Skip to content

Releases: nodejs/node

Release list

2018-11-29, Version 10.14.1 'Dubnium' (LTS), @MylesBorins

2018-11-29, Version 10.14.1 'Dubnium' (LTS), @MylesBorins

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 06 Dec 04:54
v10.14.1
d3dbe3a

Notable Changes

  • win/msi: Revert changes to installer causing issues on Windows systems.

Commits

  • [5d17bf1e13] - win: add prompt to tools installation script (João Reis) #23987
  • [589f0d2192] - win: clarify Boxstarter behavior on install tools (Rob Reynolds) #23987
  • [9e293c1328] - Revert "win,msi: install tools for native modules" (Refael Ackermann) #24344
Loading

2018-11-27, Version 10.14.0 'Dubnium' (LTS), @rvagg

2018-11-27, Version 10.14.0 'Dubnium' (LTS), @rvagg

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 06 Dec 04:53
v10.14.0
This tag was signed with the committer’s verified signature.
rvagg Rod Vagg
GPG key ID: C273792F7D83545D
Verified
Learn about vigilant mode.
b710313

This is a security release. All Node.js users should consult the security release summary at:

https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/

for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

  • Node.js: Denial of Service with large HTTP headers (CVE-2018-12121)
  • Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js)
  • Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)
  • OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734)
  • OpenSSL: Timing vulnerability in ECDSA signature generation (CVE-2019-0735)

Notable Changes

  • deps: Upgrade to OpenSSL 1.1.0j, fixing CVE-2018-0734 and CVE-2019-0735
  • http:
    • Headers received by HTTP servers must not exceed 8192 bytes in total to prevent possible Denial of Service attacks. Reported by Trevor Norris. (CVE-2018-12121 / Matteo Collina)
    • A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with server.headersTimeout. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with server.setTimeout(), this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). (CVE-2018-12122 / Matteo Collina)
  • url: Fix a bug that would allow a hostname being spoofed when parsing URLs with url.parse() with the 'javascript:' protocol. Reported by Martin Bajanik (Kentico). (CVE-2018-12123 / Matteo Collina)

Commits

Loading

2018-11-27, Version 8.14.0 'Carbon' (LTS), @rvagg

2018-11-27, Version 8.14.0 'Carbon' (LTS), @rvagg

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 06 Dec 04:52
v8.14.0
This tag was signed with the committer’s verified signature.
rvagg Rod Vagg
GPG key ID: C273792F7D83545D
Verified
Learn about vigilant mode.
39716a8

This is a security release. All Node.js users should consult the security release summary at:

https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/

for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

  • Node.js: Denial of Service with large HTTP headers (CVE-2018-12121)
  • Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js)
  • Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)
  • Node.js: HTTP request splitting (CVE-2018-12116)
  • OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734)
  • OpenSSL: Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)

Notable Changes

  • deps: Upgrade to OpenSSL 1.0.2q, fixing CVE-2018-0734 and CVE-2018-5407
  • http:
    • Headers received by HTTP servers must not exceed 8192 bytes in total to prevent possible Denial of Service attacks. Reported by Trevor Norris. (CVE-2018-12121 / Matteo Collina)
    • A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with server.headersTimeout. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with server.setTimeout(), this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). (CVE-2018-12122 / Matteo Collina)
    • Two-byte characters are now strictly disallowed for the path option in HTTP client requests. Paths containing characters outside of the range \u0021 - \u00ff will now be rejected with a TypeError. This behavior can be reverted if necessary by supplying the --security-revert=CVE-2018-12116 command line argument (this is not recommended). Reported as security concern for Node.js 6 and 8 by Arkadiy Tetelman (Lob), fixed by backporting a change by Benno Fünfstück applied to Node.js 10 and later. (CVE-2018-12116 / Matteo Collina)
  • url: Fix a bug that would allow a hostname being spoofed when parsing URLs with url.parse() with the 'javascript:' protocol. Reported by Martin Bajanik (Kentico). (CVE-2018-12123 / Matteo Collina)

