Node.js 18: alte Versionen herunterladen

Notable Changes
This release updates OpenSSL to 3.0.16 and root certificates to NSS 3.108.
Commits
- [f737a79073] - async_hooks,inspector: implement inspector api without async_wrap (Gabriel Bota) #51501
- [fce923ba69] - build: update gcovr to 7.2 and codecov config (Benjamin E. Coe) #54019
- [8b7ffd807c] - build: fix compatibility with V8's depot_tools (Richard Lau) #57330
- [ee9a343413] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #57381
- [738bf8aea4] - crypto: update root certificates to NSS 3.104 (Richard Lau) #55681
- [69d661d591] - deps: update undici to v5.29.0 (Matteo Collina) #57557
- [59fcf43b0e] - deps: update corepack to 0.32.0 (Node.js GitHub Bot) #57265
- [1b72869503] - deps: update archs files for openssl-3.0.16 (Node.js GitHub Bot) #57335
- [a566560235] - deps: upgrade openssl sources to quictls/openssl-3.0.16 (Node.js GitHub Bot) #57335
- [50c4e1da2f] - doc: add missing deprecated badges in fs.md (Yukihiro Hasegawa) #57384
- [c3babb4671] - doc: update Xcode version used for arm64 and pkg (Michaël Zasso) #57104
- [784da606a6] - doc: fix link and history of SourceMap sections (Antoine du Hamel) #57098
- [f5dbceccbe] - test: update error code in tls-psk-circuit for for OpenSSL 3.4 (sebastianas) #56420

Notable Changes
- [ea5eb0e98b] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #56566
Commits
- [bb2977ca6c] - build: use glob for dependencies of out/Makefile (Richard Lau) #55789
- [92896945b8] - build: support python 3.13 (Chengzhong Wu) #53190
- [ea5eb0e98b] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #56566
- [d03a23577d] - deps: V8: cherry-pick 26fd1dfa9cd6 (Shu-yu Guo) #55873
- [53bb21b093] - deps: V8: backport ae5a4db8ad86 (Shu-yu Guo) #55873
- [5eb6dfe284] - deps: update zlib to 1.3.0.1-motley-82a5fec (Node.js GitHub Bot) #55980
- [734515a0f7] - deps: update zlib to 1.3.0.1-motley-7e2e4d7 (Node.js GitHub Bot) #54432
- [d64cc98324] - deps: update simdutf to 5.6.4 (Node.js GitHub Bot) #56255
- [9eab21dd1d] - deps: update simdutf to 5.6.3 (Node.js GitHub Bot) #55973
- [2e3367b46a] - deps: update simdutf to 5.6.2 (Node.js GitHub Bot) #55889
- [df74d66207] - deps: update simdutf to 5.6.1 (Node.js GitHub Bot) #55850
- [ade37ee0b3] - deps: update acorn to 8.14.0 (Node.js GitHub Bot) #55699
- [a3c367adbd] - deps: update corepack to 0.31.0 (Node.js GitHub Bot) #56795
- [2cff6a8428] - deps: update corepack to 0.30.0 (Node.js GitHub Bot) #55977
- [8b8c9a2cf5] - doc: update macOS and Xcode versions for releases (Michaël Zasso) #56337
- [706af28113] - doc: add "Skip to content" button (Antoine du Hamel) #56750
- [634a6b3a14] - doc: improve accessibility of expandable lists (Antoine du Hamel) #56749
- [f0b60c5bf9] - doc: fix arrow vertical alignment in HTML version (Akash Yeole) #52193
- [91cce27ebb] - doc: remove flicker on page load on dark theme (Dima Demakov) #50942
- [522fbb00a8] - doc: make theme consistent across api and other docs (Dima Demakov) #50877
- [1486465520] - doc: save user preference for JS flavor (Vidar Eldøy) #49526
- [d74cff7e59] - doc: rename possibly confusing variable and CSS class (Antoine du Hamel) #49536
- [4829d976fe] - doc: add main ARIA landmark to API docs (Rich Trott) #49882
- [6c4ce1f1d4] - doc: add navigation ARIA landmark to doc ToC (Rich Trott) #49882
- [33548f8c1f] - doc: add history entries for JSON modules stabilization (Antoine du Hamel) #55855
- [e12bdf6141] - meta: bump actions/upload-artifact from 4.4.3 to 4.6.0 (dependabot[bot]) #56861
- [6f44ef388b] - meta: bump actions/upload-artifact from 4.4.0 to 4.4.3 (dependabot[bot]) #55685
- [ae39211117] - meta: bump actions/upload-artifact from 4.3.4 to 4.4.0 (dependabot[bot]) #54703
- [4cf80b37c7] - meta: bump actions/upload-artifact from 4.3.3 to 4.3.4 (dependabot[bot]) #54166
- [4d402b79cb] - meta: bump actions/download-artifact from 4.1.7 to 4.1.8 (dependabot[bot]) #54167
- [1c01f93497] - meta: bump actions/upload-artifact from 4.3.1 to 4.3.3 (dependabot[bot]) #52785
- [6558a516ec] - meta: bump actions/download-artifact from 4.1.4 to 4.1.7 (dependabot[bot]) #52784
- [dd70860ec8] - meta: bump actions/download-artifact from 4.1.3 to 4.1.4 (dependabot[bot]) #52314
- [4a24d92a45] - meta: bump actions/upload-artifact from 4.3.0 to 4.3.1 (dependabot[bot]) #51941
- [655b9071b9] - meta: bump actions/download-artifact from 4.1.1 to 4.1.3 (dependabot[bot]) #51938
- [0e6ad795aa] - meta: bump actions/download-artifact from 4.1.0 to 4.1.1 (dependabot[bot]) #51644
- [61babc5037] - meta: bump actions/upload-artifact from 4.0.0 to 4.3.0 (dependabot[bot]) #51643
- [8b16d80029] - meta: update artifact actions to v4 (Michaël Zasso) #51219
- [d47e8cb86d] - test: do not use deprecated import assertions (Antoine du Hamel) #55873
- [06c523d693] - test: mark test-inspector-stop-profile-after-done as flaky (Antoine du Hamel) #57001
- [dafea86962] - test: mark test-perf-hooks as flaky on macOS (Antoine du Hamel) #57001
- [8e53f1f43d] - test: mark test-inspector-multisession-ws as flaky (Antoine du Hamel) #57001
- [350eb50bbe] - test: mark test-performance-function as flaky (Antoine du Hamel) #57001
- [a1f428a343] - test: skip test-perf-hooks on SmartOS (Antoine du Hamel) #57001
- [199f52fcc0] - test: make test-crypto-hash

This is a security release.
Notable Changes
- CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
- CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
Dependency update:
- CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)
Commits
- [c03ad5ed63] - build: use rclone instead of aws CLI (Michaël Zasso) #55617
- [8232463294] - build, tools: drop leading / from r2dir (Richard Lau) #53951
- [b26bcd3394] - build, tools: copy release assets to staging R2 bucket once built (flakey5) #51394
- [56df127b7b] - build,tools: simplify upload of shasum signatures (Michaël Zasso) #53892
- [a63e9372ed] - (CVE-2025-22150) deps: update undici to v5.28.5 (Matteo Collina) nodejs-private/node-private#657
- [da2d177f91] - (CVE-2025-23084) path: fix path traversal in normalize() on Windows (Tobias Nießen) nodejs-private/node-private#555
- [6cc8d58e6f] - (CVE-2025-23085) src: fix HTTP2 mem leak on premature close and ERR_PROTO (RafaelGSS) nodejs-private/node-private#650

