mirrors/node
0
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-10-29 02:35:20 +08:00
Code Activity
40,777 Commits 61 Branches 971 Tags
v21.x
Commit Graph
7477 Commits
Author SHA1 Message Date
Deokjin Kim 87d2acc8b1 doc: fix actual result of example is different in events 
Refs: https://github.com/nodejs/node/pull/50428
PR-URL: https://github.com/nodejs/node/pull/51925
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
 2024-03-07 10:27:31 +01:00
Jacob Smith 20e0ba3b94 doc,module: clarify hook chain execution sequence 
PR-URL: https://github.com/nodejs/node/pull/51884
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2024-03-07 10:27:31 +01:00
Antoine du Hamel 5908c121c6 doc: clarify Corepack threat model 
PR-URL: https://github.com/nodejs/node/pull/51917
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2024-03-07 10:27:30 +01:00
marco-ippolito 47e6820358 2024-03-06, Version 21.7.0 (Current) 
Notable changes:

build:
  * (SEMVER-MINOR) build opt to set local location of headers (Michael Dawson) https://github.com/nodejs/node/pull/51525
crypto:
  * (SEMVER-MINOR) implement crypto.hash() (Joyee Cheung) https://github.com/nodejs/node/pull/51044
  * update root certificates to NSS 3.98 (Node.js GitHub Bot) https://github.com/nodejs/node/pull/51794
doc:
  * add zcbenz to collaborators (Cheng Zhao) https://github.com/nodejs/node/pull/51812
  * add lemire to collaborators (Daniel Lemire) https://github.com/nodejs/node/pull/51572
http2:
  * (SEMVER-MINOR) add h2 compat support for appendHeader (Tim Perry) https://github.com/nodejs/node/pull/51412
  * (SEMVER-MINOR) add server handshake utility (snek) https://github.com/nodejs/node/pull/51172
  * (SEMVER-MINOR) receive customsettings (Marten Richter) https://github.com/nodejs/node/pull/51323
lib:
  * (SEMVER-MINOR) move encodingsMap to internal/util (Joyee Cheung) https://github.com/nodejs/node/pull/51044
sea:
  * (SEMVER-MINOR) support sea.getRawAsset() (Joyee Cheung) https://github.com/nodejs/node/pull/50960
  * (SEMVER-MINOR) support embedding assets (Joyee Cheung) https://github.com/nodejs/node/pull/50960
src:
  * (SEMVER-MINOR) print string content better in BlobDeserializer (Joyee Cheung) https://github.com/nodejs/node/pull/50960
  * (SEMVER-MINOR) support multi-line values for .env file (IlyasShabi) https://github.com/nodejs/node/pull/51289
  * (SEMVER-MINOR) add `process.loadEnvFile` and `util.parseEnv` (Yagiz Nizipli) https://github.com/nodejs/node/pull/51476
  * (SEMVER-MINOR) do not coerce dotenv paths (Tobias Nießen) https://github.com/nodejs/node/pull/51425
stream:
  * (SEMVER-MINOR) implement `min` option for `ReadableStreamBYOBReader.read` (Mattias Buelens) https://github.com/nodejs/node/pull/50888
util:
  * (SEMVER-MINOR) add styleText API to text formatting (Rafael Gonzaga) https://github.com/nodejs/node/pull/51850
vm:
  * (SEMVER-MINOR) support using the default loader to handle dynamic import() (Joyee Cheung) https://github.com/nodejs/node/pull/51244

PR-URL: https://github.com/nodejs/node/pull/51932
 2024-03-05 21:16:25 +01:00
Joyee Cheung 4a889e8ea3 doc: add stability index to crypto.hash() 
PR-URL: https://github.com/nodejs/node/pull/51978
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2024-03-05 21:13:18 +01:00
Anna Henningsen af32d433ee lib: account for cwd access from snapshot serialization cb 
Functions registered with `addSerializeCallback()` can access and call
`process.cwd()`. b7d836e2c7 accounted for the fact that it is
necessary to reset the cwd cache after the snapshot builder script has
run, but did not account for possible accesses from serialization
callbacks. To properly account for these, add a deserialization
callback as well.

As a related drive-by fix, also mention the execution order of
callbacks in the documentation.

