Node.js

News from 2018

16 Aug Node v10.9.0 (Current)
This is a security release, fixing a number of vulnerabilities in OpenSSL and Node.js. Refer to the August 2018 Security Releases announcement for full details.
- buffer:
  - Fix out-of-bounds (OOB) write in Buffer.write() for UCS-2 encoding (CVE-2018-12115)
  - Fix unintentional exposure of uninitialized memory in Buffer.alloc() (CVE-2018-7166)
- deps:
  - Upgrade to OpenSSL 1.1.0i, fixing:
    - Client DoS due to large DH parameter (CVE-2018-0732)
    - ECDSA key extraction via local side-channel (CVE not assigned)
  - Upgrade V8 from 6.7 to 6.8 (Michaël Zasso) #21079
    - Memory reduction and performance improvements, details at: https://v8project.blogspot.com/2018/06/v8-release-68.html
- http: http.get() and http.request() (and https variants) can now accept three arguments to allow for a URL and an options object (Sam Ruby) #21616
- Added new collaborators
  - Sam Ruby (https://github.com/rubys)
  - George Adams (https://github.com/gdams)
Read more...
16 Aug Node v8.11.4 (LTS)
This is a security release, fixing a number of vulnerabilities in OpenSSL and Node.js. Refer to the August 2018 Security Releases announcement for full details.
- buffer: Fix out-of-bounds (OOB) write in Buffer.write() for UCS-2 encoding (CVE-2018-12115)
- deps: Upgrade to OpenSSL 1.0.2p, fixing:
  - Client DoS due to large DH parameter (CVE-2018-0732)
  - ECDSA key extraction via local side-channel (CVE not assigned)
Read more...
16 Aug Node v6.14.4 (LTS)
This is a security release, fixing a number of vulnerabilities in OpenSSL and Node.js. Refer to the August 2018 Security Releases announcement for full details.
- buffer: Fix out-of-bounds (OOB) write in Buffer.write() for UCS-2 encoding (CVE-2018-12115)
- deps: Upgrade to OpenSSL 1.0.2p, fixing:
  - Client DoS due to large DH parameter (CVE-2018-0732)
  - ECDSA key extraction via local side-channel (CVE not assigned)
Read more...
11 Aug August 2018 Security Releases

(Update 16-August-2018) Security releases available
Updates are now available for all active Node.js release lines. These include upgrades for OpenSSL and fixes for the vulnerabilities identified in the initial announcement (below).
We recommend that all users upgrade as soon as practical.
Read more...
01 Aug Node v10.8.0 (Current)
- deps:
  - Upgrade npm to 6.2.0. #21592
    - npm has moved. This release updates various URLs to point to the right places for bugs, support, and PRs.
    - Fix the regular expression matching in xcode_emulation in node-gyp to also handle version numbers with multiple-digit major versions which would otherwise break under use of XCode 10.
    - The npm tree has been significantly flattened. Tarball size for the npm package has gone from 8MB to 4.8MB.
    - Changelogs: 6.2.0-next.0, 6.2.0-next.1, 6.2.0.
Read more...
18 Jul Node v10.7.0 (Current)
- console:
  - The console.timeLog() method has been implemented. #21312
- deps:
  - Upgrade to libuv 1.22.0. #21731
  - Upgrade to ICU 62.1 (Unicode 11, CLDR 33.1). #21728
- http:
  - Added support for passing both timeout and agent options to http.request. #21204
- inspector:
  - Expose the original console API in require('inspector').console. #21659
- napi:
  - Added experimental support for functions dealing with bigint numbers. #21226
- process:
  - The process.hrtime.bigint() method has been implemented. #21256
  - Added the --title command line argument to set the process title on startup. #21477
- trace_events:
  - Added process_name metadata. #21477
- Added new collaborators
  - codebytere - Shelley Vohr
Read more...
04 Jul Node v10.6.0 (Current)
- dns:
  - An experimental promisified version of the dns module is now available. Give it a try with require('dns').promises. #21264
- fs:
  - fs.lchown has been undeprecated now that libuv supports it. #21498
- lib:
  - Atomics.wake is being renamed to Atomics.notify in the ECMAScript specification (reference). Since Node.js now has experimental support for worker threads, we are being proactive and added a notify alias, while emitting a warning if wake is used. #21413 #21518
- n-api:
  - Add API for asynchronous functions. #17887
- util:
  - util.inspect is now able to return a result instead of throwing when the maximum call stack size is exceeded during inspection. #20725
- vm:
  - Add script.createCachedData(). This API replaces the produceCachedData option of the Script constructor that is now deprecated. #20300
- worker:
  - Support for relative paths has been added to the Worker constructor. Paths are interpreted relative to the current working directory. #21407
Read more...
20 Jun Node v10.5.0 (Current)
- crypto:
  - Support for crypto.scrypt() has been added. #20816
- fs:
  - BigInt support has been added to fs.stat and fs.watchFile. #20220
  - APIs that take mode as arguments no longer throw on values larger than 0o777. #20636 #20975 (Fixes: #20498)
  - Fix crashes in closed event watchers. #20985 (Fixes: #20297)
- Worker Threads:
  - Support for multi-threading has been added behind the --experimental-worker flag in the worker_threads module. This feature is experimental and may receive breaking changes at any time. #20876
Read more...
12 Jun Node v8.11.3 (LTS)
- buffer (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang
- http2
  - (CVE-2018-7161): Fixes Denial of Service vulnerability by updating the http2 implementation to not crash under certain circumstances during cleanup
  - (CVE-2018-1000168): Fixes Denial of Service vulnerability by upgrading nghttp2 to 1.32.0
Read more...
12 Jun Node v6.14.3 (LTS)
- buffer (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang
- [7dbcfc6217] - src: avoid hanging on Buffer#fill 0-length input (Сковорода Никита Андреевич) nodejs-private/node-private#121
Read more...
12 Jun Node v9.11.2 (Current)
12 Jun Node v10.4.1 (Current)
12 Jun June 2018 Security Releases
06 Jun Node v10.4.0 (Current)
29 May Node v10.3.0 (Current)
24 May Node v10.2.1 (Current)
23 May Node v10.2.0 (Current)
15 May Node v8.11.2 (LTS)
09 May Node v10.1.0 (Current)
30 Apr Node v6.14.2 (LTS)
24 Apr Node v10.0.0 (Current)
05 Apr Node v9.11.1 (Current)
04 Apr Node v9.11.0 (Current)
30 Mar Node v9.10.1 (Current)
30 Mar Node v8.11.1 (LTS)
30 Mar Node v6.14.1 (LTS)
30 Mar Node v4.9.1 (Maintenance)
28 Mar Node v9.10.0 (Current)
28 Mar Node v8.11.0 (LTS)
28 Mar Node v6.14.0 (LTS)
28 Mar Node v4.9.0 (Maintenance)
21 Mar March 2018 Security Releases
21 Mar Node v9.9.0 (Current)
08 Mar Node v9.8.0 (Current)
07 Mar Node v8.10.0 (LTS)
06 Mar Node v6.13.1 (LTS)
02 Mar Node v9.7.1 (Current)
01 Mar Node v9.7.0 (Current)
23 Feb Node v9.6.1 (Current)
22 Feb Node v9.6.0 (Current)
13 Feb Node v6.13.0 (LTS)
01 Feb Node v9.5.0 (Current)
10 Jan Node v9.4.0 (Current)
08 Jan Meltdown and Spectre - Impact On Node.js
03 Jan Node v8.9.4 (LTS)
02 Jan Node v6.12.3 (LTS)