Commits

Loading

2018-11-27, Version 6.15.0 'Boron' (LTS), @rvagg

2018-11-27, Version 6.15.0 'Boron' (LTS), @rvagg

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 06 Dec 04:52
v6.15.0
This tag was signed with the committer’s verified signature.
rvagg Rod Vagg
GPG key ID: C273792F7D83545D
Verified
Learn about vigilant mode.
b6589e3

This is a security release. All Node.js users should consult the security release summary at:

https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/

for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

  • Node.js: Debugger port 5858 listens on any interface by default (CVE-2018-12120)
  • Node.js: Denial of Service with large HTTP headers (CVE-2018-12121)
  • Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js)
  • Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)
  • Node.js: HTTP request splitting (CVE-2018-12116)
  • OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734)
  • OpenSSL: Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)

Notable Changes

  • debugger: Backport of nodejs/node#8106 to prevent the debugger from listening on 0.0.0.0. It now defaults to 127.0.0.1. Reported by Ben Noordhuis. (CVE-2018-12120 / Ben Noordhuis).
  • deps: Upgrade to OpenSSL 1.0.2q, fixing CVE-2018-0734 and CVE-2018-5407
  • http:
    • Headers received by HTTP servers must not exceed 8192 bytes in total to prevent possible Denial of Service attacks. Reported by Trevor Norris. (CVE-2018-12121 / Matteo Collina)
    • A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with server.headersTimeout. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with server.setTimeout(), this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). (CVE-2018-12122 / Matteo Collina)
    • Two-byte characters are now strictly disallowed for the path option in HTTP client requests. Paths containing characters outside of the range \u0021 - \u00ff will now be rejected with a TypeError. This behavior can be reverted if necessary by supplying the --security-revert=CVE-2018-12116 command line argument (this is not recommended). Reported as security concern for Node.js 6 and 8 by Arkadiy Tetelman (Lob), fixed by backporting a change by Benno Fünfstück applied to Node.js 10 and later. (CVE-2018-12116 / Matteo Collina)
  • url: Fix a bug that would allow a hostname being spoofed when parsing URLs with url.parse() with the 'javascript:' protocol. Reported by Martin Bajanik (Kentico). (CVE-2018-12123 / Matteo Collina)

Commits

Loading

2018-11-27, Version 11.3.0 (Current), @rvagg

2018-11-27, Version 11.3.0 (Current), @rvagg

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 06 Dec 04:51
v11.3.0
This tag was signed with the committer’s verified signature.
rvagg Rod Vagg
GPG key ID: C273792F7D83545D
Verified
Learn about vigilant mode.
00fb73a

This is a security release. All Node.js users should consult the security release summary at:

https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/

for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

  • Node.js: Denial of Service with large HTTP headers (CVE-2018-12121)
  • Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js)
  • Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)
  • OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734)
  • OpenSSL: Timing vulnerability in ECDSA signature generation (CVE-2019-0735)

Notable Changes

  • deps: Upgrade to OpenSSL 1.1.0j, fixing CVE-2018-0734 and CVE-2019-0735
  • http:
    • Headers received by HTTP servers must not exceed 8192 bytes in total to prevent possible Denial of Service attacks. Reported by Trevor Norris. (CVE-2018-12121 / Matteo Collina)
    • A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with server.headersTimeout. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with server.setTimeout(), this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). (CVE-2018-12122 / Matteo Collina)
  • url: Fix a bug that would allow a hostname being spoofed when parsing URLs with url.parse() with the 'javascript:' protocol. Reported by Martin Bajanik (Kentico). (CVE-2018-12123 / Matteo Collina)

Commits

Loading

2018-11-20, Version 8.13.0 'Carbon' (LTS), @MylesBorins prepared by @BethGriggs

2018-11-20, Version 8.13.0 'Carbon' (LTS), @MylesBorins prepared by @BethGriggs

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 20 Nov 18:14
v8.13.0
90c7bfa

Notable changes

  • assert:
    • backport some assert commits (Ruben Bridgewater) #23223
  • deps:
    • upgrade to libuv 1.23.2 (cjihrig) #23336
    • V8: cherry-pick 64-bit hash seed commits (Yang Guo) #23274
  • http:
    • added aborted property to request (Robert Nagy) #20094
  • http2:
    • graduate from experimental (James M Snell) #22466

