Skip to content

Releases: nodejs/node

2018-03-28, Version 6.14.0 'Boron' (LTS), @MylesBorins

28 Mar 16:37
@MylesBorins MylesBorins
v6.14.0
2c93af2
Compare
Choose a tag to compare
2018-03-28, Version 6.14.0 'Boron' (LTS), @MylesBorins

This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/ for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

Notable Changes

  • Upgrade to OpenSSL 1.0.2o: Does not contain any security fixes that are known to impact Node.js.
  • Fix for inspector DNS rebinding vulnerability (CVE-2018-7160): A malicious website could use a DNS rebinding attack to trick a web browser to bypass same-origin-policy checks and allow HTTP connections to localhost or to hosts on the local network, potentially to an open inspector port as a debugger, therefore gaining full code execution access. The inspector now only allows connections that have a browser Host value of localhost or localhost6.
  • Fix for 'path' module regular expression denial of service (CVE-2018-7158): A regular expression used for parsing POSIX paths could be used to cause a denial of service if an attacker were able to have a specially crafted path string passed through one of the impacted 'path' module functions.
  • Reject spaces in HTTP Content-Length header values (CVE-2018-7159): The Node.js HTTP parser allowed for spaces inside Content-Length header values. Such values now lead to rejected connections in the same way as non-numeric values.
  • Update root certificates: 5 additional root certificates have been added to the Node.js binary and 30 have been removed.

Commits

Assets 2
Loading

2018-03-28, Version 4.9.0 'Argon' (Maintenance), @MylesBorins

28 Mar 16:36
@MylesBorins MylesBorins
v4.9.0
8f73cff
Compare
Choose a tag to compare
2018-03-28, Version 4.9.0 'Argon' (Maintenance), @MylesBorins

This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/ for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

Notable Changes

  • Upgrade to OpenSSL 1.0.2o: Does not contain any security fixes that are known to impact Node.js.
  • Fix for 'path' module regular expression denial of service (CVE-2018-7158): A regular expression used for parsing POSIX an Windows paths could be used to cause a denial of service if an attacker were able to have a specially crafted path string passed through one of the impacted 'path' module functions.
  • Reject spaces in HTTP Content-Length header values (CVE-2018-7159): The Node.js HTTP parser allowed for spaces inside Content-Length header values. Such values now lead to rejected connections in the same way as non-numeric values.
  • Update root certificates: 5 additional root certificates have been added to the Node.js binary and 30 have been removed.

Commits

Assets 2
Loading

2018-03-21, Version 9.9.0 (Current), @MylesBorins prepared by @targos

27 Mar 23:14
@MylesBorins MylesBorins
v9.9.0
74fb02f
Compare
Choose a tag to compare
2018-03-21, Version 9.9.0 (Current), @MylesBorins prepared by @targos

Notable Changes

  • assert:
    • From now on all error messages produced by assert in strict mode will produce a error diff. (Ruben Bridgewater) #17615
    • From now on it is possible to use a validation object in throws instead of the other possibilities. (Ruben Bridgewater) #17584
  • crypto:
    • allow passing null as IV unless required (Tobias Nießen) #18644
  • fs:
    • support as and as+ flags in stringToFlags() (Sarat Addepalli) #18801
  • tls:
    • expose Finished messages in TLSSocket (Anton Salikhmetov) #19102
  • tty:
    • Add getColorDepth function to determine if terminal supports colors. (Ruben Bridgewater) #17615
  • util:
    • add util.inspect compact option (Ruben Bridgewater) #17576
  • Added new collaborators

Commits

Read more
Assets 2
Loading

2018-03-07, Version 9.8.0 (Current), @MylesBorins

27 Mar 23:14
@MylesBorins MylesBorins
v9.8.0
27ba6e2
Compare
Choose a tag to compare
2018-03-07, Version 9.8.0 (Current), @MylesBorins

Notable Changes

  • crypto:
    • add cert.fingerprint256 as SHA256 fingerprint (Hannes Magnusson) #17690
  • http2:
    • Fixed issues with aborted connections in the HTTP/2 implementation (Anna Henningsen) #18987 #19002
  • loader:
    • --inspect-brk now works properly for esmodules (Gus Caplan) #18949
  • src:
    • make process.dlopen() load well-known symbol (Ben Noordhuis) #18934
  • trace_events:
    • add file pattern cli option (Andreas Madsen) #18480
  • Added new collaborators

