Node.js 16: baixar versions anteriors

This is a security release.
Notable Changes
The following CVEs are fixed in this release:
- CVE-2023-32002: Policies can be bypassed via Module._load (High)
- CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
- CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
- OpenSSL Security Releases
- OpenSSL security advisory 14th July.
- OpenSSL security advisory 19th July.
- OpenSSL security advisory 31st July
More detailed information on each of the vulnerabilities can be found in August 2023 Security Releases blog post.
Commits
- [40c3958a5a] - deps: update archs files for OpenSSL-1.1.1v (RafaelGSS) #49043
- [a9ac9da89a] - deps: fix openssl crypto clean (RafaelGSS) #49043
- [362d4c7494] - deps: upgrade openssl sources to OpenSSL_1_1_1v (RafaelGSS) #49043
- [d8ccfe9ad4] - policy: handle Module.constructor and main.extensions bypass (RafaelGSS) nodejs-private/node-private#445
- [242aaa0caa] - policy: disable process.binding() when enabled (Tobias Nießen) nodejs-private/node-private#459

This is a security release.
Notable Changes
The following CVEs are fixed in this release:
- CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
- CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
- CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
- CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
- CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
- OpenSSL Security Releases
- OpenSSL security advisory 28th March.
- OpenSSL security advisory 20th April.
- OpenSSL security advisory 30th May
- c-ares vulnerabilities:
- GHSA-9g78-jv2r-p7vc
- GHSA-8r8p-23f3-64c2
- GHSA-54xr-f67r-4pc4
- GHSA-x6mf-cxr9-8q6v
More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.
Commits
- [5a92ea7a3b] - crypto: handle cert with invalid SPKI gracefully (Tobias Nießen)
- [5df04e893a] - deps: set CARES_RANDOM_FILE for c-ares (Richard Lau) #48156
- [c171cbd124] - deps: update c-ares to 1.19.1 (RafaelGSS) #48115
- [155d3aac02] - deps: update archs files for OpenSSL-1.1.1u+quic (RafaelGSS) #48369
- [8d4c8f8ebe] - deps: upgrade openssl sources to OpenSSL_1_1_1u (RafaelGSS) #48369
- [1a5c9284eb] - doc,test: clarify behavior of DH generateKeys (Tobias Nießen) nodejs-private/node-private#426
- [e42ff4b018] - http: disable request smuggling via empty headers (Paolo Insogna) nodejs-private/node-private#429
- [10042683c8] - msi: do not create AppData\Roaming\npm (Tobias Nießen) nodejs-private/node-private#408
- [a6f4e87bc9] - policy: handle mainModule.__proto__ bypass (RafaelGSS) nodejs-private/node-private#416
- [b77000f4d7] - test: allow SIGBUS in signal-handler abort test (Michaël Zasso) #47851

Notable Changes
- deps:
- update undici to 5.20.0 (Node.js GitHub Bot) #46711
- update c-ares to 1.19.0 (Michaël Zasso) #46415
- upgrade npm to 8.19.4 (npm team) #46677
- update corepack to 0.17.0 (Node.js GitHub Bot) #46842
- (SEMVER-MINOR) src: add support for externally shared js builtins (Michael Dawson) #44376
Commits
- [de6dd67790] - crypto: avoid hang when no algorithm available (Richard Lau) #46237
- [4617512788] - crypto: ensure auth tag set for chacha20-poly1305 (Ben Noordhuis) #46185
- [24972164fc] - deps: update undici to 5.20.0 (Node.js GitHub Bot) #46711
- [85f88c6a8d] - deps: V8: cherry-pick 90be99fab31c (Michaël Zasso) #46646
- [b4ebe6d47b] - deps: update c-ares to 1.19.0 (Michaël Zasso) #46415
- [56cbc7fdda] - deps: V8: cherry-pick c2792e58035f (Jiawen Geng) #44961
- [7af9bdb31e] - deps: upgrade npm to 8.19.4 (npm team) #46677
- [962a7471b5] - deps: update corepack to 0.17.0 (Node.js GitHub Bot) #46842
- [748bc96e35] - deps: update corepack to 0.16.0 (Node.js GitHub Bot) #46710
- [a467782499] - deps: update corepack to 0.15.3 (Node.js GitHub Bot) #46037
- [1913b6763d] - deps: update corepack to 0.15.2 (Node.js GitHub Bot) #45635
- [809371a15f] - module: require.resolve.paths returns null with node schema (MURAKAMI Masahiko) #45147
- [086bb2f8d4] - Revert "src: let http2 streams end after session close" (Rich Trott) #46721
- [6a01d39120] - (SEMVER-MINOR) src: add support for externally shared js builtins (Michael Dawson) #44376
- [d081032a60] - test: fix test-net-connect-reset-until-connected (Vita Batrla) #46781
- [efe1be47ec] - test: skip test depending on overlapped-checker when not available (Antoine du Hamel) #45015
- [fc47d58abe] - test: remove cjs loader from stack traces (Geoffrey Booth) #44197
- [cf76d0790d] - test: fix WPT title when no META title is present (Filip Skokan) #46804
- [0d1485b924] - test: fix default WPT titles (Filip Skokan) #46778
- [088e9cde3d] - test: add WPTRunner support for variants and generating WPT reports (Filip Skokan) #46498
- [908c4dff44] - test: mark test-crypto-key-objects flaky on Linux (Richard Lau) #46684
- [768e56227e] - tools: make utils.SearchFiles deterministic (Bruno Pitrus) #44496

This is a security release.
Notable Changes
The following CVEs are fixed in this release:
- CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
- CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
- CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)
Fixed by an update to undici:
- CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
- See https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff for more information.
- CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)
- See https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w for more information.
More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post.
This security release includes OpenSSL security updates as outlined in the recent
OpenSSL security advisory.
Commits
- [7fef050447] - build: build ICU with ICU_NO_USER_DATA_OVERRIDE (RafaelGSS) nodejs-private/node-private#374
- [b558e9f476] - crypto: clear OpenSSL error on invalid ca cert (RafaelGSS) nodejs-private/node-private#375
- [160adb7ffc] - crypto: clear OpenSSL error queue after calling X509_check_private_key() (Filip Skokan) #45495
- [d0ece30948] - crypto: clear OpenSSL error queue after calling X509_verify() (Takuro Sato) #45377
- [2d9ae4f184] - deps: update undici to v5.19.1 (Matteo Collina) nodejs-private/node-private#388
- [d80e8312fd] - deps: cherry-pick Windows ARM64 fix for openssl (Richard Lau) #46568
- [de5c8d2c2f] - deps: update archs files for quictls/openssl-1.1.1t+quic (RafaelGSS) #46568
- [1a8ccfe908] - deps: upgrade openssl sources to OpenSSL_1_1_1t+quic (RafaelGSS) #46568
- [693789780b] - doc: clarify release notes for Node.js 16.19.0 (Richard Lau) #45846
- [f95ef064f4] - lib: makeRequireFunction patch when experimental policy (RafaelGSS) nodejs-private/node-private#358
- [b02d895137] - policy: makeRequireFunction on mainModule.require (RafaelGSS) nodejs-private/node-private#358
- [d7f83c420c] - test: avoid left behind child processes (Richard Lau) #46276

