Skip to content

Releases: nodejs/node

Release list

2018-03-28, Version 9.10.0 (Current), @MylesBorins prepared by @targos

2018-03-28, Version 9.10.0 (Current), @MylesBorins prepared by @targos

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 28 Mar 16:38
v9.10.0
c3c9984

This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/ for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

Notable Changes

  • Upgrade to OpenSSL 1.0.2o: Does not contain any security fixes that are known to impact Node.js.

  • Fix for inspector DNS rebinding vulnerability (CVE-2018-7160): A malicious website could use a DNS rebinding attack to trick a web browser to bypass same-origin-policy checks and allow HTTP connections to localhost or to hosts on the local network, potentially to an open inspector port as a debugger, therefore gaining full code execution access. The inspector now only allows connections that have a browser Host value of localhost or localhost6.

  • Fix for 'path' module regular expression denial of service (CVE-2018-7158): A regular expression used for parsing POSIX paths could be used to cause a denial of service if an attacker were able to have a specially crafted path string passed through one of the impacted 'path' module functions.

  • Reject spaces in HTTP Content-Length header values (CVE-2018-7159): The Node.js HTTP parser allowed for spaces inside Content-Length header values. Such values now lead to rejected connections in the same way as non-numeric values.

  • Update root certificates: 5 additional root certificates have been added to the Node.js binary and 30 have been removed.

  • cluster:

    • Add support for NODE_OPTIONS="--inspect" (Sameer Srivastava) #19165

  • crypto:

    • Expose the public key of a certificate (Hannes Magnusson) #17690

  • n-api:

    • Add napi_fatal_exception to trigger an uncaughtException in JavaScript (Mathias Buus) #19337

  • path:

    • Fix regression in posix.normalize (Michaël Zasso) #19520

  • stream:

    • Improve stream creation performance (Brian White) #19401

  • Added new collaborators

Commits

Read more
Loading

2018-03-28, Version 8.11.0 'Carbon' (LTS), @MylesBorins

2018-03-28, Version 8.11.0 'Carbon' (LTS), @MylesBorins

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 28 Mar 16:37
v8.11.0
22f4a35

This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/ for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

Notable Changes

  • Upgrade to OpenSSL 1.0.2o: Does not contain any security fixes that are known to impact Node.js.
  • Fix for inspector DNS rebinding vulnerability (CVE-2018-7160): A malicious website could use a DNS rebinding attack to trick a web browser to bypass same-origin-policy checks and allow HTTP connections to localhost or to hosts on the local network, potentially to an open inspector port as a debugger, therefore gaining full code execution access. The inspector now only allows connections that have a browser Host value of localhost or localhost6.
  • Fix for 'path' module regular expression denial of service (CVE-2018-7158): A regular expression used for parsing POSIX paths could be used to cause a denial of service if an attacker were able to have a specially crafted path string passed through one of the impacted 'path' module functions.
  • Reject spaces in HTTP Content-Length header values (CVE-2018-7159): The Node.js HTTP parser allowed for spaces inside Content-Length header values. Such values now lead to rejected connections in the same way as non-numeric values.
  • Update root certificates: 5 additional root certificates have been added to the Node.js binary and 30 have been removed.

Commits

Loading

2018-03-28, Version 6.14.0 'Boron' (LTS), @MylesBorins

2018-03-28, Version 6.14.0 'Boron' (LTS), @MylesBorins

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 28 Mar 16:37
v6.14.0
2c93af2

This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/ for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

Notable Changes

  • Upgrade to OpenSSL 1.0.2o: Does not contain any security fixes that are known to impact Node.js.
  • Fix for inspector DNS rebinding vulnerability (CVE-2018-7160): A malicious website could use a DNS rebinding attack to trick a web browser to bypass same-origin-policy checks and allow HTTP connections to localhost or to hosts on the local network, potentially to an open inspector port as a debugger, therefore gaining full code execution access. The inspector now only allows connections that have a browser Host value of localhost or localhost6.
  • Fix for 'path' module regular expression denial of service (CVE-2018-7158): A regular expression used for parsing POSIX paths could be used to cause a denial of service if an attacker were able to have a specially crafted path string passed through one of the impacted 'path' module functions.
  • Reject spaces in HTTP Content-Length header values (CVE-2018-7159): The Node.js HTTP parser allowed for spaces inside Content-Length header values. Such values now lead to rejected connections in the same way as non-numeric values.
  • Update root certificates: 5 additional root certificates have been added to the Node.js binary and 30 have been removed.

