Node.js 21: versionet e vjetra dhe historiku

This is a security release.

Notable Changes
- CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows

Commits
- [9095c914ed] - src: disallow direct .bat and .cmd file spawning (Ben Noordhuis) nodejs-private/node-private#562

This is a security release.
Notable changes
- CVE-2024-27983 - Assertion failed in nodehttp2Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)
- CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation- (Medium)
- llhttp version 9.2.1
- undici version 6.11.1
Commits
- [3dfc10c851] - deps: update undici to 6.11.1 (Node.js GitHub Bot) #52328
- [aceea1c5e7] - deps: update undici to 6.10.2 (Node.js GitHub Bot) #52227
- [5f0f96b275] - deps: update llhttp to 9.2.0 (Node.js GitHub Bot) #51719
- [1a65e98e22] - http: do not allow OBS fold in headers by default (Paolo Insogna) nodejs-private/node-private#556
- [3bd39fb474] - src: ensure to close stream when destroying session (Anna Henningsen) nodejs-private/node-private#561

Notable Changes
This release reverts #51389, which landed in Node.js 21.7.0. It is a documented feature that t.after() hooks are run even if a test has no subtests. The hook can be used to clean up the test itself.
Commits
- [0dfe810ac7] - benchmark: update iterations of benchmark/async_hooks/async-local- (Lei Shi) #51420
- [625c9e0ac9] - benchmark: update iterations of benchmark/domain/domain-fn-args.js (Lei Shi) #51408
- [7ff3551bad] - build: fix arm64 host cross-compilation in GN (Cheng Zhao) #51903
- [fd86ea8b71] - Revert "build: workaround for node-core-utils" (Richard Lau) #51975
- [23c32ab3a7] - build: respect the NODE env variable in Makefile (Antoine du Hamel) #51743
- [9617adc064] - Revert "build: fix warning in cares under GN build" (Luigi Pinca) #51865
- [5864534095] - deps: update nghttp2 to 1.60.0 (Node.js GitHub Bot) #51948
- [fcf235d623] - doc: add policy for distribution (Geoffrey Booth) #51918
- [87d2acc8b1] - doc: fix actual result of example is different in events (Deokjin Kim) #51925
- [5908c121c6] - doc: clarify Corepack threat model (Antoine du Hamel) #51917
- [20e0ba3b94] - doc,module: clarify hook chain execution sequence (Jacob Smith) #51884
- [4d997971ac] - lib: make sure close net server (theanarkh) #51929
- [fcc6d54aa3] - lib: return directly if udp socket close before lookup (theanarkh) #51914
- [10aaabd158] - meta: bump github/codeql-action from 3.23.2 to 3.24.6 (dependabot[bot]) #51942
- [78f38a0143] - meta: bump actions/upload-artifact from 4.3.0 to 4.3.1 (dependabot[bot]) #51941
- [42ca5452c4] - meta: bump codecov/codecov-action from 4.0.1 to 4.1.0 (dependabot[bot]) #51940
- [015a157375] - meta: bump actions/cache from 4.0.0 to 4.0.1 (dependabot[bot]) #51939
- [e476cb4a32] - meta: bump actions/download-artifact from 4.1.1 to 4.1.3 (dependabot[bot]) #51938
- [67e8001790] - meta: bump actions/setup-node from 4.0.1 to 4.0.2 (dependabot[bot]) #51937
- [50343636e8] - src: fix --disable-single-executable-application (Joyee Cheung) #51808
- [a48c9ca0db] - stream: do not defer construction by one microtick (Matteo Collina) #52005
- [bee3b364f9] - test: add regression test for test_runner after hook (Colin Ihrig) #51998
- [fff7f48f50] - test: reduce flakiness of test-runner-output (Antoine du Hamel) #51952
- [57ba8f5acb] - test: fix flaky http-chunk-extensions-limit test (Ethan Arrowood) #51943
- [9d2c03990a] - test: remove flaky designation (Luigi Pinca) #51736
- [e992af81d3] - test: skip SEA tests when SEA generation fails (Joyee Cheung) #51887
- [85aa6ca850] - Revert "test_runner: do not invoke after hook when test is empty" (Colin Ihrig) #51998

Notable changes
This is a security release.
Notable changes
- CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
- CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
- CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
- CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
- CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
- CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
- CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
- CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
- undici version 5.28.3
- libuv version 1.48.0
- OpenSSL version 3.0.13+quic1
Commits
- [8344719369] - crypto: disable PKCS#1 padding for privateDecrypt (Michael Dawson) nodejs-private/node-private#525
- [d093600ac4] - deps: update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) #51614
- [6cd930e5e8] - deps: upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) #51614
- [9590c15d3d] - deps: upgrade libuv to 1.48.0 (Santiago Gimeno) #51698
- [666096298c] - deps: disable io_uring support in libuv by default (Tobias Nießen) nodejs-private/node-private#528
- [a4edd22e30] - fs: protect against modified Buffer internals in possiblyTransformPath (Tobias Nießen) nodejs-private/node-private#497
- [6155a1ffaf] - http: add maximum chunk extension size (Paolo Insogna) nodejs-private/node-private#518
- [777509495e] - lib: use cache fs internals against path traversal (RafaelGSS) nodejs-private/node-private#516
- [9d2ac2b3fc] - lib: update undici to v5.28.3 (Matteo Collina) nodejs-private/node-private#538
- [208b3940c7] - src: fix HasOnly(capability) in node::credentials (Tobias Nießen) nodejs-private/node-private#505
- [fc2454f29c] - src,deps: disable setuid() etc if io_uring enabled (Tobias Nießen) nodejs-private/node-private#528
- [ef3eea20be] - test,doc: clarify wildcard usage (RafaelGSS) nodejs-private/node-private#517
- [8547196964] - zlib: pause stream if outgoing buffer is full (Matteo Collina) nodejs-private/node-private#540