Commits

Read more
Loading

2018-11-15, Version 11.2.0 (Current), @BridgeAR

2018-11-15, Version 11.2.0 (Current), @BridgeAR

Choose a tag to compare

View all tags
@targos targos released this 15 Nov 21:24
v11.2.0
This tag was signed with the committer’s verified signature.
targos Michaël Zasso
GPG key ID: 770F7A9A5AE15600
Verified
Learn about vigilant mode.
a19e1ab
This commit was signed with the committer’s verified signature.
targos Michaël Zasso
GPG key ID: 770F7A9A5AE15600
Verified
Learn about vigilant mode.

Notable changes

  • deps:
    • A new experimental HTTP parser (llhttp) is now supported. #24059
  • timers:
    • Fixed an issue that could cause setTimeout to stop working as expected. #24322
  • Windows
    • A crashing process will now show the names of stack frames if the node.pdb file is available. #23822
    • Continued effort to improve the installer's new stage that installs
      native build tools. #23987, #24348
    • child_process:
      • On Windows the windowsHide option default was restored to false.
        This means detached child processes and GUI apps will once again
        start in a new window. #24034
  • Added new collaborators:

Commits

  • [685724b53d] - assert: remove unused catch bindings (cjihrig) #24079
  • [bb766ae05a] - async_hooks: add HandleScopes to C++ embedder/addon API (Anna Henningsen) #24285
  • [ad5c9b4463] - benchmark: support more options in startup benchmark (Joyee Cheung) #24220
  • [d0bf8c2259] - benchmark: add dir and withFileTypes option readdir benchmarks (Joyee Cheung) #24125
  • [40b3ad3eb8] - benchmark: remove unused catch bindings (cjihrig) #24079
  • [1f3cb63da3] - bootstrap: remove unused catch bindings (cjihrig) #24079
  • [fcc25f9ee8] - buffer: fix writeUInt16BE range check (Brian White) #24208
  • [e4cd255a85] - buffer: throw exception when creating from non-Node.js Context (Anna Henningsen) #23938
  • [44ebdbb860] - build: fix benchmark tests on CI (Rich Trott) #24307
  • [1c8b4d7c89] - build: disable openssl asm on arm64 for now (Ben Noordhuis) #24270
  • [0c9d86f58c] - build: use BUILDTYPE in bench-addons-build targets (Daniel Bevenius) #24033
  • [70699ee09b] - build: lint commit message in separate Travis job (Richard Lau) #24254
  • [2b282e8f20] - build: move headers out of c++ src section (Daniel Bevenius) #24124
  • [a8008d1517] - build: only try to find node when it's needed by the target (Joyee Cheung) #24115
  • [e4bcb97024] - build: change repo to https protocol in Makefile (mritunjaygoutam12) #24073
  • [7083b96c49] - build: use latest node on travis (cjihrig) #24198
  • [99c2a10f7b] - build: fix Travis non-PR builds (Richard Lau) #24093
  • [3de1c5cadd] - build: do not lint on non-PR Travis builds (Anna Henningsen) #24076
  • [762679efec] - build: make benchmark/napi all prereq order-only (Daniel Bevenius) #23951
  • [4651cd721d] - build: add -Werror=undefined-inline to clang builds (Refael Ackermann) #23961
  • [e7133f1e7c] - build: configure default v8_optimized_debug (Refael Ackermann) #23704
  • [26c19889a8] - build,meta: don't fail Travis for commit message (Refael Ackermann) #23739
  • [838fb550c6] - build,tools: update make-v8.sh for s390x (Refael Ackermann) #23839
  • [c07cce368a] - Revert "child_process: change windowsHide default to true" (Rich Trott) #24034
  • [a1c7c1902a] - child_process: allow 'http_parser' monkey patching again (Jimb Esser) #24006
  • [4af63ee5d9] - child_process: handle undefined/null for fork() args (Shobhit Chittora) #22416
  • [a2c13fac94] - console: console.timeLog() using the default label (Marie Terrier) #24286
  • [9e891327b7] - console: cover .assert with single argument (Morgan Roderick) #24188
  • [2b48c7169a] - crypto: put legacy _handle accessors on prototypes (Michaël Zasso) #24269
  • [f669817a5a] - (SEMVER-MINOR) crypto: add support for chacha20-poly1305 for AEAD (chux0519) #24081
  • [ef69e7bcca] - deps: backport 073073b4f1 from upstream V8 (Yang Guo) #24274
  • [a39493f4aa] - deps: cherry-pick b87d408 from upstream V8 (Peter Marshall) #24272
  • [9cefbba5d7] - deps: patch V8 to 7.0.276.38 (Michaël Zasso) #24271
  • [115c57a240] - deps: introduce llhttp (Fedor Indutny) #24059
  • [566399ee31] - deps: patch V8 to 7.0.276.36 (Michaël Zasso) #24109
  • [3e1c53fe37] - deps: cherry-pick 0483e9a from upstream V8 (Joyee Cheung) #24125
  • [6b697d4816] - deps: c-ares float, version number patch (Ben Noordhuis) #23854
  • [07663694b4] - deps: upgrade to c-ares v1.15.0 (Ben Noordhuis) #23854
  • [eaea90b2ee] - deps: remove old c-ares configure files (Ben Noordhuis) #23854
  • [f49b9e9c84] - deps: patch V8 to 7.0.276.35 (Michaël Zasso) #24056
  • [6e4f238344] - deps,v8: cherry-pick dc704497 (Refael Ackermann) #23985
  • [ef8b5b4094] - deps,v8: fix gypfile bug (Refael Ackermann) #23704
  • [a01e829fb0] - doc: document http request.finished boolean (Thomas Watson) #24319
  • [36e4d0c6f0] - doc: document NODE_TLS_REJECT_UNAUTHORIZED (cjihrig) #24289
  • [fbd0b037ec] - doc: clarify issues and pull requests guidance (Rich Trott) #24316
  • [a993a488fa] - doc: fix comma splices in process.md (Rich Trott) #24357
  • [e584cc52fc] - doc: use real protocol names in ALPN example (Sam Roberts) [#24...
Read more
Loading