Notable Changes
OpenSSL 1.1.1s
This update is a bugfix release and does not address any security
vulnerabilities.
Root certificates updated to NSS 3.85
Certificates added:
- Autoridad de Certificacion Firmaprofesional CIF A62634068
- Certainly Root E1
- Certainly Root R1
- D-TRUST BR Root CA 1 2020
- D-TRUST EV Root CA 1 2020
- DigiCert TLS ECC P384 Root G5
- DigiCert TLS RSA4096 Root G5
- E-Tugra Global Root CA ECC v3
- E-Tugra Global Root CA RSA v3
- HiPKI Root CA - G1
- ISRG Root X2
- Security Communication ECC RootCA1
- Security Communication RootCA3
- Telia Root CA v2
- vTrus ECC Root CA
- vTrus Root CA
Certificates removed:
- Cybertrust Global Root
- DST Root CA X3
- GlobalSign Root CA - R2
- Hellenic Academic and Research Institutions RootCA 2011
Time zone update to 2022f
Time zone data has been updated to 2022f. This includes changes to Daylight
Savings Time (DST) for Fiji and Mexico. For more information, see
https://mm.icann.org/pipermail/tz-announce/2022-October/000075.html.
Other Notable Changes
- [33707dcd03] - dgram: add dgram send queue info (theanarkh) #44149
Dependency updates:
- [3b2b70d792] - deps: upgrade npm to 8.19.3 (npm team) #45322
Experimental features:
- [1e0dcd1ee0] - cli: add --watch (Moshe Atlow) #44366
- [8c73279ebb] - util: add default value option to parsearg (Manuel Spigolon) #44631
Commits
- [bbef3c42f6] - build: add version info to timezone update PR (Darshan Sen) #45021
- [cc2c7648e0] - build: support Python 3.11 (Luigi Pinca) #45191
- [ac24c80663] - build: remove redundant condition from common.gypi (Richard Lau) #45076
- [03dcbe3030] - build: fix bad upstream merge (Stephen Gallagher) #44642
- [1e0dcd1ee0] - cli: add --watch (Moshe Atlow) #44366
- [96d131665e] - cluster: use inspector utils (Moshe Atlow) #44592
- [704836033a] - crypto: update root certificates (Luigi Pinca) #45490
- [5a776d4a69] - deps: update timezone to 2022f (Richard Lau) #45613
- [3b2b70d792] - deps: upgrade npm to 8.19.3 (npm team) #45322
- [9fbc8b21db] - deps: update corepack to 0.15.1 (Node.js GitHub Bot) #45331
- [87e3d002ca] - deps: update corepack to 0.15.0 (Node.js GitHub Bot) #45235
- [e972ff7b13] - deps: V8: backport bbd800c6e359 (Chengzhong Wu) #44947
- [af9d8217c0] - deps: V8: cherry-pick b95354290941 (Chengzhong Wu) #44947
- [38202d321b] - deps: update undici to 5.12.0 (Node.js GitHub Bot) #45236
- [7c0da6adf9] - deps: update archs files for OpenSSL-1.1.1s (RafaelGSS) #45274
- [1149ead6f7] - deps: upgrade openssl sources to OpenSSL_1_1_1s (RafaelGSS) #45274
- [cd54bce4f5] - deps: update timezone (Node.js GitHub Bot) #44950
- [2901abe4f0] - deps: update undici to 5.11.0 (Node.js GitHub Bot) #44929
- [c80cf97033] - deps: update corepack to 0.14.2 (Node.js GitHub Bot) #44775
- [33707dcd03] - dgram: add dgram send queue info (theanarkh) #44149
- [c708d9bb94] - doc: fix typo in parseArgs default value (Tobias Nießen) #45083
- [5a0efa05d2] - node-api: handle no support for external buffers (Michael Dawson) #45181
- [db31de634e] - readline: refactor to avoid unsafe regex primordials (Antoine du Hamel) #43475
- [fbc52e5729] - src: disambiguate terms used to refer to builtins and addons (Joyee Cheung) #44135
- [953072d3db] - src: let http2 streams end after session close (Santiago Gimeno) #45153
- [54608d8dc3] - src: split property helpers from node::Environment (Chengzhong Wu) #44056
- [6733556783] - test: add test to validate changelogs for releases (Richard Lau) #45325
- [821d832cef] - test: mark test-watch-mode* as flaky on all platforms (Pierrick Bouvier) #45049
- [02a18eac69] - test: fix test-runner-inspect (Moshe Atlow) #44620
- [197df63f74] - test: add a test to ensure the correctness of timezone upgrades (Darshan Sen) #45299
- [42e9d8016a] - test: fix textdecoder test for small-icu builds (Richard Lau) #45225
- [6d736a56d8] - test: fix watch mode test flake (Moshe Atlow) #44739
- [543d3d2bf3] - test: deflake watch mode tests (Moshe Atlow) #44621
- [97f6caf4eb] - test: split watch mode inspector tests to se

This is a security release.
Notable changes
The following CVEs are fixed in this release:
- CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium)
More detailed information on each of the vulnerabilities can be found in November 2022 Security Releases blog post.
Commits
- [9ffddd7098] - inspector: harden IP address validation again (Tobias Nießen) nodejs-private/node-private#354

This is a security release.
Notable changes
The following CVEs are fixed in this release:
- CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
- CVE-2022-32213: bypass via obs-fold mechanic (Medium)
- CVE-2022-35255: Weak randomness in WebCrypto keygen
- CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)
More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post.
Commits
- [a54283a638] - crypto: fix weak randomness in WebCrypto keygen (Ben Noordhuis) nodejs-private/node-private#346
- [0713e21240] - http: disable chunked encoding when using OBS fold is used (Paolo Insogna) nodejs-private/node-private#341
- [77fe2f32e4] - src: fix IPv4 non routable validation (RafaelGSS) nodejs-private/node-private#337

This is a security release.
Notable changes
- deps:
- upgrade openssl sources to OpenSSL_1_1_1q (RafaelGSS) #43692
- src:
- add OpenSSL config appname (Daniel Bevenius) #43124
Commits
- [2303fd3fe5] - deps: update archs files for OpenSSL-1.1.1q (RafaelGSS) #43692
- [b219a63c28] - deps: upgrade openssl sources to OpenSSL_1_1_1q (RafaelGSS) #43692
- [c6553a4ef5] - deps: update archs files for OpenSSL-1.1.1p+quic (RafaelGSS) #43535
- [e9084a3e90] - deps: upgrade openssl sources to OpenSSL_1_1_1p+quic (RafaelGSS) #43535
- [1da22eb482] - http: stricter Transfer-Encoding and header separator parsing (Paolo Insogna) nodejs-private/node-private#315
- [754c9bfde0] - src: fix IPv4 validation in inspector_socket (Tobias Nießen) nodejs-private/node-private#320
- [447cf680b0] - (SEMVER-MAJOR) src,deps,build,test: add OpenSSL config appname (Daniel Bevenius) #43124

Notable Changes
- deps:
- upgrade npm to 8.11.0 (npm-cli+bot@github.com) #43210
- docs:
- add release key for RafaelGSS (Rafael Gonzaga) #43131
- add release key for Juan Arboleda (Juan José) #42961
Commits
- [f7c4ce2255] - deps: V8: cherry-pick 3ebf2052a1b2 (Liu Yu) #43147
- [447f9a0e2e] - deps: upgrade npm to 8.11.0 (npm-cli+bot@github.com) #43210
- [68572bdea2] - deps: upgrade npm to 8.10.0 (npm-cli+bot@github.com) #43061
- [3dfc632f12] - deps: upgrade npm to 8.9.0 (npm-robot) #42968
- [a746943fcb] - deps: update archs files for OpenSSL-1.1.1o (RafaelGSS) #42957
- [6efc844922] - deps: upgrade openssl sources to OpenSSL_1_1_1o (RafaelGSS) #42957
- [3ceeb574c3] - deps: upgrade npm to 8.8.0 (npm-robot) #42886
- [f8b2156e07] - deps: upgrade npm to 8.7.0 (ops+robot@npmjs.com) #42744
- [898b4751e9] - deps: upgrade npm to 8.6.0 (npm team) #42550
- [617f64a1cd] - doc: add release key for RafaelGSS (Rafael Gonzaga) #43131
- [e1b47e6e3d] - doc: add release key for Juan Arboleda (Juan José) #42961
- [4185f1f466] - src,inspector: fix empty MaybeLocal crash (Darshan Sen) #42409
- [f11b3cfc6a] - test: delete test/pummel/test-repl-empty-maybelocal-crash.js (Darshan Sen) #42720
- [feac215e4e] - tools: disable trap handler for Windows cross-compiler (Michaël Zasso) #40488
- [47cdddf59b] - tools: update V8 gypfiles for 9.6 (Michaël Zasso) #40488

This is a security release.
Notable Changes
Update to OpenSSL 1.1.1n, which addresses the following vulnerability:
- Infinite loop in BN_mod_sqrt() reachable when parsing certificates (High)(CVE-2022-0778)
More details are available at https://www.openssl.org/news/secadv/20220315.txt
Commits
- [3924618c74] - deps: update archs files for OpenSSL-1.1.1 (Hassaan Pasha) #42352
- [7a6a870d58] - deps: upgrade openssl sources to OpenSSL_1_1_1n (Hassaan Pasha) #42352
- [c533b430f4] - test: fix tests affected by OpenSSL update (Michael Dawson) #42352

This is a security release.
Notable changes
Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531)
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.
Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
More details will be available at CVE-2021-44531 after publication.
Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532)
Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.
Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
More details will be available at CVE-2021-44532 after publication.
Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533)
Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.
Affected versions of Node.js do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.
More details will be available at CVE-2021-44533 after publication.
Prototype pollution via console.table properties (Low)(CVE-2022-21824)
Due to the formatting logic of the console.table() function it was not safe to allow user controlled input to be passed to the properties parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be __proto__. The prototype pollution has very limited control, in that it only allows an empty string to be assigned numerical keys of the object prototype.
Versions of Node.js with the fix for this use a null protoype for the object these properties are being assigned to.
More details will be available at CVE-2022-21824 after publication.
Thanks to Patrik Oldsberg (rugvip) for reporting this vulnerability.
Commits
- [8dd4ca4537] - console: fix prototype pollution via console.table (Tobias Nießen) nodejs-private/node-private#307
- [e52882da4c] - crypto,tls: implement safe x509 GeneralName format (Tobias Nießen) nodejs-private/node-private#300
- [9a0a189b0b] - src: add cve reverts and associated tests (Michael Dawson) nodejs-private/node-private#300
- [4a262d42bc] - src: remove unused x509 functions (Tobias Nießen) nodejs-private/node-private#300
- [965536fe3d] - tls: fix handling of x509 subject and issuer (Tobias Nießen) nodejs-private/node-private#300
- [a2cbfa95ff] - tls: drop support for URI alternative names (Tobias Nießen) nodejs-private/node-private#300

Notable Changes
This release marks the transition of Node.js 16.x into Long Term Support (LTS)
with the codename 'Gallium'. The 16.x release line now moves into "Active LTS"
and will remain so until October 2022. After that time, it will move into
"Maintenance" until end of life in April 2024.

