PR-URL: https://github.com/nodejs/node/pull/9124
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
This release marks the transition of Node.js v6 into Long Term Support
(LTS) with the codename 'Boron'. The v6 release line now moves in to
"Active LTS" and will remain so until April 2018. After that time it
will move in to "Maintenance" until end of life in April 2019.
This is also a security release. All Node.js users should consult the
security release summary at
https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/
for details on patched vulnerabilities.
Notable changes:
* crypto: Don't automatically attempt to load an OpenSSL configuration
file, from the `OPENSSL_CONF` environment variable or from the
default location for the current platform. Always triggering a
configuration file load attempt may allow an attacker to load
compromised OpenSSL configuration into a Node.js process if they are
able to place a file in a default location. (Fedor Indutny, Rod Vagg)
* node: Introduce the `process.release.lts` property, set to `"Boron"`.
This value is `"Argon"` for v4 LTS releases and `undefined` for all
other releases. (Rod Vagg)
* V8: Backport fix for CVE-2016-5172, an arbitrary memory read.
The parser in V8 mishandled scopes, potentially allowing an attacker
to obtain sensitive information from arbitrary memory locations via
crafted JavaScript code. This vulnerability would require an
attacker to be able to execute arbitrary JavaScript code in a
Node.js process. (Rod Vagg)
* **v8_inspector**: Generate a UUID for each execution of the
inspector. This provides additional security to prevent unauthorized
clients from connecting to the Node.js process via the v8_inspector
port when running with `--inspect`. Since the debugging protocol
allows extensive access to the internals of a running process, and
the execution of arbitrary code, it is important to limit
connections to authorized tools only. Vulnerability originally
reported by Jann Horn. (Eugene Ostroukhov)
PR-URL: https://github.com/nodejs/node-private/pull/81
This define is not available in zlib prior to version 1.2.5.2. See
https://github.com/nodejs/node/issues/9110 for details. Workaround the
build breakage reported by casting away const in src/inspector_agent.cc
instead.
PR-URL: https://github.com/nodejs/node/pull/9122
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>
Change 'methods with throw an error' to 'methods will throw an error'.
PR-URL: https://github.com/nodejs/node/pull/9123
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Teddy Katz <teddy.katz@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
PR-URL: https://github.com/nodejs/node/pull/9095
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Sections:
- Introduction
- Orginization of this Document
- Object Mode
- Buffering
- API for Stream Implementers
PR-URL: https://github.com/nodejs/node/pull/9100
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
This changes the execution order from "iter, file, binary" to "file,
iter, binary". This means the csv no longer has to buffered completely.
This also has the added effect that stopping compare.js early or
interfering with performance only affects a single benchmark, instead of
all of them.
Refs: https://github.com/nodejs/node/issues/8659
PR-URL: https://github.com/nodejs/node/pull/9064
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
When a benchmark did not contain any parameters the csv configuration
filed would be "". In R this is by default parsed as NA, causing NA in
the printout too.
Fixes: https://github.com/nodejs/node/issues/9061
PR-URL: https://github.com/nodejs/node/pull/9064
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
PR-URL: https://github.com/nodejs/node/pull/9043
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Fix a regression introduced in commit 2996b5c ("crypto: Allow GCM
ciphers to have a longer IV length") from April 2016 where a misplaced
parenthesis in a 'is ECB cipher?' check made it possible to use empty
IVs with non-ECB ciphers.
Also fix some exit bugs in test/parallel/test-crypto-authenticated.js
that were introduced in commit 4a40832 ("test: cleanup IIFE tests")
where removing the IFFEs made the test exit prematurely instead of just
skipping subtests.
PR-URL: https://github.com/nodejs/node/pull/9032
Refs: https://github.com/nodejs/node/pull/6376
Refs: https://github.com/nodejs/node/issues/9024
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
npm should run in a sandbox to avoid unwanted interactions. Without
this change, npm would read the userconfig file $HOME/.npmrc which may
contain configs that break this test.
Fixes: https://github.com/nodejs/node/issues/9074
PR-URL: https://github.com/nodejs/node/pull/9079
Reviewed-By: Jeremiah Senkpiel <Fishrock123@rocketmail.com>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Commit fdca79fbc0 ("test: enable addons
test to pass with debug build") enabled the addons tests to pass when
the build type is of type debug (configure --debug).
test/addons/node-module-version/test.js was recently added and expects
the the build type to be of type Release (like most of the others until
recently). This commit allows this test to pass when the build type if
of type debug.
PR-URL: https://github.com/nodejs/node/pull/9093
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
The documentation erroneously described the errno property as an alias
for the code property, but that is not the case in the implementation.
errno is the error code of the error as a number, and code is the error
code of the error as a string.
PR-URL: https://github.com/nodejs/node/pull/9007
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Small refactoring to make contextify more readable.
Remove auto and inline FromJust(). Simplify
if statement.
PR-URL: https://github.com/nodejs/node/pull/8909
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Commit 782620f added the define only when building with the bundled
zlib. Using a shared zlib results in build breakage:
../src/inspector_agent.cc:179:16: error: assigning to 'Bytef *' (aka 'unsigned char *') from incompatible type
'const uint8_t *' (aka 'const unsigned char *')
strm.next_in = PROTOCOL_JSON + 3;
^ ~~~~~~~~~~~~~~~~~
1 error generated.
PR-URL: https://github.com/nodejs/node/pull/9077
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
2a4b068aca introduced a regression in where checking
`instanceof` would fail for `Writable` subclasses inside the
subclass constructor, i.e. before `Writable()` was called.