Commits

Read more
Assets 2
Loading

2018-03-06, Version 8.10.0 'Carbon' (LTS), @gibfahn

27 Mar 23:13
@MylesBorins MylesBorins
v8.10.0
This tag was signed with the committer’s verified signature.
gibfahn Gibson Fahnestock
GPG key ID: B01FBB92821C587A
Learn about vigilant mode.
2fce636
This commit was signed with the committer’s verified signature.
gibfahn Gibson Fahnestock
GPG key ID: B01FBB92821C587A
Learn about vigilant mode.
Compare
Choose a tag to compare
2018-03-06, Version 8.10.0 'Carbon' (LTS), @gibfahn

Notable Changes

  • deps:
    • update V8 to 6.2.414.46 (MichaΓ«l Zasso) #16413
    • revert ABI breaking changes in V8 6.2 (Anna Henningsen) #16413
    • upgrade libuv to 1.19.1 (cjihrig) #18260
    • re land npm 5.6.0 (Myles Borins) #18625
    • ICU 60 bump (Steven R. Loomis) #16876
  • crypto:
    • Support both OpenSSL 1.1.0 and 1.0.2 (David Benjamin) #16130
    • warn on invalid authentication tag length (Tobias Nießen) #17566
  • async_hooks:
    • update defaultTriggerAsyncIdScope for perf (Anatoli Papirovski) #18004
    • use typed array stack as fast path (Anna Henningsen) #17780
    • use scope for defaultTriggerAsyncId (Andreas Madsen) #17273
    • separate missing from default context (Andreas Madsen) #17273
    • rename initTriggerId (Andreas Madsen) #17273
    • deprecate undocumented API (Andreas Madsen) #16972
    • add destroy event for gced AsyncResources (Sebastian Mayr) #16998
    • add trace events to async_hooks (Andreas Madsen) #15538
    • set HTTPParser trigger to socket (Andreas Madsen) #18003
    • add provider types for net server (Andreas Madsen) #17157
  • n-api:
    • add helper for addons to get the event loop (Anna Henningsen) #17109
  • cli:
    • add --stack-trace-limit to NODE_OPTIONS (Anna Henningsen) #16495
  • console:
    • add support for console.debug (Benjamin Zaslavsky) #17033
  • module:
    • add builtinModules (Jon Moss) #16386
    • replace default paths in require.resolve() (cjihrig) #17113
  • src:
    • add helper for addons to get the event loop (Anna Henningsen) #17109
    • add process.ppid (cjihrig) #16839
  • http:
    • support generic Duplex streams (Anna Henningsen) #16267
    • add rawPacket in err of clientError event (XadillaX) #17672
    • better support for IPv6 addresses (Mattias Holmlund) #14772
  • net:
    • remove ADDRCONFIG DNS hint on Windows (Bartosz Sosnowski) #17662
  • process:
    • fix reading zero-length env vars on win32 (Anna Henningsen) #18463
  • tls:
    • unconsume stream on destroy (Anna Henningsen) #17478
  • process:
    • improve unhandled rejection message (Madara Uchiha) #17158
  • stream:
    • remove usage of *State.highWaterMark (Calvin Metcalf) #12860
  • trace_events:
    • add executionAsyncId to init events (Andreas Madsen) #17196

