Skip to content

Releases: nodejs/node

2024-03-26, Version 20.12.0 'Iron' (LTS), @richardlau

26 Mar 18:01
@richardlau richardlau
v20.12.0
This tag was signed with the committerโ€™s verified signature.
richardlau Richard Lau
GPG key ID: C43CEC45C17AB93C
Learn about vigilant mode.
94fb854
This commit was signed with the committerโ€™s verified signature.
richardlau Richard Lau
GPG key ID: C43CEC45C17AB93C
Learn about vigilant mode.
Compare
Choose a tag to compare
2024-03-26, Version 20.12.0 'Iron' (LTS), @richardlau

Notable Changes

crypto: implement crypto.hash()

This patch introduces a helper crypto.hash() that computes
a digest from the input at one shot. This can be 1.2-2x faster
than the object-based createHash() for smaller inputs (<= 5MB)
that are readily available (not streamed) and incur less memory
overhead since no intermediate objects will be created.

const crypto = require('node:crypto');

// Hashing a string and return the result as a hex-encoded string.
const string = 'Node.js';
// 10b3493287f831e81a438811a1ffba01f8cec4b7
console.log(crypto.hash('sha1', string));

Contributed by Joyee Cheung in #51044.

Loading and parsing environment variables

  • process.loadEnvFile(path):

    • Use this function to load the .env file. If no path is specified, it automatically loads the .env file in the current directory. Example: process.loadEnvFile().
    • Load a specific .env file by specifying its path. Example: process.loadEnvFile('./development.env').

  • util.parseEnv(content):

    • Use this function to parse an existing string containing environment variable assignments.
    • Example usage: require('node:util').parseEnv('HELLO=world').

Contributed by Yagiz Nizipli in #51476.

New connection attempt events

Three new events were added in the net.createConnection flow:

  • connectionAttempt: Emitted when a new connection attempt is established. In case of Happy Eyeballs, this might emitted multiple times.
  • connectionAttemptFailed: Emitted when a connection attempt failed. In case of Happy Eyeballs, this might emitted multiple times.
  • connectionAttemptTimeout: Emitted when a connection attempt timed out. In case of Happy Eyeballs, this will not be emitted for the last attempt. This is not emitted at all if Happy Eyeballs is not used.

Additionally, a previous bug has been fixed where a new connection attempt could have been started after a previous one failed and after the connection was destroyed by the user.
This led to a failed assertion.

Contributed by Paolo Insogna in #51045.

Permission Model changes

Node.js 20.12.0 comes with several fixes for the experimental permission model and two new semver-minor commits.
We're adding a new flag --allow-addons to enable addon usage when using the Permission Model.

$ node --experimental-permission --allow-addons

Contributed by Rafael Gonzaga in #51183

And relative paths are now supported through the --allow-fs-* flags.
Therefore, with this release one can use:

$ node --experimental-permission --allow-fs-read=./index.js

To give only read access to the entrypoint of the application.

Contributed by Rafael Gonzaga and Carlos Espa in #50758.

sea: support embedding assets

Users can now include assets by adding a key-path dictionary
to the configuration as the assets field. At build time, Node.js
would read the assets from the specified paths and bundle them into
the preparation blob. In the generated executable, users can retrieve
the assets using the sea.getAsset() and sea.getAssetAsBlob() API.

{
  "main": "/path/to/bundled/script.js",
  "output": "/path/to/write/the/generated/blob.blob",
  "assets": {
    "a.jpg": "/path/to/a.jpg",
    "b.txt": "/path/to/b.txt"
  }
}

The single-executable application can access the assets as follows:

const { getAsset } = require('node:sea');
// Returns a copy of the data in an ArrayBuffer
const image = getAsset('a.jpg');
// Returns a string decoded from the asset as UTF8.
const text = getAsset('b.txt', 'utf8');
// Returns a Blob containing the asset without copying.
const blob = getAssetAsBlob('a.jpg');

Contributed by Joyee Cheung in #50960.

Support configurable snapshot through --build-snapshot-config flag

We are adding a new flag --build-snapshot-config to configure snapshots through a custom JSON configuration file.

$ node --build-snapshot-config=/path/to/myconfig.json

When using this flag, additional script files provided on the command line will
not be executed and instead be interpreted as regular command line arguments.