Notable Changes
- [ac37e554a5] - esm: mark import attributes and JSON module as stable (Nicolò Ribaudo) #55333
Commits
- [c2e6a8f215] - benchmark: fix napi/ref addon (Michaël Zasso) #53233
- [4c2e07aaac] - build: pin doc workflow to Node.js 20 (Richard Lau) #55755
- [6ba4ebd060] - build: fix build with Python 3.12 (Luigi Pinca) #50582
- [c50f01399e] - crypto: ensure invalid SubtleCrypto JWK data import results in DataError (Filip Skokan) #55041
- [5c46782137] - crypto: make deriveBits length parameter optional and nullable (Filip Skokan) #53601
- [6e7274fa53] - crypto: reject dh,x25519,x448 in {Sign,Verify}Final (Huáng Jùnliàng) #53774
- [d2442044db] - crypto: reject Ed25519/Ed448 in Sign/Verify prototypes (Filip Skokan) #52340
- [93670de499] - deps: upgrade npm to 10.8.2 (npm team) #53799
- [8531c95587] - deps: upgrade npm to 10.8.1 (npm team) #53207
- [fd9933ea0f] - deps: upgrade npm to 10.8.0 (npm team) #53014
- [03852495d7] - deps: update simdutf to 5.6.0 (Node.js GitHub Bot) #55379
- [3597be4146] - deps: update simdutf to 5.5.0 (Node.js GitHub Bot) #54434
- [52d2c03738] - deps: update simdutf to 5.3.4 (Node.js GitHub Bot) #54312
- [dd882ac483] - deps: update simdutf to 5.3.1 (Node.js GitHub Bot) #54196
- [5fb8e1b428] - deps: update simdutf to 5.3.0 (Node.js GitHub Bot) #53837
- [c952fd886d] - deps: update simdutf to 5.2.8 (Node.js GitHub Bot) #52727
- [a1ae050ed5] - deps: update simdutf to 5.2.6 (Node.js GitHub Bot) #52727
- [96ec48da7f] - deps: update brotli to 1.1.0 (Node.js GitHub Bot) #50804
- [11242bcfb4] - deps: update zlib to 1.3.0.1-motley-71660e1 (Node.js GitHub Bot) #53464
- [64f98a9869] - deps: update zlib to 1.3.0.1-motley-c2469fd (Node.js GitHub Bot) #53464
- [4b815550e0] - deps: update zlib to 1.3.0.1-motley-68e57e6 (Node.js GitHub Bot) #53464
- [f6b2f68ce7] - deps: update zlib to 1.3.0.1-motley-8b7eff8 (Node.js GitHub Bot) #53464
- [e151ebef86] - deps: update zlib to 1.3.0.1-motley-e432200 (Node.js GitHub Bot) #53464
- [637a306e02] - deps: update zlib to 1.3.0.1-motley-887bb57 (Node.js GitHub Bot) #53464
- [569a739569] - deps: update zlib to 1.3.0.1-motley-209717d (Node.js GitHub Bot) #53156
- [033f1e2ba5] - deps: update zlib to 1.3.0.1-motley-4f653ff (Node.js GitHub Bot) #53052
- [aaa857fc01] - deps: update ada to 2.8.0 (Node.js GitHub Bot) #53254
- [d577321877] - deps: update acorn to 8.13.0 (Node.js GitHub Bot) #55558
- [55b3c8a41f] - deps: update acorn-walk to 8.3.4 (Node.js GitHub Bot) #54950
- [50a9456f1e] - deps: update acorn-walk to 8.3.3 (Node.js GitHub Bot) #53466
- [f56cfe776b] - deps: update acorn to 8.12.1 (Node.js GitHub Bot) #53465
- [fce3ab686d] - deps: update archs files for openssl-3.0.15+quic1 (Node.js GitHub Bot) #55184
- [46c782486e] - deps: upgrade openssl sources to quictls/openssl-3.0.15+quic1 (Node.js GitHub Bot) #55184
- [4a18581dc3] - deps: update corepack to 0.29.4 (Node.js GitHub Bot) #54845
- [67e98831ab] - deps: update archs files for openssl-3.0.14+quic1 (Node.js GitHub Bot) #54336
- [c60c6630af] - deps: upgrade openssl sources to quictls/openssl-3.0.14+quic1 (Node.js GitHub Bot) #54336
- [935a506377] - deps: update corepack to 0.29.3 (Node.js GitHub Bot) #54072
- [dbdfdd0226] - deps: update corepack to 0.29.2 (Node.js GitHub Bot) #53838
- [395ee44608] - deps: update corepack to 0.28.2 (Node.js GitHub Bot) #53253
- [6ba8bc0618] - deps: update c-ares to 1.29.0 (Node.js GitHub Bot) #53155
- [81c3260cd2] - deps: update corepack to 0.28.1 (Node.js GitHub Bot) #52946
- [e4739e9aa6] - doc: only apply content-visibility on all.html (Filip Skokan) #53510
- [4d2ac5d98f] - doc: move release key for Myles Borins (Richard Lau) #54059
- [1c4decc998] - doc: add release key for aduh95 (Antoine du Hamel) #55349
- [a4f6f0918f] - doc: add names next to release key bash commands (Aviv Keller) #52878
- [c679348f83] - errors: use determineSpecificType in more error messages (Antoine du Hamel) #49580
- [3059262185] - esm: fix broken assertion in legacyMainResolve (Antoine du Hamel) #55708
- [ac37e

This is a security release.
Notable Changes
- CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
- CVE-2024-22020 - Bypass network import restriction via data URL (Medium)
Commits
- [85abedf1ff] - lib,esm: handle bypass network-import via data: (RafaelGSS) nodejs-private/node-private#522
- [eccd63b865] - src: handle permissive extension on cmd check (RafaelGSS) nodejs-private/node-private#596

Notable Changes
This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections.
A fix has also been included for compiling Node.js from source with newer versions of Clang.
The list of keys used to sign releases has been synchronized with the current list from the main branch.
Updated dependencies
- acorn updated to 8.11.3.
- acorn-walk updated to 8.3.2.
- ada updated to 2.7.8.
- c-ares updated to 1.28.1.
- corepack updated to 0.28.0.
- nghttp2 updated to 1.61.0.
- ngtcp2 updated to 1.3.0.
- npm updated to 10.7.0. Includes a fix from npm@10.5.1 to limit the number of open connections npm/cli#7324.
- simdutf updated to 5.2.4.
- zlib updated to 1.3.0.1-motley-7d77fb7.
Commits
- [0c260e10e7] - deps: update zlib to 1.3.0.1-motley-7d77fb7 (Node.js GitHub Bot) #52516
- [1152d7f919] - deps: update zlib to 1.3.0.1-motley-24c07df (Node.js GitHub Bot) #52199
- [755399db9d] - deps: update zlib to 1.3.0.1-motley-24342f6 (Node.js GitHub Bot) #52123
- [af3e32073b] - deps: update ada to 2.7.8 (Node.js GitHub Bot) #52517
- [e4ea2db58b] - deps: update c-ares to 1.28.1 (Node.js GitHub Bot) #52285
- [14e857bea2] - deps: update corepack to 0.28.0 (Node.js GitHub Bot) #52616
- [7f5dd44ca6] - deps: upgrade npm to 10.7.0 (npm team) #52767
- [78f84ebb09] - deps: update ngtcp2 to 1.3.0 (Node.js GitHub Bot) #51796
- [1f489a3753] - deps: update ngtcp2 to 1.2.0 (Node.js GitHub Bot) #51584
- [3034968225] - deps: update ngtcp2 to 1.1.0 (Node.js GitHub Bot) #51319
- [1aa9da467f] - deps: add nghttp3/**/.deps to .gitignore (Luigi Pinca) #51400
- [28c0c78c9a] - deps: update ngtcp2 and nghttp3 (James M Snell) #51291
- [8fd5a35364] - deps: upgrade npm to 10.5.2 (npm team) #52458
- [2c53ff31c9] - deps: update acorn-walk to 8.3.2 (Node.js GitHub Bot) #51457
- [12f28f33c2] - deps: update acorn to 8.11.3 (Node.js GitHub Bot) #51317
- [dddb7eb3e0] - deps: update acorn-walk to 8.3.1 (Node.js GitHub Bot) #50457
- [c86550e607] - deps: update acorn-walk to 8.3.0 (Node.js GitHub Bot) #50457
- [9500817f66] - deps: update acorn to 8.11.2 (Node.js GitHub Bot) #50460
- [7a8c7b6275] - deps: update ada to 2.7.7 (Node.js GitHub Bot) #52028
- [b199889943] - deps: update corepack to 0.26.0 (Node.js GitHub Bot) #52027
- [052b0ba0c6] - deps: upgrade npm to 10.5.1 (npm team) #52351
- [209823d3af] - deps: update simdutf to 5.2.4 (Node.js GitHub Bot) #52473
- [5114cbe18a] - deps: update simdutf to 5.2.3 (Yagiz Nizipli) #52381
- [be30309ea0] - deps: update simdutf to 5.0.0 (Daniel Lemire) #52138
- [b56f66e250] - deps: update simdutf to 4.0.9 (Node.js GitHub Bot) #51655
- [a9f3b9d9d1] - deps: update nghttp2 to 1.61.0 (Node.js GitHub Bot) #52395
- [1b6fa70620] - deps: update nghttp2 to 1.60.0 (Node.js GitHub Bot) #51948
- [3c9dbbf4d4] - deps: update nghttp2 to 1.59.0 (Node.js GitHub Bot) #51581
- [e28316da54] - deps: update nghttp2 to 1.58.0 (Node.js GitHub Bot) #50441
- [678641f470] - deps: V8: cherry-pick d15d49b09dc7 (Bo Anderson) #52337
- [1147fee7d9] - doc: remove ableist language from crypto (Jamie King) #52063
- [5e93eae972] - doc: add release key for marco-ippolito (marco-ippolito) #52257
- [6689a98488] - http: remove closeIdleConnections function while calling server close (Kumar Rishav) #52336
- [71616e8a8a] - node-api: make tsfn accept napi_finalize once more (Gabriel Schulhof) #51801
- [d9d9e62474] - src: avoid draining platform tasks at FreeEnvironment (Chengzhong Wu) #51290
- [e5fc8ec9fc] - test: skip v8-updates/test-linux-perf (Michaël Zasso) #49639
- [351ef189ca] - test: v8: Add test-linux-perf-logger test suite (Luke Albao) #50352
- [5cec2efc31] - test: reduce the number of requests and parsers (Luigi Pinca) #50240
- [5186e453d9] - test: deflake test-http-regr-gh-2928 (Luigi Pinca) #49574
- [c60cd67e1c] - test: skip test for dynamically linked OpenSSL (Richard Lau) #52542