Notable Changes
Experimental ESM Loader Hooks API
Node.js ESM Loader hooks have been consolidated to represent the steps involved needed to facilitate future loader chaining:
1. resolve: resolve [+ getFormat]
2. load: getFormat + getSource + transformSource
For consistency, getGlobalPreloadCode has been renamed to globalPreload.
A loader exporting obsolete hook(s) will trigger a single deprecation warning (per loader) listing the errant hooks.
Contributed by Jacob Smith, Geoffrey Booth, and Bradley Farias - https://github.com/nodejs/node/pull/37468
Other Notable Changes
- [8fdabcb918] - deps: upgrade npm to 8.1.0 (npm team) #40463
- [d1d9f2de30] - doc: deprecate (doc-only) http abort related (dr-js) #36670
- [4116b6c907] - (SEMVER-MINOR) vm: add support for import assertions in dynamic imports (Antoine du Hamel) #40249
Commits
- [8bb3951e41] - build: remove duplicate check for authors.yml (Rich Trott) #40393
- [2de57edced] - build: make scripts in gyp run with right python (Cheng Zhao) #39730
- [a8926d199d] - crypto: remove incorrect constructor invocation (gc) #40300
- [8fdabcb918] - deps: upgrade npm to 8.1.0 (npm team) #40463
- [dca5ac1539] - deps: suppress zlib compiler warnings (Daniel Bevenius) #40343
- [91c3bf6a7f] - deps: upgrade Corepack to 0.10 (Maël Nison) #40374
- [7e02124a06] - dgram: add nread assertion to UDPWrap::OnRecv (Darshan Sen) #40295
- [2d409ed29e] - dns: refactor and use validators (Voltrex) #40022
- [dc7291dab8] - doc: remove ESLint comments which were breaking the CJS/ESM toggles (Mark Skelton) #40408
- [85b7385115] - doc: add pronouns for tniessen to README (Tobias Nießen) #40412
- [1d5857c9f4] - doc: format changelogs (Rich Trott) #40388
- [5eb9402b50] - doc: fix missing variable in deepStrictEqual example (OliverOdo) #40396
- [6f77d1a1d5] - doc: fix asyncLocalStorage.run() description (Constantine Kim) #40381
- [93a48e02dc] - doc: fix typos in n-api docs (Ignacio Carbajo) #40402
- [fb7afb91c2] - doc: format doc/guides using format-md task (Rich Trott) #40358
- [6c091c7878] - doc: improve phrasing in fs.md (Arslan Ali) #40255
- [38d81380ac] - doc: add link to core promises tracking issue (Michael Dawson) #40355
- [71a94aa82a] - doc: correct ESM load hook table header (Jacob Smith) #40234
- [5b074affb4] - doc: fix typo in esm.md (Mason Malone) #40273
- [3b3aaa0a37] - doc: fix typo in ESM example (Tobias Nießen) #40275
- [f848553fb8] - doc: assign missing deprecation number (Michaël Zasso) #40324
- [d1d9f2de30] - doc: deprecate (doc-only) http abort related (dr-js) #36670
- [1ef2cf8413] - doc: anchor link parity between markdown and html-generated docs (foxxyz) #39304
- [3743406b0a] - (SEMVER-MINOR) esm: consolidate ESM loader hooks (Jacob Smith) #37468
- [168020e1c8] - lib: refactor to use let (gdccwxx) #40364
- [bcd59d70bb] - meta: consolidate AUTHORS entries for gabrielschulhof (Rich Trott) #40420
- [80b4245db8] - meta: consolidate AUTHORS information for geirha (Rich Trott) #40406
- [93cecb4700] - meta: consolidate duplicate AUTHORS entries for hassaanp (Rich Trott) #40391
- [fff3135909] - meta: update AUTHORS (Node.js GitHub Bot) #40392
- [122481713d] - meta: consolidate AUTHORS entry for thw0rted (Rich Trott) #40387
- [7f50313fcc] - meta: update label-pr-config (Mestery) #40199
- [5668182665] - meta: use .mailmap to consolidate AUTHORS entries for ide (Rich Trott) #40367
- [bc86084a3e] - net: check if option is undefined (Daijiro Wachi) #40344
- [4564a93e5e] - net: remove unused ObjectKeys (Daijiro Wachi) #40344
- [dbb2e6f429] - net: check objectMode first and then readble || writable (Daijiro Wachi) #40344
- [a672be57c8] - net: throw error to object mode in Socket (Daijiro Wachi) #40344
- [faf9e28c36] - src: remove usage of AllocatedBuffer from stream_* (Darshan Sen) #40293
- [857af2ba99] - src: add missing initialization (Michael Dawson) #40370
- [2bfa87edbc] - stream: fix fromAsyncGen (Robert Nagy) #40499
- [1e15137e71] - test: replace common port with specific number (Daijiro Wachi) #40344
-

This is a security release.
Notable changes
- CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
- The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2021-22959 after publication.
- CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)
- The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details will be available at CVE-2021-22960 after publication.
Commits
- [af488f8dc8] - deps: update llhttp to 6.0.4 (Matteo Collina) nodejs-private/node-private#284
- [2d1eefad98] - http: add regression test for smuggling content length (Matteo Collina) nodejs-private/node-private#284
- [45d419ab1c] - http: add regression test for chunked smuggling (Matteo Collina) nodejs-private/node-private#284

Notable Changes
- crypto
- update root certificates (Richard Lau) #40280
- deps
- upgrade npm to 8.0.0 (npm team) #40369
- update nghttp2 to v1.45.1 (thunder-coding) #40206
- update V8 to 9.4.146.19 (Michaël Zasso) #40285
- tools
- update certdata.txt (Richard Lau) #40280
Commits
- [34f3021ca3] - benchmark: add util.toUSVString()'s benchmark (Khaidi Chu) #40203
- [f83b9bcb6f] - build: support Python 3.10.0 (FrankQiu) #40296
- [3148f9b64e] - build: check for duplicates in new AUTHORS entries (Rich Trott) #40264
- [48c162d457] - build: set DESTCPU correctly for 'make binary' on Apple Silicon (Chris Heisterkamp) #40147
- [7fbfb66d41] - build: limit update authors CI scope (Jiawen Geng) #40219
- [a1bee94502] - build: pass a tuple of alternatives to str.endswith() (Christian Clauss) #40017
- [eaf9d08332] - build: add --no-user for pip commands in Makefile (Rich Trott) #40169
- [e22ca06ac4] - build: fix "test-internet.yml" workflows (SURYAPRATAP SINGH SURYAVANSHI) #40177
- [4da73d09bf] - (SEMVER-MINOR) build: reset embedder string to "-node.0" (Michaël Zasso) #40285
- [4b117fbc81] - console: use validators for consistency (Voltrex) #39812
- [6489423187] - console: avoid unnecessary variables (Pancake) #40183
- [9af2592e69] - crypto: update root certificates (Richard Lau) #40280
- [2fa5e5011f] - crypto: handle initEDRaw pkey failure (Shelley Vohr) #40188
- [7968c79301] - crypto: don't call callback twice in case crypto.randomBytes fails (Guilherme Bernal) #40157
- [b89c7ae297] - deps: upgrade npm to 8.0.0 (npm team) #40369
- [947f3dc9af] - deps: V8: patch jinja2 for Python 3.10 compat (Michaël Zasso) #40296
- [685c7d43a5] - (SEMVER-MINOR) deps: update nghttp2 to v1.45.1 (thunder-coding) #40206
- [e7046e0ff1] - deps: restore minimum ICU version to 68 (Michaël Zasso) #39470
- [a3db2033d4] - (SEMVER-MINOR) deps: make V8 9.4 abi-compatible with 9.0 (Michaël Zasso) #40285
- [5cc24e6d76] - deps: V8: cherry-pick 9a607043cb31 (Jiawen Geng) #40046
- [8de5eb88d3] - deps: V8: cherry-pick 5681a6565828 (Michaël Zasso) #39945
- [150d816edb] - deps: V8: cherry-pick bdcda72cd1d8 (Michaël Zasso) #39945
- [807b68b430] - deps: V8: cherry-pick 00bb1a77c03e (Darshan Sen) #39829
- [be016948df] - deps: silence irrelevant V8 warning (Michaël Zasso) #38990
- [22dcd3e4dc] - deps: silence irrelevant V8 warnings (Michaël Zasso) #37587
- [1aea6a771b] - deps: fix V8 build issue with inline methods (Jiawen Geng) #40060
- [e9812157f0] - deps: make v8.h compatible with VS2015 (Joao Reis) #32116
- [88ae710057] - deps: V8: forward declaration of Rtl*FunctionTable (Refael Ackermann) #32116
- [e810f0766f] - deps: V8: patch register-arm64.h (Refael Ackermann) #32116
- [b8aabd5622] - deps: V8: un-cherry-pick bd019bd (Refael Ackermann) #32116
- [309c4f05df] - (SEMVER-MINOR) deps: update V8 to 9.4.146.19 (Michaël Zasso) #40285
- [69eaaf6321] - doc: format general markdown files (Rich Trott) #40322
- [dc9c31985c] - doc: fix the inline code-block at the NodeDhKeyGenParams class (Justin) #40341
- [8d0546db39] - doc: correct the codeblock for hmacImportParams.hash (Justin) #40340
- [1db2ffd008] - doc: fix typo in stream docs (Juan José Arboleda) #40337
- [abfcbcd14c] - doc: update fast-track approval comment request (voltrexmaster) #40316
- [e2cd2f44f2] - doc: fix CVE-2021-22940 references (Michaël Zasso) #40308
- [88bdbf1e29] - doc: format markdown files in test directory (Rich Trott) #40290
- [f71ac57a86] - doc: add triagers to the table of contents (FrankQiu) #39969
- [a5218b5313] - doc: update Forrest Norvell's pronouns (Forrest L Norvell) #40292
- [d2e54e5d0c] - doc: reorder stream 'readable' paragraphs (Vincent Weevers) #40212
- [1d0a3e1a0c] - doc: fix typo in fs (Brian White) #40257
- [66edb7bfe1] - doc: fix typo in fs.md (Arslan Ali) #40254
- [614a7c21f8] - doc: fix typo in packages.md (Arslan Ali) #40230
- [9fa6dfbe76] - doc: fix example of crypto.generateKeySync (Gary Ho) #40225
- [9a2b94a142] - doc: update fs.watchFile doc (Clément Nardi) #40134
- [a68f91c884] - doc:

Notable Changes
- [fb226ff2ee] - (SEMVER-MINOR) crypto: add rsa-pss keygen parameters (Filip Skokan) #39927
- [85206b7311] - deps: upgrade npm to 7.24.0 (npm team) #40167
- [98f56d179c] - deps: update Acorn to v8.5.0 (Michaël Zasso) #40015
- [9655329772] - doc: add Ayase-252 to collaborators (Qingyu Deng) #40078
- [59fff925be] - (SEMVER-MINOR) fs: make open and close stream override optional when unused (Antoine du Hamel) #40013
- [a63a4bce90] - (SEMVER-MINOR) http: limit requests per connection (Artur K) #40082
- The maximum number of requests a socket can handle before closing keep alive connection can be set with server.maxRequestsPerSocket.
- [9a672961fa] - (SEMVER-MINOR) src: add --no-global-search-paths cli option (Cheng Zhao) #39754
- Adds the --no-global-search-paths command-line option to not search modules from global paths like $HOME/.node_modules and $NODE_PATH.
- [fe920b6cbf] - (SEMVER-MINOR) src: make napi_create_reference accept symbol (JckXia) #39926
- [97f3072ceb] - (SEMVER-MINOR) stream: add signal support to pipeline generators (Robert Nagy) #39067
Commits
- [b7dc651884] - build: run modified internet tests on GitHub Actions (Rich Trott) #40100
- [8d5787a043] - build: add .mailmap/AUTHORS to paths-ignore for test-macos (Rich Trott) #40109
- [9793e7ff08] - build: add .mailmap/AUTHORS to path-ignore for test-asan (Rich Trott) #40109
- [886921de38] - build: add paths-ignore for build-tarball workflow (Rich Trott) #40109
- [01b1946b38] - build: only lint version numbers for pull requests (Michaël Zasso) #40027
- [c804d070a6] - build: add daily/on-demand internet test workflow (Rich Trott) #40086
- [7bddaecbf4] - build: add YAML linting to GitHub Actions (Rich Trott) #40007
- [5a20f9055c] - build: add YAML linting (Rich Trott) #40007
- [0b30867c08] - build: run AUTHORS update weekly (Rich Trott) #40004
- [22a78a75ee] - build: preserves symbols during LTO with macOS linker (Jesse Chan) #39839
- [f0dec58d43] - crypto: fix webcrypto ed(25519|448) spki/pkcs8 import (Filip Skokan) #40131
- [d80082f3eb] - crypto: use validateObject (Voltrex) #39872
- [d657ae6f8a] - crypto: fix RSA-PSS default saltLength (Tobias Nießen) #39999
- [fc45cbe7a8] - crypto: fix default MGF1 hash for OpenSSL 3 (Tobias Nießen) #40031
- [105c9e6d3b] - crypto: check webcrypto asymmetric key types during importKey (Filip Skokan) #39962
- [fb226ff2ee] - (SEMVER-MINOR) crypto: add rsa-pss keygen parameters (Filip Skokan) #39927
- [85206b7311] - deps: upgrade npm to 7.24.0 (npm team) #40167
- [06f6e01f37] - deps: add riscv64 into openssl Makefile and gen openssl-riscv64 (Lu Yahan) #40063
- [9c76c69972] - deps: patch V8 to 9.3.345.19 (Michaël Zasso) #40108
- [0df47d5843] - deps: upgrade npm to 7.23.0 (npm team) #40055
- [b3843bf417] - deps: patch v8 for vs2019 in std17 (Jiawen Geng) #40060
- [67759585a0] - deps: patch for v8 on windows (Jiawen Geng) #40010
- [98f56d179c] - deps: update Acorn to v8.5.0 (Michaël Zasso) #40015
- [5c6708582e] - dns: cleanup validation (Voltrex) #40061
- [e4825dcfd5] - doc: changes default values for fs.read fns (RISHABH BUDHIRAJA) #39163
- [0254b4b0d3] - doc: fix markdown indentation in lists (Michaël Zasso) #40142
- [b6939a3419] - doc: prepare README.md for stricter linting (Rich Trott) #40137
- [a07d8444f9] - doc: fix comma splice (Rich Trott) #40133
- [2488bc0c4f] - doc: clean up weird notes about reentrancy (Anna Henningsen) #40107
- [8b80dcbc30] - doc: correct parameters in fs and stream documentation (vipul kumar) #39984
- [1ced732078] - doc: fix CJS-ESM selector in Safari (Bradley Farias) #40135
- [7fdb12739d] - doc: add timeout.close (Nikita Galkin) #40036
- [81cb14bb58] - doc: clarify that ObjectWrap requires manual cleanup on shutdown (Gerhard Stöbich) #40074
- [8aad81dd99] - doc: add full list of subsystems (FrankQiu) #39971
- [9655329772] - doc: add Ayase-252 to collaborators (Qingyu Deng) #40078
- [6d399e11e9] - doc: fix CCM cipher example in MJS (Tobias Nießen) #39949
- [d426ee9b17] - doc: fix property name 

Notable Changes
This release fixes a regression introduced by the V8 9.3 update in Node.js 16.9.0.
Commits
- [04f1943109] - deps: V8: cherry-pick 9a607043cb31 (Jiawen Geng) #40046

