lukechilds/node - node - Gitea: Git with a cup of tea

Commit Graph

Author	SHA1	Message	Date
Jeremiah Senkpiel	e4ee09a5b3	2016-10-12, Version 6.8.0 (Current) * fs: - `SyncWriteStream` now inherits from `Stream.Writable`. (Anna Henningsen) https://github.com/nodejs/node/pull/8830 - Practically, this means that when stdio is piped to a file, stdout and stderr will still be `Writable` streams. - `fs.existsSync()` has been undeprecated. `fs.exists()` remains deprecated. (Dan Fabulich) https://github.com/nodejs/node/pull/8364 * http: `http.request()` now accepts a `timeout` option. (Rene Weber) https://github.com/nodejs/node/pull/8101 * module: The module loader now maintains its own realpath cache. (Anna Henningsen) https://github.com/nodejs/node/pull/8100 * npm: Upgraded to 3.10.8 (Kat Marchán) https://github.com/nodejs/node/pull/8706 * stream: `Duplex` streams now show proper `instanceof Stream.Writable`. (Anna Henningsen) https://github.com/nodejs/node/pull/8834 * timers: Improved `setTimeout`/`Interval` performance by up to 22%. (Brian White) https://github.com/nodejs/node/pull/8661 PR-URL: https://github.com/nodejs/node/pull/9034	8 years ago
Evan Lucas	3d54ea4304	doc: fix broken links in changelogs Some commit links in the changelogs were pointing to incorrect/missing shas. PR-URL: https://github.com/nodejs/node/pull/8122 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>	8 years ago
Evan Lucas	aae1862385	2016-09-27, Version 6.7.0 (Current) This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ for details on patched vulnerabilities. Notable Changes Semver Minor: * openssl: - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity), CVE-2016-2183, CVE-2016-2178, and CVE-2016-6306. (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8714 - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8786 - Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) https://github.com/nodejs/node-private/pull/73 * http: CVE-2016-5325 - Properly validate for allowable characters in the `reason` argument in `ServerResponse#writeHead()`. Fixes a possible response splitting attack vector. This introduces a new case where `throw` may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) https://github.com/nodejs/node-private/pull/60 Semver Patch: * buffer: Zero-fill excess bytes in new `Buffer` objects created with `Buffer.concat()` while providing a `totalLength` parameter that exceeds the total length of the original `Buffer` objects being concatenated. (Сковорода Никита Андреевич) https://github.com/nodejs/node-private/pull/64 * src: Fix regression where passing an empty password and/or salt to crypto.pbkdf2() would cause a fatal error (Rich Trott) https://github.com/nodejs/node/pull/8572 * tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of `.` in the wildcard string. Originally reported by Alexander Minozhenko and James Bunton (Atlassian). (Ben Noordhuis) https://github.com/nodejs/node-private/pull/75 v8: Fix regression where a regex on a frozen object was broken (Myles Borins) https://github.com/nodejs/node/pull/8673	8 years ago
Rod Vagg	eba39c4bc6	2016-09-27, Version 4.6.0 'Argon' (LTS) This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ for details on patched vulnerabilities. Notable Changes Semver Minor: * openssl: - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8714 - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8786 - Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) https://github.com/nodejs/node-private/pull/70 * http: CVE-2016-5325 - Properly validate for allowable characters in the `reason` argument in `ServerResponse#writeHead()`. Fixes a possible response splitting attack vector. This introduces a new case where `throw` may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) https://github.com/nodejs/node-private/pull/46 Semver Patch: * buffer: Zero-fill excess bytes in new `Buffer` objects created with `Buffer.concat()` while providing a `totalLength` parameter that exceeds the total length of the original `Buffer` objects being concatenated. (Сковорода Никита Андреевич) https://github.com/nodejs/node-private/pull/65 * tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of `*.` in the wildcard string. Originally reported by Alexander Minozhenko and James Bunton (Atlassian). (Ben Noordhuis) https://github.com/nodejs/node-private/pull/63 PR-URL: https://github.com/nodejs/node-private/pull/74	8 years ago