2018-11-02, Version 11.1.0 (Current), @targos

2018-11-02, Version 11.1.0 (Current), @targos

Choose a tag to compare

View all tags
@targos targos released this 02 Nov 12:37
v11.1.0
This tag was signed with the committer’s verified signature.
targos Michaël Zasso
GPG key ID: 770F7A9A5AE15600
Verified
Learn about vigilant mode.
af6d262
This commit was signed with the committer’s verified signature.
targos Michaël Zasso
GPG key ID: 770F7A9A5AE15600
Verified
Learn about vigilant mode.

Notable changes

  • deps
  • repl
    • Top-level for-await-of is now supported in the REPL. #23841
  • timers
    • Fixed an issue that could cause timers to enter an infinite loop. #23870

Commits

  • [2c2e2b53ab] - benchmark: fix bench-mkdirp to use recursive option (Klaus Meinhardt) #23699
  • [787e13b41c] - build: expose more openssl categories for addons (Jonathan Cardoso Machado) #23344
  • [b8f3bb107e] - build: add lint-py which uses flake8 (cclauss) #21952
  • [35c3c4ba68] - build: allow for overwriting of use_openssl_def (Shelley Vohr) #23763
  • [5c35d0db47] - build,meta: switch to gcc-4.9 on travis (Refael Ackermann) #23778
  • [141aec9564] - crypto: add SET_INTEGER_CONSANT macro (Daniel Bevenius) #23687
  • [4112a10abe] - crypto: strip unwanted space from openssl version (Sam Roberts) #23678
  • [2cc4f5c923] - deps: patch V8 to 7.0.276.32 (Michaël Zasso) #23851
  • [0312d8b2cd] - deps: fix shim for v8::Value::IntegerValue() (Anna Henningsen) #23898
  • [9011db426e] - (SEMVER-MINOR) deps: move more deprecations to V8_DEPRECATED (Anna Henningsen) #23414
  • [e5b51cc496] - (SEMVER-MINOR) deps: icu 63.1 bump (CLDR 34) (Steven R. Loomis) #23715
  • [ab58439916] - deps: icu: apply workaround patch (Steven R. Loomis) #23764
  • [3b66a8d893] - deps: fix wrong default for v8 handle zapping (Refael Ackermann) #23801
  • [26510fbd8e] - doc: add branding to style guide (Rich Trott) #23967
  • [33053ec8d7] - doc: use Node.js instead of Node (Rich Trott) #23967
  • [ec009f620c] - doc: revise BUILDING.md (Rich Trott) #23966
  • [da494ef889] - doc: clarify fd behaviour with {read,write}File (Sakthipriyan Vairamani (thefourtheye)) #23706
  • [539e1233b0] - doc: moved test instructions to BUILDING.md (Kamat, Trivikram) #23949
  • [cc65fee1d3] - doc: fix typographical issues (Denis McDonald) #23970
  • [ee6b0395f5] - doc: sort markdown refs in errors (Sam Roberts) #23972
  • [ee299c7ef1] - doc: remove "idiomatic choice" from queueMicrotask (Rod Vagg) #23885
  • [147e5d5792] - doc: document HPE_HEADER_OVERFLOW error (Sam Roberts) #23963
