Add example to show what running Node.js with `--inspect`
should look like.
Some IDEs do not show the link when running with `--inspect`.
This example hints to what the full output looks like.
PR-URL: https://github.com/nodejs/node/pull/8845
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
This is a security release. All Node.js users should consult the
security release summary at
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
for details on patched vulnerabilities.
Notable Changes
Semver Minor:
* openssl:
- Upgrade to 1.0.2i, fixes a number of defects impacting Node.js:
CVE-2016-6304 ("OCSP Status Request extension unbounded memory
growth", high severity), CVE-2016-2183, CVE-2016-2178, and CVE-2016-6306.
(Shigeki Ohtsu) https://github.com/nodejs/node/pull/8714
- Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in
a crash when using CRLs, CVE-2016-7052.
(Shigeki Ohtsu) https://github.com/nodejs/node/pull/8786
- Remove support for loading dynamic third-party engine modules.
An attacker may be able to hide malicious code to be inserted
into Node.js at runtime by masquerading as one of the dynamic
engine modules. Originally reported by Ahmed Zaki (Skype).
(Ben Noordhuis) https://github.com/nodejs/node-private/pull/73
* http: CVE-2016-5325 - Properly validate for allowable characters in
the `reason` argument in `ServerResponse#writeHead()`. Fixes a
possible response splitting attack vector. This introduces a new
case where `throw` may occur when configuring HTTP responses, users
should already be adopting try/catch here. Originally reported
independently by Evan Lucas and Romain Gaucher.
(Evan Lucas) https://github.com/nodejs/node-private/pull/60
Semver Patch:
* buffer: Zero-fill excess bytes in new `Buffer` objects created with
`Buffer.concat()` while providing a `totalLength` parameter that
exceeds the total length of the original `Buffer` objects being
concatenated.
(Сковорода Никита Андреевич) https://github.com/nodejs/node-private/pull/64
* src: Fix regression where passing an empty password and/or salt to
crypto.pbkdf2() would cause a fatal error
(Rich Trott) https://github.com/nodejs/node/pull/8572
* tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
check whereby a TLS server may be able to serve an invalid wildcard
certificate for its hostname due to improper validation of `*.` in the
wildcard string. Originally reported by Alexander Minozhenko and
James Bunton (Atlassian).
(Ben Noordhuis) https://github.com/nodejs/node-private/pull/75
* v8: Fix regression where a regex on a frozen object was broken
(Myles Borins) https://github.com/nodejs/node/pull/8673
PR-URL: https://github.com/nodejs/node/pull/8475
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Clarify a few items in the onboarding doc about landing a PR. One
addition is to include the optional `Refs:` metadata.
PR-URL: https://github.com/nodejs/node/pull/8479
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/8488
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/8281
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Define the context property r.context.m, not r.m.
PR-URL: https://github.com/nodejs/node/pull/8469
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Note that trying to listen for some signals using `process.on()`
is unsafe in the `process` docs.
PR-URL: https://github.com/nodejs/node/pull/8410
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Emit two line events when there is a delay between
CR('\r') and LF('\n').
Introduced a new option `crlfDelay`. If the delay between \r and \n
exceeds `crlfDelay` milliseconds, both \r and \n will be treated as
separate end-of-line input. Default to 100 milliseconds.
`crlfDelay` will be coerced to [100, 2000] range.
PR-URL: https://github.com/nodejs/node/pull/8109
Reviewed-By: Yorkie Liu <yorkiefixer@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reinstate crypto.timingSafeEqual() which was reverted due to test
issues. The flaky test issues are resolved in this new changeset.
PR-URL: https://github.com/nodejs/node/pull/8304
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
PR-URL: https://github.com/nodejs/node/pull/8229
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
* add node-test-pull-request link
* minor formatting improvements
PR-URL: https://github.com/nodejs/node/pull/8374
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Prince John Wesley <princejohnwesley@gmail.com>
fix a wrong link to ../topics/the-event-loop-timers-and-nexttick.md
PR-URL: https://github.com/nodejs/node/pull/8315
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/8370
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Prince John Wesley <princejohnwesley@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reword and re-organize. Only significant content change is to
specifically call out the two-CTC-member-LGTM requirement for
semver-major changes.
