BackPup/node
1
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-11-09 15:11:11 -05:00
Code Issues Packages Projects Releases Wiki Activity
40,882 Commits 266 Branches 972 Tags
780d030bdfb89bdb5e55c19dbe8d181c026d22ba
Commit Graph
7522 Commits
Author SHA1 Message Date
Moshe Atlow 4f68c7c1c9 watch: mark as stable 
PR-URL: https://github.com/nodejs/node/pull/52074
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2024-03-15 13:09:48 +00:00
Marco Ippolito 9a1e01c4ce util: support array of formats in util.styleText 
PR-URL: https://github.com/nodejs/node/pull/52040
Fixes: https://github.com/nodejs/node/issues/52035
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
 2024-03-15 10:42:21 +00:00
Chengzhong Wu 0eb2b727f6 src: return a number from process.constrainedMemory() constantly 
`0` is already a special value returned from
`uv_get_constrained_memory` representing unknown or no constraint.
Make `process.constrainedMemory()` constantly return a number instead
to avoid polymorphic return type.

PR-URL: https://github.com/nodejs/node/pull/52039
Reviewed-By: theanarkh <theratliter@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
 2024-03-15 00:27:33 +08:00
Robert Nagy 1abff07392 stream: bump default highWaterMark 
This should give a performance boost accross the board.

Given that the old limit is a decod old and memory capacity has
doubled many times since I think it is appropriate to slightly bump
the default limit.

PR-URL: https://github.com/nodejs/node/pull/52037
Refs: https://github.com/nodejs/node/pull/46608
Refs: https://github.com/nodejs/node/pull/50120
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
 2024-03-13 19:02:14 +00:00
fengmk2 57d2e4881c doc: remove ArrayBuffer from crypto.hash() data parameter type 
PR-URL: https://github.com/nodejs/node/pull/52069
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
 2024-03-13 15:56:33 +00:00
Colin Ihrig 84de97a61e test_runner: support forced exit 
This commit updates the test runner to allow a forced exit once
all known tests have finished running.

Fixes: https://github.com/nodejs/node/issues/49925
PR-URL: https://github.com/nodejs/node/pull/52038
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Raz Luvaton <rluvaton@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2024-03-13 10:49:15 +00:00
theanarkh 78be0d0f1c src: add uv_get_available_memory to report and process 
PR-URL: https://github.com/nodejs/node/pull/52023
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
 2024-03-13 04:06:49 +00:00
Geoffrey Booth 63d04d4d80 module: fix detect-module not retrying as esm for cjs-only errors 
PR-URL: https://github.com/nodejs/node/pull/52024
Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2024-03-12 13:37:51 +00:00
Marco Ippolito de0602d190 crypto: runtime deprecate Hash constructor 
PR-URL: https://github.com/nodejs/node/pull/51880
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 2024-03-12 07:58:03 +00:00
Joyee Cheung 575ced8139 module: print location of unsettled top-level await in entry points 
When the entry point is a module and the graph it imports still
contains unsettled top-level await when the Node.js instance
finishes the event loop, search from the entry point module
for unsettled top-level await and print their location.

To avoid unnecessary overhead, we register a promise that only
gets settled when the entry point graph evaluation returns
from await, and only search the module graph if it's still
unsettled by the time the instance is exiting.

This patch only handles this for entry point modules. Other kinds of
modules are more complicated so will be left for the future.

Drive-by: update the terminology "unfinished promise" to the
more correct one "unsettled promise" in the codebase.

PR-URL: https://github.com/nodejs/node/pull/51999
Fixes: https://github.com/nodejs/node/issues/42868
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2024-03-10 08:21:22 +08:00
Daniel Kaplan 8f9f5db1e8 doc: document that const c2 = vm.createContext(c1); c1 === c2 is true 
- As far as I can tell, the documentation didn't say this, so I was left
  wondering if there is a difference between `c1` and `c2` in `const c2
= vm.createContext(c1);` According to my own tests, they are equivalent.
I thought it was worth documenting as it would've saved me a bit of time
if this information were written down.