Refs: https://github.com/nodejs/node/pull/49684
PR-URL: https://github.com/nodejs/node/pull/51901
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2024-03-01 09:20:49 +01:00
JounQin 3fdaeba9e6 doc: remove redundant backquote which breaks sentence 
PR-URL: https://github.com/nodejs/node/pull/51904
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: theanarkh <theratliter@gmail.com>
Reviewed-By: Qingyu Deng <i@ayase-lab.com>
 2024-02-29 12:54:51 +01:00
Shrujal Shah db30428f06 doc: update guide link for Event Loop 
PR-URL: https://github.com/nodejs/node/pull/51874
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Qingyu Deng <i@ayase-lab.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Claudio Wunder <cwunder@gnome.org>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2024-02-29 12:54:51 +01:00
Joyee Cheung 78c226281c crypto: implement crypto.hash() 
This patch introduces a helper crypto.hash() that computes
a digest from the input at one shot. This can be 1.2-1.6x faster
than the object-based createHash() for smaller inputs (<= 5MB)
that are readily available (not streamed) and incur less memory
overhead since no intermediate objects will be created.

PR-URL: https://github.com/nodejs/node/pull/51044
Refs: https://github.com/nodejs/performance/issues/136
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
 2024-02-29 12:54:51 +01:00
Ameet Kaustav a5a17a18e3 doc: change ExperimentalWarnings to ExperimentalWarning 
PR-URL: https://github.com/nodejs/node/pull/51741
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
 2024-02-27 12:10:14 +01:00
Rafael GonzagaandHemanth HM 88e08bbe80 util: add styleText API to text formatting 
Co-Authored-By: Hemanth HM <hemanth.hm@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/51850
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Adrian Estrada <edsadr@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2024-02-27 12:10:14 +01:00
Tobias Nießen 80c750c8c1 doc,crypto: further clarify RSA_PKCS1_PADDING support 
PR-URL: https://github.com/nodejs/node/pull/51799
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
 2024-02-26 13:57:09 +01:00
Filip Skokan b53919d988 doc,crypto: add changelog and note about disabled RSA_PKCS1_PADDING 
PR-URL: https://github.com/nodejs/node/pull/51782
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2024-02-19 14:14:42 +01:00
Joyee Cheung 7ceb6d6700 sea: update stability index 
The design is relatively stable now and it's more suitable to
describe it as being "in active developement".

PR-URL: https://github.com/nodejs/node/pull/51774
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Debadree Chatterjee <debadree333@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
 2024-02-19 14:14:42 +01:00
Joyee Cheung 4c508269cd vm: support using the default loader to handle dynamic import() 
This patch adds support for using
`vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER` as
`importModuleDynamically` in all APIs that take the option
except `vm.SourceTextModule`. This allows users to have a shortcut
to support dynamic import() in the compiled code without missing
the compilation cache if they don't need customization of the
loading process. We emit an experimental warning when the
`import()` is actually handled by the default loader through
this option instead of requiring `--experimental-vm-modules`.

In addition this refactors the documentation for
`importModuleDynamically` and adds a dedicated section for it
with examples.

`vm.SourceTextModule` is not supported in this patch because
it needs additional refactoring to handle `initializeImportMeta`,
which can be done in a follow-up.

PR-URL: https://github.com/nodejs/node/pull/51244
Fixes: https://github.com/nodejs/node/issues/51154
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
 2024-02-15 13:50:39 +01:00
Marco Ippolito af6b5b1722 doc: mark isWebAssemblyCompiledModule eol 
PR-URL: https://github.com/nodejs/node/pull/51442
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
 2024-02-15 13:48:16 +01:00
Antoine du Hamel a62f69ecad doc: fix globals.md introduction 
Splitting the introduction sentence in two paragraphs so it's
clearer the list of variables only apply to the second sentence.

PR-URL: https://github.com/nodejs/node/pull/51742
Reviewed-By: Jithil P Ponnan <jithil@outlook.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
 2024-02-15 12:07:06 +01:00
Dmitry Semigradsky 519dc8aad6 doc: updates for better json generating 
PR-URL: https://github.com/nodejs/node/pull/51592
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
 2024-02-15 12:06:51 +01:00
Gabriel Schulhof 37182c4c1f doc: fix uncaught exception example 
PR-URL: https://github.com/nodejs/node/pull/51638
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Akhil Marsonya <akhil.marsonya27@gmail.com>
 2024-02-15 12:06:48 +01:00
Ognjen Jevremović c9be260b7d doc: clarify execution of after hook on test suite completion 
The `after` hook now explicitly mentions that it is executed once after
all the tests in a test suite have completed, regardless of whether the
tests passed or failed. This ensures that cleanup tasks or actions
specified in the after hook are guaranteed to run.