Commits

Loading

2018-03-28, Version 4.9.0 'Argon' (Maintenance), @MylesBorins

2018-03-28, Version 4.9.0 'Argon' (Maintenance), @MylesBorins

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 28 Mar 16:36
v4.9.0
8f73cff

This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/ for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

Notable Changes

  • Upgrade to OpenSSL 1.0.2o: Does not contain any security fixes that are known to impact Node.js.
  • Fix for 'path' module regular expression denial of service (CVE-2018-7158): A regular expression used for parsing POSIX an Windows paths could be used to cause a denial of service if an attacker were able to have a specially crafted path string passed through one of the impacted 'path' module functions.
  • Reject spaces in HTTP Content-Length header values (CVE-2018-7159): The Node.js HTTP parser allowed for spaces inside Content-Length header values. Such values now lead to rejected connections in the same way as non-numeric values.
  • Update root certificates: 5 additional root certificates have been added to the Node.js binary and 30 have been removed.

Commits

Loading

2018-03-21, Version 9.9.0 (Current), @MylesBorins prepared by @targos

2018-03-21, Version 9.9.0 (Current), @MylesBorins prepared by @targos

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 27 Mar 23:14
v9.9.0
74fb02f

Notable Changes

  • assert:
    • From now on all error messages produced by assert in strict mode will produce a error diff. (Ruben Bridgewater) #17615
    • From now on it is possible to use a validation object in throws instead of the other possibilities. (Ruben Bridgewater) #17584
  • crypto:
    • allow passing null as IV unless required (Tobias Nießen) #18644
  • fs:
    • support as and as+ flags in stringToFlags() (Sarat Addepalli) #18801
  • tls:
    • expose Finished messages in TLSSocket (Anton Salikhmetov) #19102
  • tty:
    • Add getColorDepth function to determine if terminal supports colors. (Ruben Bridgewater) #17615
  • util:
    • add util.inspect compact option (Ruben Bridgewater) #17576
  • Added new collaborators

Commits

Read more
Loading

2018-03-07, Version 9.8.0 (Current), @MylesBorins

2018-03-07, Version 9.8.0 (Current), @MylesBorins

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 27 Mar 23:14
v9.8.0
27ba6e2

Notable Changes

  • crypto:
    • add cert.fingerprint256 as SHA256 fingerprint (Hannes Magnusson) #17690
  • http2:
    • Fixed issues with aborted connections in the HTTP/2 implementation (Anna Henningsen) #18987 #19002
  • loader:
    • --inspect-brk now works properly for esmodules (Gus Caplan) #18949
  • src:
    • make process.dlopen() load well-known symbol (Ben Noordhuis) #18934
  • trace_events:
    • add file pattern cli option (Andreas Madsen) #18480
  • Added new collaborators

Commits

Read more
Loading

2018-03-06, Version 8.10.0 'Carbon' (LTS), @gibfahn

2018-03-06, Version 8.10.0 'Carbon' (LTS), @gibfahn

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 27 Mar 23:13
v8.10.0
This tag was signed with the committer’s verified signature.
gibfahn Gibson Fahnestock
GPG key ID: B01FBB92821C587A
Verified
Learn about vigilant mode.
2fce636
This commit was signed with the committer’s verified signature.
gibfahn Gibson Fahnestock
GPG key ID: B01FBB92821C587A
Verified
Learn about vigilant mode.