Commits

  • [5dab90b8bb] - async_hooks: update defaultTriggerAsyncIdScope for perf (Anatoli Papirovski) #18004
  • [086af68c19] - async_hooks: use typed array stack as fast path (Anna Henningsen) #17780
  • [0f7c8984af] - async_hooks: use CHECK instead of throwing error (Jon Moss) #17832
  • [5a199a905b] - async_hooks: use scope for defaultTriggerAsyncId (Andreas Madsen) #17273
  • [03873db4d0] - async_hooks: separate missing from default context (Andreas Madsen) #17273
  • [cce92ccfa8] - async_hooks: rename initTriggerId (Andreas Madsen) #17273
  • [025b9f208f] - (SEMVER-MINOR) async_hooks: deprecate undocumented API (Andreas Madsen) #16972
  • [36dbd1181a] - (SEMVER-MINOR) async_hooks: add destroy event for gced AsyncResources (Sebastian Mayr) #16998
  • [331b175af2] - (SEMVER-MINOR) async_hooks: add trace events to async_hooks (Andreas Madsen) #15538
  • [91d4eb5ff8] - (SEMVER-MINOR) async_hooks,http: set HTTPParser trigger to socket (Andreas Madsen) #18003
  • [0211175bc7] - async_hooks,test: only use IPv6 in http test (Andreas Madsen) #18143
  • [6d55a4c941] - (SEMVER-MINOR) async_wrap: add provider types for net server (Andreas Madsen) #17157
  • [8143a95c1f] - benchmark: implement duration in http test double (Joyee Cheung) #18380
  • [f779a8b5a4] - benchmark: make compare.R easier to understand (Andreas Madsen) #18373
  • [deb70417cd] - benchmark: remove redundant + (sreepurnajasti) #17803
  • [452d2c561a] - benchmark: fix timeout in write-stream-throughput (Anatoli Papirovski) #17958
  • [1e3ea5023b] - benchmark: make temp file path configurable (Rich Trott) #17811
  • [91135b9bd2] - build: fix Makefile wrt finding node executable (Yang Guo) #18040
  • [f07bb16255] - build: fix cctest target with --enable-static (Qingyan Li) #17992
  • [e61344a9e9] - build: remove cctest extension (Yihong Wang) #16680
  • [fd845d80eb] - build,win: update lint-cpp on Windows (Kyle Farnung) #18012
  • [44ab4f09a2] - build,win,msi: support WiX with VS2017 (JoΓ£o Reis) #17101
  • [ec7996ca15] - (SEMVER-MINOR) cli: add --stack-trace-limit to NODE_OPTIONS (Anna Henningsen) #16495
  • [087cdaf871] - cluster: resolve relative unix socket paths (laino) #16749
  • [162ff56439] - (SEMVER-MINOR) console: add support for console.debug (Benjamin Zaslavsky) #17033
  • [8cc0ea78d7] - crypto: do not reach into OpenSSL internals for ThrowCryptoError (David Benjamin) #16701
  • [072902a258] - crypto: remove leftover initialization (Myles Borins) #18622
  • [b0526ba7f1] - (SEMVER-MINOR) crypto: clear some SSL_METHOD deprecation warnings (David Benjamin) #16130
  • [78738266d6] - (SEMVER-MINOR) crypto: make ALPN the same for OpenSSL 1.0.2 & 1.1.0 (David Benjamin) #16130
  • [f1d458be58] - (SEMVER-MINOR) crypto: remove deprecated ECDH calls w/ OpenSSL 1.1 (David Benjamin) #16130
  • [f9a597a1d3] - (SEMVER-MINOR) crypto: emulate OpenSSL 1.0 ticket scheme in 1.1 (David Benjamin) #16130
  • [eb377f38f6] - (SEMVER-MINOR) crypto: h...
Read more
Assets 2
Loading

2018-03-06, Version 6.13.1 'Boron' (LTS), @MylesBorins

06 Mar 20:11
@MylesBorins MylesBorins
v6.13.1
1246f72
Compare
Choose a tag to compare
2018-03-06, Version 6.13.1 'Boron' (LTS), @MylesBorins

Notable Changes

  • http, tls:
    • better support for IPv6 addresses (Mattias Holmlund) #14772

Commits

Assets 2
Loading

2018-03-02, Version 9.7.1 (Current), @rvagg

06 Mar 19:59
@MylesBorins MylesBorins
v9.7.1
This tag was signed with the committer’s verified signature.
rvagg Rod Vagg
GPG key ID: C273792F7D83545D
Learn about vigilant mode.
316926f
Compare
Choose a tag to compare
2018-03-02, Version 9.7.1 (Current), @rvagg

No additional commits. New version published due to a bad node-v9.7.0.pkg file that was published to nodejs.org in the previous release.