Notable Changes
Corepack
Node.js now includes Corepack, a script that acts as a bridge between Node.js projects and the package managers they are intended to be used with during development.
In practical terms, Corepack will let you use Yarn and pnpm without having to install them - just like what currently happens with npm, which is shipped in Node.js by default.
Please head over to the Corepack documentation page for more information on how to use it.
Contributed by Maël Nison - #39608
V8 9.3
V8 is updated to version 9.3, which includes performance improvements and new JavaScript features.
Object.hasOwn
Object.hasOwn is a static alias for Object.prototype.hasOwnProperty.call:
Object.hasOwn({ value: 42 }, 'value'); // Returns `true`.
Error cause
Errors can now be optionally constructed with a cause option, pointing to another error.
This adds a cause property on the new error:
const error1 = new Error('Error one');
const error2 = new Error('Error two', { cause: error1 });
// error2.cause === error1
Contributed by Michaël Zasso - #39947
Other Notable Changes
- [34c627e4bc] - (SEMVER-MINOR) crypto: add RSA-PSS params to asymmetricKeyDetails (Tobias Nießen) #39851
- [20da0a5379] - (SEMVER-MINOR) module: support pattern trailers (Guy Bedford) #39635
- [cb44781371] - (SEMVER-MINOR) stream: add stream.compose (Robert Nagy) #39029
Commits
- [2343c394fb] - async_hooks: use resource stack for AsyncLocalStorage run (Stephen Belanger) #39890
- [00951827cd] - Revert "build: add windows-2022 to GitHub test matrix" (Michaël Zasso) #39982
- [e7834535b3] - build: add windows-2022 to GitHub test matrix (Michaël Zasso) #39857
- [c49b0c0dd4] - build: add support for Visual Studio 2022 (Michaël Zasso) #39857
- [afdb665e57] - build: fix find-inactive-collaborators workflow token (Rich Trott) #39909
- [0ff88f362f] - build: update token used for pull requests (Rich Trott) #39907
- [beca890330] - build: adapt v8_pch.h to V8 9.3 (Michaël Zasso) #39469
- [2170346aa3] - build: reset embedder string to "-node.0" (Michaël Zasso) #39947
- [d33ab968ab] - cluster: fix comment regarding child_process file (Yash Ladha) #39308
- [585199497f] - crypto: fix regression in RSA-PSS keygen (Tobias Nießen) #39937
- [34c627e4bc] - (SEMVER-MINOR) crypto: add RSA-PSS params to asymmetricKeyDetails (Tobias Nießen) #39851
- [1dd91582da] - crypto: fix rsa-pss one-shot sign/verify error handling (Filip Skokan) #39830
- [20cf47004e] - crypto: fix JWK RSA-PSS SubtleCrypto.exportKey (Filip Skokan) #39828
- [e25dc8e470] - deps: upgrade npm to 7.21.1 (npm team) #39904
- [9270684837] - deps: update archs files for OpenSSL-1.1.1l+quic (Richard Lau) #39867
- [4b5bbec6cc] - deps: upgrade openssl sources to OpenSSL_1_1_1l+quic (Richard Lau) #39867
- [71659fd4ba] - (SEMVER-MINOR) deps: add corepack (Maël Nison) #39608
- [7470db0dfb] - deps: restore minimum ICU version to 68 (Michaël Zasso) #39470
- [92d83d18d2] - deps: make V8 9.3 abi-compatible with 9.0 (Michaël Zasso) #39947
- [0140face81] - deps: V8: cherry-pick 00bb1a77c03e (Darshan Sen) #39829
- [3e1053e755] - deps: V8: cherry-pick 81814ed44574 (Stephen Belanger) #39719
- [d9d0104878] - deps: silence irrelevant V8 warning (Michaël Zasso) #38990
- [cd9b03ea40] - deps: silence irrelevant V8 warnings (Michaël Zasso) #37587
- [b83cab712f] - deps: fix V8 build issue with inline methods (Jiawen Geng) #35415
- [068824d754] - deps: make v8.h compatible with VS2015 (Joao Reis) #32116
- [54f4f1af50] - deps: V8: forward declaration of Rtl*FunctionTable (Refael Ackermann) #32116
- [10ba1cb8b2] - deps: V8: patch register-arm64.h (Refael Ackermann) #32116
- [3ce6f72124] - deps: V8: un-cherry-pick bd019bd (Refael Ackermann) #32116
- [f43c292520] - (SEMVER-MINOR) deps: update V8 to 9.3.345.16 (Michaël Zasso) #39947
- [9e782eb758] - doc: remove {C,Dec}ompressionStream documentation (Luigi Pinca) #39899
- [7857e9cc77] - doc: add descriptions about when options.mode is ignored (Ray) #39881
- [d43b555047] - doc: remove danbev from TSC member list (D

Notable Changes
- [2e90b10f35] - doc: deprecate type coercion for dns.lookup options (Antoine du Hamel) #38906
- [a6d50a18a0] - (SEMVER-MINOR) stream: add stream.Duplex.from utility (Robert Nagy) #39519
- [af7047a815] - (SEMVER-MINOR) stream: add isDisturbed helper (Robert Nagy) #39628
- [66400374de] - (SEMVER-MINOR) util: expose toUSVString (Robert Nagy) #39814
Commits
- [90bf247a55] - build: fix update authors commit (Mestery) #39858
- [c968372e37] - build: add authors.yml (Tierney Cyren) #35831
- [3f284cf65c] - build: add option to hide console window (Cheng Zhao) #39712
- [a01e3ab41d] - deps: V8: cherry-pick 00bb1a77c03e (Darshan Sen) #39829
- [cce95c4c5b] - deps: upgrade npm to 7.21.0 (Myles Borins) #39813
- [254810a22e] - doc: add duplicate CVE check in sec. release doc (Daniel Bevenius) #39845
- [8c50d16712] - doc: improve description of the triagers team (Michaël Zasso) #39833
- [c02165d992] - doc: update instructions for cc (Michael Dawson) #39674
- [208305fd8f] - doc: move util.toUSVString() outside of deprecated group (Luigi Pinca) #39840
- [2e90b10f35] - doc: deprecate type coercion for dns.lookup options (Antoine du Hamel) #38906
- [8460a3216c] - doc: deprecate using non-boolean values in the verbatim option (Antoine du Hamel) #38906
- [3041d57201] - doc: fix malformed changelog entries (Rich Trott) #39791
- [2b02f747c3] - doc: fix lint errors in packages.md (Rich Trott) #39792
- [a387600d8f] - doc: add example of self-reference in scoped packages (Jesús Leganés-Combarro 'piranna) #37630
- [7a25bf3a6d] - doc: add himadriganguly as a triager (Himadri Ganguly) #39757
- [d1900f43ce] - fs: combine require() and destructure (Colin Ihrig) #39806
- [158d4464d2] - meta: add gyp as owner of gyp files and tools/gyp (Mary Marchini) #34847
- [8fa38500f2] - policy: canonicalize before resolving specifiers (Bradley Farias) #37863
- [a7a217be13] - repl: fix tla function hoisting (Don Jayamanne) #39745
- [3a8399ee61] - src: return Maybe<bool> from InitializeContextRuntime() (Darshan Sen) #39695
- [a704c9dfce] - (SEMVER-MINOR) src: call overload ctor from the original ctor (Darshan Sen) #39768
- [0918ea0683] - (SEMVER-MINOR) src: add a constructor overload for CallbackScope (Darshan Sen) #39768
- [a6d50a18a0] - (SEMVER-MINOR) stream: duplexify (Robert Nagy) #39519
- [af7047a815] - (SEMVER-MINOR) stream: add isDisturbed helper (Robert Nagy) #39628
- [f98311a7c8] - tools: update workflow to open a pull request (Rich Trott) #39825
- [d33f897509] - tools: use find-inactive-collaborators to modify README.md (Rich Trott) #39825
- [d82ee96861] - tools: update gyp-next to v0.9.5 (Jiawen Geng) #39818
- [79079ea01b] - tools: fix markdown linting (Rich Trott) #39832
- [01093b07cc] - tools: update markdown linter dependencies and move to ESM (Antoine du Hamel) #39801
- [9dc0c91392] - tools: update rollup to latest version in markdown linter (Rich Trott) #39797
- [c34e2534ab] - tools: update markdown lint dependencies (Rich Trott) #39770
- [66400374de] - (SEMVER-MINOR) util: expose toUSVString (Robert Nagy) #39814