Rod Vagg	e686be90bb	2016-09-27 Version 0.12.16 (Maintenance) Release This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ for details on patched vulnerabilities. Notable changes: * buffer: Zero-fill excess bytes in new `Buffer` objects created with `Buffer.concat()` while providing a `totalLength` parameter that exceeds the total length of the original `Buffer` objects being concatenated. (Сковорода Никита Андреевич) * http: - CVE-2016-5325 - Properly validate for allowable characters in the `reason` argument in `ServerResponse#writeHead()`. Fixes a possible response splitting attack vector. This introduces a new case where `throw` may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) - Invalid status codes can no longer be sent. Limited to 3 digit numbers between 100 - 999. Lack of proper validation may also serve as a potential response splitting attack vector. Backported from v4.x. (Brian White) * openssl: - Upgrade to 1.0.1u, fixes a number of defects impacting Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. - Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis, Rod Vagg) * tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of `*.` in the wildcard string. Originally reported by Alexander Minozhenko and James Bunton (Atlassian). (Ben Noordhuis) PR-URL: https://github.com/nodejs/node-private/pull/72	8 years ago
Rod Vagg	f5ee3fe10e	2016-09-27 Version 0.10.47 (Maintenance) Release This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ for details on patched vulnerabilities. Notable changes: * buffer: Zero-fill excess bytes in new `Buffer` objects created with `Buffer.concat()` while providing a `totalLength` parameter that exceeds the total length of the original `Buffer` objects being concatenated. (Сковорода Никита Андреевич) * http: - CVE-2016-5325 - Properly validate for allowable characters in the `reason` argument in `ServerResponse#writeHead()`. Fixes a possible response splitting attack vector. This introduces a new case where `throw` may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) - Invalid status codes can no longer be sent. Limited to 3 digit numbers between 100 - 999. Lack of proper validation may also serve as a potential response splitting attack vector. Backported from v4.x. (Brian White) * openssl: Upgrade to 1.0.1u, fixes a number of defects impacting Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. * tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of `*.` in the wildcard string. Originally reported by Alexander Minozhenko and James Bunton (Atlassian). (Ben Noordhuis) PR-URL: https://github.com/nodejs/node-private/pull/71	8 years ago
Сковорода Никита Андреевич	50be885285	tools: enable more remark-lint rules New rules: 1. rule-style 2. strong-marker 3. no-shell-dollars 4. no-inline-padding 5. code-block-style 6. no-multiple-toplevel-headings Fixes to the existing files applied. PR-URL: https://github.com/nodejs/node/pull/8708 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com> Reviewed-By: Johan Bergström <bugs@bergstroem.nu> Reviewed-By: James M Snell <jasnell@gmail.com>	8 years ago