Refs: https://github.com/nodejs/node/issues/50901
PR-URL: https://github.com/nodejs/node/pull/51523
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
 2024-02-15 12:06:44 +01:00
Joyee Cheung e8d9065262 sea: support sea.getRawAsset() 
This patch adds support for `sea.getRawAsset()` which is
similar to `sea.getAsset()` but returns the raw asset
in an array buffer without copying. Users should avoid
writing to the returned array buffer. If the injected
section is not marked as writable or not aligned,
writing to the raw asset is likely to result in a crash.

PR-URL: https://github.com/nodejs/node/pull/50960
Refs: https://github.com/nodejs/single-executable/issues/68
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
 2024-02-15 12:06:44 +01:00
Joyee Cheung cea5295c16 sea: support embedding assets 
With this patch:

Users can now include assets by adding a key-path dictionary
to the configuration as the `assets` field. At build time, Node.js
would read the assets from the specified paths and bundle them into
the preparation blob. In the generated executable, users can retrieve
the assets using the `sea.getAsset()` and `sea.getAssetAsBlob()` API.

```json
{
  "main": "/path/to/bundled/script.js",
  "output": "/path/to/write/the/generated/blob.blob",
  "assets": {
    "a.jpg": "/path/to/a.jpg",
    "b.txt": "/path/to/b.txt"
  }
}
```

The single-executable application can access the assets as follows:

```cjs
const { getAsset } = require('node:sea');
// Returns a copy of the data in an ArrayBuffer
const image = getAsset('a.jpg');
// Returns a string decoded from the asset as UTF8.
const text = getAsset('b.txt', 'utf8');
// Returns a Blob containing the asset.
const blob = getAssetAsBlob('a.jpg');
```

Drive-by: update the  documentation to include a section dedicated
to the injected main script and refer to it as "injected main
script" instead of "injected module" because it's a script, not
a module.

PR-URL: https://github.com/nodejs/node/pull/50960
Refs: https://github.com/nodejs/single-executable/issues/68
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
 2024-02-15 12:06:44 +01:00
Antoine du Hamel 08832e76d3 esm: improve error when calling import.meta.resolve from data: URL 
PR-URL: https://github.com/nodejs/node/pull/49516
Reviewed-By: James M Snell <jasnell@gmail.com>
 2024-02-15 12:05:55 +01:00
IlyasShabi c7912c3d5a src: support multi-line values for .env file 
PR-URL: https://github.com/nodejs/node/pull/51289
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
 2024-02-15 12:05:54 +01:00
Duncan Chiu 8c0a257021 doc: fix dns.lookup and dnsPromises.lookup description 
PR-URL: https://github.com/nodejs/node/pull/51517
Fixes: https://github.com/nodejs/node/issues/51482
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2024-02-15 12:05:53 +01:00
Tobias Nießen 177e13cb0d doc: note that path.normalize deviates from POSIX 
PR-URL: https://github.com/nodejs/node/pull/51513
Refs: https://github.com/nodejs/node/issues/51345
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2024-02-15 12:05:53 +01:00
Yagiz Nizipli b8ae5c27c6 src: add process.loadEnvFile and util.parseEnv 
PR-URL: https://github.com/nodejs/node/pull/51476
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 2024-02-15 12:05:50 +01:00
Kenrick fd2a3cef57 doc: fix historical experimental fetch flag 
PR-URL: https://github.com/nodejs/node/pull/51506
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2024-02-15 12:05:48 +01:00
Rafael Gonzaga 1d40a0067a doc: fix type of connectionAttempt parameter 
PR-URL: https://github.com/nodejs/node/pull/51490
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
 2024-02-15 12:05:48 +01:00
Ian Kerins d3b78051ce doc: remove reference to resolved child_process v8 issue 
The linked v8 issue is closed. The NodeJS half of that issue has also
been resolved. While there still may be issues related to
child_process spawn performance, they are not related to this v8 issue.