PR-URL: https://github.com/nodejs/node/pull/8344
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
PR-URL: https://github.com/nodejs/node/pull/8326
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
This makes the famous `EventEmitter memory leak` warnings occurring
when the listener count for a given event exceeds a specified number
more programatically accessible, by giving them properties referring
to the event emitter instance and the event itself.
This can be useful for debugging the origins of such a warning when
the stack itself doesn’t reveal enough information about the event
emitter instance itself, e.g. when manual inspection of the
already-registered listeners is expected to be useful.
PR-URL: https://github.com/nodejs/node/pull/8298
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jeremiah Senkpiel <Fishrock123@rocketmail.com>
The default value of the `len` parameter is zero and it is included in
the documenetation.
This patch also has examples of how `ftruncate` can be used.
PR-URL: https://github.com/nodejs/node/pull/7648
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/8250
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Bryan English <bryan@bryanenglish.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
In example parseHeader, stream listen **readable** event,
if call stream.unshift(buf) before stream.removeListener('readable',
onReadable), readable event will be emited before removeListener,
so callback will not been called correctlly.
After change to
```js
stream.removeListener('error', callback);
stream.removeListener('readable', onReadable);
if (buf.length)
stream.unshift(buf);
```
It solves this problem.
PR-URL: https://github.com/nodejs/node/pull/8200
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
The function signature of `util._extend` is not intuitive and the
documentation doesn't specify the necessary second parameter. This
patch changes the parameter names in the code and the function params
in doc.
PR-URL: https://github.com/nodejs/node/pull/8187
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Yorkie Liu <yorkiefixer@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
The documentation describing the output from the examples for
buf.readUIntBE and buf.readUIntLE were switched in terms of what the
code would actually output. This patch addresses this by switching the
two lines of example code to be in the same order as the functions are
listed earlier in the documentation.
PR-URL: https://github.com/nodejs/node/pull/8240
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Prince John Wesley <princejohnwesley@gmail.com>
Corrected to `timeout`
PR-URL: https://github.com/nodejs/node/pull/8231
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Yorkie Liu <yorkiefixer@gmail.com>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
`mkdtemp` functions accept an optional `options` parameter, which can
be either a String specifying encoding, or an Object with an `encoding`
property.
PR-URL: https://github.com/nodejs/node/pull/7842
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Claudio Rodriguez <cjrodr@yahoo.com>
Add a `util.inspect.custom` Symbol which can be used to customize
`util.inspect()` output. Providing `obj[util.inspect.custom]`
works like providing `obj.inspect`, except that the former allows
avoiding name clashes with other `inspect()` methods.
Fixes: https://github.com/nodejs/node/issues/8071
PR-URL: https://github.com/nodejs/node/pull/8174
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Refs: https://github.com/nodejs/node/pull/8437
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
PR-URL: https://github.com/nodejs/node/pull/8206
Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Bryan English <bryan@bryanenglish.com>
PR-URL: https://github.com/nodejs/node/pull/8158
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Added class/extends example to util.md
PR-URL: https://github.com/nodejs/node/pull/8183
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yorkie Liu <yorkiefixer@gmail.com>
Reviewed-By: Robert Jefe Lindstaedt <robert.lindstaedt@gmail.com>
Const is block scoped.
PR-URL: https://github.com/nodejs/node/pull/8124
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
querystring subsystem docs referred to `obj.hashOwnProperty()`
which is non-existent. Corrected to `obj.hasOwnProperty()`.
PR-URL: https://github.com/nodejs/node/pull/8107
Reviewed-By: targos - Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Prince John Wesley <princejohnwesley@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/8060
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
`POST_STATUS_TO_PR` previously did not work.
Now it works.
Update the onboarding documentation accordingly.
PR-URL: https://github.com/nodejs/node/pull/8059
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Franziska Hinkelmann
Evan Lucas
Jeremiah Senkpiel
Italo A. Casas
Rich Trott
Josh Gavant
yorkie
Luigi Pinca
Anna Henningsen
Prince J Wesley
not-an-aardvark
Mike Ralphson
Alexis374
Brian White
Dan Fabulich
Hubert Mine
James M Snell
Sakthipriyan Vairamani
Zwb
David Keeler
Fangshi He
Simen Bekkhus
Shahid Shaikh
Bartosz Sosnowski
lazlojuly
Tracy Hinds
Ben Gourley
cjihrig