Jeremiah Senkpiel	ea2a309e3b	2016-09-14, Version 6.6.0 (Current) Notable changes: * crypto: Added `crypto.timingSafeEqual()`. (not-an-aardvark) https://github.com/nodejs/node/pull/8304 * events: Made the "max event listeners" memory leak warning more accessible. (Anna Henningsen) https://github.com/nodejs/node/pull/8298 * promises: Unhandled rejections now emit a process warning after the first tick. (Benjamin Gruenbaum) https://github.com/nodejs/node/pull/8223 * repl: Added auto alignment for `.editor` mode. (Prince J Wesley) https://github.com/nodejs/node/pull/8241 * util: Some functionality has been added to `util.inspect()`: - Returning `this` from a custom inspect function now works. (Anna Henningsen) https://github.com/nodejs/node/pull/8174 - Added support for Symbol-based custom inspection methods. (Anna Henningsen) https://github.com/nodejs/node/pull/8174 Refs: https://github.com/nodejs/node/issues/8428 Refs: https://github.com/nodejs/node/pull/8457 PR-URL: https://github.com/nodejs/node/pull/8466	8 years ago
Evan Lucas	0482d6d592	2016-08-26, Version 6.5.0 (Current) Notable changes: * buffer: Fix regression introduced in v6.4.0 that prevented .write() at buffer end (Anna Henningsen) https://github.com/nodejs/node/pull/8154 * deps: update V8 to 5.1.281.75 (Ali Ijaz Sheikh) https://github.com/nodejs/node/pull/8054 * inspector: * fix inspector hang while disconnecting (Aleksei Koziatinskii) https://github.com/nodejs/node/pull/8021 * add support for uncaught exception (Aleksei Koziatinskii) https://github.com/nodejs/node/pull/8043 * repl: Fix saving editor mode text in `.save` (Prince J Wesley) https://github.com/nodejs/node/pull/8145 * *Revert* "repl,util: insert carriage returns in output" (Evan Lucas) https://github.com/nodejs/node/pull/8143 PR-URL: https://github.com/nodejs/node/pull/8253	8 years ago
Myles Borins	e7bd4d2597	2016-08-15, Version 4.5.0 'Argon' (LTS) Notable Changes: Semver Minor: * buffer: * backport new buffer constructor APIs to v4.x (Сковорода Никита Андреевич) https://github.com/nodejs/node/pull/7562 * backport --zero-fill-buffers cli option (James M Snell) https://github.com/nodejs/node/pull/5745 * build: * add Intel Vtune profiling support (Chunyang Dai) https://github.com/nodejs/node/pull/5527 * repl: * copying tabs shouldn't trigger completion (Eugene Obrezkov) https://github.com/nodejs/node/pull/5958 * src: * add node::FreeEnvironment public API (Cheng Zhao) https://github.com/nodejs/node/pull/3098 * test: * run v8 tests from node tree (Bryon Leung) https://github.com/nodejs/node/pull/4704 * V8: * Add post mortem data to improve object inspection and function's context variables inspection (Fedor Indutny) https://github.com/nodejs/node/pull/3779 Semver Patch: * buffer: * ignore negative allocation lengths (Anna Henningsen) https://github.com/nodejs/node/pull/7562 * crypto: * update root certificates (Ben Noordhuis) https://github.com/nodejs/node/pull/7363 * libuv: * upgrade libuv to 1.9.1 (Saúl Ibarra Corretgé) https://github.com/nodejs/node/pull/6796 * upgrade libuv to 1.9.0 (Saúl Ibarra Corretgé) https://github.com/nodejs/node/pull/5994 * npm: * upgrade to 2.15.9 (Kat Marchán) https://github.com/nodejs/node/pull/7692	9 years ago
cjihrig	d83373d800	2016-08-15, Version 6.4.0 (Current) Notable changes: * build: zlib symbols and additional OpenSSL symbols are now exposed on Windows platforms. (Alex Hultman) https://github.com/nodejs/node/pull/7983 and https://github.com/nodejs/node/pull/7576 * child_process, cluster: Forked child processes and cluster workers now support stdio configuration. (Colin Ihrig) https://github.com/nodejs/node/pull/7811 and https://github.com/nodejs/node/pull/7838 * child_process: argv[0] can now be set to arbitrary values in spawned processes. (Pat Pannuto) https://github.com/nodejs/node/pull/7696 * fs: fs.ReadStream now exposes the number of bytes it has read so far. (Linus Unnebäck) https://github.com/nodejs/node/pull/7942 * repl: The REPL now supports editor mode. (Prince J Wesley) https://github.com/nodejs/node/pull/7275 * util: inspect() can now be configured globally using util.inspect.defaultOptions. (Roman Reiss) https://github.com/nodejs/node/pull/8013 Refs: https://github.com/nodejs/node/issues/8020 PR-URL: https://github.com/nodejs/node/pull/8070	8 years ago