Notable Changes
This release fixes a bug in undici using WebStreams
Commits
- [662ac95729] - Revert "stream: fix cloned webstreams not being unref'd" (Matteo Collina) #51491
- [1b8bba8aee] - test: add regression test for 51586 (Matteo Collina) #51491

Notable Changes
This release fixes a regression introduced in v21.3.0 that caused the fs.writeFileSync method to throw when called with 'utf8' encoding, no flag option, and if the target file didn't exist yet.
- [32acafeeb6] - (SEMVER-MINOR) fs: introduce dirent.parentPath (Antoine du Hamel) #50976
- [724548674d] - fs: use default w flag for writeFileSync with utf8 encoding (Murilo Kakazu) #50990
Commits
- [b24ee15fb2] - benchmark: update iterations in benchmark/crypto/hkdf.js (Lei Shi) #50866
- [f79b54e60e] - benchmark: update iterations in benchmark/crypto/get-ciphers.js (Lei Shi) #50863
- [dc049acbbb] - benchmark: update number of iterations for util.inspect (kylo5aby) #50651
- [d7c562ae38] - deps: update googletest to 76bb2af (Node.js GitHub Bot) #50555
- [59a45ddbef] - deps: update googletest to b10fad3 (Node.js GitHub Bot) #50555
- [099ebdb781] - deps: update undici to 5.28.1 (Node.js GitHub Bot) #50975
- [4b1bed04f7] - deps: update undici to 5.28.0 (Node.js GitHub Bot) #50915
- [b281e98b1e] - doc: add additional details about --input-type (Shubham Pandey) #50796
- [b7036f2028] - doc: add procedure when CVEs don't get published (Rafael Gonzaga) #50945
- [7adf239af0] - doc: fix some errors in esm resolution algorithms (Christopher Jeffrey (JJ)) #50898
- [759ebcaead] - doc: reserve 121 for Electron 29 (Shelley Vohr) #50957
- [cedc3427fa] - doc: run license-builder (github-actions[bot]) #50926
- [30a6f19769] - doc: document non-node_modules-only runtime deprecation (Joyee Cheung) #50748
- [eecab883f0] - doc: add doc for Unix abstract socket (theanarkh) #50904
- [ec74b93b38] - doc: remove flicker on page load on dark theme (Dima Demakov) #50942
- [724548674d] - fs: use default w flag for writeFileSync with utf8 encoding (Murilo Kakazu) #50990
- [32acafeeb6] - (SEMVER-MINOR) fs: introduce dirent.parentPath (Antoine du Hamel) #50976
- [c1ee506454] - fs: remove workaround for esm package (Yagiz Nizipli) #50907
- [1cf087dfb3] - lib: refactor to use validateFunction in diagnostics_channel (Deokjin Kim) #50955
- [c37d18d5e1] - lib: streamline process.binding() handling (Joyee Cheung) #50773
- [246cf73631] - lib,src: replace toUSVString with toWellFormed() (Yagiz Nizipli) #47342
- [9bc79173a0] - loader: speed up line length calc used by moduleProvider (Mudit) #50969
- [812ab9e4f8] - meta: bump step-security/harden-runner from 2.6.0 to 2.6.1 (dependabot[bot]) #50999
- [1dbe1af19a] - meta: bump github/codeql-action from 2.22.5 to 2.22.8 (dependabot[bot]) #50998
- [bed1b93f8a] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #50931
- [1e7d101428] - src: make ModifyCodeGenerationFromStrings more robust (Joyee Cheung) #50763
- [709ac479eb] - src: disable uncaught exception abortion for ESM syntax detection (Yagiz Nizipli) #50987
- [f6ff11c9f9] - src: fix backtrace with tail [[noreturn]] abort (Chengzhong Wu) #50849
- [74f5a1cbc9] - src: print MKSNAPSHOT debug logs to stderr (Joyee Cheung) #50759
- [3a1c664a97] - test: replace forEach to for.. test-webcrypto-export-import-cfrg.js (Angelo Parziale) #50785
- [ac3a6eefe3] - test: log more information in SEA tests (Joyee Cheung) #50759
- [94462d42f5] - test: consolidate utf8 text fixtures in tests (Joyee Cheung) #50732
- [8e1a70a347] - tools: add triggers to update release links workflow (Moshe Atlow) #50974
- [ca10cbb774] - tools: update lint-md-dependencies to rollup@4.5.2 (Node.js GitHub Bot) #50913
- [1e40c4a366] - tools: fix current version check (Marco Ippolito) #50951
- [3faed331e1] - typings: fix JSDoc in internal/modules/esm/hooks (Alex Yang) #50887
- [6a087ceffa] - url: throw error if argument length of revokeObjectURL is 0 (DylanTet) #50433