These changes were contributed by Joyee Cheung and Anna Henningsen in #50453

Text Styling

  • util.styleText(format, text): This function returns a formatted text considering the format passed.

A new API has been created to format text based on util.inspect.colors, enabling you to style text in different colors (such as red, blue, ...) and emphasis (italic, bold, ...).

const { styleText } = require('node:util');
const errorMessage = styleText('red', 'Error! Error!');
console.log(errorMessage);

Contributed by Rafael Gonzaga in #51850.

vm: support using the default loader to handle dynamic import()

This patch adds support for using vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER as the
importModuleDynamically option in all vm APIs that take this option except vm.SourceTextModule. This allows users to have a shortcut to support dynamic import() in the compiled code without missing the compilation cache if they don't need customization of the loading process. We emit an experimental warning when the import() is actually handled by the default loader through this option instead of requiring --experimental-vm-modules.

const { Script, constants } = require('node:vm');
const { resolve } = require('node:path');
const { writeFileSync } = require('node:fs');

// Write test.js and test.txt to the directory where the current script
// being run is located.
writeFileSync(resolve(__dirname, 'test.mjs'),
              'export const filename = "./test.json";');
writeFileSync(resolve(__dirname, 'test.json'),
              '{"hello": "world"}');

// Compile a script that loads test.mjs and then test.json
// as if the script is placed in the same directory.
const script = new Script(
  `(async function() {
    const { filename } = await import('./test.mjs');
    return import(filename, { with: { type: 'json' } })
  })();`,
  {
    filename: resolve(__dirname, 'test-with-default.js'),
    importModuleDynamically: constants.USE_MAIN_CONTEXT_DEFAULT_LOADER,
  });

// { default: { hello: 'world' } }
script.runInThisContext().then(console.log);

Contributed by Joyee Cheung in #51244.

Root certificates updated to NSS 3.98

Certificates added:

  • Telekom Security TLS ECC Root 2020
  • Telekom Security TLS RSA Root 2023

Certificates removed:

  • Security Communication Root CA

Updated dependencies

  • acorn updated to 8.11.3.
  • ada updated to 2.7.6.
  • base64 updated to 0.5.2.
  • brotli updated to 1.1.0.
  • c-ares updated to 1.27.0.
  • corepack updated to 0.25.2.
  • ICU updated to 74.2. Includes CLDR 44.1 and Unicode 15.1.
  • nghttp2 updated to 1.60.0.
  • npm updated to 10.5.0. Fixes a regression in signals not being passed onto child processes.
  • simdutf8 updated to 4.0.8.
  • Timezone updated to 2024a.
  • zlib updated to 1.3.0.1-motley-40e35a7.

Other notable changes

  • [4f49e9d000] - (SEMVER-MINOR) build: build opt to set local location of headers (Michael Dawson) #51525
  • [ccdb01187b] - doc: add zcbenz to collaborators (Cheng Zhao) #51812
  • [481af53aea] - doc: add lemire to collaborators (Daniel Lemire) #51572
  • [5ba4d96525] - (SEMVER-MINOR) http2: add h2 compat support for appendHeader (Tim Perry) #51412
  • [0861498e8b] - (SEMVER-MINOR) http2: add server handshake utility (snek) #51172
  • [6b08d006ee] - (SEMVER-MINOR) http2: receive customsettings (Marten Richter) #51323
  • [7894989bf0] - (SEMVER-MINOR) lib: move encodingsMap to internal/util (Joyee Cheung) #51044
  • [a58c98ea85] - (SEMVER-MINOR) src: print string content better in BlobDeserializer (Joyee Cheung) #50960
  • [c3c0a3ee5c] - (SEMVER-MINOR) src: support multi-line values for .env file (IlyasShabi) #51289
  • [2a921966c6] - (SEMVER-MINOR) src: do not coerce dotenv paths (Tobias NieรŸen) #51425
  • [0dee86f295] - (SEMVER-MINOR) src: support configurable snapshot (Joyee Cheung) #50453
  • [ade6614067] - (SEMVER-MINOR) stream: add support for deflate-raw format to webstreams compression (Damian Krzeminski) #50097
  • [[`...
Read more
Assets 2

2024-03-26, Version 18.20.0 'Hydrogen' (LTS), @richardlau

26 Mar 18:00
@richardlau richardlau
v18.20.0
This tag was signed with the committerโ€™s verified signature.
richardlau Richard Lau
GPG key ID: C43CEC45C17AB93C
Learn about vigilant mode.
f75dc41
This commit was signed with the committerโ€™s verified signature.
richardlau Richard Lau
GPG key ID: C43CEC45C17AB93C
Learn about vigilant mode.
Compare
Choose a tag to compare
2024-03-26, Version 18.20.0 'Hydrogen' (LTS), @richardlau

Notable Changes

Added support for import attributes

Support has been added for import attributes, to replace the old import
assertions syntax. This will aid migration by making the new syntax available
across all currently supported Node.js release lines.

