimir Morozov) #42459
[3026ca0bf2] - src: fix coverity report (Michael Dawson) #42663
[01fd048c6e] - src: update NODE_MODULE_VERSION to 108 (Michaël Zasso) #42657
[75a71dc7ae] - src: fix alphabetically sorted binding list (Tobias Nießen) #42687
[457567f72c] - src: include crypto in the bootstrap snapshot (Joyee Cheung) #42203
[aa7dc808f5] - src: update ImportModuleDynamically (Camillo Bruni) #41610
[fa0439e66c] - src: update NODE_MODULE_VERSION to 105 (Michaël Zasso) #41610
[6ec1664dc8] - src: update NODE_MODULE_VERSION to 104 (Michaël Zasso) #40907
[a706342368] - src: add kNoBrowserGlobals flag for Environment (Cheng Zhao) #40532
[0c57a37dd0] - src,crypto: remove uses of AllocatedBuffer from crypto_tls.cc (Darshan Sen) #42589
[be01185844] - src,inspector: fix empty MaybeLocal crash (Darshan Sen) #42409
[340b770d3f] - stream: unify writableErrored and readableErrored (Robert Nagy) #40799
[19064bec34] - test: delete test/pummel/test-repl-empty-maybelocal-crash.js (Darshan Sen) #42720
[9d6af7d1fe] - test: improve internal/url.js coverage (Yoshiki Kurihara) #42650
[d49df5ca8d] - test: adapt message tests for V8 10.2 (Michaël Zasso) #42657
[c6b4e9604f] - test: adapt test-worker-debug for V8 10.0 (Michaël Zasso) #42657
[0854fce8bc] - test: adapt test-v8-serdes for V8 9.9 (Michaël Zasso) #42657
[73d53fe9f5] - test: only skip slow tests on Raspberry Pi devices (Richard Lau) #42645
[db7fa9f4b7] - test: allow numeric string for lookupService test (Daeyeon Jeong) #42596
[0525a147b2] - test: remove an unnecessary undefined in wpt (Khaidi Chu) #41470
[bb762c5bd0] - test: simplify test-http-write-callbacks.js (Tobias Nießen) #42628
[1600869eb7] - test: fix comments in test files (Daeyeon Jeong) #42536
[82181bb9b8] - test: fix failure in test/sequential/test-heapdump.js (Darshan Sen) #41772
[ba5b5acaf1] - test: improve worker_threads coverage (Erick Wendel) #41818
[f076c36335] - tools: update clang-format 1.6.0 to 1.7.0 (Rich Trott) #42724
[45162bf9e7] - tools: update clang-format from 1.2.3 to 1.6.0 (Rich Trott) #42685
[40bc08089d] - tools: update V8 gypfiles for 10.1 (Michaël Zasso) #42657
[09513cd1a3] - tools: update eslint to 8.13.0 (Node.js GitHub Bot) #42678
[b99bb57416] - tools: update gyp-next to v0.12.1 (Michaël Zasso) #42625
[2468db1f53] - tools: update lint-md-dependencies to @rollup/plugin-commonjs@21.0.3 (Node.js GitHub Bot) #42584
[8a3f28a05c] - tools: add v8-embedder-state-scope.h to distributed headers (Michaël Zasso) #41610
[30c4e1d952] - tools: update V8 gypfiles for 9.8 (Michaël Zasso) #41610
[1ad44094a2] - tools: update V8 gypfiles for 9.7 (Michaël Zasso) #40907
[86b77f7d0f] - tools,doc: use V8::DisposePlatform (Michaël Zasso) #41610
[62e62757b3] - tools,test: fix V8 initialization order (Camillo Bruni) #42657
[0187bc5cdc] - v8: make v8.writeHeapSnapshot() error codes consistent (Darshan Sen) #42577
[74b9baa426] - v8: make writeHeapSnapshot throw if fopen fails (Antonio Román) #41373

Files

CHANGELOG_V18.md

Latest commit

History

CHANGELOG_V18.md

File metadata and controls

Node.js 18 ChangeLog

2023-06-20, Version 18.16.1 'Hydrogen' (LTS), @RafaelGSS

Notable Changes

Commits

2023-04-12, Version 18.16.0 'Hydrogen' (LTS), @danielleadams

Notable changes

Add initial support for single executable applications

Replace url parser with Ada

Other notable changes

Commits

2023-03-07, Version 18.15.0 'Hydrogen' (LTS), @BethGriggs prepared by @juanarbol

Notable Changes

Commits

2023-02-21, Version 18.14.2 'Hydrogen' (LTS), @MylesBorins

Notable Changes

Commits

2023-02-16, Version 18.14.1 'Hydrogen' (LTS), @RafaelGSS prepared by @juanarbol

Notable Changes

Commits

2023-02-02, Version 18.14.0 'Hydrogen' (LTS), @BethGriggs prepared by @juanarbol

Notable changes

Updated npm to 9.3.1

Engines

Filesystem

Auth

Login

Tarball Packing

Display/Debug/Timing Info

Config/Command Deprecations or Removals

Other notable changes

Commits

2023-01-05, Version 18.13.0 'Hydrogen' (LTS), @danielleadams

Notable changes

Add support for externally shared js builtins

Introduce File

Support function mocking on Node.js test runner

Other notable changes

Commits

2022-11-03, Version 18.12.1 'Hydrogen' (LTS), @juanarbol

Notable changes

Commits

2022-10-25, Version 18.12.0 'Hydrogen' (LTS), @ruyadorno and @RafaelGSS

Notable Changes

2022-10-13, Version 18.11.0 (Current), @danielleadams

Notable changes

watch mode (experimental)

Other notable changes

Commits

2022-09-28, Version 18.10.0 (Current), @RafaelGSS

Notable changes

Commits

2022-09-23, Version 18.9.1 (Current), @RafaelGSS

Notable changes

llhttp updated to 6.0.10

Commits

2022-09-08, Version 18.9.0 (Current), @RafaelGSS

Notable changes

Commits

2022-08-24, Version 18.8.0 (Current), @ruyadorno

Notable changes

bootstrap: implement run-time user-land snapshots via --build-snapshot and --snapshot-blob

Other notable changes

Commits

2022-07-26, Version 18.7.0 (Current), @danielleadams

Notable changes

Commits

2022-07-13, Version 18.6.0 (Current), @targos

Notable Changes

Experimental ESM Loader Hooks API

Commits

Semver-minor commits

Semver-patch commits

Documentation commits

Other commits

Introduce `File`