Notable Changes
- fs:
- experimental: add recursive cp method (Benjamin Coe) #39372
Commits
- [a80c989306] - async_hooks: merge resource_symbol with owner_symbol (Darshan Sen) #38468
- [69a2a6b6c3] - bootstrap: call _undestroy() inside _destroy for stdout and stderr (Matteo Collina) #39685
- [5bc31ea0aa] - buffer: add endings option, remove Node.js specific encoding option (James M Snell) #39708
- [091a579275] - (SEMVER-MINOR) buffer: add Blob.prototype.stream method and other cleanups (James M Snell) #39693
- [097d898e58] - build: run coverage for inspector protocol changes (Richard Lau) #39725
- [cf028df0ed] - build: fix V8 build with pointer compression (Michaël Zasso) #39664
- [9d38400de1] - build: exclude markdown files from some GitHub Actions (Rich Trott) #39565
- [eeb804a7b7] - build: use lts shorthand in GitHub Actions (Rich Trott) #39538
- [93a904d0ba] - (SEMVER-MINOR) crypto: implement webcrypto.randomUUID (Michaël Zasso) #39648
- [3321b65a5a] - debugger: prevent simultaneous heap snapshots (Rich Trott) #39638
- [6c375e18b6] - debugger: remove undefined parameter (Rich Trott) #39570
- [103bf20988] - deps: V8: cherry-pick 81814ed44574 (Stephen Belanger) #39719
- [cf5e5b5711] - deps: upgrade to libuv 1.42.0 (Luigi Pinca) #39525
- [5f92d2fe6d] - dgram: use simplified validator (Voltrex) #39753
- [c7e918b06a] - (SEMVER-MINOR) dns: add "tries" option to Resolve options (Luan Devecchi) #39610
- [5d66646b71] - doc: correct cjs code to match mjs code (Raz Luvaton) #39509
- [f18bb2a0f1] - doc: fix typo in hmac.paramNames default (Justin) #39766
- [338a166e83] - doc: fix fs.rmdir recursive option deprecation history (Antoine du Hamel) #39728
- [bfb1dc0a2c] - doc: fixed variable names in queueMicrotask example (ashish maurya) #39634
- [08b31f12f8] - doc: change "Version 4 UUID" to "version 4 UUID" (Tobias Nießen) #39682
- [f5200f9785] - doc: update debugger.md description and examples (Rich Trott) #39661
- [4700f1e529] - doc: fix color contrast issue in light mode (Rich Trott) #39660
- [88c83a4698] - (SEMVER-MINOR) doc: add missing change to resolver ctor (Luan Devecchi) #39610
- [760cafa5ed] - doc: fix typo in url.md (Howie Zhao) #39666
- [9ab5503693] - doc: add point to ask H1 reporter about credit (Daniel Bevenius) #39585
- [7514405456] - doc: update min mac ver + move mac arm64 to tier 1 (Ash Cripps) #39586
- [d7c8c6dcee] - doc: add missing introduced_in metadata (Richard Lau) #39575
- [8072517097] - doc: add code examples to Writable.destroy() and Writable.destroyed (Juan José Arboleda) #39491
- [55f47cc2d0] - doc: add String.prototype.at and %TypedArray%.prototype.at (Jordan Harband) #39583
- [0c0412e2c4] - doc: move NODE_MODULE_VERSION in release guide (Richard Lau) #39544
- [5df74f9b21] - doc: remove outdated ARM information from release guide (Richard Lau) #39544
- [8eccb11ea0] - doc: fence command examples in release guide (Richard Lau) #39544
- [0bd97e1f2d] - doc: update backport labels in release guide (Richard Lau) #39544
- [2129ad6a0a] - doc: add code example to fs.truncate method (Juan José Arboleda) #39454
- [3ff5e153ef] - doc: add code example to http.createServer method (Juan José Arboleda) #39455
- [7d0c869cfa] - doc: add PerformanceObserver buffered document (legendecas) #39514
- [0dc167a03f] - (SEMVER-MINOR) fs: add recursive cp method (Benjamin Coe) #39372
- [54dd3df943] - http: decodes url.username and url.password for authorization header (Lew Gordon) #39310
- [81e62f67bf] - inspector: update inspector_protocol to 89c4adf (Rich Trott) #39650
- [793fee4915] - inspector: update inspector_protocol to 8ec18cf (Rich Trott) #39614
- [5afdc1f4c0] - lib: simplify validators (Voltrex) #39753
- [ca3cb96d25] - lib: cleanup validation (Voltrex) #39652
- [cc08d3062f] - lib: cleanup instance validation (Voltrex) #39656
- [2751cdf6f9] - lib: use helper for readability (Voltrex) #39649
- [c68415cba2] - lib: use validators (Voltrex) #39663
- [be2d60dd1d] - lib: use validator (Voltrex) #39547
- [486d51ac0c] - lib: use va

This is a security release.
Notable Changes
- CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)
- Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of hostnames returned by Domain Name Servers in the Node.js DNS library which can lead to the output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22931.
- CVE-2021-22940: Use after free on close http2 on stream canceling (High)
- Node.js was vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix. You can read more about it at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22940.
- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low)
- If the Node.js HTTPS API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22939.
Commits
- [054537cdc2] - deps: update c-ares to 1.17.2 (Beth Griggs) #39724
- [ac544905b6] - deps: reflect c-ares source tree (Beth Griggs) #39653
- [a914b23cbc] - deps: apply missed updates from c-ares 1.17.1 (Beth Griggs) #39653
- [31d5773654] - http2: add tests for cancel event while client is paused reading (Akshay K) #39622
- [a3c33d4ce7] - http2: update handling of rst_stream with error code NGHTTP2_CANCEL (Akshay K) #39622
- [6c7fff6f1d] - tls: validate "rejectUnauthorized: undefined" (Matteo Collina) nodejs-private/node-private#276

Notable Changes
- Updated npm to 7.20.3 (npm team) #39579
- Reverted an ABI-breaking change from V8 9.2 that could impact some native modules (Michaël Zasso) #39624
- Fixed a bug in error handling known to affect at least Webpack and Jest (Guy Bedford) #39593
Commits
- [6c769ccedf] - build: override python executable path on configure (legendecas) #39465
- [cbf6a01c17] - crypto: fix generateKeyPair with encoding 'jwk' (himself65) #39319
- [3091295609] - deps: revert ABI-breaking change from V8 9.2 (Michaël Zasso) #39624
- [06d7b8e8c8] - deps: upgrade npm to 7.20.3 (npm team) #39579
- [7b612fadc2] - doc: fix crypto.hkdf callback derivedKey type (Filip Skokan) #39453
- [7a731efd97] - doc,lib,test: rename HKDF 'key' argument (Tobias Nießen) #39474
- [93bbaa0ce9] - module: fix ERR_REQUIRE_ESM error for null frames (Guy Bedford) #39593
- [e13162de09] - module: refine enrichCJSError (Antoine du Hamel) #39507
- [815fbec6f1] - repl: do not include legacy getter/setter methods in completion (Anna Henningsen) #39576
- [0405c8d3f0] - zlib: avoid converting Uint8Array instances to Buffer (Antoine du Hamel) #39492

Notable Changes
Node.js 16.4.1 introduced a regression in the Windows installer on
non-English locales that is being fixed in this release. There is no
need to download this release if you are not using the Windows
installer.
Commits
- [76e709ec63] - win,msi: use localized "Authenticated Users" name (Richard Lau) #39241

This is a security release.
Notable Changes
Vulnerabilities fixed:
- CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)
- Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918
- CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)
- Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22921
Commits
- [d33aead28b] - deps: uv: cherry-pick 99c29c9c2c9b (Ben Noordhuis) nodejs-private/node-private#267
- [2690907b81] - win,msi: set install directory permission (AkshayK) nodejs-private/node-private#269