Assets 2
Loading

2018-03-01, Version 9.7.0 (Current), @rvagg prepared by @addaleax

06 Mar 19:58
@MylesBorins MylesBorins
v9.7.0
This tag was signed with the committer’s verified signature.
rvagg Rod Vagg
GPG key ID: C273792F7D83545D
Learn about vigilant mode.
85bbd43
Compare
Choose a tag to compare
2018-03-01, Version 9.7.0 (Current), @rvagg prepared by @addaleax

Notable Changes

  • libuv:

    • Updated to libuv 1.19.2 (Colin Ihrig) #18918

  • src:

    • Add initial support for Node.js-specific post-mortem metadata (Matheus Marchini) #14901

  • timers:

    • The return value of setImmediate() now has ref() and unref() methods (Anatoli Papirovski) #18139

  • util:

    • It is now possible to get the name for a numerical platform-specific error code as a string (Joyee Cheung) #18186

Commits

  • [5ddef2988b] - async_wrap: schedule destroy hook as unref (Anatoli Papirovski) #18241
  • [be9777c5f6] - benchmark: add stream.pipe benchmarks (Mathias Buus) #18617
  • [4012ae8885] - build: fix coverage build (Yihong Wang) #18409
  • [8c934990ef] - build: add node_lib_target_name to cctest deps (Daniel Bevenius) #18576
  • [f7e1402923] - build: include the libuv and zlib into node (Yihong Wang) #18383
  • [237a363dc7] - build: make gyp user defined variables lowercase (Daniel Bevenius) #16238
  • [16ef386507] - build, win: vcbuild improvements (Bartosz Sosnowski) #17015
  • [4fa1f3197f] - cluster: fix inspector port assignment (Santiago Gimeno) #18696
  • [ec55965501] - deps: upgrade libuv to 1.19.2 (cjihrig) #18918
  • [7fb72a5fa3] - deps,src: align ssize_t ABI between Node & nghttp2 (Anna Henningsen) #18565
  • [dd917eb946] - doc: add pending-deprecation to deprecations list (Π‘ΠΊΠΎΠ²ΠΎΡ€ΠΎΠ΄Π° Никита АндрССвич) #18433
  • [287946ddff] - doc: remove Returns: {undefined} (Sho Miyamoto) #18951
  • [4f454bde74] - doc: mention git-node in the collaborator guide (Joyee Cheung) #18960
  • [4bc54238b2] - doc: update 2fa information in onboarding.md (Rich Trott) #18968
  • [b456e31964] - doc: add process.debugPort to doc/api/process.md (flickz) #18716
  • [6f177e7b5d] - doc: readable.push(undefined) in non-object mode (ι™ˆεˆš) #18283
  • [85322518ca] - doc: remove extraneous "for example" text (Rich Trott) #18890
  • [38cf3cf494] - doc: update description of 'clientError' event (Luigi Pinca) #18885
  • [e447580872] - doc: fix link in onboarding.md (Justin Lee) #18878
  • [205a84cf09] - doc: remove CII badge in README (Roman Reiss) #18908
  • [1246902bae] - errors: move error creation helpers to errors.js (Joyee Cheung) #18546
  • [b3fe55aada] - errors: improve the description of ERR_INVALID_ARG_VALUE (Joyee Cheung) #18358
  • [112c9a3a19] - http: remove default 'drain' listener on upgrade (Luigi Pinca) #18866
  • [c7f9608626] - http: allow _httpMessage to be GC'ed (Luigi Pinca) #18865
  • [738b0a1f2e] - lib: add process to internal module wrapper (Anna Henningsen) #17198
  • [cfb78bc1df] - process: use linked reusable queue for ticks (Mathias Buus) #18617
  • [4acea14197] - process: do not directly schedule _tickCallback in _fatalException (Anatoli Papirovski) #17841
  • [d348496345] - process: refactor nextTick for clarity (Anatoli Papirovski) #17738
  • [cf0b95c4b1] - process: use more direct sync I/O for stdio (Anna Henningsen) #18019
  • [b4c933dd44] - promises: refactor rejection handling (Anatoli Papirovski) #18207
  • [01398b29e9] - repl: fix tab-complete warning (killagu) #18881
  • [e33b9fa7b5] - src: fix GetCpuProfiler() deprecation warning (Ben Noordhuis) #18534
  • [91694497ba] - src: refactor WriteWrap and ShutdownWraps (Anna Henningsen) #18676
  • [fa691f7d95] - src: only set JSStreamWrap write req after write() (Anna Henningsen) #18676
  • [296523a698] - src: remove unnecessary async hooks check (Anatoli Papirovski) #18291
  • [4de4c54069] - src: expose uv.errmap to binding (Joyee Cheung) #17338
  • [189e566076] - src: do not redefine private for GenDebugSymbols (Joyee Cheung) #18653
  • [07c6fb983b] - src: use AliasedBuffer for TickInfo (Anatoli Papirovski) #17881
  • [684684e567] - src: simplify handles for libuv streams (Anna Henningsen) #18334
  • [cb5ed45603] - src: refactor stream callbacks and ownership (Anna Henningsen) #18334
  • [f60757796b] - src: use DoTryWrite() for not-all-Buffer writev()s too (Anna Henningsen) #18019
  • [f17987ba16] - src: remove HasWriteQueue() (Anna Henningsen) #18019
  • [2282dceb29] - src: remove node namespace qualifiers (Daniel Bevenius) #18962
  • [6e7aa3d8f4] - src: fix abort when taking a heap snapshot (Ben Noordhuis) #18898
  • [a17d6840e1] - src: fix deprecation warning in node_perf.cc (Daniel Bevenius) #18877
  • [46fc507054] - (SEMVER-MINOR) src, test: node internals' postmortem metadata (Matheus Marchini) #14901
  • [7853a7fd2a] - test: add test for stream unpipe with 'data' listeners (Anna Henningsen) #18516
  • [3543c5543b] - test: make sure WriteWrap tests are actually async (Anna Henningsen) #18676
  • [7dd3c8af88] - test: add url type check in Module options (JiaHerr Tee) #18664
  • [1be5e33f03] - test: replace assert.throws with expec...
Read more
Assets 2
Loading