This is a security release.
Notable Changes
- CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows
Commits
- [6627222409] - src: disallow direct .bat and .cmd file spawning (Ben Noordhuis) nodejs-private/node-private#564

This is a security release.
Notable Changes
- CVE-2024-27983 - Assertion failed in nodehttp2Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)
- CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
- llhttp version 9.2.1
- undici version 5.28.4
Commits
- [60d24938de] - deps: update undici to v5.28.4 (Matteo Collina) nodejs-private/node-private#577
- [5d4d5848cf] - http: do not allow OBS fold in headers by default (Paolo Insogna) nodejs-private/node-private#558
- [0fb816dbcc] - src: ensure to close stream when destroying session (Anna Henningsen) nodejs-private/node-private#561

Notable Changes
Added support for import attributes
Support has been added for import attributes, to replace the old import
assertions syntax. This will aid migration by making the new syntax available
across all currently supported Node.js release lines.
This adds the with keyword which should be used in place of the previous
assert keyword, which will be removed in a future semver-major Node.js
release.
For example,
import "foo" assert { ... }
should be replaced with
import "foo" with { ... }
For more details, see
- #50134
- #51622
Contributed by Nicolò Ribaudo in #51136
and Antoine du Hamel in #50140.
Doc deprecation for dirent.path
Please use newly added dirent.parentPath instead.
Contributed by Antoine du Hamel in #50976
and #51020.
Experimental node-api feature flags
Introduces an experimental feature to segregate finalizers that affect GC state.
A new type called node_api_nogc_env has been introduced as the const version
of napi_env and node_api_nogc_finalize as a variant of napi_finalize that
accepts a node_api_nogc_env as its first argument.
This feature can be turned off by defining
NODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT.
Contributed by Gabriel Schulhof in #50060.
Root certificates updated to NSS 3.98
Certificates added:
- Telekom Security TLS ECC Root 2020
- Telekom Security TLS RSA Root 2023
Certificates removed:
- Security Communication Root CA
Updated dependencies
- ada updated to 2.7.6.
- base64 updated to 0.5.2.
- c-ares updated to 1.27.0.
- corepack updated to 0.25.2.
- ICU updated to 74.2. Includes CLDR 44.1 and Unicode 15.1.
- npm updated to 10.5.0. Fixes a regression in signals not being passed onto child processes.
- simdutf8 updated to 4.0.8.
- Timezone updated to 2024a.
- zlib updated to 1.3.0.1-motley-40e35a7.
vm: fix V8 compilation cache support for vm.Script
Previously repeated compilation of the same source code using vm.Script
stopped hitting the V8 compilation cache after v16.x when support for
importModuleDynamically was added to vm.Script, resulting in a performance
regression that blocked users (in particular Jest users) from upgrading from
v16.x.
The recent fixes allow the compilation cache to be hit again
for vm.Script when --experimental-vm-modules is not used even in the
presence of the importModuleDynamically option, so that users affected by the
performance regression can now upgrade. Ongoing work is also being done to
enable compilation cache support for vm.CompileFunction.
Contributed by Joyee Cheung in #49950
and #50137.
Commits
- [c70383b8d4] - build: support Python 3.12 (Shi Pujin) #50209
- [4b960c3a4a] - build: fix incorrect g++ warning message (Richard Lau) #51695
- [8fdea67694] - crypto: update root certificates to NSS 3.98 (Node.js GitHub Bot) #51794
- [812b126dd9] - deps: V8: cherry-pick d90d4533b053 (Michaël Zasso) #50077
- [9ab8c3db87] - deps: update c-ares to 1.27.0 (Node.js GitHub Bot) #51846
- [c688680387] - deps: update c-ares to 1.26.0 (Node.js GitHub Bot) #51582
- [9498ac8a47] - deps: compile c-ares with C11 support (Michaël Zasso) #51410
- [8fb743642f] - deps: update c-ares to 1.25.0 (Node.js GitHub Bot) #51385
- [7bea2d7c12] - deps: update zlib to 1.3.0.1-motley-40e35a7 (Node.js GitHub Bot) #51274
- [57a38c8f75] - deps: update zlib to 1.3.0.1-motley-dd5fc13 (Node.js GitHub Bot) #51105
- [b0ca084a6b] - deps: update zlib to 1.3-22124f5 (Node.js GitHub Bot) #50910
- [4b43823f37] - deps: update zlib to 1.2.13.1-motley-5daffc7 (Node.js GitHub Bot) #50803
- [f0da591812] - deps: update zlib to 1.2.13.1-motley-dfc48fc (Node.js GitHub Bot) #50456
- [16d28a883a] - deps: update base64 to 0.5.2 (Node.js GitHub Bot) #51455
- [13a9e81cb6] - deps: update base64 to 0.5.1 (Node.js GitHub Bot) #50629
- [b4502d3ac5] - deps: update simdutf to 4.0.8 (Node.js GitHub Bot) #51000
- [183cf8a74a] - deps: update simdutf to 4.0.4 (Node.js GitHub Bot) #50772
- [11ba8593ea] - deps: update ada to 2.7.6 (Node.js GitHub Bot) #51542
- [73a946d55c] - deps: update ada to 2.7.5 (Node.js GitHub Bot) #51542

Notable changes
This is a security release.
Notable changes
- CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
- CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
- CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
- CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
- undici version 5.28.3
- npm version 10.2.4
Commits
- [69e0a1dba8] - crypto: update root certificates to NSS 3.95 (Node.js GitHub Bot) #50805
- [d3d357ab09] - crypto: disable PKCS#1 padding for privateDecrypt (Michael Dawson) nodejs-private/node-private#525
- [3d27175c42] - deps: fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) #51614
- [331558b8ab] - deps: update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) #51614
- [99b77dfb9c] - deps: upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) #51614
- [6cdc71bff1] - deps: upgrade npm to 10.2.4 (npm team) #50751
- [911cb33cda] - http: add maximum chunk extension size (Paolo Insogna) nodejs-private/node-private#520
- [f48b89689d] - lib: update undici to v5.28.3 (Matteo Collina) nodejs-private/node-private#536
- [e6b4c105e0] - src: fix HasOnly(capability) in node::credentials (Tobias Nießen) nodejs-private/node-private#505
- [97c49076cd] - test: skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) #49621
- [60affdde8e] - tools: add macOS notarization verification step (Ulises Gascón) #50833
- [ccc676a327] - tools: use macOS keychain to notarize the releases (Ulises Gascón) #50715
- [31f1ceb380] - tools: remove unused file (Ulises Gascon) #50622
- [bd5f6fb92a] - tools: add macOS notarization stapler (Ulises Gascón) #50625
- [4168c4f71b] - tools: improve macOS notarization process output readability (Ulises Gascón) #50389
- [4622f775aa] - tools: remove unused version function (Ulises Gascón) #50390
- [b90804b1e7] - win,tools: upgrade Windows signing to smctl (Stefan Stojanovic) #50956
- [f31d47e135] - zlib: pause stream if outgoing buffer is full (Matteo Collina) nodejs-private/node-private#542

This is a security release.
Notable Changes
The following CVEs are fixed in this release:
- CVE-2023-44487: nghttp2 Security Release (High)
- CVE-2023-45143: undici Security Release (High)
- CVE-2023-38552: Integrity checks according to policies can be circumvented (Medium)
- CVE-2023-39333: Code injection via WebAssembly export names (Low)
More detailed information on each of the vulnerabilities can be found in October 2023 Security Releases blog post.
Commits
- [55028468db] - deps: update undici to v5.26.3 (Matteo Collina) #50153
- [a792bbc515] - deps: update nghttp2 to 1.57.0 (James M Snell) #50121
- [f6444defa4] - deps: update nghttp2 to 1.56.0 (Node.js GitHub Bot) #49582
- [7e9b08dfd4] - deps: update nghttp2 to 1.55.1 (Node.js GitHub Bot) #48790
- [85672c153f] - deps: update nghttp2 to 1.55.0 (Node.js GitHub Bot) #48746
- [300a902422] - deps: update nghttp2 to 1.53.0 (Node.js GitHub Bot) #47997
- [7d83ed0bf6] - Revert "deps: update nghttp2 to 1.55.0" (Richard Lau) #50151
- [1193ca5fdb] - lib: let deps require node prefixed modules (Matthew Aitken) #50047
- [eaf9083cf1] - module: fix code injection through export names (Tobias Nießen) nodejs-private/node-private#461
- [1c538938cc] - policy: use tamper-proof integrity check function (Tobias Nießen) nodejs-private/node-private#462