PR-URL: https://github.com/nodejs/node/pull/51960
Refs: https://github.com/nodejs/node/pull/51946
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
 2024-03-09 14:31:51 +00:00
Aras Abbasi 999c6b34fb doc: test for cli options 
PR-URL: https://github.com/nodejs/node/pull/51623
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
 2024-03-07 18:00:11 +00:00
Stephen Belanger 4f3cf4e89a diagnostics_channel: early-exit tracing channel trace methods 
PR-URL: https://github.com/nodejs/node/pull/51915
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
 2024-03-07 03:03:32 +00:00
marco-ippolito 2246cd9735 2024-03-06, Version 21.7.0 (Current) 
Notable changes:

build:
  * (SEMVER-MINOR) build opt to set local location of headers (Michael Dawson) https://github.com/nodejs/node/pull/51525
crypto:
  * (SEMVER-MINOR) implement crypto.hash() (Joyee Cheung) https://github.com/nodejs/node/pull/51044
  * update root certificates to NSS 3.98 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/51794
doc:
  * add zcbenz to collaborators (Cheng Zhao) https://github.com/nodejs/node/pull/51812
  * add lemire to collaborators (Daniel Lemire) https://github.com/nodejs/node/pull/51572
http2:
  * (SEMVER-MINOR) add h2 compat support for appendHeader (Tim Perry) https://github.com/nodejs/node/pull/51412
  * (SEMVER-MINOR) add server handshake utility (snek) https://github.com/nodejs/node/pull/51172
  * (SEMVER-MINOR) receive customsettings (Marten Richter) https://github.com/nodejs/node/pull/51323
lib:
  * (SEMVER-MINOR) move encodingsMap to internal/util (Joyee Cheung) https://github.com/nodejs/node/pull/51044
sea:
  * (SEMVER-MINOR) support sea.getRawAsset() (Joyee Cheung) https://github.com/nodejs/node/pull/50960
  * (SEMVER-MINOR) support embedding assets (Joyee Cheung) https://github.com/nodejs/node/pull/50960
src:
  * (SEMVER-MINOR) print string content better in BlobDeserializer (Joyee Cheung) https://github.com/nodejs/node/pull/50960
  * (SEMVER-MINOR) support multi-line values for .env file (IlyasShabi) https://github.com/nodejs/node/pull/51289
  * (SEMVER-MINOR) add `process.loadEnvFile` and `util.parseEnv` (Yagiz Nizipli) https://github.com/nodejs/node/pull/51476
  * (SEMVER-MINOR) do not coerce dotenv paths (Tobias Nießen) https://github.com/nodejs/node/pull/51425
stream:
  * (SEMVER-MINOR) implement `min` option for `ReadableStreamBYOBReader.read` (Mattias Buelens) https://github.com/nodejs/node/pull/50888
util:
  * (SEMVER-MINOR) add styleText API to text formatting (Rafael Gonzaga) https://github.com/nodejs/node/pull/51850
vm:
  * (SEMVER-MINOR) support using the default loader to handle dynamic import() (Joyee Cheung) https://github.com/nodejs/node/pull/51244

PR-URL: https://github.com/nodejs/node/pull/51932
 2024-03-06 15:35:16 -03:00
Marco Ippolito edd6190836 doc: deprecate hmac public constructor 
PR-URL: https://github.com/nodejs/node/pull/51881
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Adrian Estrada <edsadr@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 2024-03-06 16:00:43 +00:00
Joyee Cheung d96606d9aa doc: add stability index to crypto.hash() 
PR-URL: https://github.com/nodejs/node/pull/51978
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2024-03-05 20:12:28 +00:00
Marco Ippolito a0c466810a doc: deprecate fs.Stats public constructor 
PR-URL: https://github.com/nodejs/node/pull/51879
Refs: https://github.com/nodejs/node/pull/51681
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
 2024-03-05 13:49:36 +00:00
Moshe Atlow 151d365ad1 fs: expose glob and globSync 
PR-URL: https://github.com/nodejs/node/pull/51912
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Nitzan Uziely <linkgoron@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2024-03-03 23:15:35 +00:00
Joyee Cheung 7f2d61f82a v8: implement v8.queryObjects() for memory leak regression testing 
This is similar to the `queryObjects()` console API provided by the
Chromium DevTools console. It can be used to search for objects that
have the matching constructor on its prototype chain in the entire
heap, which can be useful for memory leak regression tests. To avoid
surprising results, users should avoid using this API on constructors
whose implementation they don't control, or on constructors that can
be invoked by other parties in the application.