Notable changes
- async_hooks:
- stabilize part of AsyncLocalStorage (Vladimir de Turckheim) #37675
- deps:
- upgrade npm to 7.18.1 (npm team) #39065
- update V8 to 9.1.269.36 (Michaël Zasso) #38273
- dns:
- allow --dns-result-order to change default dns verbatim (Ouyang Yadong) #38099
Commits
- [d2b972ee52] - async_hooks: check for empty contexts before removing (Bryan English) #39095
- [03e75fda4c] - async_hooks: switch between native and context hooks correctly (Stephen Belanger) #38912
- [8115e6ee6d] - (SEMVER-MINOR) async_hooks: stabilize part of AsyncLocalStorage (Vladimir de Turckheim) #37675
- [5f51729014] - bootstrap: move event loop handle checking into snapshot builder (Joyee Cheung) #39007
- [9d100aa269] - bootstrap: split NodeMainInstance::Run() (Joyee Cheung) #39007
- [2aaf2f231f] - build: reconfigure when gyp files change on Windows (Joyee Cheung) #39066
- [7f225a05ee] - Revert "build: work around bug in MSBuild v16.10.0" (Michaël Zasso) #38977
- [1853127dde] - build: reset embedder string to "-node.0" (Michaël Zasso) #38273
- [c0d236f5ea] - build: make build-addons errors fail the build (Richard Lau) #38983
- [173292bcf8] - build: fix commit-queue default branch (Mary Marchini) #38998
- [e939e243bf] - build: don't pass python override to V8 build (Richard Lau) #38969
- [651c58b412] - build: correct Xcode spelling in .gitignore (bl-ue) #38895
- [5203c9ced7] - build: fast-track npm PRs and dont-land them on LTS (Michaël Zasso) #38885
- [7de57d4d33] - build: dont-land gyp-next PRs on LTS branches (Michaël Zasso) #38887
- [e87cd4542b] - child_process: refactor to use validateBoolean (Qingyu Deng) #38927
- [69fa9e16e9] - (SEMVER-MINOR) child_process: allow options.cwd receive a URL (Khaidi Chu) #38862
- [cf9d686c35] - crypto: fix aes crash when tag length too small (Khaidi Chu) #38914
- [1799ea36f0] - crypto: use compatible version of EVP_CIPHER_name (Shelley Vohr) #38925
- [6d5dc63ae4] - crypto: fix label cast in EVP_PKEY_CTX_set0_rsa_oaep_label (Shelley Vohr) #38926
- [6e93c17bf5] - crypto: use EVP_get_cipherbynid directly (Shelley Vohr) #38901
- [82c293959e] - crypto: add missing rand.h include (Shelley Vohr) #38864
- [e4f802de9a] - debugger: rename internal library for clarity (Rich Trott) #39080
- [1e8bdab581] - debugger: use ERR_DEBUGGER_STARTUP_ERROR in _inspect.js (Rich Trott) #39024
- [b43cb69fbb] - debugger: use error codes in debugger REPL (Rich Trott) #39024
- [dc9218136b] - debugger: use ERR_DEBUGGER_ERROR in debugger client (Rich Trott) #39024
- [711916a271] - debugger: remove unnecessary boilerplate copyright comment (Rich Trott) #38952
- [0f65e41442] - debugger: reduce scope of eslint disable comment (Rich Trott) #38946
- [1fa724ec5a] - deps: upgrade npm to 7.18.1 (npm team) #39065
- [c6aa68598d] - deps: upgrade npm to 7.17.0 (npm team) #38999
- [864fe9910b] - deps: make V8 9.1 abi-compatible with 9.0 (Michaël Zasso) #38991
- [c93f3573eb] - deps: V8: cherry-pick fa4cb172cde2 (Michaël Zasso) #38273
- [3c6c28b0a1] - deps: V8: cherry-pick 4c074516397b (Michaël Zasso) #38273
- [3c37396d5c] - deps: V8: cherry-pick 5f4413194480 (Michaël Zasso) #38273
- [3433559a55] - deps: V8: cherry-pick 272445f10927 (Michaël Zasso) #38273
- [f56c78574e] - deps: V8: cherry-pick c0fceaa0669b (Michaël Zasso) #38273
- [7197fcec93] - deps: V8: cherry-pick d59db06bf542 (Michaël Zasso) #38273
- [bf7aa9fef8] - deps: silence irrelevant V8 warnings (Michaël Zasso) #37587
- [eac377bc15] - deps: V8: backport aaacffa1e003 (Michaël Zasso) #38273
- [1a7c8a12c1] - deps: fix V8 build issue with inline methods (Jiawen Geng) #35415
- [3c9a75522b] - deps: make v8.h compatible with VS2015 (Joao Reis) #32116
- [8ed258339a] - deps: V8: forward declaration of Rtl*FunctionTable (Refael Ackermann) #32116
- [4ef37c83a9] - deps: V8: patch register-arm64.h (Refael Ackermann) #32116
- [7c61c6ee25] - deps: V8: un-cherry-pick bd019bd (Refael Ackermann) #32116
- [e82ef4148e] - (SEMVER-MINOR) deps: update V8 to 9.1.269.36 (Michaël Zasso) #38273
- [70af14

Notable Changes
- cli:
- add -C alias for --conditions flag (Guy Bedford) #38755
- deps:
- add workspaces support to npm install commands (Ruy Adorno) #38750
Commits
- [4e58ec4aa6] - benchmark: output JSON-compatible numbers (Michaël Zasso) #38778
- [7a9d0fd5a9] - benchmark: fix http elapsed time (Antoine du Hamel) #38743
- [a98d631905] - bootstrap: include vm and contextify binding into the snapshot (Joyee Cheung) #38677
- [f1628960e1] - build: remove outdated dont-land-on-v6.x label (Michaël Zasso) #38886
- [6986154b30] - build: work around bug in MSBuild v16.10.0 (Michaël Zasso) #38873
- [24cca7c5ea] - build: add lto build to CI (Jiawen Geng) #38567
- [80c32b7a9a] - build: allow LTO with Clang 3.9.1+ (Jesse Chan) #38751
- [e9be2095cf] - build: replace non-POSIX test -a|o (Issam E. Maghni) #38731
- [717a8b63e1] - child_process: retain reference to data with advanced serialization (Anna Henningsen) #38728
- [bc8400122c] - (SEMVER-MINOR) cli: add -C alias for --conditions flag (Guy Bedford) #38755
- [eb7c932a6d] - debugger: revise async iterator usage to comply with lint rules (Rich Trott) #38847
- [f1000e0e52] - debugger: removed unused function argument (Rich Trott) #38850
- [ee1056da60] - debugger: wait for V8 debugger to be enabled (Michaël Zasso) #38811
- [47ad448def] - deps: upgrade npm to 7.15.1 (npm team) #38880
- [e8192b5e89] - deps: upgrade npm to 7.14.0 (Ruy Adorno) #38750
- [15aaf14690] - deps: update llhttp to 6.0.2 (Fedor Indutny) #38665
- [108ffdb68f] - doc: fixed typo in n-api.md (julianjany) #38822
- [131a6918dd] - doc: use "Long Term Support" in collaborator guide (Rich Trott) #38841
- [4844337cd7] - doc: use "Long Term Support" in technical values doc (Rich Trott) #38841
- [f1e823b679] - doc: use "Long Term Support" in README (Philip) #38839
- [4e11971a76] - doc: fix grammar in fs.md (yotamselementor) #38818
- [e2f28c80d1] - doc: fixup code sample in http.md (TodorTotev) #38776
- [96fa387082] - doc: document null target pattern (Guy Bedford) #38724
- [5553be3f4e] - doc: update code examples for node:url module (fisker Cheung) #38645
- [0c063a1258] - doc,url: clarify domainTo* when built without ICU (Darshan Sen) #38789
- [2054efa02c] - events: refactor to use primordials in lib/events (Akhil Marsonya) #38117
- [4884991a12] - lib: include url in bootstrap snapshot and remove unnecessary lazy-loads (Joyee Cheung) #38826
- [08ad2f6c18] - lib: fix typos (bl-ue) #38846
- [7d3a8cb854] - lib: remove unnecessary lazy loads (Joyee Cheung) #38737
- [5d9442a024] - lib: load internal/fs/watchers and internal/fs/read_file_context early (Joyee Cheung) #38737
- [2268d1cf4c] - lib: refactor to reuse validators (Rongjian Zhang) #38608
- [496f7eae92] - node-api: fix shutdown crashes (Michael Dawson) #38492
- [e1195312b9] - (SEMVER-MINOR) os: add os.devNull (Luigi Pinca) #38569
- [7ba305552f] - src: set PromiseHooks by Environment (Bryan English) #38821
- [74205b3542] - src: replace autos in node_api.cc (Khaidi Chu) #38852
- [120849f609] - src: cache necessary isolate & context in api/* (Khaidi Chu) #38366
- [f25cd4f377] - src: fix typos (bl-ue) #38845
- [a1b0e64187] - src: support fs_event_wrap binding in the snapshot (Joyee Cheung) #38737
- [36d4a4331d] - src: remove redundant v8 namespaces in env.cc (Juan José Arboleda) #38792
- [3e6b3b22c5] - src: use SPrintF in ProcessEmitWarning (Darshan Sen) #38758
- [9ca5c0e29e] - src: fix compiler warnings in node_buffer.cc (Darshan Sen) #38722
- [3741595289] - src: set CONF_MFLAGS_DEFAULT_SECTION for OpenSSL 3 (Daniel Bevenius) #38732
- [4e3353223e] - src: use HandleScope in StreamReq::Done() (Darshan Sen) #38720
- [c576311954] - src: remove commented code in node_file.cc (Juan José Arboleda) #38693
- [61c95f08b3] - src: write named pipe info in diagnostic report (legendecas) #38637
- [ba96f14233] - src: remove unused iostream library (Juan José Arboleda) #38694
- [f5dd85bbe6] - src: remove more extra semis from member fns (Shelley Vohr) #38744
- [a47fd67154] - src: replace autos in 