Luigi Pinca	dabac8a2fb	doc: remove spurious new line in CHANGELOG_V6.md PR-URL: https://github.com/nodejs/node/pull/8009 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>	9 years ago
Сковорода Никита Андреевич	e1643ccc5a	doc: fix minor formatting issue in 0.10 changelog This splits one huge commit description into paragraphs, which supposedly was the intended behavior there. PR-URL: https://github.com/nodejs/node/pull/7727 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Michaël Zasso <mic.besace@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>	9 years ago
Сковорода Никита Андреевич	fc11fe8e5d	doc: remove extra indentation in iojs changelog This removes the extra two spaces indentation which was somewhy present in the iojs changelog from v1.8.1 to v3.3.1. iojs changelog was the only file affected. PR-URL: https://github.com/nodejs/node/pull/7727 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Michaël Zasso <mic.besace@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>	9 years ago
Сковорода Никита Андреевич	9ddc915a9c	doc: convert tabs to spaces Convert all instances of tab indentation in *.md files to spaces. This affects only three files. PR-URL: https://github.com/nodejs/node/pull/7727 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Michaël Zasso <mic.besace@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>	9 years ago
Timothy Gu	1896ca9e8e	doc: fill in missing V8 version PR-URL: https://github.com/nodejs/node/pull/7878 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Evan Lucas <evanlucas@me.com> Reviewed-By: Minwoo Jung <jmwsoft@gmail.com> Reviewed-By: Brian White <mscdex@mscdex.net> Reviewed-By: James M Snell <jasnell@gmail.com>	9 years ago
Evan Lucas	c21a212bdc	2016-07-21, Version 6.3.1 (Current) Notable changes: * buffer: * Improve performance of Buffer.from(str, 'hex') and Buffer#write(str, 'hex'). (Christopher Jeffrey) https://github.com/nodejs/node/pull/7602 * Fix creating from zero-length ArrayBuffer. (Ingvar Stepanyan) https://github.com/nodejs/node/pull/7176 * deps: * Upgrade to V8 5.0.71.xx. (Ben Noordhuis) https://github.com/nodejs/node/pull/7531 * Backport V8 instanceof bugfix (Franziska Hinkelmann) https://github.com/nodejs/node/pull/7638 * repl: Fix issue with function redeclaration. (Prince J Wesley) https://github.com/nodejs/node/pull/7794 * util: Fix inspecting of boxed symbols. (Anna Henningsen) https://github.com/nodejs/node/pull/7641 PR-URL: https://github.com/nodejs/node/pull/7782	9 years ago
Сковорода Никита Андреевич	a58b48bc3b	doc: various documentation formatting fixes * Fix markdown code sample in releases.md, it was <a id="x.y.x></a>" * Fix some markdown errors, e.g. in changelogs * Fix broken defs links, e.g. in domain-postmortem.md * Fix other broken refs, by addaleax * Add links to some defs that were present but not linked to * Remove dead defs * Move defs to the bottom (one file affected) * Add language indicators to all code blocks, using `txt` when no specific language could be chosen * Some minor formatting changes (spaces, ident, headings) PR-URL: https://github.com/nodejs/node/pull/7637 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Roman Reiss <me@silverwind.io>	9 years ago
vsemozhetbyt	80478a5240	doc: fix typo in the CHANGELOG_V6 compliment -> complement PR-URL: https://github.com/nodejs/node/pull/7568 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>	9 years ago