To avoid accidental leaks, this API does not return raw references to
the objects found. By default, it returns the count of the objects
found. If `options.format` is `'summary'`, it returns an array
containing brief string representations for each object. The visibility
provided in this API is similar to what the heap snapshot provides,
while users can save the cost of serialization and parsing and directly
filer the target objects during the search.

We have been using this API internally for the test suite, which
has been more stable than any other leak regression testing
strategies in the CI. With a public implementation we can now
use the public API instead.

PR-URL: https://github.com/nodejs/node/pull/51927
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 2024-03-02 22:11:30 +00:00
Deokjin Kim 9930f114a0 doc: fix actual result of example is different in events 
Refs: https://github.com/nodejs/node/pull/50428
PR-URL: https://github.com/nodejs/node/pull/51925
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
 2024-03-02 15:35:37 +00:00
Jacob Smith 2e2a848c58 doc,module: clarify hook chain execution sequence 
PR-URL: https://github.com/nodejs/node/pull/51884
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2024-03-02 14:33:25 +00:00
Antoine du Hamel 14293814a7 doc: clarify Corepack threat model 
PR-URL: https://github.com/nodejs/node/pull/51917
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2024-03-01 23:02:41 +00:00
Ethan ArrowoodandJoyee Cheung 009665fb56 report: add --report-exclude-network option 
New option `--report-exclude-network`, also available as
`report.excludeNetwork`, enables the user to exclude
networking interfaces in their diagnostic report.
On some systems, this can cause the report to take minutes
to generate so this option can be used to optimize that.

Fixes: https://github.com/nodejs/node/issues/46060

PR-URL: https://github.com/nodejs/node/pull/51645

Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
 2024-03-01 21:50:04 +00:00
Michał Drobniak 00dc6d9d97 test_runner: improve --test-name-pattern to allow matching single test 
Try to match a test by name prefixed with all its ancestors
to ensure uniqueness of the name

Fixes: https://github.com/nodejs/node/issues/46728
PR-URL: https://github.com/nodejs/node/pull/51577
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2024-03-01 12:58:11 +00:00
Moshe Atlow aac5ad901d test_runner: add test:complete event to reflect execution order 
PR-URL: https://github.com/nodejs/node/pull/51909
Fixes: https://github.com/nodejs/node/issues/51907
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2024-03-01 10:08:09 +00:00
Anna Henningsen 40565e90b4 lib: account for cwd access from snapshot serialization cb 
Functions registered with `addSerializeCallback()` can access and call
`process.cwd()`. b7d836e2c7 accounted for the fact that it is
necessary to reset the cwd cache after the snapshot builder script has
run, but did not account for possible accesses from serialization
callbacks. To properly account for these, add a deserialization
callback as well.

As a related drive-by fix, also mention the execution order of
callbacks in the documentation.

Refs: https://github.com/nodejs/node/pull/49684
PR-URL: https://github.com/nodejs/node/pull/51901
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2024-02-29 20:55:00 +00:00
JounQin 2f01f02ac6 doc: remove redundant backquote which breaks sentence 
PR-URL: https://github.com/nodejs/node/pull/51904
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: theanarkh <theratliter@gmail.com>
Reviewed-By: Qingyu Deng <i@ayase-lab.com>
 2024-02-28 10:52:11 +00:00
Shrujal Shah 7824a79eba doc: update guide link for Event Loop 
PR-URL: https://github.com/nodejs/node/pull/51874
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Qingyu Deng <i@ayase-lab.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2024-02-27 13:29:59 +00:00
Joyee Cheung 4c46439fe9 crypto: implement crypto.hash() 
This patch introduces a helper crypto.hash() that computes
a digest from the input at one shot. This can be 1.2-1.6x faster
than the object-based createHash() for smaller inputs (<= 5MB)
that are readily available (not streamed) and incur less memory
overhead since no intermediate objects will be created.