Notable Changes

  • deps:
    • update V8 to 6.2.414.46 (Michaël Zasso) #16413
    • revert ABI breaking changes in V8 6.2 (Anna Henningsen) #16413
    • upgrade libuv to 1.19.1 (cjihrig) #18260
    • re land npm 5.6.0 (Myles Borins) #18625
    • ICU 60 bump (Steven R. Loomis) #16876
  • crypto:
    • Support both OpenSSL 1.1.0 and 1.0.2 (David Benjamin) #16130
    • warn on invalid authentication tag length (Tobias Nießen) #17566
  • async_hooks:
    • update defaultTriggerAsyncIdScope for perf (Anatoli Papirovski) #18004
    • use typed array stack as fast path (Anna Henningsen) #17780
    • use scope for defaultTriggerAsyncId (Andreas Madsen) #17273
    • separate missing from default context (Andreas Madsen) #17273
    • rename initTriggerId (Andreas Madsen) #17273
    • deprecate undocumented API (Andreas Madsen) #16972
    • add destroy event for gced AsyncResources (Sebastian Mayr) #16998
    • add trace events to async_hooks (Andreas Madsen) #15538
    • set HTTPParser trigger to socket (Andreas Madsen) #18003
    • add provider types for net server (Andreas Madsen) #17157
  • n-api:
    • add helper for addons to get the event loop (Anna Henningsen) #17109
  • cli:
    • add --stack-trace-limit to NODE_OPTIONS (Anna Henningsen) #16495
  • console:
    • add support for console.debug (Benjamin Zaslavsky) #17033
  • module:
    • add builtinModules (Jon Moss) #16386
    • replace default paths in require.resolve() (cjihrig) #17113
  • src:
    • add helper for addons to get the event loop (Anna Henningsen) #17109
    • add process.ppid (cjihrig) #16839
  • http:
    • support generic Duplex streams (Anna Henningsen) #16267
    • add rawPacket in err of clientError event (XadillaX) #17672
    • better support for IPv6 addresses (Mattias Holmlund) #14772
  • net:
    • remove ADDRCONFIG DNS hint on Windows (Bartosz Sosnowski) #17662
  • process:
    • fix reading zero-length env vars on win32 (Anna Henningsen) #18463
  • tls:
    • unconsume stream on destroy (Anna Henningsen) #17478
  • process:
    • improve unhandled rejection message (Madara Uchiha) #17158
  • stream:
    • remove usage of *State.highWaterMark (Calvin Metcalf) #12860
  • trace_events:
    • add executionAsyncId to init events (Andreas Madsen) #17196

Commits

  • [5dab90b8bb] - async_hooks: update defaultTriggerAsyncIdScope for perf (Anatoli Papirovski) #18004
  • [086af68c19] - async_hooks: use typed array stack as fast path (Anna Henningsen) #17780
  • [0f7c8984af] - async_hooks: use CHECK instead of throwing error (Jon Moss) #17832
  • [5a199a905b] - async_hooks: use scope for defaultTriggerAsyncId (Andreas Madsen) #17273
  • [03873db4d0] - async_hooks: separate missing from default context (Andreas Madsen) #17273
  • [cce92ccfa8] - async_hooks: rename initTriggerId (Andreas Madsen) #17273
  • [025b9f208f] - (SEMVER-MINOR) async_hooks: deprecate undocumented API (Andreas Madsen) #16972
  • [36dbd1181a] - (SEMVER-MINOR) async_hooks: add destroy event for gced AsyncResources (Sebastian Mayr) #16998
  • [331b175af2] - (SEMVER-MINOR) async_hooks: add trace events to async_hooks (Andreas Madsen) #15538
  • [91d4eb5ff8] - (SEMVER-MINOR) async_hooks,http: set HTTPParser trigger to socket (Andreas Madsen) #18003
  • [0211175bc7] - async_hooks,test: only use IPv6 in http test (Andreas Madsen) #18143
  • [6d55a4c941] - (SEMVER-MINOR) async_wrap: add provider types for net server (Andreas Madsen) #17157
  • [8143a95c1f] - benchmark: implement duration in http test double (Joyee Cheung) #18380
  • [f779a8b5a4] - benchmark: make compare.R easier to understand (Andreas Madsen) #18373
  • [deb70417cd] - benchmark: remove redundant + (sreepurnajasti) #17803
  • [452d2c561a] - benchmark: fix timeout in write-stream-throughput (Anatoli Papirovski) #17958
  • [1e3ea5023b] - benchmark: make temp file path configurable (Rich Trott) #17811
  • [91135b9bd2] - build: fix Makefile wrt finding node executable (Yang Guo) #18040
  • [f07bb16255] - build: fix cctest target with --enable-static (Qingyan Li) #17992
  • [e61344a9e9] - build: remove cctest extension (Yihong Wang) #16680
  • [fd845d80eb] - build,win: update lint-cpp on Windows (Kyle Farnung) #18012
  • [44ab4f09a2] - build,win,msi: support WiX with VS2017 (João Reis) #17101
  • [ec7996ca15] - (SEMVER-MINOR) cli: add --stack-trace-limit to NODE_OPTIONS (Anna Henningsen) #16495
  • [087cdaf871] - cluster: resolve relative unix socket paths (laino) #16749
  • [162ff56439] - (SEMVER-MINOR) console: add support for console.debug (Benjamin Zaslavsky) #17033
  • [8cc0ea78d7] - crypto: do not reach into OpenSSL internals for ThrowCryptoError (David Benjamin) #16701
  • [072902a258] - crypto: remove leftover initialization (Myles Borins) #18622
  • [b0526ba7f1] - (SEMVER-MINOR) crypto: clear some SSL_METHOD deprecation warnings (David Benjamin) #16130
  • [78738266d6] - (SEMVER-MINOR) crypto: make ALPN the same for OpenSSL 1.0.2 & 1.1.0 (David Benjamin) #16130
  • [f1d458be58] - (SEMVER-MINOR) crypto: remove deprecated ECDH calls w/ OpenSSL 1.1 (David Benjamin) #16130
  • [f9a597a1d3] - (SEMVER-MINOR) crypto: emulate OpenSSL 1.0 ticket scheme in 1.1 (David Benjamin) #16130
  • [eb377f38f6] - (SEMVER-MINOR) crypto: h...
Read more
Loading