Notable Changes
This release addresses some regressions that appeared in Node.js 18.18.0:
- (Windows) FS can not handle certain characters in file name #48673
- 18 and 20 node images give error - Text file busy (after re-build images) nodejs/docker-node#1968
- libuv update in 18.18.0 breaks webpack's thread-loader #49911
The libuv 1.45.0 and 1.46.0 updates that were released in Node.js 18.18.0 have been temporarily reverted.
Commits
- [3e3a75cc46] - Revert "build: sync libuv header change" (Richard Lau) #50036
- [14ece2c479] - Revert "deps: upgrade to libuv 1.45.0" (Richard Lau) #50036
- [022352acbe] - Revert "deps: upgrade to libuv 1.46.0" (Richard Lau) #50036
- [d9f138189c] - Revert "deps: add missing thread-common.c in uv.gyp" (Richard Lau) #50036
- [7a3e1ffbb8] - fs: make sure to write entire buffer (Robert Nagy) #49211
- [04cba95a67] - test: add tmpdir.resolve() (Livia Medeiros) #49079

This is a security release.
Notable Changes
The following CVEs are fixed in this release:
- CVE-2023-32002: Policies can be bypassed via Module._load (High)
- CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
- CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
- OpenSSL Security Releases
- OpenSSL security advisory 14th July.
- OpenSSL security advisory 19th July.
- OpenSSL security advisory 31st July
More detailed information on each of the vulnerabilities can be found in August 2023 Security Releases blog post.
Commits
- [fe3abdf82e] - deps: update archs files for openssl-3.0.10+quic1 (Node.js GitHub Bot) #49036
- [2c5a522d9c] - deps: upgrade openssl sources to quictls/openssl-3.0.10+quic1 (Node.js GitHub Bot) #49036
- [15bced0bde] - policy: handle Module.constructor and main.extensions bypass (RafaelGSS) nodejs-private/node-private#417
- [d4570fae35] - policy: disable process.binding() when enabled (Tobias Nießen) nodejs-private/node-private#460

This is a security release.
Notable Changes
The following CVEs are fixed in this release:
- CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
- CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
- CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
- CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
- CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
- OpenSSL Security Releases
- OpenSSL security advisory 28th March.
- OpenSSL security advisory 20th April.
- OpenSSL security advisory 30th May
- c-ares vulnerabilities:
- GHSA-9g78-jv2r-p7vc
- GHSA-8r8p-23f3-64c2
- GHSA-54xr-f67r-4pc4
- GHSA-x6mf-cxr9-8q6v
More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.
Commits
- [bf3e2c8928] - crypto: handle cert with invalid SPKI gracefully (Tobias Nießen) nodejs-private/node-private#393
- [70f9449072] - deps: set CARES_RANDOM_FILE for c-ares (Richard Lau) #48156
- [35d4efb57b] - deps: update c-ares to 1.19.1 (RafaelGSS) #48115
- [392dfedc77] - deps: update archs files for openssl-3.0.9-quic1 (Node.js GitHub Bot) #48402
- [46cd5fe38b] - deps: upgrade openssl sources to quictls/openssl-3.0.9-quic1 (Node.js GitHub Bot) #48402
- [7e3d2d85c2] - doc,test: clarify behavior of DH generateKeys (Tobias Nießen) nodejs-private/node-private#426
- [4ff6ba050a] - http: disable request smuggling via rempty headers (Paolo Insogna) nodejs-private/node-private#428
- [ab269129a6] - msi: do not create AppData\Roaming\npm (Tobias Nießen) nodejs-private/node-private#408
- [925e8f5619] - policy: handle mainModule.__proto__ bypass (RafaelGSS) nodejs-private/node-private#416
- [d6fae8e47e] - test: allow SIGBUS in signal-handler abort test (Michaël Zasso) #47851

Notable Changes
- [63563f8a7a] - doc,lib,src,test: rename --test-coverage (Colin Ihrig) #46017
- [28a775b32f] - test_runner: add initial code coverage support (Colin Ihrig) #46017
- [4d50db14b3] - (SEMVER-MINOR) test_runner: add reporters (Moshe Atlow) #45712
- [643545ab79] - (SEMVER-MINOR) fs: add statfs() functions (Colin Ihrig) #46358
- [110ead9abb] - (SEMVER-MINOR) vm: expose cachedDataRejected for vm.compileFunction (Anna Henningsen) #46320
- [02632b42cf] - (SEMVER-MINOR) v8: support gc profile (theanarkh) #46255
- [f09b838408] - (SEMVER-MINOR) src,lib: add constrainedMemory API for process (theanarkh) #46218
- [cb5bb12422] - (SEMVER-MINOR) buffer: add isAscii method (Yagiz Nizipli) #46046
Commits
- [6f91c8e2ae] - benchmark: add trailing commas (Antoine du Hamel) #46370
- [d0b9be21eb] - benchmark: remove buffer benchmarks redundancy (Brian White) #45735
- [6468f30d0d] - benchmark: introduce benchmark combination filtering (Brian White) #45735
- [cb5bb12422] - (SEMVER-MINOR) buffer: add isAscii method (Yagiz Nizipli) #46046
- [ec61bb04c0] - build: export more OpenSSL symbols on Windows (Mohamed Akram) #45486
- [7bae4333ce] - build: fix MSVC 2022 Release compilation (Vladimir Morozov (REDMOND)) #46228
- [0f5f2d4470] - crypto: include hmac.h in crypto_util.h (Adam Langley) #46279
- [91ece4161b] - crypto: avoid hang when no algorithm available (Richard Lau) #46237
- [492fc95bdf] - deps: V8: cherry-pick 90be99fab31c (Michaël Zasso) #46646
- [732c77e3d9] - deps: update acorn to 8.8.2 (Node.js GitHub Bot) #46363
- [8582f99ffb] - deps: update to uvwasi 0.0.15 (Colin Ihrig) #46253
- [5453cd9940] - deps: V8: cherry-pick bf0bd4868dde (Michaël Zasso) #45908
- [3ea53c5dc8] - deps: V8: cherry-pick c875e86df1d7 (sepehrst) #46501
- [c04808de4b] - doc: correct the sed command for macOS in release process docs (Juan José) #46397
- [8113220690] - doc: pass string to textEncoder.encode as input (Deokjin Kim) #46421
- [129dccf5d2] - doc: add tip for session.post function (theanarkh) #46354
- [919e581732] - doc: add documentation for socket.destroySoon() (Luigi Pinca) #46337
- [fc15ac95a5] - doc: fix commit message using test instead of deps (Tony Gorez) #46313
- [d153a93200] - doc: add v8 fast api contribution guidelines (Yagiz Nizipli) #46199
- [dbf082d082] - doc: fix small typo error (0xflotus) #46186
- [94421b4cfe] - doc: mark some parameters as optional in webstreams (Deokjin Kim) #46269
- [5adb743511] - doc: update output of example in events.getEventListeners (Deokjin Kim) #46268
- [63563f8a7a] - doc,lib,src,test: rename --test-coverage (Colin Ihrig) #46017
- [4e88c7c813] - esm: delete preload mock test (Geoffrey Booth) #46402
- [643545ab79] - (SEMVER-MINOR) fs: add statfs() functions (Colin Ihrig) #46358
- [5019b5473f] - http: res.setHeaders first implementation (Marco Ippolito) #46109
- [76622c4c60] - inspector: allow opening inspector when NODE_V8_COVERAGE is set (Moshe Atlow) #46113
- [92f0747e03] - meta: update AUTHORS (Node.js GitHub Bot) #46399
- [795251bc6f] - meta: update AUTHORS (Node.js GitHub Bot) #46303
- [8865424c31] - meta: add .mailmap entry (Rich Trott) #46303
- [5ed679407b] - meta: move evanlucas to emeritus (Evan Lucas) #46274
- [403df210ac] - module: move test reporter loading (Geoffrey Booth) #45923
- [2f7319e387] - readline: fix detection of carriage return (Antoine du Hamel) #46306
- [73a8f46c4d] - Revert "src: let http2 streams end after session close" (Santiago Gimeno) #46721
- [30d783f91a] - src: stop tracing agent before shutting down libuv (Santiago Gimeno) #46380
- [1508d90fda] - src: get rid of fp arithmetic in ParseIPv4Host (Tobias Nießen) #46326
- [bdb793a082] - src: use UNREACHABLE instead of CHECK(falsy) (Tobias Nießen) #46317
- [116a33649b] - src: add support for ETW stack walking (José Dapena Paz) #46203
- [b06298c98e] - src: refactor EndsInANumber in node_url.cc and adds IsIPv4NumberValid (Miguel Teixeira) #46227
- [26f41b041c] - src: fix c++ exception on bad command line arg (Ben Noordhuis) #46290
-