Also, calling `null instanceof Writable` or
`undefined instanceof Writable` would fail due to accessing the
`_writableState` property of the target object.
This fixes these problems.
PR-URL: https://github.com/nodejs/node/pull/9088
Ref: https://github.com/nodejs/node/pull/8834#issuecomment-253640692
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
This commit fixes a regression introduced in 0ed8839a27 that caused
additional queued immediate callbacks to be ignored if
`clearImmediate(immediate)` was called within the callback for
`immediate`.
PR-URL: https://github.com/nodejs/node/pull/9086
Fixes: https://github.com/nodejs/node/issues/9084
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
This adds a new ESLint tool to check for let
declarations within the for, forIn, forOf expressions.
Fixes: https://github.com/nodejs/node/issues/9045
Ref: https://github.com/nodejs/node/pull/8873
PR-URL: https://github.com/nodejs/node/pull/9049
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Teddy Katz <teddy.katz@gmail.com>
Reviewed-By: Prince John Wesley <princejohnwesley@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
`end` MUST always be emitted **before** `close`. However, if a handle
will invoke `uv_close_cb` immediately, or in the same JS tick - `close`
may be emitted first.
PR-URL: https://github.com/nodejs/node/pull/9066
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
The config.gypi target has a recipe that uses the control function error
to report if the config.gypi file is missing or if it is stale (the
configure file was updated which is a prerequisite of this rule).
GNU make has two phases, immediate and deferred. During the first phase
it will expand any variables or functions as the makefile is parsed.
The recipe in this case is a shell if statement, which is a deferred
construct. But the control function $(error) is an immediate construct
which will cause the makefile processing to stop during the first phase
of the Make process.
If I understand this correctly the only possible outcome of this rule is
the "Stale config.gypi, please re-run ./configure" message which will
be done in the first phase and then exit. The shell condition will not
be considered. So it will never report that the config.gypi is missing.
bnoordhuis suggested that we simply change this into a single error
message:
"Missing or stale config.gypi, please run configure"
PR-URL: https://github.com/nodejs/node/pull/9053
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
tick-processor-base.js is a module used by three other tests. It is not
a test fixture so move it out of the fixture directory. (One downside to
having it in the fixture directory is that fixture code is not currently
linted.)
It is possible that the code in tick-processor-base.js should be
integrated into common.js. This can potentially happen subsequently (and
might make a reasonable good first contribution for a new contributor).
PR-URL: https://github.com/nodejs/node/pull/9022
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Adds verbose reasons to the documentation on why the
Reviewed-By metadata on a pull request is important.
This was loosely mentioned as an issue in the referenced
issue below, and answered by @addaleax.
Ref: https://github.com/nodejs/node/issues/8893
PR-URL: https://github.com/nodejs/node/pull/9044
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Adds documentation and explicit reasons on why
the GitHub web interface button is not used. This was
explained in the referenced issue by @TheAlphaNerd.
Fixes: https://github.com/nodejs/node/issues/8893
PR-URL: https://github.com/nodejs/node/pull/9044
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Wrapped the timer into class to ensure it is cleaned up properly.
PR-URL: https://github.com/nodejs/node/pull/8870
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
* var to const
* add check that expected error is ENOENT
* indexOf() to includes()
PR-URL: https://github.com/nodejs/node/pull/8999
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
This replaces TickObject with an object literal. This offers
performance improvements of up to ~20%.
PR-URL: https://github.com/nodejs/node/pull/8932
Reviewed-By: Claudio Rodriguez <cjrodr@yahoo.com>
Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
Unsanitized paths containing line feed characters can be used for
header injection and request splitting so reject them with an exception.
There seems to be no reasonable use case for allowing control characters
(characters <= 31) while there are several scenarios where they can be
used to exploit software bugs so reject control characters altogether.
PR-URL: https://github.com/nodejs/node/pull/8923
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: not-an-aardvark <not-an-aardvark@users.noreply.github.com>
As the CTC grows and has representation from more time zones, we need to
embrace asynchronous decision making and rely less on the actual
meeting. This change is a proposal for that which, ironically, probably
has to be approved at a meeting.
PR-URL: https://github.com/nodejs/node/pull/8945
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Julien Gilli <jgilli@nodejs.org>
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
SSL_get_SSL_CTX returns the SSL_CTX for an SSL. Previously the code
accessed |ssl->ctx| directly, but that's no longer possible with OpenSSL
1.1.0.
SSL_get_SSL_CTX exists all the way back to (at least) OpenSSL 0.9.8 and
so this change should be fully compatible.
PR-URL: https://github.com/nodejs/node/pull/8995
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Fix compile bug when building with the --without-intl option
(introduced by 4b312387ea)
PR-URL: https://github.com/nodejs/node/pull/9041
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Rich Trott
Rod Vagg
Bradley T. Hughes
Parambir Singh
Miguel Angel Asencio Hurtado
Indrek Ardel
Benji Marinacci
marzelin
Andreas Madsen
scott stern
Ben Noordhuis
João Reis
Daniel Bevenius
Tyler Brazier
John Vilk
Franziska Hinkelmann
solebox
Evan Lucas
Anna Henningsen
Brian White
jessicaquynh
Tanuja-Sawant
Fedor Indutny
Ilya Frolov
Eugene Ostroukhov
Nikolai Vavilov
Jenna Vuong
Jeremiah Senkpiel
larissayvette
Adam Langley
James M Snell