This adds the with keyword which should be used in place of the previous
assert keyword, which will be removed in a future semver-major Node.js
release.

For example,

import "foo" assert { ... }

should be replaced with

import "foo" with { ... }

For more details, see

Contributed by Nicolรฒ Ribaudo in #51136
and Antoine du Hamel in #50140.

Doc deprecation for dirent.path

Please use newly added dirent.parentPath instead.

Contributed by Antoine du Hamel in #50976
and #51020.

Experimental node-api feature flags

Introduces an experimental feature to segregate finalizers that affect GC state.
A new type called node_api_nogc_env has been introduced as the const version
of napi_env and node_api_nogc_finalize as a variant of napi_finalize that
accepts a node_api_nogc_env as its first argument.

This feature can be turned off by defining
NODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT.

Contributed by Gabriel Schulhof in #50060.

Root certificates updated to NSS 3.98

Certificates added:

  • Telekom Security TLS ECC Root 2020
  • Telekom Security TLS RSA Root 2023

Certificates removed:

  • Security Communication Root CA

Updated dependencies

  • ada updated to 2.7.6.
  • base64 updated to 0.5.2.
  • c-ares updated to 1.27.0.
  • corepack updated to 0.25.2.
  • ICU updated to 74.2. Includes CLDR 44.1 and Unicode 15.1.
  • npm updated to 10.5.0. Fixes a regression in signals not being passed onto child processes.
  • simdutf8 updated to 4.0.8.
  • Timezone updated to 2024a.
  • zlib updated to 1.3.0.1-motley-40e35a7.

vm: fix V8 compilation cache support for vm.Script

Previously repeated compilation of the same source code using vm.Script
stopped hitting the V8 compilation cache after v16.x when support for
importModuleDynamically was added to vm.Script, resulting in a performance
regression that blocked users (in particular Jest users) from upgrading from
v16.x.

The recent fixes allow the compilation cache to be hit again
for vm.Script when --experimental-vm-modules is not used even in the
presence of the importModuleDynamically option, so that users affected by the
performance regression can now upgrade. Ongoing work is also being done to
enable compilation cache support for vm.CompileFunction.

Contributed by Joyee Cheung in #49950
and #50137.

Commits

Read more
Assets 2

2024-03-08, Version 21.7.1 (Current), @targos

08 Mar 22:06
@targos targos
v21.7.1
This tag was signed with the committerโ€™s verified signature.
targos Michaรซl Zasso
GPG key ID: 770F7A9A5AE15600
Learn about vigilant mode.
84c7e6f
This commit was signed with the committerโ€™s verified signature.
targos Michaรซl Zasso
GPG key ID: 770F7A9A5AE15600
Learn about vigilant mode.
Compare
Choose a tag to compare
2024-03-08, Version 21.7.1 (Current), @targos

Notable Changes

This release reverts #51389, which
landed in Node.js 21.7.0. It is a documented feature that t.after() hooks are
run even if a test has no subtests. The hook can be used to clean up the test
itself.