Jeremiah Senkpiel	7628031847	2016-07-06, Version 6.3.0 (Current) Notable changes: * buffer: Added `buffer.swap64()` to compliment `swap16()` & `swap32()`. (Zach Bjornson) https://github.com/nodejs/node/pull/7157 * build: New `configure` options have been added for building Node.js as a shared library. (Stefan Budeanu) https://github.com/nodejs/node/pull/6994 - The options are: `--shared`, `--without-v8-platform` & `--without-bundled-v8`. * crypto: Root certificates have been updated. (Ben Noordhuis) https://github.com/nodejs/node/pull/7363 * debugger: The server address is now configurable via `--debug=<address>:<port>`. (Ben Noordhuis) https://github.com/nodejs/node/pull/3316 * npm: Upgraded npm to v3.10.3 (Kat Marchán) https://github.com/nodejs/node/pull/7515 & (Rebecca Turner) https://github.com/nodejs/node/pull/7410 * readline: Added the `prompt` option to the readline constructor. (Evan Lucas) https://github.com/nodejs/node/pull/7125 * repl / vm: `sigint`/`ctrl+c` will now break out of infinite loops without stopping the Node.js instance. (Anna Henningsen) https://github.com/nodejs/node/pull/6635 * src: - Added a `node::FreeEnvironment` public C++ API. (Cheng Zhao) https://github.com/nodejs/node/pull/3098 - Refactored `require('constants')`, constants are now available directly from their respective modules. (James M Snell) https://github.com/nodejs/node/pull/6534 * stream: Improved `readable.read()` performance by up to 70%. (Brian White) https://github.com/nodejs/node/pull/7077 * timers: `setImmediate()` is now up to 150% faster in some situations. (Andras) https://github.com/nodejs/node/pull/6436 * util: Added a `breakLength` option to `util.inspect()` to control how objects are formatted across lines. (cjihrig) https://github.com/nodejs/node/pull/7499 * v8-inspector: Experimental support has been added for debugging Node.js over the inspector protocol. (Ali Ijaz Sheikh) https://github.com/nodejs/node/pull/6792 - Note: This feature is experimental, and it could be altered or removed. - You can try this feature by running Node.js with the `--inspect` flag. Refs: https://github.com/nodejs/node/pull/7441 PR-URL: https://github.com/nodejs/node/pull/7550	9 years ago
Myles Borins	21535e851c	2016-06-28, Version 4.4.7 'Argon' (LTS) This LTS release comes with 89 commits. This includes 46 commits that are docs related, 11 commits that are test related, 8 commits that are build related, and 4 commits that are benchmark related. Notable Changes: - debugger: - All properties of an array (aside from length) can now be printed in the repl (cjihrig) https://github.com/nodejs/node/pull/6448 - npm: - Upgrade npm to 2.15.8 (Rebecca Turner) https://github.com/nodejs/node/pull/7412 - stream: - Fix for a bug that became more prevalent with the stream changes that landed in v4.4.5. (Anna Henningsen) https://github.com/nodejs/node/pull/7160 - V8: - Fix for a bug in crankshaft that was causing crashes on arm64 (Myles Borins) https://github.com/nodejs/node/pull/7442 - Add missing classes to postmortem info such as JSMap and JSSet (evan.lucas) https://github.com/nodejs/node/pull/3792	9 years ago
Myles Borins	9744928cf5	doc: fix layout problem in v4 changelog The current layout is breaking the release post tool. This commit also removed erroneous entires in the main CHANGELOG for v4.4.6 and v5.12.0. PR-URL: https://github.com/nodejs/node/pull/7394 Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>	9 years ago
Evan Lucas	6a9438343b	2016-06-23, Version 5.12.0 (Stable) Notable changes: This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/june-2016-security-releases for details on patched vulnerabilities. * buffer * backport allocUnsafeSlow (Сковорода Никита Андреевич) [#7169](https://github.com/nodejs/node/pull/7169) * ignore negative allocation lengths (Anna Henningsen) [#7221](https://github.com/nodejs/node/pull/7221) * deps: backport 3a9bfec from v8 upstream (Ben Noordhuis) [nodejs/node-private#40](https://github.com/nodejs/node-private/pull/40) * Fixes a Buffer overflow vulnerability discovered in v8. More details can be found in the CVE (CVE-2016-1699). PR-URL: https://github.com/nodejs/node-private/pull/51	9 years ago
