Add description of user responsibility in the choice of cypto
algorithms and its key length. Some of recommendations for the safer
use are also described.
PR-URL: https://github.com/nodejs/node/pull/3479
Reviewed-By: James M Snell <jasnell@gmail.com>
Update the documentation for `process.stdout` and `process.stdout` to
clarify that writes can block when stdio is redirected to a file. In
all other cases, it's non-blocking.
PR-URL: https://github.com/nodejs/node/pull/3170
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Fixed an intermittent issue on AIX where the 600ms timeout was reached
before the 'connection' event was fired. This resulted in a failure as
serverConnection would be undefined and the assert.equal would throw an
error. Changed the flow of the test so that the timeout is only set
after a connection has been made.
PR-URL: https://github.com/nodejs/node/pull/3646
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Check that trying to use a < 1024 bits DH key throws an exception.
parallel/test-tls-dhe tests this as well but it feels incongruous not to
do it here when both tests have similar logic for 1024/2048 bits keys.
PR-URL: https://github.com/nodejs/node/pull/3629
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
When setTimeout() and setInterval() are called with `delay` greater than
TIMEOUT_MAX (2147483647), the supplied value is ignored and 1 is used
instead. Add a note about this in the timers docs.
PR-URL: https://github.com/nodejs/node/pull/3512
Reviewed-By: Trevor Norris <trev.norris@gmai.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Neuter external `nullptr` buffers, otherwise their contents will be
materialized on access, and the buffer instance will be internalized.
This leads to a crash like this:
v8::ArrayBuffer::Neuter Only externalized ArrayBuffers can be
neutered
Fix: #3619
PR-URL: https://github.com/nodejs/node/pull/3624
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
Fix regarding description of the following functions:
Certificate.exportPublicKey(spkac)
Certificate.exportChallenge(spkac)
The descriptions were applied incorrectly.
PR-URL: https://github.com/nodejs/node/pull/3614
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
This is to ensure that it is evaluated the same way it would be if it
were to be run by node or required.
Before, the following would pass if run by node, but fail if run via
the syntax check flag:
if (true) {
return;
}
Now, this will pass the syntax check
PR-URL: https://github.com/nodejs/node/pull/3587
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Notable changes:
* buffer: (Breaking) Removed both 'raw' and 'raws' encoding types from Buffer,
these have been deprecated for a long time (Sakthipriyan Vairamani) #2859.
* console: (Breaking) Values reported by console.time() now have 3 decimals of
accuracy added (Michaël Zasso) #3166.
* fs:
- fs.readFile*(), fs.writeFile*(), and fs.appendFile*() now also accept a file
descriptor as their first argument (Johannes Wüller) #3163.
- (Breaking) In fs.readFile(), if an encoding is specified and the internal
toString() fails the error is no longer thrown but is passed to the callback
(Evan Lucas) #3485.
- (Breaking) In fs.read() (using the fs.read(fd, length, position, encoding,
callback) form), if the internal toString() fails the error is no longer
thrown but is passed to the callback (Evan Lucas) #3503.
* http:
- Fixed a bug where pipelined http requests would stall (Fedor Indutny) #3342.
- (Breaking) When parsing HTTP, don't add duplicates of the following headers:
Retry-After, ETag, Last-Modified, Server, Age, Expires. This is in addition
to the following headers which already block duplicates: Content-Type,
Content-Length, User-Agent, Referer, Host, Authorization,
Proxy-Authorization, If-Modified-Since, If-Unmodified-Since, From, Location,
Max-Forwards (James M Snell) #3090.
- (Breaking) The callback argument to OutgoingMessage#setTimeout() must be a
function or a TypeError is thrown (James M Snell) #3090.
- (Breaking) HTTP methods and header names must now conform to the RFC 2616
"token" rule, a list of allowed characters that excludes control characters
and a number of separator characters. Specifically, methods and header names
must now match /^[a-zA-Z0-9_!#$%&'*+.^`|~-]+$/ or a TypeError will be thrown
(James M Snell) #2526.
* node:
- (Breaking) Deprecated the _linklist module (Rich Trott) #3078.
- (Breaking) Removed require.paths and require.registerExtension(), both had
been previously set to throw Error when accessed
(Sakthipriyan Vairamani) #2922.
* npm: Upgraded to version 3.3.6 from 2.14.7, see
https://github.com/npm/npm/releases/tag/v3.3.6 for more details. This is a
major version bump for npm and it has seen a significant amount of change.