2018-03-06, Version 6.13.1 'Boron' (LTS), @MylesBorins

2018-03-06, Version 6.13.1 'Boron' (LTS), @MylesBorins

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 06 Mar 20:11
v6.13.1
1246f72

Notable Changes

  • http, tls:
    • better support for IPv6 addresses (Mattias Holmlund) #14772

Commits

Loading

2018-03-02, Version 9.7.1 (Current), @rvagg

2018-03-02, Version 9.7.1 (Current), @rvagg

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 06 Mar 19:59
v9.7.1
This tag was signed with the committer’s verified signature.
rvagg Rod Vagg
GPG key ID: C273792F7D83545D
Verified
Learn about vigilant mode.
316926f

No additional commits. New version published due to a bad node-v9.7.0.pkg file that was published to nodejs.org in the previous release.

Loading

2018-03-01, Version 9.7.0 (Current), @rvagg prepared by @addaleax

2018-03-01, Version 9.7.0 (Current), @rvagg prepared by @addaleax

Choose a tag to compare

View all tags
@MylesBorins MylesBorins released this 06 Mar 19:58
v9.7.0
This tag was signed with the committer’s verified signature.
rvagg Rod Vagg
GPG key ID: C273792F7D83545D
Verified
Learn about vigilant mode.
85bbd43

Notable Changes

  • libuv:

    • Updated to libuv 1.19.2 (Colin Ihrig) #18918

  • src:

    • Add initial support for Node.js-specific post-mortem metadata (Matheus Marchini) #14901

  • timers:

    • The return value of setImmediate() now has ref() and unref() methods (Anatoli Papirovski) #18139

  • util:

    • It is now possible to get the name for a numerical platform-specific error code as a string (Joyee Cheung) #18186

