Weekly Update - Jun 12th, 2015

io.js 2.3 releases

This week we had one io.js release v2.3.0, complete changelog can be found on GitHub.

Notable changes

• libuv: Upgraded to 1.6.0 and 1.6.1, see full ChangeLog for details. (Saúl Ibarra Corretgé) #1905 #1889. Highlights include:
  • Fix TTY becoming blocked on OS X
  • Fix UDP send callbacks to not to be synchronous
  • Add uv_os_homedir() (exposed as os.homedir(), see below)
• npm: See full release notes for details. (Kat Marchán) #1899. Highlight:
  • Use GIT_SSH_COMMAND (available as of Git 2.3)
• openssl:
  • Upgrade to 1.0.2b and 1.0.2c, introduces DHE man-in-the-middle protection (Logjam) and fixes malformed ECParameters causing infinite loop (CVE-2015-1788). See the security advisory for full details. (Shigeki Ohtsu) #1950 #1958
  • Support FIPS mode of OpenSSL, see README for instructions. (Fedor Indutny) #1890
• os: Add os.homedir() method. (Colin Ihrig) #1791
• smalloc: Deprecate whole module. (Vladimir Kurchatkin) #1822
• Add new collaborators:
  • Alex Kocharin (@rlidwka)
  • Christopher Monsanto (@monsanto)
  • Ali Ijaz Sheikh (@ofrobots)
  • Oleg Elifantiev (@Olegas)
  • Domenic Denicola (@domenic)
  • Rich Trott (@Trott)

Known issues

See https://github.com/nodejs/node/labels/confirmed-bug for complete and current list of known issues.

• Some problems with unreferenced timers running during beforeExit are still to be resolved. See #1264.
• Surrogate pair in REPL can freeze terminal #690
• process.send() is not synchronous as the docs suggest, a regression introduced in 1.0.2, see #760 and fix in #774
• Calling dns.setServers() while a DNS query is in progress can cause the process to crash on a failed assertion #894
• url.resolve may transfer the auth portion of the url when resolving between two full hosts, see #1435.

Community Updates

• Openssl vulnerabilities are updated on io.js. Resume: Upgrade to 1.0.2b and 1.0.2c, introduces DHE man-in-the-middle protection (Logjam) and fixes malformed ECParameters causing infinite loop (CVE-2015-1788). See the security advisory for full details. (Shigeki Ohtsu) #1950 #1958
• io.js 2.3.0 os.homedir() ponyfill
• "Should I use Node.js or io.js? And which version?" article by StrongLoop
• iojs now supports --use_strong. Strong mode (part of Google v8 experiments) implements a stronger semantics.
• "Node.js and io.js Merge Under the Node Foundation" by InfoQ.

Upcoming Events

• CascadiaJS tickets are on sale, July 8th - 10th at Washington State
• BrazilJS Conf tickets are on sale, August 21st - 22nd at Shopping Center BarraShoppingSul
• NodeConf EU tickets are on sale, September 6th - 9th at Waterford, Ireland
• JSConf CO, October 16th - 17th at Ruta N, Medellin