  • [24c6a02930] - doc: add documentation for http.IncomingMessage$complete (James M Snell) #23914
  • [82ee6c3e47] - doc: remove mailing list (Rich Trott) #23932
  • [99fffff6e0] - doc: remove notice of dashes in V8 options (Denys Otrishko) #23903
  • [8b5339da14] - doc: rename README section for Release Keys (Rich Trott) #23927
  • [676875195b] - doc: add note about ABI compatibility (Myles Borins) #22237
  • [f01a806276] - doc: add optional callback to socket.end() (Ajido) #23937
  • [64c205d9bc] - doc: make example more clarified in cluster.md (ZYSzys) #23931
  • [748dbf9778] - doc: simplify valid security issue descriptions (Rich Trott) #23881
  • [e241398ef6] - doc: simplify path.basename() on POSIX and Windows (ZYSzys) #23864
  • [49b32af5ab] - doc: document nullptr comparisons in style guide (Anna Henningsen) #23805
  • [0ba49fec12] - doc: remove problematic example from README (Rich Trott) #23817
  • [d808d27120] - doc: use Cookie in request.setHeader() examples (Luigi Pinca) #23707
  • [1baba9b061] - doc: NODE_EXTRA_CA_CERTS is ignored if setuid root (Ben Noordhuis) #23770
  • [dd5afbe05f] - doc: add review suggestions to require() (erickwendel) #23605
  • [db113a24e0] - doc: document and warn if the ICU version is too old (Steven R. Loomis) #23766
  • [c30de85ca5] - doc: move @phillipj to emeriti (Phillip Johnsen) #23790
  • [84fdb1cc0e] - doc: add note about removeListener order (James M Snell) #23762
  • [f4c4b2b41b] - doc: document ACL limitation for fs.access on Windows (James M Snell) #23772
  • [83b776c864] - doc: document that addMembership must be called once in a cluster (James M Snell) #23746
  • [1851cf4f83] - doc, test: document and test vm timeout escapes (James M Snell) #23743
  • [b4b101fed6] - (SEMVER-MINOR) fs: default open/openSync flags argument to 'r' (Ben Noordhuis) #23767
  • [1c5ffb3ec5] - (SEMVER-MINOR) lib: add escapeCodeTimeout as an option to createInterface (Raoof) #19780
  • [1cda41b7da] - lib: migrate from process.binding('config') to getOptions() (Vladimir Ilic) #23588
  • [22cd53791a] - lib: trigger uncaught exception handler for microtasks (Gus Caplan) #23794
  • [97496f0fd9] - n-api: make per-Context-ness of napi\_env explicit (Anna Henningsen) #23689
  • [3e512f1897] - os: fix memory leak in userInfo() (Anna Henningsen) #23893
  • [02f13abde3] - repl: support top-level for-await-of (Shelley Vohr) #23841
  • [86cf01404c] - repl: migrate from process.binding('config') to getOptions() (Jose Bucio) #23684
  • [4a79b2568f] - src: improve StreamBase write throughput ...
Read more
Loading