Please see the original npm v3.0.0 release notes for a list of major changes
(Rebecca Turner) #3310.
* src: (Breaking) Bumped NODE_MODULE_VERSION to 47 from 46, this is necessary
due to the V8 upgrade. Native add-ons will need to be recompiled
(Rod Vagg) #3400.
* timers: Attempt to reuse the timer handle for setTimeout().unref(). This fixes
a long-standing known issue where unrefed timers would perviously hold
beforeExit open (Fedor Indutny) #3407.
* tls:
- Added ALPN Support (Shigeki Ohtsu) #2564.
- TLS options can now be passed in an object to createSecurePair()
(Коренберг Марк) #2441.
- (Breaking) The default minimum DH key size for tls.connect() is now 1024
bits and a warning is shown when DH key size is less than 2048 bits. This a security consideration to prevent "logjam" attacks. A new minDHSize TLS
option can be used to override the default. (Shigeki Ohtsu) #1831.
* util:
- (Breaking) util.p() was deprecated for years, and has now been removed
(Wyatt Preul) #3432.
- (Breaking) util.inherits() can now work with ES6 classes. This is considered
a breaking change because of potential subtle side-effects caused by a
change from directly reassigning the prototype of the constructor using
`ctor.prototype = Object.create(superCtor.prototype, { constructor: { ... } })`
to using `Object.setPrototypeOf(ctor.prototype, superCtor.prototype)`
(Michaël Zasso) #3455.
* v8: (Breaking) Upgraded to 4.6.85.25 from 4.5.103.35 (Ali Ijaz Sheikh) #3351.
- Implements the spread operator, see
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Spread_operator
for further information.
- Implements new.target, see
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target
for further information.
* zlib: Decompression now throws on truncated input (e.g. unexpected end of
file) (Yuval Brik) #2595.
PR-URL: https://github.com/nodejs/node/pull/3466
Currently util.format is being used for string templating in tls.
By replacing all of the instances of util.format with backtick
string we can remove the need to require util in tls all together.
PR-URL: https://github.com/nodejs/node/pull/3456
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Fedor Indutny <fedor@indutny.com>
The documentation indicates that child.send() returns a boolean but it
has returned undefinined at since v0.12.0. It now returns a boolean per
the (slightly updated) documentation.
PR-URL: https://github.com/nodejs/node/pull/3516
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Fix the following error message in windows using VS 2013:
LINK : fatal error LNK1194: cannot delay-load 'node.exe'
due to import of data symbol '"__declspec(dllimport)
const v8::OutputStream::`vftable'"
(__imp_??_7OutputStream@v8@@6B@)'; link without
/DELAYLOAD:node.exe
PR-URL: https://github.com/nodejs/node/pull/3572
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
There is currently no information in the Collaborators guide regarding
LTS. This commit adds some basic copy explaining what LTS is, what is
considered for LTS, and a simple way collaborators can help.
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Steven R. Loomis <srloomis@us.ibm.com>
PR-URL: https://github.com/nodejs/node/pull/3442
This is a reland of https://github.com/nodejs/node/pull/3165. The patch abates
the truncation of script filenames in the perf-event output produced by V8.
V8 commits:
Original: https://github.com/v8/v8/commit/03ef3cd004c2fd31ae7e48772f106df67b8c2feb
Reland: https://github.com/v8/v8/commit/010897c16adb46d3fe403eab525502a63e174b0c
Original commit message:
improve perf_basic_prof filename reporting
The buffer used for appending filenames to the string printed to the
perf_basic_prof log was unnecessarily too small. Bump it up to be at least
kUtf8BufferSize.
Truncation of filenames makes it really hard to work with profiles gathered on
Node.js. Because of the way Node.js works, you can have node module dependencies
in deeply nested directories. The last thing you want when investigating a
performance problem is to have script names be truncated.
This patch is a stop-gap. Ideally, I want no truncation of the filename at all
and use a dynamically growing buffer. That would be a larger change, and I
wanted to have a quick fix available that can be back-ported to Node.js LTS
release.
R=yangguo@chromium.org,yurys@chromium.org
BUG=
Review URL: https://codereview.chromium.org/1388543002
PR-URL: https://github.com/nodejs/node/pull/3520
Reviewed-By: bnoordhuis - Ben Noordhuis <info@bnoordhuis.nl>
Rebecca Turner