Notable Changes
- [f864bef32a] - deps: upgrade npm to 9.5.0 (npm team) #46673
Commits
- [880a65d7ff] - build: delete snapshot.blob file from the project (Juan José Arboleda) #46626
- [cbea56efda] - deps: update undici to 5.20.0 (Node.js GitHub Bot) #46711
- [f864bef32a] - deps: upgrade npm to 9.5.0 (npm team) #46673
- [648041d568] - deps: upgrade npm to 9.4.0 (npm team) #46353
- [5e1f213f3c] - deps: patch V8 to 10.2.154.26 (Michaël Zasso) #46446

This is a security release.
Notable Changes
The following CVEs are fixed in this release:
- CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
- CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
- CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
- CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)
- CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)
More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post.
This security release includes OpenSSL security updates as outlined in the recent
OpenSSL security advisory.
Commits
- [8393ebc72d] - build: build ICU with ICU_NO_USER_DATA_OVERRIDE (RafaelGSS) nodejs-private/node-private#379
- [004e34d046] - crypto: clear OpenSSL error on invalid ca cert (RafaelGSS) #46572
- [5e0142a852] - deps: cherry-pick Windows ARM64 fix for openssl (Richard Lau) #46572
- [f71fe278a6] - deps: update archs files for quictls/openssl-3.0.8+quic (RafaelGSS) #46572
- [2c6817e42b] - deps: upgrade openssl sources to quictls/openssl-3.0.8+quic (RafaelGSS) #46572
- [f0afa0bfe5] - deps: update undici to 5.19.1 (Node.js GitHub Bot) #46634
- [c26a34c13e] - deps: update undici to 5.18.0 (Node.js GitHub Bot) #46634
- [db93ee4a15] - deps: update undici to 5.17.1 (Node.js GitHub Bot) #46634
- [b4e49fb02c] - deps: update undici to 5.16.0 (Node.js GitHub Bot) #46634
- [90994e6a2c] - deps: update undici to 5.15.1 (Node.js GitHub Bot) #46634
- [00302fc7ac] - deps: update undici to 5.15.0 (Node.js GitHub Bot) #46634
- [0e3b796cc5] - lib: makeRequireFunction patch when experimental policy (RafaelGSS) nodejs-private/node-private#371
- [7cccd5565f] - policy: makeRequireFunction on mainModule.require (RafaelGSS) nodejs-private/node-private#371

This is a security release.
Notable changes
The following CVEs are fixed in this release:
- CVE-2022-3602: X.509 Email Address 4-byte Buffer Overflow (High)
- CVE-2022-3786: X.509 Email Address Variable Length Buffer Overflow (High)
- CVE-2022-43548: DNS rebinding in --inspect via invalid octal IP address (Medium)
More detailed information on each of the vulnerabilities can be found in November 2022 Security Releases blog post.
Commits
- [39f8a672e3] - deps: update archs files for quictls/openssl-3.0.7+quic nodejs/node#45286
- [80218127c8] - deps: upgrade openssl sources to quictls/openssl-3.0.7+quic nodejs/node#45286
- [165342beac] - inspector: harden IP address validation again (Tobias Nießen) nodejs-private/node-private#354

Notable Changes
This release marks the transition of Node.js 18.x into Long Term Support (LTS)
with the codename 'Hydrogen'. The 18.x release line now moves into "Active LTS"
and will remain so until October 2023. After that time, it will move into
"Maintenance" until end of life in April 2025.

Notable changes
watch mode (experimental)
Running in 'watch' mode using node --watch restarts the process when an imported file is changed.
Contributed by Moshe Atlow in #44366
Other notable changes
- fs:
- (SEMVER-MINOR) add FileHandle.prototype.readLines (Antoine du Hamel) #42590
- http:
- (SEMVER-MINOR) add writeEarlyHints function to ServerResponse (Wing) #44180
- http2:
- (SEMVER-MINOR) make early hints generic (Yagiz Nizipli) #44820
- lib:
- (SEMVER-MINOR) refactor transferable AbortSignal (flakey5) #44048
- src:
- (SEMVER-MINOR) add detailed embedder process initialization API (Anna Henningsen) #44121
- util:
- (SEMVER-MINOR) add default value option to parsearg (Manuel Spigolon) #44631
Commits
- [27b4b782ce] - benchmark: add vm context global proxy benchmark (Joyee Cheung) #44796
- [4e82521af1] - bootstrap: update comments in bootstrap/node.js (Joyee Cheung) #44726
- [725be0ea50] - buffer: initialize TextDecoder once on blob.text() (Yagiz Nizipli) #44787
- [653c3b1f62] - buffer,lib: update atob to align wpt's base64.json (Khaidi Chu) #43901
- [37808b3355] - build: convert V8 test JSON to JUnit XML (Keyhan Vakil) #44049
- [f92871a52b] - build: update timezone-update.yml (Alex) #44717
- [f85d3471ee] - child_process: remove lookup of undefined property (Colin Ihrig) #44766
- [2f5f41c315] - (SEMVER-MINOR) cli: add --watch (Moshe Atlow) #44366
- [7fb9cc70f3] - cluster: use inspector utils (Moshe Atlow) #44592
- [99a2c16040] - crypto: add causes to applicable webcrypto's OperationError (Filip Skokan) #44890
- [e0fbba0939] - crypto: use EVP_PKEY_CTX_set_dsa_paramgen_q_bits when available (David Benjamin) #44561
- [a90386b0a1] - deps: update undici to 5.11.0 (Node.js GitHub Bot) #44929
- [aa68d40fbf] - deps: update corepack to 0.14.2 (Node.js GitHub Bot) #44775
- [c892f35815] - deps: V8: fix debug build (Ben Noordhuis) #44392
- [91514393dc] - dns: support dns module in the snapshot (Joyee Cheung) #44633
- [ce3cb29319] - doc: add fsPromises.readFile() example (Tierney Cyren) #40237
- [97df9b84a2] - doc: improve building doc for Android (BuShe Pie) #44888
- [8c69da893b] - doc: mention corepack prepare supports tag or range (Michael Rienstra) #44646
- [842bc64833] - doc: remove Legacy status from querystring (Rich Trott) #44912
- [ddb5402f5f] - doc: fix label name in collaborator guide (Rich Trott) #44920
- [d08b024a3d] - doc: fix typo in Node.js 12 changelog (Lorand Horvath) #42880
- [b6b9c427c5] - doc: move release keys we don't use anymore in README (Rich Trott) #44899
- [e92b074b32] - doc: fix grammar in dns docs (#44850) (Colin Ihrig) #44850
- [780144c339] - doc: remove unnecessary leading commas (Colin Ihrig) #44854
- [6ae9bc8fbc] - doc: add extra step for reporter pre-approval (Rafael Gonzaga) #44806
- [ccf31d8bca] - doc: add anchor link for --preserve-symlinks (Kohei Ueno) #44858
- [7c5c19ee54] - doc: update node prefix require.cache example (Simone Busoli) #44724
- [2a5bce6318] - doc: include last security release date (Vladimir de Turckheim) #44794
- [4efaf4265c] - doc: remove "currently" and comma splice from child_process.md (Rich Trott) #44789
- [3627616b40] - doc,crypto: mark experimental algorithms more visually (Filip Skokan) #44892
- [3c653cf23a] - doc,crypto: add missing CFRG curve algorithms to supported lists (Filip Skokan) #44876
- [70f55020d3] - doc,crypto: add null length to crypto.subtle.deriveBits (Filip Skokan) #44876
- [910fbd0ece] - esm: fix duplicated test (Geoffrey Booth) #44779
- [bc00f3bde1] - fs: fix opts.filter issue in cp async (Tho) #44922
- [11d1c23fa0] - (SEMVER-MINOR) fs: add FileHandle.prototype.readLines (Antoine du Hamel) #42590
- [67fb76519a] - fs: improve promise based readFile performance for big files (Ruben Bridgewater) #44295
- [dc6379bdc2] - fs: don't hard code name in validatePosition() (Colin Ihrig) #44767
- [eb19b1e97c] - http: be more aggressive to reply 400, 408 and 431 (ywave620) #44818
- [4c869c8d9e] - (SEMVER-MINOR) http: add writeEarlyHints function to ServerResponse (Wing