Commits

  • [0dfe810ac7] - benchmark: update iterations of benchmark/async_hooks/async-local- (Lei Shi) #51420
  • [625c9e0ac9] - benchmark: update iterations of benchmark/domain/domain-fn-args.js (Lei Shi) #51408
  • [7ff3551bad] - build: fix arm64 host cross-compilation in GN (Cheng Zhao) #51903
  • [fd86ea8b71] - Revert "build: workaround for node-core-utils" (Richard Lau) #51975
  • [23c32ab3a7] - build: respect the NODE env variable in Makefile (Antoine du Hamel) #51743
  • [9617adc064] - Revert "build: fix warning in cares under GN build" (Luigi Pinca) #51865
  • [5864534095] - deps: update nghttp2 to 1.60.0 (Node.js GitHub Bot) #51948
  • [fcf235d623] - doc: add policy for distribution (Geoffrey Booth) #51918
  • [87d2acc8b1] - doc: fix actual result of example is different in events (Deokjin Kim) #51925
  • [5908c121c6] - doc: clarify Corepack threat model (Antoine du Hamel) #51917
  • [20e0ba3b94] - doc,module: clarify hook chain execution sequence (Jacob Smith) #51884
  • [4d997971ac] - lib: make sure close net server (theanarkh) #51929
  • [fcc6d54aa3] - lib: return directly if udp socket close before lookup (theanarkh) #51914
  • [10aaabd158] - meta: bump github/codeql-action from 3.23.2 to 3.24.6 (dependabot[bot]) #51942
  • [78f38a0143] - meta: bump actions/upload-artifact from 4.3.0 to 4.3.1 (dependabot[bot]) #51941
  • [42ca5452c4] - meta: bump codecov/codecov-action from 4.0.1 to 4.1.0 (dependabot[bot]) #51940
  • [015a157375] - meta: bump actions/cache from 4.0.0 to 4.0.1 (dependabot[bot]) #51939
  • [e476cb4a32] - meta: bump actions/download-artifact from 4.1.1 to 4.1.3 (dependabot[bot]) #51938
  • [67e8001790] - meta: bump actions/setup-node from 4.0.1 to 4.0.2 (dependabot[bot]) #51937
  • [50343636e8] - src: fix --disable-single-executable-application (Joyee Cheung) #51808
  • [a48c9ca0db] - stream: do not defer construction by one microtick (Matteo Collina) #52005
  • [bee3b364f9] - test: add regression test for test_runner after hook (Colin Ihrig) #51998
  • [fff7f48f50] - test: reduce flakiness of test-runner-output (Antoine du Hamel) #51952
  • [57ba8f5acb] - test: fix flaky http-chunk-extensions-limit test (Ethan Arrowood) #51943
  • [9d2c03990a] - test: remove flaky designation (Luigi Pinca) #51736
  • [e992af81d3] - test: skip SEA tests when SEA generation fails (Joyee Cheung) #51887
  • [85aa6ca850] - Revert "test_runner: do not invoke after hook when test is empty" (Colin Ihrig) #51998
Assets 2

2024-03-06, Version 21.7.0 (Current), @RafaelGSS prepared by @marco-ippolito

06 Mar 18:52
@RafaelGSS RafaelGSS
v21.7.0
This tag was signed with the committerโ€™s verified signature.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Learn about vigilant mode.
47e6820
Compare
Choose a tag to compare
2024-03-06, Version 21.7.0 (Current), @RafaelGSS prepared by @marco-ippolito

Text Styling

  • util.styleText(format, text): This function returns a formatted text considering the format passed.

A new API has been created to format text based on util.inspect.colors, enabling you to style text in different colors (such as red, blue, ...) and emphasis (italic, bold, ...).

const { styleText } = require('node:util');
const errorMessage = styleText('red', 'Error! Error!');
console.log(errorMessage);

Contributed by Rafael Gonzaga and Hemanth HM in #51850.

Loading and parsing environment variables

  • process.loadEnvFile(path):

    • Use this function to load the .env file. If no path is specified, it automatically loads the .env file in the current directory. Example: process.loadEnvFile().
    • Load a specific .env file by specifying its path. Example: process.loadEnvFile('./development.env').

  • util.parseEnv(content):

    • Use this function to parse an existing string containing environment variable assignments.
    • Example usage: require('node:util').parseEnv('HELLO=world').

Contributed by Yagiz Nizipli in #51476

Support for multi-line values for .env file

Node.js 21.7.0 will now support multi-line values in the .env file:

MULTI_LINE="HELLO
WORLD"

Contributed by Ilyas Shabi #51289

sea: support embedding assets

Users can now include assets by adding a key-path dictionary
to the configuration as the assets field. At build time, Node.js
would read the assets from the specified paths and bundle them into
the preparation blob. In the generated executable, users can retrieve
the assets using the sea.getAsset() and sea.getAssetAsBlob() API.