Commits

  • [5ddef2988b] - async_wrap: schedule destroy hook as unref (Anatoli Papirovski) #18241
  • [be9777c5f6] - benchmark: add stream.pipe benchmarks (Mathias Buus) #18617
  • [4012ae8885] - build: fix coverage build (Yihong Wang) #18409
  • [8c934990ef] - build: add node_lib_target_name to cctest deps (Daniel Bevenius) #18576
  • [f7e1402923] - build: include the libuv and zlib into node (Yihong Wang) #18383
  • [237a363dc7] - build: make gyp user defined variables lowercase (Daniel Bevenius) #16238
  • [16ef386507] - build, win: vcbuild improvements (Bartosz Sosnowski) #17015
  • [4fa1f3197f] - cluster: fix inspector port assignment (Santiago Gimeno) #18696
  • [ec55965501] - deps: upgrade libuv to 1.19.2 (cjihrig) #18918
  • [7fb72a5fa3] - deps,src: align ssize_t ABI between Node & nghttp2 (Anna Henningsen) #18565
  • [dd917eb946] - doc: add pending-deprecation to deprecations list (Сковорода Никита Андреевич) #18433
  • [287946ddff] - doc: remove Returns: {undefined} (Sho Miyamoto) #18951
  • [4f454bde74] - doc: mention git-node in the collaborator guide (Joyee Cheung) #18960
  • [4bc54238b2] - doc: update 2fa information in onboarding.md (Rich Trott) #18968
  • [b456e31964] - doc: add process.debugPort to doc/api/process.md (flickz) #18716
  • [6f177e7b5d] - doc: readable.push(undefined) in non-object mode (陈刚) #18283
  • [85322518ca] - doc: remove extraneous "for example" text (Rich Trott) #18890
  • [38cf3cf494] - doc: update description of 'clientError' event (Luigi Pinca) #18885
  • [e447580872] - doc: fix link in onboarding.md (Justin Lee) #18878
  • [205a84cf09] - doc: remove CII badge in README (Roman Reiss) #18908
  • [1246902bae] - errors: move error creation helpers to errors.js (Joyee Cheung) #18546
  • [b3fe55aada] - errors: improve the description of ERR_INVALID_ARG_VALUE (Joyee Cheung) #18358
  • [112c9a3a19] - http: remove default 'drain' listener on upgrade (Luigi Pinca) #18866
  • [c7f9608626] - http: allow _httpMessage to be GC'ed (Luigi Pinca) #18865
  • [738b0a1f2e] - lib: add process to internal module wrapper (Anna Henningsen) #17198
  • [cfb78bc1df] - process: use linked reusable queue for ticks (Mathias Buus) #18617
  • [4acea14197] - process: do not directly schedule _tickCallback in _fatalException (Anatoli Papirovski) #17841
  • [d348496345] - process: refactor nextTick for clarity (Anatoli Papirovski) #17738
  • [cf0b95c4b1] - process: use more direct sync I/O for stdio (Anna Henningsen) #18019
  • [b4c933dd44] - promises: refactor rejection handling (Anatoli Papirovski) #18207
  • [01398b29e9] - repl: fix tab-complete warning (killagu) #18881
  • [e33b9fa7b5] - src: fix GetCpuProfiler() deprecation warning (Ben Noordhuis) #18534
  • [91694497ba] - src: refactor WriteWrap and ShutdownWraps (Anna Henningsen) #18676
  • [fa691f7d95] - src: only set JSStreamWrap write req after write() (Anna Henningsen) #18676
  • [296523a698] - src: remove unnecessary async hooks check (Anatoli Papirovski) #18291
  • [4de4c54069] - src: expose uv.errmap to binding (Joyee Cheung) #17338
  • [189e566076] - src: do not redefine private for GenDebugSymbols (Joyee Cheung) #18653
  • [07c6fb983b] - src: use AliasedBuffer for TickInfo (Anatoli Papirovski) #17881
  • [684684e567] - src: simplify handles for libuv streams (Anna Henningsen) #18334
  • [cb5ed45603] - src: refactor stream callbacks and ownership (Anna Henningsen) #18334
  • [f60757796b] - src: use DoTryWrite() for not-all-Buffer writev()s too (Anna Henningsen) #18019
  • [f17987ba16] - src: remove HasWriteQueue() (Anna Henningsen) #18019
  • [2282dceb29] - src: remove node namespace qualifiers (Daniel Bevenius) #18962
  • [6e7aa3d8f4] - src: fix abort when taking a heap snapshot (Ben Noordhuis) #18898
  • [a17d6840e1] - src: fix deprecation warning in node_perf.cc (Daniel Bevenius) #18877
  • [46fc507054] - (SEMVER-MINOR) src, test: node internals' postmortem metadata (Matheus Marchini) #14901
  • [7853a7fd2a] - test: add test for stream unpipe with 'data' listeners (Anna Henningsen) #18516
  • [3543c5543b] - test: make sure WriteWrap tests are actually async (Anna Henningsen) #18676
  • [7dd3c8af88] - test: add url type check in Module options (JiaHerr Tee) #18664
  • [1be5e33f03] - test: replace assert.throws with expec...
Read more
Loading