Rod Vagg	fb146cecc3	2016-06-23 Version 0.12.15 (Maintenance) Release This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/ for details on patched vulnerabilities. Notable changes: * libuv: (CVE-2014-9748) Fixes a bug in the read/write locks implementation for Windows XP and Windows 2003 that can lead to undefined and potentially unsafe behaviour. More information can be found at https://github.com/libuv/libuv/issues/515 or at https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/. * V8: (CVE-2016-1669) Fixes a potential Buffer overflow vulnerability discovered in V8, more details can be found in the CVE at https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1669 or at https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/. PR-URL: https://github.com/nodejs/node-private/pull/53	9 years ago
Rod Vagg	71b29bb8a9	2016-06-23 Version 0.10.46 (Maintenance) Release This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/ for details on patched vulnerabilities. Notable changes: * libuv: (CVE-2014-9748) Fixes a bug in the read/write locks implementation for Windows XP and Windows 2003 that can lead to undefined and potentially unsafe behaviour. More information can be found at https://github.com/libuv/libuv/issues/515 or at https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/. * V8: (CVE-2016-1669) Fixes a potential Buffer overflow vulnerability discovered in V8, more details can be found in the CVE CVE-2016-1669 at https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1669 or at https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/. Commits: * [`3374f57973`] - deps: update libuv to 0.10.37 (Saúl Ibarra Corretgé) https://github.com/nodejs/node/pull/7293 * [`fcb9145e29`] - deps: backport 3a9bfec from v8 upstream (Myles Borins) https://github.com/nodejs/node-private/pull/43 PR-URL: https://github.com/nodejs/node-private/pull/52	9 years ago
Myles Borins	a9c34aeae7	2016-06-23, Version 4.4.6 'Argon' (LTS) This is an important security release. All Node.js users should consult the security release summary at nodejs.org for details on patched vulnerabilities. This release is specifically related to a Buffer overflow vulnerability discovered in v8, more details can be found in the CVE https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1669 PR-URL: https://github.com/nodejs/node-private/pull/41	9 years ago
Evan Lucas	e427150e75	2016-06-17, Version 6.2.2 (Current) Release Notable changes: * http: - req.read(0) could cause incoming connections to stall and time out under certain conditions. (Fedor Indutny) [#7211](https://github.com/nodejs/node/pull/7211) - When freeing the socket to be reused in keep-alive Agent wait for both prefinish and end events. Otherwise the next request may be written before the previous one has finished sending the body, leading to a parser errors. (Fedor Indutny) [#7149](https://github.com/nodejs/node/pull/7149) * npm: upgrade npm to 3.9.5 (Kat Marchán) [#7139](https://github.com/nodejs/node/pull/7139) PR-URL: https://github.com/nodejs/node/pull/7323	9 years ago
Rod Vagg	daafe2c65e	2016-06-02, Version 6.2.1 (Current) * buffer: Ignore negative lengths in calls to Buffer() and Buffer.allocUnsafe(). This fixes a possible security concern (reported by Feross Aboukhadijeh) where user input is passed unchecked to the Buffer constructor or allocUnsafe() as it can expose parts of the memory slab used by other Buffers in the application. Note that negative lengths are not supported by the Buffer API and user input to the constructor should always be sanitised and type-checked. (Anna Henningsen) https://github.com/nodejs/node/pull/7030 * npm: Upgrade npm to 3.9.3 (Kat Marchán) https://github.com/nodejs/node/pull/7030 * tty: Default to blocking mode for stdio on OS X. A bug fix in libuv 1.9.0, introduced in Node.js v6.0.0, exposed problems with Node's use of non-blocking stdio, particularly on OS X which has a small output buffer. This change should fix CLI applications that have been having problems with output since Node.js v6.0.0 on OS X. The core team is continuing to address stdio concerns that exist across supported platforms and progress can be tracked at https://github.com/nodejs/node/pull/6980. (Jeremiah Senkpiel) https://github.com/nodejs/node/pull/6895 * V8: Upgrade to V8 5.0.71.52. This includes a fix that addresses problems experienced by users of node-inspector since Node.js v6.0.0, see https://github.com/nodejs/node/issues/6980 for details. (Michaël Zasso) https://github.com/nodejs/node/pull/6928	9 years ago