Notable Changes
Automatically detect and run ESM syntax
The new flag --experimental-detect-module can be used to automatically run ES modules when their syntax can be detected. For “ambiguous” files, which are .js or extensionless files with no package.json with a type field, Node.js will parse the file to detect ES module syntax; if found, it will run the file as an ES module, otherwise it will run the file as a CommonJS module. The same applies to string input via --eval or STDIN.
We hope to make detection enabled by default in a future version of Node.js. Detection increases startup time, so we encourage everyone — especially package authors — to add a type field to package.json, even for the default "type": "commonjs". The presence of a type field, or explicit extensions such as .mjs or .cjs, will opt out of detection.
Contributed by Geoffrey Booth in #50096.
Other Notable Changes
- [3729e33358] - doc: add H4ad to collaborators (Vinícius Lourenço) #50217
- [18862e4d5d] - (SEMVER-MINOR) fs: add flush option to appendFile() functions (Colin Ihrig) #50095
- [5a52c518ef] - (SEMVER-MINOR) lib: add navigator.userAgent (Yagiz Nizipli) #50200
- [789372a072] - (SEMVER-MINOR) stream: allow pass stream class to stream.compose (Alex Yang) #50187
- [f3a9ea0bc4] - stream: improve performance of readable stream reads (Raz Luvaton) #50173
- [dda33c2bf1] - vm: reject in importModuleDynamically without --experimental-vm-modules (Joyee Cheung) #50137
- [3999362c59] - vm: use internal versions of compileFunction and Script (Joyee Cheung) #50137
- [a54179f0e0] - vm: unify host-defined option generation in vm.compileFunction (Joyee Cheung) #50137
Commits
- [9cd68b9083] - buffer: remove unnecessary assignment in fromString (Tobias Nießen) #50199
- [a362c276ec] - crypto: ensure valid point on elliptic curve in SubtleCrypto.importKey (Filip Skokan) #50234
- [f4da308f8d] - deps: V8: cherry-pick f7d000a7ae7b (Luke Albao) #50302
- [269e268c38] - deps: update ada to 2.7.2 (Node.js GitHub Bot) #50338
- [03a31ce41e] - deps: update corepack to 0.22.0 (Node.js GitHub Bot) #50325
- [000531781b] - deps: update undici to 5.26.4 (Node.js GitHub Bot) #50274
- [f050668c14] - deps: update c-ares to 1.20.1 (Node.js GitHub Bot) #50082
- [ba258b682b] - deps: update c-ares to 1.20.0 (Node.js GitHub Bot) #50082
- [571f7ef1fa] - deps: patch V8 to 11.8.172.15 (Michaël Zasso) #50114
- [943047e800] - deps: V8: cherry-pick 25902244ad1a (Joyee Cheung) #50156
- [db2a1cf1cb] - doc: fix navigator.hardwareConcurrency example (Tobias Nießen) #50278
- [6e537aeb44] - doc: explain how to disable navigator (Geoffrey Booth) #50310
- [c40de82d62] - doc: add loong64 info into platform list (Shi Pujin) #50086
- [1c21a1880b] - doc: update release process LTS step (Richard Lau) #50299
- [2473aa3672] - doc: fix release process table of contents (Richard Lau) #50216
- [ce9d84eae3] - doc: update api stream.compose (Alex Yang) #50206
- [dacee4d9b5] - doc: add ReflectConstruct to known perf issues (Vinicius Lourenço) #50111
- [82363be2ac] - doc: fix typo in dgram docs (Peter Johnson) #50211
- [8c1a46c751] - doc: fix H4ad collaborator sort (Vinicius Lourenço) #50218
- [3729e33358] - doc: add H4ad to collaborators (Vinícius Lourenço) #50217
- [bac872cbd0] - doc: update release-stewards with last sec-release (Rafael Gonzaga) #50179
- [06b7724f14] - doc: add command to keep major branch sync (Rafael Gonzaga) #50102
- [47633ab086] - doc: add loong64 to list of architectures (Shi Pujin) #50172
- [1f40ca1b91] - doc: update security release process (Michael Dawson) #50166
- [998feda118] - esm: do not give wrong hints when detecting file format (Antoine du Hamel) #50314
- [e375063e01] - (SEMVER-MINOR) esm: detect ESM syntax in ambiguous JavaScript (Geoffrey Booth) #50096
- [c76eb27971] - esm: improve check for ESM syntax (Geoffrey Booth) #50127
- [7740bf820c] - esm: rename error code related to import attributes (Antoine du Hamel) #50181
- [0cc176ef25] - fs: improve error performance for readSync (Jun