2018-10-30, Version 10.13.0 'Dubnium' (LTS), @MylesBorins

2018-10-30, Version 10.13.0 'Dubnium' (LTS), @MylesBorins

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 02 Nov 15:19
v10.13.0
ab4af08

This release marks the transition of Node.js 10.x into Long Term
Support (LTS) with the codename 'Dubnium'. The 10.x release line
now moves in to "Active LTS" and will remain so until April 2020.
After that time it will move in to "Maintenance" until end of
life in April 2021.

Notable Changes

This release only includes minimal changes necessary to fix known regressions prior to LTS.

Commits

  • [2ba6010082] - buffer: fix crash for invalid index types (Anna Henningsen)
  • [2cd68be69d] - build: spawn make test-ci with -j1 (Refael Ackermann) #23733
  • [1003f4c975] - deps: fix wrong default for v8 handle zapping (Refael Ackermann) #23801
Loading

2018-10-23, Version 11.0.0 (Current), @jasnell

2018-10-23, Version 11.0.0 (Current), @jasnell

Choose a tag to compare

View all tags
@jasnell jasnell released this 23 Oct 18:22
v11.0.0
This tag was signed with the committer’s verified signature.
jasnell James M Snell
GPG key ID: 7341B15C070877AC
Verified
Learn about vigilant mode.
cea049b
This commit was signed with the committer’s verified signature.
jasnell James M Snell
GPG key ID: 7341B15C070877AC
Verified
Learn about vigilant mode.

Notable Changes

  • Build
    • FreeBSD 10 is no longer supported. #22617
  • child_process
    • The default value of the windowsHide option has been changed to true. #21316
  • console
    • console.countReset() will emit a warning if the timer being reset does not exist. #21649
    • console.time() will no longer reset a timer if it already exists. #20442
  • Dependencies
    • V8 has been updated to 7.0. #22754
  • fs
    • The fs.read() method now requires a callback. #22146
    • The previously deprecated fs.SyncWriteStream utility has been removed.#20735
  • http
    • The http, https, and tls modules now use the WHATWG URL parser by default. #20270
  • General
    • Use of process.binding() has been deprecated. Userland code using process.binding() should re-evaluate that use and begin migrating. If there are no supported API alternatives, please open an issue in the Node.js GitHub repository so that a suitable alternative may be discussed.
    • An experimental implementation of queueMicrotask() has been added. #22951
  • Internal
    • Windows performance-counter support has been removed. #22485
    • The --expose-http2 command-line option has been removed. #20887
  • Timers
    • Interval timers will be rescheduled even if previous interval threw an error. #20002
    • nextTick queue will be run after each immediate and timer. #22842
  • util
    • The WHATWG TextEncoder and TextDecoder are now globals. #22281
    • util.inspect() output size is limited to 128 MB by default. #22756
    • A runtime warning will be emitted when NODE_DEBUG is set for either http or http2. #21914