Myles Borins	8c1d5e58d4	doc: improve rendering of v4.4.5 changelog entry Remove extra newlines that were causing rendering problems. PR-URL: https://github.com/nodejs/node/pull/6958 Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>	9 years ago
Anna Henningsen	b5f76dbd3e	doc: fix broken references in changelogs Some references to a few versions were broken, likely in part due to the transition to a split changelog format. PR-URL: https://github.com/nodejs/node/pull/6942 Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Roman Reiss <me@silverwind.io>	9 years ago
Myles Borins	e03c32696e	2016-05-24, Version 4.4.5 'Argon' (LTS) Notable changes: * buffer: * Buffer no longer errors if you call lastIndexOf with a search term longer than the buffer (Anna Henningsen) https://github.com/nodejs/node/pull/6511 * contextify: * Context objects are now properly garbage collected, this solves a problem some individuals were experiencing with extreme memory growth (Ali Ijaz Sheikh) https://github.com/nodejs/node/pull/6871 * deps: * update npm to 2.15.5 (Rebecca Turner) https://github.com/nodejs/node/pull/6663 * http: * Invalid status codes can no longer be sent. Limited to 3 digit numbers between 100 - 999 (Brian White) https://github.com/nodejs/node/pull/6291	9 years ago
Evan Lucas	26120e2eb0	2016-05-17, Version 6.2.0 (Stable) - buffer: fix lastIndexOf and indexOf in various edge cases (Anna Henningsen) [#6511](https://github.com/nodejs/node/pull/6511) - child_process: use /system/bin/sh on android (Ben Noordhuis) [#6745](https://github.com/nodejs/node/pull/6745) - deps: - upgrade npm to 3.8.9 (Rebecca Turner) [#6664](https://github.com/nodejs/node/pull/6664) - upgrade to V8 5.0.71.47 (Ali Ijaz Sheikh) [#6572](https://github.com/nodejs/node/pull/6572) - upgrade libuv to 1.9.1 (Saúl Ibarra Corretgé) [#6796](https://github.com/nodejs/node/pull/6796) - Intl: ICU 57 bump (Steven R. Loomis) [#6088](https://github.com/nodejs/node/pull/6088) - repl: - copying tabs shouldn't trigger completion (Eugene Obrezkov) [#5958](https://github.com/nodejs/node/pull/5958) - exports `Recoverable` (Blake Embrey) [#3488](https://github.com/nodejs/node/pull/3488) - src: add O_NOATIME constant (Rich Trott) [#6492](https://github.com/nodejs/node/pull/6492) - src,module: add --preserve-symlinks command line flag (James M Snell) [#6537](https://github.com/nodejs/node/pull/6537) - util: adhere to `noDeprecation` set at runtime (Anna Henningsen) [#6683](https://github.com/nodejs/node/pull/6683) As of this release the 6.X line now includes 64-bit binaries for Linux on Power Systems running in big endian mode in addition to the existing 64-bit binaries for running in little endian mode. PR-URL: https://github.com/nodejs/node/pull/6810	9 years ago
James M Snell	c663a6db05	doc: refactor the changelog by version The changelog was getting rather huge and difficult to manage. It also wasn't very useful in terms of being able to quickly find specific Node.js versions, or tracking the history for a single major release stream. This reorganizes the changelog by versions separated out over multiple files. An index of the most recent versions is provided in the main log. PR-URL: https://github.com/nodejs/node/pull/6503 Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Robert Lindstaedt <robert.lindstaedt@gmail.com> Reviewed-By: Rod Vagg <rod@vagg.org> Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>	9 years ago

33 Commits (b16a97e042657d4f20c0716c69fb61652c857117)