{
  "main": "/path/to/bundled/script.js",
  "output": "/path/to/write/the/generated/blob.blob",
  "assets": {
    "a.jpg": "/path/to/a.jpg",
    "b.txt": "/path/to/b.txt"
  }
}

The single-executable application can access the assets as follows:

const { getAsset } = require('node:sea');
// Returns a copy of the data in an ArrayBuffer
const image = getAsset('a.jpg');
// Returns a string decoded from the asset as UTF8.
const text = getAsset('b.txt', 'utf8');
// Returns a Blob containing the asset without copying.
const blob = getAssetAsBlob('a.jpg');

Contributed by Joyee Cheung in #50960

vm: support using the default loader to handle dynamic import()

This patch adds support for using vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER as the
importModuleDynamically option in all vm APIs that take this option except vm.SourceTextModule. This allows users to have a shortcut to support dynamic import() in the compiled code without missing the compilation cache if they don't need customization of the loading process. We emit an experimental warning when the import() is actually handled by the default loader through this option instead of requiring --experimental-vm-modules.

const { Script, constants } = require('node:vm');
const { resolve } = require('node:path');
const { writeFileSync } = require('node:fs');

// Write test.js and test.txt to the directory where the current script
// being run is located.
writeFileSync(resolve(__dirname, 'test.mjs'),
              'export const filename = "./test.json";');
writeFileSync(resolve(__dirname, 'test.json'),
              '{"hello": "world"}');

// Compile a script that loads test.mjs and then test.json
// as if the script is placed in the same directory.
const script = new Script(
  `(async function() {
    const { filename } = await import('./test.mjs');
    return import(filename, { with: { type: 'json' } })
  })();`,
  {
    filename: resolve(__dirname, 'test-with-default.js'),
    importModuleDynamically: constants.USE_MAIN_CONTEXT_DEFAULT_LOADER,
  });

// { default: { hello: 'world' } }
script.runInThisContext().then(console.log);

Contributed by Joyee Cheung in #51244

crypto: implement crypto.hash()

This patch introduces a helper crypto.hash() that computes
a digest from the input at one shot. This can be 1.2-2x faster
than the object-based createHash() for smaller inputs (<= 5MB)
that are readily available (not streamed) and incur less memory
overhead since no intermediate objects will be created.

const crypto = require('node:crypto');

// Hashing a string and return the result as a hex-encoded string.
const string = 'Node.js';
// 10b3493287f831e81a438811a1ffba01f8cec4b7
console.log(crypto.hash('sha1', string));

Contributed by Joyee Cheung in #51044

Other Notable Changes

  • [8ae0eeb7f4] - (SEMVER-MINOR) build: build opt to set local location of headers (Michael Dawson) #51525
  • [496776cc78] - crypto: update root certificates to NSS 3.98 (Node.js GitHub Bot) #51794
  • [a8c9e6f7e9] - doc: add zcbenz to collaborators (Cheng Zhao) #51812
  • [adbf2d3837] - doc: add lemire to collaborators (Daniel Lemire) #51572
  • [4b1c6839f4] - (SEMVER-MINOR) http2: add h2 compat support for appendHeader (Tim Perry) #51412
  • [d8aa2bac0b] - (SEMVER-MINOR) http2: add server handshake utility (snek) #51172
  • [b9275d9039] - (SEMVER-MINOR) http2: receive customsettings (Marten Richter) #51323
  • [5a2d2daad5] - (SEMVER-MINOR) lib: move encodingsMap to internal/util (Joyee Cheung) #51044
  • [e8d9065262] - (SEMVER-MINOR) sea: support sea.getRawAsset() (Joyee Cheung) #50960
  • [47186fbad5] - (SEMVER-MINOR) src: print string content better in BlobDeserializer (Joyee Cheung) #50960
  • [119e045053] - (SEMVER-MINOR) src: do not coerce dotenv paths (Tobias NieรŸen) #51425
  • [9ab353af00] - (SEMVER-MINOR) stream: implement min option for ReadableStreamBYOBReader.read (Mattias Buelens) #50888