2018-02-22, Version 9.6.1 (Current), @MylesBorins

06 Mar 19:58
@MylesBorins MylesBorins
v9.6.1
0643e3e
Compare
Choose a tag to compare
2018-02-22, Version 9.6.1 (Current), @MylesBorins

This is a special release to fix potentially Semver-Major regression that was released in v9.6.0

Notable Changes

  • events:
    • events.usingDomains being set to false by default was removed in 9.6.0 which was a change in behavior compares to 9.5.0. This behavior change has been reverted and the events object now has usingDomains preset to false, which is the behavior in 9.x prior to 9.6.0 (Myles Borins) #18944

Commits

Assets 2
Loading

2018-02-22, Version 9.6.0 (Current), @MylesBorins

06 Mar 19:57
@MylesBorins MylesBorins
v9.6.0
cb18511
Compare
Choose a tag to compare
2018-02-22, Version 9.6.0 (Current), @MylesBorins

Notable Changes

  • async_hooks:
    • deprecate unsafe emit{Before,After} (Ali Ijaz Sheikh) #18513
    • rename PromiseWrap.parentId to PromiseWrap.isChainedPromise (Ali Ijaz Sheikh) #18633
  • deps:
    • update node-inspect to 1.11.3 (Jan Krems) #18354
    • ICU 60.2 bump (Steven R. Loomis) #17687
    • Introduce ScriptOrModule and HostDefinedOptions to V8 (Jan Krems) #16889
  • http:
    • add options to http.createServer() for IncomingMessage and ServerReponse (Peter Marton) #15752
  • http2:
    • add http fallback options to .createServer (Peter Marton) #15752
  • https:
    • Adds the remaining options from tls.createSecureContext() to the string generated by Agent#getName(). This allows https.request() to accept the options and generate unique sockets appropriately. (Jeff Principe) #16402
  • inspector:
    • --inspect-brk for es modules (Guy Bedford) #18194
  • lib:
    • allow process kill by signal number (Sam Roberts) #16944
  • module:
    • enable dynamic import (Myles Borins) #18387
    • dynamic import is now supported (Jan Krems) #15713
  • n-api:
    • add methods to open/close callback scope (Michael Dawson) #18089
  • src:
    • allow --perf-(basic-)?prof in NODE_OPTIONS (Leko) #17600
  • vm:
    • add support for es modules (Gus Caplan) #17560

Commits

Read more
Assets 2
Loading