PR-URL: https://github.com/nodejs/node/pull/51044
Refs: https://github.com/nodejs/performance/issues/136
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
 2024-02-27 13:27:19 +01:00
Ameet Kaustav 123dc51c6c doc: change ExperimentalWarnings to ExperimentalWarning 
PR-URL: https://github.com/nodejs/node/pull/51741
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
 2024-02-26 13:14:36 +00:00
Rafael GonzagaandHemanth HM 455644582d util: add styleText API to text formatting 
Co-Authored-By: Hemanth HM <hemanth.hm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/51850
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Adrian Estrada <edsadr@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2024-02-26 09:55:57 +00:00
Tobias Nießen 57f9298090 doc,crypto: further clarify RSA_PKCS1_PADDING support 
PR-URL: https://github.com/nodejs/node/pull/51799
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
 2024-02-20 10:23:54 -05:00
Filip Skokan fe2299089d doc,crypto: add changelog and note about disabled RSA_PKCS1_PADDING 
PR-URL: https://github.com/nodejs/node/pull/51782
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2024-02-18 15:04:19 +00:00
Joyee Cheung ec3040f721 sea: update stability index 
The design is relatively stable now and it's more suitable to
describe it as being "in active developement".

PR-URL: https://github.com/nodejs/node/pull/51774
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Debadree Chatterjee <debadree333@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
 2024-02-17 18:03:26 +00:00
Antoine du Hamel 10c6596f6d doc: fix globals.md introduction 
Splitting the introduction sentence in two paragraphs so it's
clearer the list of variables only apply to the second sentence.

PR-URL: https://github.com/nodejs/node/pull/51742
Reviewed-By: Jithil P Ponnan <jithil@outlook.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
 2024-02-15 08:30:44 +00:00
Tobias Nießen 6d14352c51 src,deps: disable setuid() etc if io_uring enabled 
Within Node.js, attempt to determine if libuv is using io_uring. If it
is, disable process.setuid() and other user identity setters.

We cannot fully prevent users from changing the process's user identity,
but this should still prevent some accidental, dangerous scenarios.

PR-URL: https://github.com/nodejs-private/node-private/pull/528
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2024-22017
 2024-02-14 14:27:34 -03:00
Tobias Nießen 42e659cb9d deps: disable io_uring support in libuv by default 
setuid() does not affect libuv's internal io_uring operations if
initialized before the call to setuid(). This potentially allows the
process to perform privileged operations despite presumably having
dropped such privileges through a call to setuid(). Similar concerns
apply to other functions that modify the process's user identity.

This commit changes libuv's io_uring behavior from opt-out (through
UV_USE_IO_URING=0) to opt-in (through UV_USE_IO_URING=1) until we figure
out a better long-term solution.

PR-URL: https://github.com/nodejs-private/node-private/pull/528
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2024-22017
 2024-02-14 14:27:34 -03:00
RafaelGSS 834ae3785b test,doc: clarify wildcard usage 
Follow-up: https://github.com/nodejs/node/pull/51209
PR-URL: https://github.com/nodejs-private/node-private/pull/517
Fixes: https://hackerone.com/bugs?subject=nodejs&report_id=2257156
CVE-ID: CVE-2024-21890
 2024-02-14 14:27:34 -03:00
RafaelGSS b43171c6f6 2024-02-14, Version 21.6.2 (Current) 
This is a security release.

Notable changes:

crypto:
  * disable PKCS#1 padding for privateDecrypt (Michael Dawson) https://github.com/nodejs-private/node-private/pull/525
deps:
  * upgrade libuv to 1.48.0 (Santiago Gimeno) https://github.com/nodejs/node/pull/51698
  * disable io_uring support in libuv by default (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/528
fs:
  * protect against modified Buffer internals in possiblyTransformPath (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/497
http:
  * add maximum chunk extension size (Paolo Insogna) https://github.com/nodejs-private/node-private/pull/518
lib:
  * update undici to v5.28.3 (Matteo Collina) https://github.com/nodejs-private/node-private/pull/538
  * use cache fs internals against path traversal (RafaelGSS) https://github.com/nodejs-private/node-private/pull/516
src:
  * fix HasOnly(capability) in node::credentials (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/505
src,deps:
  * disable setuid() etc if io_uring enabled (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/528
test,doc:
  * clarify wildcard usage (RafaelGSS) https://github.com/nodejs-private/node-private/pull/517
zlib:
  * pause stream if outgoing buffer is full (Matteo Collina) https://github.com/nodejs-private/node-private/pull/540

PR-URL: https://github.com/nodejs-private/node-private/pull/543
 2024-02-14 14:12:25 -03:00
marco-ippolito 5405aa5b90 2024-02-14, Version 20.11.1 'Iron' (LTS) 
This is a security release.

