News from 2020

• 18 Feb Node v13.9.0 (Current)
  • async_hooks
    • add executionAsyncResource (Matteo Collina) #30959
  • crypto
    • add crypto.diffieHellman (Tobias Nießen) #31178
    • add DH support to generateKeyPair (Tobias Nießen) #31178
    • simplify DH groups (Tobias Nießen) #31178
    • add key type 'dh' (Tobias Nießen) #31178
  • test
    • skip keygen tests on arm systems (Tobias Nießen) #31178
  • perf_hooks
    • add property flags to GCPerformanceEntry (Kirill Fomichev) #29547
  • process
    • report ArrayBuffer memory in memoryUsage() (Anna Henningsen) #31550
  • readline
    • make tab size configurable (Ruben Bridgewater) #31318
  • report
    • add support for Workers (Anna Henningsen) #31386
  • worker
    • add ability to take heap snapshot from parent thread (Anna Henningsen) #31569
  • added new collaborators
    • add ronag to collaborators (Robert Nagy) #31498

  Read more...

• 18 Feb Node v12.16.1 (LTS)

  Node.js 12.16.0 included 6 regressions that are being fixed in this release

  Accidental Unflagging of Self Resolving Modules:

  12.16.0 included a large update to the ESM implementation. One of the new features, Self Referential Modules, was accidentally released without requiring the --experimental-modules flag. This release is being made to appropriately flag the feature.

  Read more...

• 11 Feb Node v12.16.0 (LTS)

  New assert APIs

  The assert module now provides experimental assert.match() and assert.doesNotMatch() methods. They will validate that the first argument is a string and matches (or does not match) the provided regular expression:

  Read more...

• 06 Feb February 2020 Security Releases

  Updates are now available for all active Node.js release lines for the following issues.

  Affected Node.js versions can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system.

  Read more...

• 06 Feb Node v13.8.0 (Current)

  This is a security release.

  Vulnerabilities fixed:

  • CVE-2019-15606: HTTP header values do not have trailing OWS trimmed.
  • CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header.
  • CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string.

  Read more...

• 06 Feb Node v12.15.0 (LTS)

  This is a security release.

  Vulnerabilities fixed:

  • CVE-2019-15606: HTTP header values do not have trailing OWS trimmed.
  • CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header.
  • CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string.

  Read more...

• 06 Feb Node v10.19.0 (LTS)

  This is a security release.

  Vulnerabilities fixed:

  • CVE-2019-15606: HTTP header values do not have trailing OWS trimmed.
  • CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header.
  • CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string.

  Read more...

• 21 Jan Node v13.7.0 (Current)
  • deps:
    • upgrade to libuv 1.34.1 (cjihrig) #31332
    • upgrade npm to 6.13.6 (Ruy Adorno) #31304
  • module
    • add API for interacting with source maps (bcoe) #31132
    • loader getSource, getFormat, transform hooks (Geoffrey Booth) #30986
    • logical conditional exports ordering (Guy Bedford) #31008
    • unflag conditional exports (Guy Bedford) #31001
  • process:
    • allow monitoring uncaughtException (Gerhard Stoebich) #31257
  • Added new collaborators:
    • GeoffreyBooth - Geoffrey Booth. #31306

  Read more...

• 09 Jan Node v10.18.1 (LTS)
  • http2: fix session memory accounting after pausing (Michael Lehenbauer) #30684
  • n-api: correct bug in napi_get_last_error (Octavian Soldea) #28702
  • tools: update tzdata to 2019c (Myles Borins) #30479

  Read more...

• 07 Jan Node v13.6.0 (Current)
  • assert:
    • Implement assert.match() and assert.doesNotMatch() (Ruben Bridgewater) #30929
  • events:
    • Add EventEmitter.on to async iterate over events (Matteo Collina) #27994
    • Allow monitoring error events (Gerhard Stoebich) #30932
  • fs:
    • Allow overriding fs for streams (Robert Nagy) #29083
  • perf_hooks:
    • Move perf_hooks out of experimental (legendecas) #31101
  • repl:
    • Implement ZSH-like reverse-i-search (Ruben Bridgewater) #31006
  • tls:
    • Add PSK (pre-shared key) support (Denys Otrishko) #23188

  Read more...

• 07 Jan Node v12.14.1 (LTS)