Notable changes
- doc:
- (SEMVER-MINOR) deprecate modp1, modp2, and modp5 groups (Tobias Nießen) #44588
- add legendecas to TSC list (Michael Dawson) #44662
- move policy docs to the permissions scope (Rafael Gonzaga) #44222
- gyp:
- libnode for ios app embedding (chexiongsheng) #44210
- http:
- (SEMVER-MINOR) throw error on content-length mismatch (sidwebworks) #44588
- stream:
- (SEMVER-MINOR) add ReadableByteStream.tee() (Daeyeon Jeong) #44505
Commits
- [f497368679] - benchmark: fix startup benchmark (Evan Lucas) #44727
- [0c9a94684e] - benchmark: add stream destroy benchmark (SindreXie) #44533
- [9c5c1459a8] - bootstrap: clean up inspector console methods during serialization (Joyee Cheung) #44279
- [19f67dba8a] - bootstrap: remove unused global parameter in per-context scripts (Joyee Cheung) #44472
- [9da11426f6] - build: remove redundant entry in crypto (Jiawen Geng) #44604
- [70898b4e67] - build: rewritten the Android build system (BuShe Pie) #44207
- [a733f7faac] - Revert "build: go faster, drop -fno-omit-frame-pointer" (Ben Noordhuis) #44566
- [1315a83333] - build: fix bad upstream merge (Stephen Gallagher) #44642
- [993bd9b134] - crypto: restrict PBKDF2 args to signed int (Tobias Nießen) #44575
- [ca5fb67b4e] - deps: update to ngtcp2 0.8.1 and nghttp3 0.7.0 (Tobias Nießen) #44622
- [8da1d6ebc4] - deps: update corepack to 0.14.1 (Node.js GitHub Bot) #44704
- [d36c4a3088] - deps: update ngtcp2 update instructions (Tobias Nießen) #44619
- [7129106aa0] - deps: upgrade npm to 8.19.2 (npm team) #44632
- [3cc8f4bb56] - deps: update to uvwasi 0.0.13 (Colin Ihrig) #44524
- [4686579d4b] - dns: remove unnecessary parameter from validateOneOf (Yagiz Nizipli) #44635
- [729dd95f1f] - dns: refactor default resolver (Joyee Cheung) #44541
- [6dc038262a] - doc: mention git node backport (RafaelGSS) #44764
- [fd971f5176] - doc: ensure to revert node_version changes (Rafael Gonzaga) #44760
- [f274b08f8e] - doc: fix description for napi_get_cb_info() in n-api.md (Daeyeon Jeong) #44761
- [2502f2353d] - doc: update the deprecation for exit code to clarify its scope (Daeyeon Jeong) #44714
- [064543d0ae] - doc: update guidance for adding new modules (Michael Dawson) #44576
- [33a2f17534] - doc: add registry number for Electron 22 (Keeley Hammond) #44748
- [10a0d75c26] - doc: include code examples for webstreams consumers (Lucas Santos) #44387
- [4dbe4a010c] - doc: mention where to push security commits (RafaelGSS) #44691
- [82cb8151ad] - doc: remove extra space on threadpool usage (Connor Burton) #44734
- [6ef9af2748] - doc: make legacy banner slightly less bright (Rich Trott) #44665
- [b209c83e66] - doc: improve building doc for Windows Powershell (Brian Muenzenmeyer) #44625
- [05b17e9250] - doc: maintain only one list of MODP groups (Tobias Nießen) #44644
- [ec1cbdb69b] - doc: add legendecas to TSC list (Michael Dawson) #44662
- [9341fb4446] - doc: remove comma in README.md (Taha-Chaudhry) #44599
- [3dabb44dda] - doc: use serial comma in report docs (Daeyeon Jeong) #44608
- [226d90a95a] - doc: use serial comma in stream docs (Daeyeon Jeong) #44609
- [3f710fa636] - doc: remove empty line in YAML block (Claudio Wunder) #44617
- [4ad1b0abc3] - (SEMVER-MINOR) doc: deprecate modp1, modp2, and modp5 groups (Tobias Nießen) #44588
- [2d92610525] - doc: remove old OpenSSL ENGINE constants (Tobias Nießen) #44589
- [03705639c4] - doc: fix heading levels for test runner hooks (Fabian Meyer) #44603
- [6c557346a7] - doc: fix errors in http.md (Luigi Pinca) #44587
- [48d944b71c] - doc: fix vm.Script createCachedData example (Chengzhong Wu) #44487
- [2813323120] - doc: mention how to get commit release (Rafael Gonzaga) #44572
- [ea7b44d474] - doc: fix link in process.md (Antoine du Hamel) #44594
- [39b65d2fb7] - doc: do not use weak MODP group in example (Tobias Nießen) #44585
- [f5549afd90] - doc: remove ebpf from supported tooling list (Rafael Gonzaga) #44549
- [a3360b1f4f] - doc: emphasize that createCipher is never secure (Tobias Nießen) #44538
- [4e6

This is a security release.
Notable changes
The following CVEs are fixed in this release:
- CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
- Insufficient fix for macOS devices on v18.5.0
- CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium)
- CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)
- Insufficient fix on v18.5.0
- CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)
- Insufficient fix on v18.5.0
- CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)
- CVE-2022-35255: Weak randomness in WebCrypto keygen
More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post.
llhttp updated to 6.0.10
llhttp is updated to 6.0.10 which includes fixes for the following vulnerabilities.
- HTTP Request Smuggling - CVE-2022-32213 bypass via obs-fold mechanic (Medium)(CVE-2022-32213 ): The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
- HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215): The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
- HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)(CVE-35256): The llhttp parser in the http does not correctly handle header fields that are not terminated with CLRF. This can lead to HTTP Request Smuggling (HRS).
Commits
- [0c2a5723be] - crypto: fix weak randomness in WebCrypto keygen (Ben Noordhuis) nodejs-private/node-private#
- [ffb6f4d51d] - deps: MacOS - fix location of OpenSSL config file (Michael Dawson) nodejs-private/node-private#345
- [01bffcdd93] - http: disable chunked encoding when OBS fold is used (Paolo Insogna) nodejs-private/node-private#341
- [2c379d341d] - src: fix IPv4 non routable validation (RafaelGSS) nodejs-private/node-private#337

Notable changes
- doc
- add daeyeon to collaborators (Daeyeon Jeong) #44355
- lib
- (SEMVER-MINOR) add diagnostics channel for process and worker (theanarkh) #44045
- os
- (SEMVER-MINOR) add machine method (theanarkh) #44416
- report
- (SEMVER-MINOR) expose report public native apis (Chengzhong Wu) #44255
- src
- (SEMVER-MINOR) expose environment RequestInterrupt api (Chengzhong Wu) #44362
- vm
- include vm context in the embedded snapshot (Joyee Cheung) #44252
Commits
- [e27e709d3c] - build: add --libdir flag to configure (Stephen Gallagher) #44361
- [30da2b4d89] - build: added NINJA env to customize ninja binary (Jeff Dickey) #44293
- [3c5354869e] - cluster: fix cluster rr distribute error (theanarkh) #44202
- [5cefd02618] - crypto: handle invalid prepareAsymmetricKey JWK inputs (Filip Skokan) #44475
- [c868e36385] - crypto: add digest name to INVALID_DIGEST errors (Tobias Nießen) #44468
- [35cbe1ad85] - crypto: use actual option name in error message (Tobias Nießen) #44455
- [c3dbe18e4c] - crypto: simplify control flow in HKDF (Tobias Nießen) #44272
- [28781a1f7e] - crypto: improve RSA-PSS digest error messages (Tobias Nießen) #44307
- [b1eafe14fd] - debugger: decrease timeout used to wait for the port to be free (Joyee Cheung) #44359
- [8ef5c40a83] - deps: update corepack to 0.14.0 (Node.js GitHub Bot) #44509
- [cf19a79dfc] - deps: upgrade npm to 8.19.1 (npm team) #44486
- [c5630ad1a7] - deps: V8: backport ff8d67c88449 (Michaël Zasso) #44423
- [255e7fbd08] - deps: update Acorn to v8.8.0 (Michaël Zasso) #44437
- [754d26a53e] - deps: patch V8 to 10.2.154.15 (Michaël Zasso) #44294
- [1b50ff2600] - deps: update icu tzdata to 2022b (Matías Zúñiga) #44283
- [1e451dca99] - deps: upgrade llhttp to 6.0.9 (Paolo Insogna) #44344
- [57da3db522] - deps: update undici to 5.9.1 (Node.js GitHub Bot) #44319
- [1c87a7e8f6] - doc: add missing parenthesis in TLSSocket section (Tobias Nießen) #44512
- [05006eddb2] - doc: do not use "Returns:" for crypto.constants (Tobias Nießen) #44481
- [54b6ed58bc] - doc: use serial comma in addons docs (Tobias Nießen) #44482
- [11452a97b3] - doc: add --update-assert-snapshot to node.1 (Colin Ihrig) #44429
- [ae028e8ac3] - doc: improve assert.snapshot() docs (Colin Ihrig) #44429
- [71c869688a] - doc: add missing imports in events sample code (Brian Evans) #44337
- [92046e8027] - doc: apply scroll-margin-top to h2, h3 elements (metonym) #44414
- [3e6cde5931] - doc: fix spacing issue in --build-snapshot help text (Shohei YOSHIDA) #44435
- [8e41dbb81b] - doc: mention cherry-pick edge-case on release (RafaelGSS) #44408
- [cef30f9afc] - doc: note on release guide to update main branch (Ruy Adorno) #44384
- [21437f7a7f] - doc: fix release guide example consistency (Ruy Adorno) #44385
- [ed52bd0a18] - doc: fix style of n-api.md (theanarkh) #44377
- [65c1f4015f] - doc: add history for net.createServer() options (Luigi Pinca) #44326
- [4a0f750a6c] - doc: add daeyeon to collaborators (Daeyeon Jeong) #44355
- [8cc5556f76] - doc: fix typo in test runner code examples (Moshe Atlow) #44351
- [b660b7467d] - doc,worker: document resourceLimits overrides (Keyhan Vakil) #43992
- [2ed3b30696] - inspector: prevent integer overflow in open() (Tobias Nießen) #44367
- [b8f08e5e7e] - lib: codify findSourceMap return value when not found (Chengzhong Wu) #44397
- [a86ef1ba3e] - lib: use safe Promise alternatives when available (Antoine du Hamel) #43476
- [e519ac7842] - meta: update AUTHORS (Node.js GitHub Bot) #44511
- [c03f28b960] - meta: update AUTHORS (Node.js GitHub Bot) #44422
- [ef08cbddac] - node-api: avoid calling virtual methods in base's dtor (Chengzhong Wu) #44424
- [256340197c] - node-api: cleanup redundant static modifiers (Chengzhong Wu) #44301
- [6714736706] - (SEMVER-MINOR) os: add machine method (theanarkh) #44416
- [807b1e5533] - report: get stack trace with cross origin contexts (Chengzhong Wu) #44398
- [b17cc877d0] - report: fix missing section javascriptHeap on OOMError (Chengzhong Wu) #44398
- [1f23c17ae0] - (SE