Notable Changes
- [36b948560c] - (SEMVER-MINOR) async_hooks: use new v8::Context PromiseHook API (Stephen Belanger) #36394
- [c0deeeacb2] - lib: support setting process.env.TZ on windows (James M Snell) #38642
- [4c4902748c] - (SEMVER-MINOR) module: add support for URL to import.meta.resolve (Antoine du Hamel) #38587
- [c182198c44] - (SEMVER-MINOR) process: add 'worker' event (James M Snell) #38659
- [fbf02e3198] - (SEMVER-MINOR) util: add util.types.isKeyObject and util.types.isCryptoKey (Filip Skokan) #38619
Commits
- [36b948560c] - (SEMVER-MINOR) async_hooks: use new v8::Context PromiseHook API (Stephen Belanger) #36394
- [dcae03203e] - buffer: remove TODOs in atob / btoa (Khaidi Chu) #38548
- [48b557e904] - buffer: remove unreachable code (Rongjian Zhang) #38537
- [b0df28dea5] - build: add workaround for V8 builds (Richard Lau) #38632
- [3bb12db255] - build: remove dependency on distutils.spawn (Richard Lau) #38600
- [10aaf30da1] - build: add missing torque output sources (Richard Lau) #38576
- [03b4a3a5bf] - build: compile with -std=gnu++14 (Darshan Sen) #38504
- [4296591154] - build,src,test,doc: enable FIPS for OpenSSL 3.0 (Daniel Bevenius) #38633
- [36bb8daba5] - crypto: forbid NODE-ED25519 and NODE-ED448 "raw" key export (Filip Skokan) #38668
- [36bb7243ff] - debugger: refactor inspect_repl to use primordials (Antoine du Hamel) #38551
- [16a6c8d5a6] - debugger: refactor to use internal modules (Antoine du Hamel) #38550
- [11dd9a6838] - debugger: disable only the lint rules required by current file state (Rich Trott) #38529
- [e79f540fa0] - debugger: avoid non-ASCII char in code file (Rich Trott) #38529
- [d9867b9358] - debugger: wrap lines longer than 80 chars (Rich Trott) #38529
- [352a600142] - debugger: rename inspector-cli test module to debugger (Rich Trott) #38530
- [608d0e11f3] - deps: upgrade npm to 7.13.0 (Ruy Adorno) #38682
- [5c71f49d3f] - deps: upgrade npm to 7.12.1 (Ruy Adorno) #38628
- [ec2dbfb200] - deps: patch V8 to 9.0.257.25 (Michaël Zasso) #38556
- [ab298723b5] - (SEMVER-MINOR) deps: V8: cherry-pick fa4cb172cde2 (Stephen Belanger) #36394
- [a84e9b3e7d] - (SEMVER-MINOR) deps: V8: cherry-pick 4c074516397b (Stephen Belanger) #36394
- [043b1aaa3f] - (SEMVER-MINOR) deps: V8: cherry-pick 5f4413194480 (Stephen Belanger) #36394
- [1a104bac74] - (SEMVER-MINOR) deps: V8: cherry-pick 272445f10927 (Stephen Belanger) #36394
- [827ae05538] - (SEMVER-MINOR) deps: V8: backport c0fceaa0669b (Stephen Belanger) #36394
- [f31a6114a4] - deps: V8: cherry-pick 530080c44af2 (Milad Fa) #38489
- [4001dd28ba] - dgram: extract cluster lazy loading method to make it testable (Rongjian Zhang) #38563
- [a0dc194e31] - doc: document buffer.kStringMaxLength (Tobias Nießen) #38688
- [8590c151cd] - doc: update abort signal in fs promise api example (Moritz Kneilmann) #38669
- [0100a3b026] - doc: add documentation for fs.WriteStream.close() (Hitesh Sharma) #38610
- [5c38a554ec] - doc: clarify synchronous blocking of Worker stdio (James M Snell) #38658
- [1765e32c45] - doc: update contact info (Gabriel Schulhof) #38689
- [c4b161cb89] - doc: change color of doctag on night mode (Qingyu Deng) #38652
- [6620a3182e] - doc: add ESM code examples in url.md (Antoine du Hamel) #38651
- [d3de0ef5d4] - doc: fix fs.openSync() signature (Luigi Pinca) #38591
- [56bf6c1bcd] - doc: typo stats() should be stat(); clarity (Bryan Field) #38541
- [1d9fd49f41] - doc: fix code example in ecdh.setPublicKey() (Jordan Baczuk) #38542
- [4c70e42928] - doc: use HEAD instead of master for links (Antoine du Hamel) #38518
- [ae9128ec61] - doc: clarify DiffieHellmanGroup class docs (Nitzan Uziely) #38363
- [e59131d97f] - doc: fix broken AHAFS link in fs doc (Rich Trott) #38534
- [e9d4c8587a] - doc: use AIX instead of Aix in fs.md (Rich Trott) #38535
- [e0118f347a] - doc: remove extraneous dash from flag prefix (Rodolfo Carvalho) #38532
- [9e10e1a76f] - doc: corrected workload name as per the latest VS Installer (MrJithil) #38500
- [38644d6f96] - doc: use sentence cas

Notable Changes
- [8a90f55a05] - (SEMVER-MINOR) fs: allow no-params fsPromises fileHandle read (Nitzan Uziely) #38287
Commits
- [28e16488cf] - async_hooks,doc: replace process.stdout.fd with 1 (Darshan Sen) #38382
- [cbab7ec6e5] - benchmark: avoid using console.log() (Antoine du Hamel) #38370
- [ba15b20062] - benchmark: use process.hrtime.bigint() (Antoine du Hamel) #38369
- [bc6e719884] - bootstrap: freeze more intrinsics (Antoine du Hamel) #38217
- [29faf0f12e] - build: fix label-pr workflow (Michaël Zasso) #38399
- [b5d669a6ea] - build: label PRs with GitHub Action instead of nodejs-github-bot (Phillip Johnsen) #38301
- [195f679331] - crypto: don't crash with some selfsigned certs (Nils Dralle) #37990
- [4b073b0beb] - crypto: fix generateKeyPair type checks (Nitzan Uziely) #38364
- [c1d9b5b386] - crypto: fix scrypt keylen validation (Antoine du Hamel) #38385
- [7354479ad5] - crypto: fix DiffieHellman generator validation (eladkeyshawn) #38311
- [0e446d6048] - debugger: enable linter on internal/inspector/inspect_client (Antoine du Hamel) #38417
- [9f0e80aa4d] - debugger: refactor internal/inspector/_inspect to use more primordials (Antoine du Hamel) #38406
- [a0c566f85a] - debugger: apply automatic lint fixes for inspect_repl.js (Rich Trott) #38411
- [b884ea739b] - debugger: apply automatic lint fixes for _inspect.js (Rich Trott) #38411
- [f946aa0360] - debugger: remove unused function argument (Rich Trott) #38400
- [203a9689a3] - debugger: align message with Node.js standard (Rich Trott) #38400
- [ef617dcbb0] - debugger: add usage example for --port (Rafael Gonzaga) #38400
- [37b5ce2d5a] - debugger: fix race condition/deadlock on initialization (Rich Trott) #38161
- [2a6203d155] - debugger: replace internal use of deprecated API (Rich Trott) #38161
- [6fff9fff97] - debugger: allow longer time to connect (Rich Trott) #38161
- [def85daace] - debugger: accommodate line chunking in Windows (Rich Trott) #38161
- [07361e6b77] - debugger: fix inspect restart on Windows (Rich Trott) #38161
- [d65615e119] - debugger: remove unused code (Rich Trott) #38161
- [62b03bc4f6] - debugger: move node-inspect to internal library (Rich Trott) #38161
- [e3b75cb5aa] - deps: V8: cherry-pick fd75c97d3f56 (Michaël Zasso) #38455
- [aabddfbeb5] - deps: upgrade npm to 7.11.2 (Ruy Adorno) #38475
- [7b9fb92d51] - deps: update to cjs-module-lexer@1.2.1 (Guy Bedford) #38450
- [47626c52a3] - deps: patch V8 to 9.0.257.24 (Michaël Zasso) #38423
- [f455e08621] - deps: patch V8 to 9.0.257.21 (Michaël Zasso) #38333
- [dd61a26d8c] - deps: update llhttp to 6.0.1 (Fedor Indutny) #38359
- [05f41cdbcc] - deps: patch V8 to 9.0.257.19 (Michaël Zasso) #38270
- [224faa0a05] - Revert "doc: os.uptime() temporary bug notice" (Michaël Zasso) #38494
- [3b0480dde8] - doc: document 'secureConnect' event limitation (James M Snell) #38447
- [92586046ec] - doc: fix outdated util inspect documentation and layout example (Ruben Bridgewater) #37079
- [13de4cf1ca] - doc: mark Node.js 10 as End-of-Life (Richard Lau) #38482
- [3cbfde1f25] - doc: mark querystring api as legacy (James M Snell) #38436
- [a5929c2487] - doc: update node-api support matrix (Michael Dawson) #38424
- [f08650cefe] - doc: add arguments for stream event of Http2Server and Http2SecureServer (Qingyu Deng) #37892
- [2d59273bed] - doc: indicate that abort tests do not generate core files (Rich Trott) #38422
- [f1970127ee] - doc: add try/catch in http2 respondWithFile example (Matteo Collina) #38410
- [f6f1317f43] - doc: note the system requirements for V8 tests (DeeDeeG) #38319
- [4b19beaf3c] - doc: minor clarification to pathObject (James M Snell) #38437
- [1eae4af6f7] - doc: clarify that fs.Dir async iterator closes automatically (James M Snell) #38438
- [14afb39259] - doc: document new TCP_KEEPCNT and TCP_KEEPINTVL socket option defaults (Arnold Zokas) #38313
- [ed5ef21690] - doc: do not mention TCP in the allowHalfOpen option description (Luigi Pinca) #38360
- [042985c139] - doc: update message to match actual o