Commits

  • [4ddb9b33d5] - async_hooks,inspector: implement inspector api without async_wrap (Gabriel Bota) #51501
  • [7e06c11f55] - benchmark: update iterations of assert/deepequal-typedarrays.js (Lei Shi) #51419
  • [72be232006] - benchmark: update iterations of benchmark/assert/deepequal-map.js (Lei Shi) #51416
  • [92e7c310cb] - benchmark: rename startup.js to startup-core.js (Joyee Cheung) #51669
  • [c9ada533a2] - build: remove librt libs link for Android compatibility (BuShe Pie) #51632
  • [86ac787889] - build: do not rely on gn_helpers in GN build (Cheng Zhao) #51439
  • [9be6b7ccf0] - build: fix warning in cares under GN build (Cheng Zhao) #51687
  • [d1a8c2e989] - build: fix building js2c with GN (Cheng Zhao) #51818
  • [9840715dc0] - build: encode non-ASCII Latin1 characters as one byte in JS2C (Joyee Cheung) #51605
  • [8ae0eeb7f4] - (SEMVER-MINOR) build: build opt to set local location of headers (Michael Dawson) #51525
  • [1999719877] - build: use macOS m1 machines for testing (Yagiz Nizipli) #51620
  • [85f63f3d7d] - build: check before removing %config% link (liudonghua) #51437
  • [cc37959232] - build: increase parallel executions in github (Yagiz Nizipli) #51554
  • [2921d55121] - build: remove copyright header in node.gni (Cheng Zhao) [#51535](https://gith...
Read more
Assets 2

2024-02-14, Version 21.6.2 (Current), @RafaelGSS

14 Feb 17:43
@RafaelGSS RafaelGSS
v21.6.2
This tag was signed with the committerโ€™s verified signature.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Learn about vigilant mode.
3eccdd1
Compare
Choose a tag to compare
2024-02-14, Version 21.6.2 (Current), @RafaelGSS

Notable changes

This is a security release.

Notable changes

  • CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
  • CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
  • CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
  • CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
  • CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
  • CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
  • CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
  • CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
  • undici version 5.28.3
  • libuv version 1.48.0
  • OpenSSL version 3.0.13+quic1

Commits

Assets 2

2024-02-14, Version 20.11.1 'Iron' (LTS), @RafaelGSS prepared by @marco-ippolito

14 Feb 17:43
@RafaelGSS RafaelGSS
v20.11.1
This tag was signed with the committerโ€™s verified signature.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Learn about vigilant mode.
9b1bf44
Compare
Choose a tag to compare
2024-02-14, Version 20.11.1 'Iron' (LTS), @RafaelGSS prepared by @marco-ippolito

Notable changes

This is a security release.

Notable changes

  • CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
  • CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
  • CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
  • CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
  • CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
  • CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
  • CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
  • CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
  • undici version 5.28.3
  • libuv version 1.48.0
  • OpenSSL version 3.0.13+quic1

Commits

Assets 2

2024-02-14, Version 18.19.1 'Hydrogen' (LTS), @RafaelGSS prepared by @marco-ippolito

14 Feb 17:42
@RafaelGSS RafaelGSS
v18.19.1
This tag was signed with the committerโ€™s verified signature.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Learn about vigilant mode.
6610cc4
Compare
Choose a tag to compare
2024-02-14, Version 18.19.1 'Hydrogen' (LTS), @RafaelGSS prepared by @marco-ippolito

Notable changes

This is a security release.

Notable changes

  • CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
  • CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
  • CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
  • CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
  • undici version 5.28.3
  • npm version 10.2.4

Commits

Assets 2

2024-01-22, Version 21.6.1 (Current), @RafaelGSS

22 Jan 19:26
@RafaelGSS RafaelGSS
v21.6.1
This tag was signed with the committerโ€™s verified signature.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Learn about vigilant mode.
3dc0e49
Compare
Choose a tag to compare
2024-01-22, Version 21.6.1 (Current), @RafaelGSS

Notable Changes

This release fixes a bug in undici using WebStreams

Commits

  • [662ac95729] - Revert "stream: fix cloned webstreams not being unref'd" (Matteo Collina) #51491
  • [1b8bba8aee] - test: add regression test for 51586 (Matteo Collina) #51491
Assets 2

2024-01-15, Version 21.6.0 (Current), @RafaelGSS

15 Jan 14:54
@RafaelGSS RafaelGSS
v21.6.0
This tag was signed with the committerโ€™s verified signature.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Learn about vigilant mode.
f38a9a5
Compare
Choose a tag to compare
2024-01-15, Version 21.6.0 (Current), @RafaelGSS

New connection attempt events

Three new events were added in the net.createConnection flow:

  • connectionAttempt: Emitted when a new connection attempt is established. In case of Happy Eyeballs, this might emitted multiple times.
  • connectionAttemptFailed: Emitted when a connection attempt failed. In case of Happy Eyeballs, this might emitted multiple times.
  • connectionAttemptTimeout: Emitted when a connection attempt timed out. In case of Happy Eyeballs, this will not be emitted for the last attempt. This is not emitted at all if Happy Eyeballs is not used.