This is a security release.
Notable Changes
- [3f0c3e142d] - (SEMVER-MAJOR) src,deps,build,test: add OpenSSL config appname (Daniel Bevenius) #43124
- [9578158ff8] - (SEMVER-MAJOR) src,doc,test: add --openssl-shared-config option (Daniel Bevenius) #43124
- Node.js now reads nodejs_conf section in the openssl config
- [dc7af13486] - deps: update archs files for quictls/openssl-3.0.5+quic (RafaelGSS) #43693
- [fa72c534eb] - deps: upgrade openssl sources to quictls/openssl-3.0.5+quic (RafaelGSS) #43693
Commits
- [dc7af13486] - deps: update archs files for quictls/openssl-3.0.5+quic (RafaelGSS) #43693
- [fa72c534eb] - deps: upgrade openssl sources to quictls/openssl-3.0.5+quic (RafaelGSS) #43693
- [a5fc2deb43] - deps: update default openssl.cnf directory (Michael Dawson) nodejs-private/node-private#335
- [f2407748e3] - http: stricter Transfer-Encoding and header separator parsing (Paolo Insogna) nodejs-private/node-private#315
- [e4af5eba95] - src: fix IPv4 validation in inspector_socket (Tobias Nießen) nodejs-private/node-private#320
- [3f0c3e142d] - (SEMVER-MAJOR) src,deps,build,test: add OpenSSL config appname (Daniel Bevenius) #43124
- [9578158ff8] - (SEMVER-MAJOR) src,doc,test: add --openssl-shared-config option (Daniel Bevenius) #43124

Notable Changes
- crypto:
- remove Node.js-specific webcrypto extensions (Filip Skokan) #43310
- add CFRG curves to Web Crypto API (Filip Skokan) #42507
- dns:
- accept 'IPv4' and 'IPv6' for family (Antoine du Hamel) #43054
- report:
- add more heap infos in process report (theanarkh) #43116
Commits
- [702bfa0b7c] - async_hooks: use kEmptyObject (LiviaMedeiros) #43159
- [f7c4015fd8] - bootstrap: consolidate global properties definition (Chengzhong Wu) #43357
- [8d892f5259] - build: add nonpm and nocorepack to vcbuild.bat (Darshan Sen) #43219
- [4109ddc005] - child_process: use kEmptyObject (LiviaMedeiros) #43159
- [7b5cb14f0c] - cluster: use kEmptyObject (LiviaMedeiros) #43159
- [9f1de2c005] - crypto: fix webcrypto import of cfrg raw public keys (Filip Skokan) #43404
- [7f02e22998] - crypto: test webcrypto ec raw public key import (Filip Skokan) #43405
- [0a075cb548] - crypto: fix webcrypto JWK EC and OKP import crv check (Filip Skokan) #43346
- [df0903c8e8] - crypto: use kEmptyObject (LiviaMedeiros) #43159
- [6d0053345e] - (SEMVER-MINOR) crypto: remove Node.js-specific webcrypto extensions (Filip Skokan) #43310
- [28c034d6b5] - (SEMVER-MINOR) crypto: add CFRG curves to Web Crypto API (Filip Skokan) #42507
- [fe7fd85109] - deps: update Corepack to 0.11.2 (Maël Nison) #43402
- [517f17b214] - deps: update undici to 5.5.1 (Node.js GitHub Bot) #43412
- [f4c830fbe4] - deps: upgrade npm to 8.12.1 (npm CLI robot) #43301
- [0bb84b09a5] - (SEMVER-MINOR) dns: accept 'IPv4' and 'IPv6' for family (Antoine du Hamel) #43054
- [f91babe494] - doc: packages documentation updates for 12 EOL (Guy Bedford) #43375
- [066f963ec1] - doc: add initial doc on how to update cjs-module-lexer (Michael Dawson) #43255
- [36e5684ae0] - doc: clarify use of deps/icu-small (Michael Dawson) #43287
- [b9634e7ef3] - doc: remove llnode from diag tierlist (Tony Gorez) #43289
- [4caeb10e7b] - doc: remove ETW from diag tierlist (Tony Gorez) #43295
- [41955e5ce5] - doc: use serial comma in report docs (Tobias Nießen) #43394
- [e30d4c1cb0] - doc: add fspromises mkdir example (Tierney Cyren) #40843
- [adec5fa929] - doc: add F3n67u to triagers (Feng Yu) #43350
- [cc3505b192] - doc: fix typo in globals.md (Daeyeon Jeong) #43365
- [052c8eaf6a] - doc: use serial comma in webstreams docs (Tobias Nießen) #43353
- [b824a0b7d0] - doc: fix specifier example in esm.md (hiroki osame) #43351
- [d558b3c028] - doc: add undici to glossary (F3n67u) #43327
- [f9ad98f5cb] - doc: change glossary link in pull request guide to node's glossary doc (Feng Yu) #43318
- [02944a6783] - doc: fix typo in util.parseArgs usage example (Michael Ficarra) #43332
- [f2bc6a3f71] - doc: improve description of TZ (Tobias Nießen) #43334
- [9335ea6c35] - doc: use serial comma in net docs (Tobias Nießen) #43335
- [05f38c6c3e] - doc: make clear the result of comparison between Symbol.for (Kohei Ueno) #43309
- [c9aed9de9f] - doc: add missing require to stream api doc (Feng Yu) #43237
- [f3188c1c9c] - doc: add CIGTM to glossary.md (Feng Yu) #43316
- [c572d2d115] - doc: use serial comma in pull request doc (Feng Yu) #43319
- [8a4e1fa002] - doc: use serial comma in ESM docs (Tobias Nießen) #43322
- [fff0560a66] - doc: promote cdt to tier 3 (Tony Gorez) #43290
- [7d0f6da97f] - doc: fix chromium document link in pull-requests.md (rikapo) #43265
- [4674b0d2a5] - doc: fix 404 link of BUILDING.md (Feng Yu) #43234
- [ee392c5c0b] - doc: update CHANGELOG_V18.md (Filip Skokan) #43298
- [5a3a2a197f] - doc: add src/crypto to CC list for nodejs/crypto (Tobias Nießen) #43286
- [69ce50396c] - doc: use serial comma in console docs (Tobias Nießen) #43257
- [0c5092c51c] - events: fix adding abort listener in events.once (Daeyeon Jeong) #43373
- [fda2105481] - events: use kEmptyObject (LiviaMedeiros) #43159
- [63bf49b143] - fs: use kEmptyObject (LiviaMedeiros) #43159
- [9b764531b9] - fs: export constants from fs/promises (Feng Yu) #43177
- [a4409f85f8] - http: use kEmptyObject (LiviaMedeiros) #43159
- [2ffd54105a] - http2: use kEmpty