Notable changes:

crypto:
  * disable PKCS#1 padding for privateDecrypt (Michael Dawson) https://github.com/nodejs-private/node-private/pull/525
deps:
  * upgrade libuv to 1.48.0 (Santiago Gimeno) https://github.com/nodejs/node/pull/51699
  * update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/51614
  * upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/51614
  * disable io\_uring support in libuv by default (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/529
  * fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) https://github.com/nodejs/node/pull/51737
fs:
  * protect against modified Buffer internals in possiblyTransformPath (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/49
http:
  * add maximum chunk extension size (Paolo Insogna) https://github.com/nodejs-private/node-private/pull/519
lib:
  * update undici to v5.28.3 (Matteo Collina) https://github.com/nodejs-private/node-private/pull/539
  * use cache fs internals against path traversal (RafaelGSS) https://github.com/nodejs-private/node-private/pull/516
src:
  * fix HasOnly(capability) in node::credentials (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/505
src,deps:
  * disable setuid() etc if io\_uring enabled (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/529
test,doc:
  * clarify wildcard usage (RafaelGSS) https://github.com/nodejs-private/node-private/pull/517
zlib:
  * pause stream if outgoing buffer is full (Matteo Collina) https://github.com/nodejs-private/node-private/pull/541

PR-URL: https://github.com/nodejs-private/node-private/pull/544
 2024-02-14 14:10:22 -03:00
marco-ippolito 2a5a150772 2024-02-14, Version 18.19.1 'Hydrogen' (LTS) 
This is a security release.

Notable changes:

crypto:
  * update root certificates to NSS 3.95 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/50805
  * disable PKCS#1 padding for privateDecrypt (Michael Dawson) https://github.com/nodejs-private/node-private/pull/525
deps:
  * upgrade npm to 10.2.4 (npm team) https://github.com/nodejs/node/pull/50751
  * update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/51614
  * upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) ://github.com/nodejs/node/pull/51614
  * fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) https://github.com/nodejs/node/pull/51614
http:
  * add maximum chunk extension size (Paolo Insogna) https://github.com/nodejs-private/node-private/pull/520
lib:
  * update undici to v5.28.3 (Matteo Collina) https://github.com/nodejs-private/node-private/pull/536
src:
  * fix HasOnly(capability) in node::credentials (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/505
test:
  * skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) https://github.com/nodejs/node/pull/49621
tools:
  * add macOS notarization verification step (Ulises Gascón) https://github.com/nodejs/node/pull/50833
  * use macOS keychain to notarize the releases (Ulises Gascón) https://github.com/nodejs/node/pull/50715
  * remove unused file (Ulises Gascon) https://github.com/nodejs/node/pull/50622
  * add macOS notarization stapler (Ulises Gascón) https://github.com/nodejs/node/pull/50625
  * improve macOS notarization process output readability (Ulises Gascón) https://github.com/nodejs/node/pull/50389
  * remove unused `version` function (Ulises Gascón) https://github.com/nodejs/node/pull/50390
win,tools:
  * upgrade Windows signing to smctl (Stefan Stojanovic) https://github.com/nodejs/node/pull/50956
zlib:
  * pause stream if outgoing buffer is full (Matteo Collina) https://github.com/nodejs-private/node-private/pull/542