Additionally, a previous bug has been fixed where a new connection attempt could have been started after a previous one failed and after the connection was destroyed by the user.
This led to a failed assertion.

Contributed by Paolo Insogna in #51045.

Changes to the Permission Model

Node.js 21.6.0 comes with several fixes for the experimental permission model and two new semver-minor commits.
We're adding a new flag --allow-addons to enable addon usage when using the Permission Model.

$ node --experimental-permission --allow-addons

Contributed by Rafael Gonzaga in #51183

And relative paths are now supported through the --allow-fs-* flags.
Therefore, with this release one can use:

$ node --experimental-permission --allow-fs-read=./index.js

To give only read access to the entrypoint of the application.

Contributed by Rafael Gonzaga and Carlos Espa in #50758

Support configurable snapshot through --build-snapshot-config flag

We are adding a new flag --build-snapshot-config to configure snapshots through a custom JSON configuration file.

$ node --build-snapshot-config=/path/to/myconfig.json

When using this flag, additional script files provided on the command line will
not be executed and instead be interpreted as regular command line arguments.

These changes were contributed by Joyee Cheung and Anna Henningsen in #50453

Other Notable Changes

  • [c31ed51373] - (SEMVER-MINOR) timers: export timers.promises (Marco Ippolito) #51246

Commits

  • [13a1241b83] - assert,crypto: make KeyObject and CryptoKey testable for equality (Filip Skokan) #50897
  • [4dcc5114aa] - benchmark: remove dependency on unshipped tools (Adam Majer) #51146
  • [2eb41f86b3] - build: fix for VScode "Reopen in Container" (Serg Kryvonos) #51271
  • [e03ac83c19] - build: fix arm64 cross-compilation (Michaรซl Zasso) #51256
  • [cd61fce34e] - build: add -flax-vector-conversions to V8 build (Michaรซl Zasso) #51257
  • [e5017a522e] - crypto: update CryptoKey symbol properties (Filip Skokan) #50897
  • [c0d2e8be11] - deps: update corepack to 0.24.0 (Node.js GitHub Bot) #51318
  • [24a9a72492] - deps: update acorn to 8.11.3 (Node.js GitHub Bot) #51317
  • [e53cbb22c2] - deps: update ngtcp2 and nghttp3 (James M Snell) #51291
  • [f00f1204f1] - deps: update brotli to 1.1.0 (Node.js GitHub Bot) #50804
  • [a41dca0c51] - deps: update zlib to 1.3.0.1-motley-40e35a7 (Node.js GitHub Bot) #51274
  • [efa12a89c6] - deps: update simdutf to 4.0.8 (Node.js GitHub Bot) #51000
  • [25eba3d20b] - deps: V8: cherry-pick de611e69ad51 (Keyhan Vakil) #51200
  • [a07d6e23e4] - deps: update simdjson to 3.6.3 (Node.js GitHub Bot) #51104
  • [6d1bfcb2dd] - deps: update googletest to 530d5c8 (Node.js GitHub Bot) #51191
  • [75e5615c43] - deps: update acorn-walk to 8.3.1 (Node.js GitHub Bot) #50457
  • [3ecc7dcc00] - deps: update acorn-walk to 8.3.0 (Node.js GitHub Bot) #50457
  • [e2f8d741c8] - deps: update zlib to 1.3.0.1-motley-dd5fc13 (Node.js GitHub Bot) #51105
  • [4a5d3bda72] - doc: the GN files should use Node's license (Cheng Zhao) #50694
  • [84127514ba] - doc: improve localWindowSize event descriptions (Davy Landman) #51071
  • [8ee882a49c] - doc: mark --jitless as experimental (Antoine du Hamel) #51247
  • [876743ece1] - doc: run license-builder (github-actions[bot]) #51199
  • [ec6fcff009] - doc: fix limitations and known issues in pm (Rafael Gonzaga) #51184
  • [c13a5c0373] - doc: mention node:wasi in the Threat Model (Rafael Gonzaga) #51211
  • [4b19e62444] - doc: remove ambiguous 'considered' (Rich Trott) #51207
  • [5453abd6ad] - doc: set exit code in custom test runner example (Matteo Collina) #51056
  • [f9d4e07faf] - doc: remove version from maintaining-dependencies.md (Antoine du Hamel) #51195
  • [df8927a073] - doc: mention native addons are restricted in pm (Rafael Gonzaga) #51185
  • [e636d83914] - doc: correct note on behavior of stats.isDirectory (Nick Reilingh) #50946
  • [1c71435c2a] - doc: fix TestsStream parent class (Jungku Lee) #51181
  • [2c227b0d64] - doc: fix simdjson wrong link (Marco Ippolito) #51177
  • [efa13e1943] - (SEMVER-MINOR) doc: add documentation for --build-snapshot-config (Anna Henningsen) #50453
  • [941aedc6fc] - errors: fix stacktrace of SystemError (uzlopak) #49956
  • [47548d9e61] - esm: fix hint on invalid module specifier (Antoine du Hamel) #51223
  • [091098f40a] - fs: fix fs.promises.realpath for long paths on Windows (็ฟ  / green) #51032
  • [e5a8fa01aa] - fs: make offset, position & length args in fh.read() optional (Pulkit Gupta) #51087
  • [c87e5d51cc] - fs: add missing jsdoc parameters to readSync (Yagiz Nizipli) #51225
  • [e24249cf37] - fs: remove internalModuleReadJSON binding (Yagiz Nizipli) #51224
  • [7421467812] - fs: improve mkdtemp performance for buffer prefix (Yagiz Nizipli) #51078
  • [5b229d775f] - fs: validate fd synchronously on c++ (Yagiz Nizipli) #51027
  • [[...
Read more
Assets 2