Semver-Major Commits

  • [0518b9edf3] - (SEMVER-MAJOR) assert: multiple improvements (Ruben Bridgewater) #21628
  • [21c3a402d4] - (SEMVER-MAJOR) assert: validate input stricter (Ruben Bridgewater) #20481
  • [439b75b9c0] - (SEMVER-MAJOR) assert, util: *DeepEqual() handles ArrayBuffers (Caleb Sander) #22266
  • [5d95542212] - (SEMVER-MAJOR) buffer: move process.binding('buffer') to internalBinding (Weijia Wang) #22370
  • [8fb6bce3a0] - (SEMVER-MAJOR) buffer: unconditionally use internalBinding (cjihrig) #23234
  • [755520c4c3] - (SEMVER-MAJOR) buffer: show hidden item count (Ruben Bridgewater) #22289
  • [60b5b38b48] - (SEMVER-MAJOR) buffer: do not always use defaults (Ruben Bridgewater) #20054
  • [b3b3f53a33] - (SEMVER-MAJOR) build: exclude npm test directories on Windows (Richard Lau) #23001
  • [dd296a8344] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #22754
  • [4b25ef5341] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #21983
  • [c0fb95d700] - (SEMVER-MAJOR) build: stop supporting FreeBSD 10 (Michaël Zasso) #22617
  • [4b47d2907d] - (SEMVER-MAJOR) build: do not copy v8-inspector* headers ar part of install (Alexey Kozyatinskiy) #22586
  • [2d4dd10829] - (SEMVER-MAJOR) build: add '-z relro -z now' linker flags (Shao,Ting) #20513
  • [9c9c01f183] - (SEMVER-MAJOR) child_process: move process.binding('spawn_sync') to internalBinding (Anto Aravinth) #22260
  • [af883e1f99] - (SEMVER-MAJOR) child_process: fix switches for alternative shells on Windows (Tessei Kameyama) #21943
  • [56cf058878] - (SEMVER-MAJOR) child_process: make process_wrap binding internal (cjihrig) #22479
  • [420d8afe3d] - (SEMVER-MAJOR) child_process: change windowsHide default to true (cjihrig) #21316
  • [d4164ca559] - (SEMVER-MAJOR) console: console.countReset() should emit warning (Dominic Farolino) #21649
  • [a59826403a] - (SEMVER-MAJOR) console: console.time() should not reset a timer when it exists (Gus Caplan) #20442
  • [90e8f79f65] - (SEMVER-MAJOR) constants: freeze the constants object (Bryan English) #19813
  • [058c5b81cd] - (SEMVER-MAJOR) crypto: do not allow multiple calls to setAuthTag (Tobias Nießen) #22931
  • [19ad6b8f72] - (SEMVER-MAJOR) crypto: deprecate digest == null in PBKDF2 (Tobias Nießen) #22861
  • [0ade10df79] - (SEMVER-MAJOR) crypto: hide native handles from JS modules (Tobias Nießen) #22747
  • [503fd55a35] - (SEMVER-MAJOR) crypto: make _toBuf non-enumerable (Tobias Nießen) #22551
  • [221df2286d] - (SEMVER-MAJOR) crypto: deprecate aliases for randomBytes (Tobias Nießen) #22519
  • [50aa85dc9b] - (SEMVER-MAJOR) crypto: deprecate _toBuf (Tobias Nießen) #22501
  • [eab916c4e8] - (SEMVER-MAJOR) crypto: move process.binding('tls_wrap') internal (Daniel Bevenius) #22429
  • [bf5cc3bf1a] - (SEMVER-MAJOR) crypto: move process.binding('crypto') to internal (Daniel Bevenius) #22426
  • [39dd3a4430] - (SEMVER-MAJOR) crypto: deprecate useless crypto APIs (Tobias Nießen) #22126
  • [933d8eb689] - (SEMVER-MAJOR) crypto: move createCipher to runtime deprecation (Tobias Nießen) #22089
  • [d2ee7d64aa] - (SEMVER-MAJOR) crypto: remove deprecated legacy API (Antoine du HAMEL) #21153
  • [faf449ca04] - (SEMVER-MAJOR) crypto: throw in setAuthTag on invalid length (Tobias Nießen) #20040
  • [d81a7b4baa] - (SEMVER-MAJOR) crypto: throw on invalid authentication tag length (Tobias Nießen) #17825
  • [2f9775995f] - (SEMVER-MAJOR) crypto: move Decipher.finaltol to End-of-Life (Tobias Nießen) #19941
  • [083d1012c7] - (SEMVER-MAJOR) deps: cherry-pick b0af309 from upstream V8 (Anna Henningsen) #23415
  • [dca0300a86] - (SEMVER-MAJOR) deps: cherry-pick 2363cdf from upstream V8 (Michaël Zasso) #22754
  • [1da9d60003] - (SEMVER-MAJOR) deps: ...
Read more
Loading