PR-URL: https://github.com/nodejs-private/node-private/pull/545
 2024-02-14 14:05:41 -03:00
Dmitry Semigradsky bf39716735 doc: updates for better json generating 
PR-URL: https://github.com/nodejs/node/pull/51592
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
 2024-02-13 21:37:42 +00:00
Aras Abbasi c975384264 lib: enable WebSocket by default 
PR-URL: https://github.com/nodejs/node/pull/51594
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
 2024-02-04 14:03:39 +00:00
Gabriel Schulhof 5acd42ed9e doc: fix uncaught exception example 
PR-URL: https://github.com/nodejs/node/pull/51638
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Akhil Marsonya <akhil.marsonya27@gmail.com>
 2024-02-03 17:36:37 +00:00
Ognjen Jevremović 9aa211edf5 doc: clarify execution of after hook on test suite completion 
The `after` hook now explicitly mentions that it is executed once after
all the tests in a test suite have completed, regardless of whether the
tests passed or failed. This ensures that cleanup tasks or actions
specified in the after hook are guaranteed to run.

Refs: https://github.com/nodejs/node/issues/50901
PR-URL: https://github.com/nodejs/node/pull/51523
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
 2024-02-03 06:24:22 +00:00
Joyee Cheung c307ad7686 sea: support sea.getRawAsset() 
This patch adds support for `sea.getRawAsset()` which is
similar to `sea.getAsset()` but returns the raw asset
in an array buffer without copying. Users should avoid
writing to the returned array buffer. If the injected
section is not marked as writable or not aligned,
writing to the raw asset is likely to result in a crash.

PR-URL: https://github.com/nodejs/node/pull/50960
Refs: https://github.com/nodejs/single-executable/issues/68
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
 2024-02-02 15:25:34 +01:00
Joyee Cheung ce8f085d26 sea: support embedding assets 
With this patch:

Users can now include assets by adding a key-path dictionary
to the configuration as the `assets` field. At build time, Node.js
would read the assets from the specified paths and bundle them into
the preparation blob. In the generated executable, users can retrieve
the assets using the `sea.getAsset()` and `sea.getAssetAsBlob()` API.

```json
{
  "main": "/path/to/bundled/script.js",
  "output": "/path/to/write/the/generated/blob.blob",
  "assets": {
    "a.jpg": "/path/to/a.jpg",
    "b.txt": "/path/to/b.txt"
  }
}
```

The single-executable application can access the assets as follows:

```cjs
const { getAsset } = require('node:sea');
// Returns a copy of the data in an ArrayBuffer
const image = getAsset('a.jpg');
// Returns a string decoded from the asset as UTF8.
const text = getAsset('b.txt', 'utf8');
// Returns a Blob containing the asset.
const blob = getAssetAsBlob('a.jpg');
```

Drive-by: update the  documentation to include a section dedicated
to the injected main script and refer to it as "injected main
script" instead of "injected module" because it's a script, not
a module.

PR-URL: https://github.com/nodejs/node/pull/50960
Refs: https://github.com/nodejs/single-executable/issues/68
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
 2024-02-02 15:25:34 +01:00
Joyee Cheung ad0bcb9c02 vm: support using the default loader to handle dynamic import() 
This patch adds support for using
`vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER` as
`importModuleDynamically` in all APIs that take the option
except `vm.SourceTextModule`. This allows users to have a shortcut
to support dynamic import() in the compiled code without missing
the compilation cache if they don't need customization of the
loading process. We emit an experimental warning when the
`import()` is actually handled by the default loader through
this option instead of requiring `--experimental-vm-modules`.

In addition this refactors the documentation for
`importModuleDynamically` and adds a dedicated section for it
with examples.

`vm.SourceTextModule` is not supported in this patch because
it needs additional refactoring to handle `initializeImportMeta`,
which can be done in a follow-up.

PR-URL: https://github.com/nodejs/node/pull/51244
Fixes: https://github.com/nodejs/node/issues/51154
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
 2024-02-01 11:45:42 +00:00
Antoine du Hamel 3fbe1579ce esm: improve error when calling import.meta.resolve from data: URL 
PR-URL: https://github.com/nodejs/node/pull/49516
Reviewed-By: James M Snell <jasnell@gmail.com>
 2024-01-31 23:22:18 +01:00
IlyasShabi 8b2836611e src: support multi-line values for .env file 
PR-URL: https://github.com/nodejs/node/pull/51289
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
 2024-01-31 13:09:13 +00:00