2024-01-09, Version 20.11.0 'Iron' (LTS), @UlisesGascon

10 Jan 12:46
@UlisesGascon UlisesGascon
v20.11.0
This tag was signed with the committerโ€™s verified signature.
UlisesGascon Ulises Gascรณn
GPG key ID: 04CD3F2FDE079578
Learn about vigilant mode.
8d4fbd7
This commit was signed with the committerโ€™s verified signature.
UlisesGascon Ulises Gascรณn
GPG key ID: 04CD3F2FDE079578
Learn about vigilant mode.
Compare
Choose a tag to compare
2024-01-09, Version 20.11.0 'Iron' (LTS), @UlisesGascon

Notable Changes

  • [833190fe7c] - crypto: update root certificates to NSS 3.95 (Node.js GitHub Bot) #50805
  • [a541b78bdb] - doc: add MrJithil to collaborators (Jithil P Ponnan) #50666
  • [d4be8fad83] - doc: add Ethan-Arrowood as a collaborator (Ethan Arrowood) #50393
  • [c1a196c897] - (SEMVER-MINOR) esm: add import.meta.dirname and import.meta.filename (James Sumners) #48740
  • [aa3209b880] - fs: add c++ fast path for writeFileSync utf8 (CanadaHonk) #49884
  • [8e886a2fff] - (SEMVER-MINOR) module: remove useCustomLoadersIfPresent flag (Chengzhong Wu) #48655
  • [21ab3c0f0b] - (SEMVER-MINOR) module: bootstrap module loaders in shadow realm (Chengzhong Wu) #48655
  • [29d91b13e3] - (SEMVER-MINOR) src: add --disable-warning option (Ethan Arrowood) #50661
  • [11b3e470db] - (SEMVER-MINOR) src: create per isolate proxy env template (Chengzhong Wu) #48655
  • [621c4d66c2] - (SEMVER-MINOR) src: make process binding data weak (Chengzhong Wu) #48655
  • [139d6c8d3b] - stream: use Array for Readable buffer (Robert Nagy) #50341
  • [6206957e8d] - stream: optimize creation (Robert Nagy) #50337
  • [e64378643d] - (SEMVER-MINOR) test_runner: adds built in lcov reporter (Phil Nash) #50018
  • [4a830c2d9d] - (SEMVER-MINOR) test_runner: add Date to the supported mock APIs (Lucas Santos) #48638
  • [842dc01def] - (SEMVER-MINOR) test_runner, cli: add --test-timeout flag (Shubham Pandey) #50443

Commits

Read more
Assets 2