Notable Changes
- [dc3b91f351] - deps: update undici to 5.4.0 (Node.js GitHub Bot) #43262
- [d6cf409d78] - (SEMVER-MINOR) util: add parseArgs module (Benjamin Coe) #42675
- [9539cfa358] - (SEMVER-MINOR) http: add uniqueHeaders option to request and createServer (Paolo Insogna) #41397
- [41fdc2617d] - deps: upgrade npm to 8.11.0 (npm team) #43210
- [0000654e47] - deps: patch V8 to 10.2.154.4 (Michaël Zasso) #43067
- [b3c8e609fd] - (SEMVER-MINOR) deps: update V8 to 10.2.154.2 (Michaël Zasso) #42740
- [3e89b7336d] - (SEMVER-MINOR) fs: make params in writing methods optional (LiviaMedeiros) #42601
- [9539cfa358] - (SEMVER-MINOR) http: add uniqueHeaders option to request and createServer (Paolo Insogna) #41397
- [8f5b4570e5] - (SEMVER-MINOR) net: add ability to reset a tcp socket (pupilTong) #43112
- [5eff7b4a6a] - (SEMVER-MINOR) Revert "build: make x86 Windows support temporarily experimental" (Michaël Zasso) #42740
- This means 32-bit Windows binaries are back with this release.
Commits
- [aefc9dda9a] - benchmark: add node-error benchmark (RafaelGSS) #43077
- [85d81a764f] - bootstrap: include code cache in the embedded snapshot (Joyee Cheung) #43023
- [5eff7b4a6a] - (SEMVER-MINOR) Revert "build: make x86 Windows support temporarily experimental" (Michaël Zasso) #42740
- [d6634707c5] - (SEMVER-MINOR) build: run V8 tests with detected Python version (Richard Lau) #42740
- [b8b5e6df67] - (SEMVER-MINOR) build: reset embedder string to "-node.0" (Michaël Zasso) #42740
- [285ef30877] - console: fix console.dir crash on a revoked proxy (Daeyeon Jeong) #43100
- [920d8c5300] - crypto: align webcrypto RSA key import/export with other implementations (Filip Skokan) #42816
- [c76caadf2e] - debugger: throw a more useful error when the frame is missing (Kohei Ueno) #42776
- [dc3b91f351] - deps: update undici to 5.4.0 (Node.js GitHub Bot) #43262
- [35250bf2f6] - deps: regenerate OpenSSL archs files (Daniel Bevenius) #42973
- [ecacc3a727] - deps: exclude linker scripts for windows builds (Daniel Bevenius) #42973
- [41fdc2617d] - deps: upgrade npm to 8.11.0 (npm team) #43210
- [87b248e27e] - deps: update undici to 5.3.0 (Node.js GitHub Bot) #43197
- [d42de132a7] - deps: upgrade npm to 8.10.0 (npm team) #43061
- [0000654e47] - deps: patch V8 to 10.2.154.4 (Michaël Zasso) #43067
- [742ffefb44] - (SEMVER-MINOR) deps: make V8 10.2 ABI-compatible with 10.1 (Michaël Zasso) #42740
- [c626a533c7] - deps: make V8 compilable with older glibc (Michaël Zasso) #42657
- [76546b12a2] - deps: V8: fix v8-cppgc.h for MSVC (Jiawen Geng) #42657
- [45e1fd4473] - deps: silence V8's warning on CompileFunction (Michaël Zasso) #40907
- [2130891a9a] - (SEMVER-MINOR) deps: disable trap handler for Windows cross-compiler (Michaël Zasso) #40488
- [e678b6c63d] - deps: fix V8 build issue with inline methods (Jiawen Geng) #38807
- [f83323f304] - deps: V8: forward declaration of Rtl*FunctionTable (Refael Ackermann) #32116
- [4be7584ca6] - deps: V8: un-cherry-pick bd019bd (Refael Ackermann) #32116
- [b3c8e609fd] - (SEMVER-MINOR) deps: update V8 to 10.2.154.2 (Michaël Zasso) #42740
- [0afdc3e9a8] - doc: use serial comma in errors docs (Tobias Nießen) #43242
- [00989338b3] - doc: add note regarding %Array.prototype.concat% in primordials.md (Antoine du Hamel) #43166
- [badf72dd0a] - doc: use serial comma in worker_threads docs (Tobias Nießen) #43220
- [776e746f0a] - doc: fix napi version for node_api_symbol_for (Danielle Adams) #42878
- [76b46801f8] - doc: document signal option for EventTarget#addEventListener (Antoine du Hamel) #43170
- [3082c75efd] - doc: make minor adjustments (LiviaMedeiros) #43175
- [598c1f102e] - doc: use serial comma in dgram docs (Tobias Nießen) #43191
- [b772c13a62] - doc: use serial comma in process docs (Tobias Nießen) #43179
- [f90a3d7a54] - doc: improved parallel specification (mawaregetsuka) #42679
- [71074eedef] - doc: improve callback params for fs.mkdir (Daeyeon Jeong) #43016
- [2b8b224077] - doc: remove outdated footnote (Python 2 --> 3 for V8 te

Notable Changes
OpenSSL 3.0.3
This update can be treated as a security release as the issues addressed in OpenSSL 3.0.3 slightly affect Node.js 18.
See https://nodejs.org/en/blog/vulnerability/openssl-fixes-in-regular-releases-may2022/ for more information on how the May 2022 OpenSSL releases affect other Node.js release lines.
- [8e54c19a6e] - deps: update archs files for quictls/openssl-3.0.3+quic (RafaelGSS) #43022
- [6365bf808e] - deps: upgrade openssl sources to quictls/openssl-3.0.3 (RafaelGSS) #43022
Other Notable Changes
- [13c333e533] - Revert "deps: add template for generated headers" (Daniel Bevenius) #42978
- [d128356a7f] - deps: update undici to 5.2.0 (Node.js GitHub Bot) #43059
- [2df1624f80] - deps: upgrade npm to 8.9.0 (npm team) #42968
- [6365bf808e] - deps: upgrade openssl sources to quictls/openssl-3.0.3 (RafaelGSS) #43022
- [4a3f678e70] - doc: add LiviaMedeiros to collaborators (LiviaMedeiros) #43039
- [686c4c1f6f] - doc: add release key for Juan Arboleda (Juan José) #42961
- [784d84cf34] - (SEMVER-MINOR) fs: add read(buffer[, options]) versions (LiviaMedeiros) #42768
- [2f192c4be0] - (SEMVER-MINOR) http: added connection closing methods (Paolo Insogna) #42812
- [c92e291beb] - (SEMVER-MINOR) perf_hooks: add PerformanceResourceTiming (RafaelGSS) #42725
Commits
- [7cac7bb806] - assert: fix CallTracker wraps the function causes the length to be lost (OneNail) #42909
- [e74a8da287] - assert: make assert.fail less affected by prototype tampering (Antoine du Hamel) #42918
- [1146806673] - bootstrap: stop delaying instantiation of maps in per-context scripts (Darshan Sen) #42934
- [a20310d171] - bootstrap: use a context snapshotted with primordials in workers (Joyee Cheung) #42867
- [9ee7d9eb15] - bootstrap: fix wasm_web_api external reference registration (Joyee Cheung) #42903
- [cec678a00e] - build: set ASAN workaround (Richard Lau) #43085
- [7c4df42caa] - build: disable windows-2022 temporarily (Jiawen Geng) #43093
- [0eb32ed976] - build: fix various shared library build issues (William Marlow) #41850
- [48f4a714b2] - build: fix indeterminacy of icu_locales value (Sergey Nazaryev) #42865
- [19c060fd84] - crypto: adjust minimum length in generateKey('hmac', ...) (LiviaMedeiros) #42944
- [183bcc0699] - crypto: clean up parameter validation in HKDF (Tobias Nießen) #42924
- [946f57c7bc] - debugger: fix inconsistent inspector output of exec new Map() (Kohei Ueno) #42423
- [d128356a7f] - deps: update undici to 5.2.0 (Node.js GitHub Bot) #43059
- [a9703a55ef] - deps: remove opensslconf template headers (Daniel Bevenius) #43035
- [a4a4f7134b] - deps: fix llhttp version number (Michael Dawson) #43029
- [8e54c19a6e] - deps: update archs files for quictls/openssl-3.0.3+quic (RafaelGSS) #43022
- [6365bf808e] - deps: upgrade openssl sources to quictls/openssl-3.0.3 (RafaelGSS) #43022
- [e8121ae7fe] - deps: regenerate OpenSSL archs files (Daniel Bevenius) #42978
- [13c333e533] - Revert "deps: add template for generated headers" (Daniel Bevenius) #42978
- [2df1624f80] - deps: upgrade npm to 8.9.0 (npm team) #42968
- [f53ed9d1bb] - doc: use serial comma in fs docs (Tobias Nießen) #43104
- [839824aca8] - doc: use serial comma in events docs (Tobias Nießen) #43113
- [9629c74080] - doc: use serial comma in modules docs (Tobias Nießen) #43103
- [76096c2d4a] - doc: use serial comma in util docs (Tobias Nießen) #43063
- [1e9de0dd5a] - doc: remove git:// protocol, adjust nits in onboarding.md (LiviaMedeiros) #43045
- [eb630d7ef9] - doc: add maintaining info for shared libary option (Michael Dawson) #42517
- [3816a97bae] - doc: add detail for how to update llhttp (Michael Dawson) #43028
- [330e267a57] - doc: use serial comma in buffer docs (Tobias Nießen) #43048
- [0957212390] - doc: use consistent method symbol (Paolo Insogna) #42974
- [22cb7104cb] - doc: add Rafael to the security steward for NearForm (Matteo Collina) #42966
- [ef177da3f1] - doc: mark some node-api functions as experimental (NickNaso) #42987
- [4a3f678e70] - doc: ad