Node.js

News from 2019

16 Aug August 2019 Security Releases

Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for more information.
Read more...
15 Aug Node v10.16.3 (LTS)

This is a security release.
Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for more information.
Read more...
15 Aug Node v8.16.1 (LTS)

This is a security release.
Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for more information.
Read more...
15 Aug Node v12.8.1 (Current)

This is a security release.
Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for more information.
Read more...
06 Aug Node v10.16.2 (LTS)
This release patches a regression in the OpenSSL upgrade to 1.1.1c that causes intermittent hangs in machines that have low entropy.
- [894a9dd230] - deps: cherry-pick c19c5a6 from openssl upstream (Ali Ijaz Sheikh) #28983
Read more...
06 Aug Node v12.8.0 (Current)
- assert:
  - Legacy mode deprecation (DEP0089) is revoked (Colin Ihrig) #28892
- crypto:
  - The outputLength option is added to crypto.createHash (Tobias Nießen) #28805
  - The maxmem range is increased from 32 to 53 bits (Tobias Nießen) #28799
- n-api:
  - Added APIs for per-instance state management (Gabriel Schulhof) #28682
- report:
  - Network interfaces get included in the report (Colin Ihrig) #28911
- src:
  - v8.getHeapCodeStatistics() is now exported (Yuriy Vasiyarov) #27978
Read more...
31 Jul Node v10.16.1 (LTS)
- deps: upgrade openssl sources to 1.1.1c (Sam Roberts) #28212
- stream: do not unconditionally call \_read() on resume() (Anna Henningsen) #26965
- worker: fix nullptr deref after MessagePort deser failure (Anna Henningsen) #25076
Read more...
23 Jul Node v12.7.0 (Current)
- deps:
  - Updated nghttp2 to 1.39.1 (gengjiawen) #28448.
  - Updated npm to 6.10.0 (isaacs) #28525.
- esm:
  - Implemented experimental "pkg-exports" proposal. A new "exports" field can be added to a module's package.json file to provide custom subpath aliasing. See proposal-pkg-exports for more information (Guy Bedford) #28568.
- http:
  - Added response.writableFinished (Robert Nagy) #28681.
  - Exposed headers, rawHeaders and other fields on an http.ClientRequest "information" event (Austin Wright) #28459.
- inspector:
  - Added inspector.waitForDebugger() (Aleksei Koziatinskii) #28453.
- policy:
  - Added --policy-integrity=sri CLI option to mitigate policy tampering. If a policy integrity is specified and the policy does not have that integrity, Node.js will error prior to running any code (Bradley Farias) #28734.
- readline,tty:
  - Exposed stream API from various methods which write characters (cjihrig) #28674, #28721.
- report:
  - Modify process.report.getReport() to return an Object instead of a JSON string (Christopher Hiller) #28630.
- src:
  - Use cgroups to get memory limits. This improves the way we set the memory ceiling for a Node.js process. Previously we would use the physical memory size to estimate the necessary V8 heap sizes. The physical memory size is not necessarily the correct limit, e.g. if the process is running inside a docker container or is otherwise constrained. This change adds the ability to get a memory limit set by linux cgroups, which is used by docker containers to set resource constraints (Kelvin Jin) #27508.
Read more...
03 Jul Node v12.6.0 (Current)
- build:
  - Experimental support for building Node.js on MIPS architecture is back #27992.
- child_process:
  - The promisified versions of child_process.exec and child_process.execFile now both return a Promise which has the child instance attached to their child property #28325.
- deps:
  - Updated libuv to 1.30.1 #28449, #28511.
    - Support for the Haiku platform has been added.
    - The maximum UV_THREADPOOL_SIZE has been increased from 128 to 1024.
    - uv_fs_copyfile() now works properly when the source and destination files are the same.
- process:
  - A new method, process.resourceUsage() was added. It returns resource usage for the current process, such as CPU time #28018.
- src:
  - Fixed an issue related to stdio that could lead to a crash of the process in some circumstances #28490.
- stream:
  - Added a writableFinished property to writable streams. It indicates that all the data has been flushed to the underlying system #28007.
- worker:
  - Fixed an issue that prevented worker threads to listen for data on stdin #28153.
- meta:
  - Added Jiawen Geng to collaborators #28322.
Read more...
27 Jun Node v12.5.0 (Current)
- build:
  - The startup time is reduced by enabling V8 snapshots by default #28181
- deps:
  - Updated V8 to 7.5.288.22 #27375
    - The numeric separator feature is now enabled by default
  - Updated OpenSSL to 1.1.1c #28211
- inspector:
  - The --inspect-publish-uid flag was added to specify ways of the inspector web socket url exposure #27741
- n-api:
  - Accessors on napi_define_* are now ECMAScript-compliant #27851
- report:
  - The cpu info got added to the report output #28188
- src:
  - Restore the original state of the stdio file descriptors on exit to prevent leaving stdio in raw or non-blocking mode #24260
- tools,gyp:
  - Introduce MSVS 2019 #27375
- util:
  - inspect:
    - Array grouping became more compact and uses more columns than before #28059 #28070
    - Long strings will not be split at 80 characters anymore. Instead they will be split on new lines #28055
- worker:
  - worker.terminate() now returns a promise and using the callback is deprecated #28021
Read more...
04 Jun Node v12.4.0 (Current)
28 May Node v10.16.0 (LTS)
22 May Node v12.3.1 (Current)
21 May Node v12.3.0 (Current)
07 May Node v12.2.0 (Current)
30 Apr Node v11.15.0 (Current)
29 Apr Node v12.1.0 (Current)
23 Apr Node v12.0.0 (Current)
16 Apr Node v8.16.0 (LTS)
11 Apr Node v11.14.0 (Current)
03 Apr Node v6.17.1 (LTS)
28 Mar Node v11.13.0 (Current)
15 Mar Node v11.12.0 (Current)
06 Mar Node v11.11.0 (Current)
05 Mar Node v10.15.3 (LTS)
28 Feb February 2019 Security Releases
28 Feb Node v11.10.1 (Current)
28 Feb Node v10.15.2 (LTS)
28 Feb Node v8.15.1 (LTS)
28 Feb Node v6.17.0 (LTS)
14 Feb Node v11.10.0 (Current)
30 Jan Node v11.9.0 (Current)
29 Jan Node v10.15.1 (LTS)
25 Jan Node v11.8.0 (Current)
18 Jan Node v11.7.0 (Current)