Weekly Update - Jun 12th, 2015

Giovanny Gioyik

io.js 2.3 releases

This week we had one io.js release v2.3.0, complete changelog can be found on GitHub.

libuv: Upgraded to 1.6.0 and 1.6.1, see full ChangeLog for details. (Saúl Ibarra Corretgé) #1905 #1889. Highlights include:
- Fix TTY becoming blocked on OS X
- Fix UDP send callbacks to not to be synchronous
- Add uv_os_homedir() (exposed as os.homedir(), see below)
npm: See full release notes for details. (Kat Marchán) #1899. Highlight:
- Use GIT_SSH_COMMAND (available as of Git 2.3)
openssl:
- Upgrade to 1.0.2b and 1.0.2c, introduces DHE man-in-the-middle protection (Logjam) and fixes malformed ECParameters causing infinite loop (CVE-2015-1788). See the security advisory for full details. (Shigeki Ohtsu) #1950 #1958
- Support FIPS mode of OpenSSL, see README for instructions. (Fedor Indutny) #1890
os: Add os.homedir() method. (Colin Ihrig) #1791
smalloc: Deprecate whole module. (Vladimir Kurchatkin) #1822
Add new collaborators:
- Alex Kocharin (@rlidwka)
- Christopher Monsanto (@monsanto)
- Ali Ijaz Sheikh (@ofrobots)
- Oleg Elifantiev (@Olegas)
- Domenic Denicola (@domenic)
- Rich Trott (@Trott)

Some problems with unreferenced timers running during beforeExit are still to be resolved. See #1264.
Surrogate pair in REPL can freeze terminal #690
process.send() is not synchronous as the docs suggest, a regression introduced in 1.0.2, see #760 and fix in #774
Calling dns.setServers() while a DNS query is in progress can cause the process to crash on a failed assertion #894
url.resolve may transfer the auth portion of the url when resolving between two full hosts, see #1435.

Openssl vulnerabilities are updated on io.js. Resume: Upgrade to 1.0.2b and 1.0.2c, introduces DHE man-in-the-middle protection (Logjam) and fixes malformed ECParameters causing infinite loop (CVE-2015-1788). See the security advisory for full details. (Shigeki Ohtsu) #1950 #1958
io.js 2.3.0 os.homedir() ponyfill
"Should I use Node.js or io.js? And which version?" article by StrongLoop
iojs now supports --use_strong. Strong mode (part of Google v8 experiments) implements a stronger semantics.
"Node.js and io.js Merge Under the Node Foundation" by InfoQ.

CascadiaJS tickets are on sale, July 8th - 10th at Washington State
BrazilJS Conf tickets are on sale, August 21st - 22nd at Shopping Center BarraShoppingSul
NodeConf EU tickets are on sale, September 6th - 9th at Waterford, Ireland
JSConf CO, October 16th - 17th at Ruta N, Medellin