Refs: https://bugs.chromium.org/p/v8/issues/detail?id=7381
Refs: https://github.com/nodejs/node/pull/48523
Refs: https://github.com/nodejs/performance/issues/138
PR-URL: https://github.com/nodejs/node/pull/51467
Reviewed-By: Keyhan Vakil <kvakil@sylph.kvakil.me>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2024-02-15 12:05:43 +01:00
Chengzhong Wu 10f95283c6 doc: add notes on inspector breakpoints 
Setting breakpoints with a same-thread inspector session should be
avoided because the program being attached and paused is exactly the
debugger itself. A worker thread inspector session or a debugger
program should be used if breakpoints are needed.

PR-URL: https://github.com/nodejs/node/pull/51417
Fixes: https://github.com/nodejs/node/issues/51397
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2024-02-15 12:05:42 +01:00
u9g fc5629616b doc: fix spelling mistake 
PR-URL: https://github.com/nodejs/node/pull/51454
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2024-02-15 12:02:33 +01:00
Tim Perry 4b1c6839f4 http2: add h2 compat support for appendHeader 
PR-URL: https://github.com/nodejs/node/pull/51412
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2024-02-15 12:02:33 +01:00
snek d8aa2bac0b http2: add server handshake utility 
PR-URL: https://github.com/nodejs/node/pull/51172
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2024-02-15 12:02:33 +01:00
Tim Kuijsten 74d4e382a7 doc: fix some policy scope typos 
PR-URL: https://github.com/nodejs/node/pull/51234
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2024-02-15 12:02:30 +01:00
Marten Richter b9275d9039 http2: receive customsettings 
This commit gives node.js the ability to also receive custom settings,
in addition to sending, them which was implemented before.
The custom settings received are limited to setting ids,
that were specified before, when creating the session eithers through
the server or the client.

PR-URL: https://github.com/nodejs/node/pull/51323
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2024-02-15 12:02:29 +01:00
Marco Ippolito d7658ca6a2 doc: improve subtests documentation 
PR-URL: https://github.com/nodejs/node/pull/51379
Fixes: https://github.com/nodejs/node/issues/51359
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
 2024-02-15 12:00:57 +01:00
Joseph Joy c18a813638 doc: add missing word in child_process.md 
PR-URL: https://github.com/nodejs/node/pull/50370
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
 2024-02-15 12:00:57 +01:00
Aras Abbasi 63e0ceb48f net: fix example IPv4 in dns docs 
PR-URL: https://github.com/nodejs/node/pull/51377
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
 2024-02-15 12:00:57 +01:00
Mert Can Altın 66c11f31c3 node-api: optimize napi_set_property for perf 
PR-URL: https://github.com/nodejs/node/pull/50282
Reviewed-By: Vladimir Morozov <vmorozov@microsoft.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
 2024-02-15 12:00:55 +01:00
James M Snell fabd5c4b21 doc: fixup alignment of warning subsection 
Subsection was accidentally aligned with the wrong event.

PR-URL: https://github.com/nodejs/node/pull/51374
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Harshitha K P <harshitha014@gmail.com>
 2024-02-15 12:00:55 +01:00
Mattias Buelens 9ab353af00 stream: implement min option for ReadableStreamBYOBReader.read 
PR-URL: https://github.com/nodejs/node/pull/50888
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Debadree Chatterjee <debadree333@gmail.com>
 2024-02-15 12:00:54 +01:00
RafaelGSS 3eccdd1ae6 2024-02-14, Version 21.6.2 (Current) 
This is a security release.

Notable changes:

crypto:
  * disable PKCS#1 padding for privateDecrypt (Michael Dawson) https://github.com/nodejs-private/node-private/pull/525
deps:
  * upgrade libuv to 1.48.0 (Santiago Gimeno) https://github.com/nodejs/node/pull/51698
  * disable io_uring support in libuv by default (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/528
fs:
  * protect against modified Buffer internals in possiblyTransformPath (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/497
http:
  * add maximum chunk extension size (Paolo Insogna) https://github.com/nodejs-private/node-private/pull/518
lib:
  * update undici to v5.28.3 (Matteo Collina) https://github.com/nodejs-private/node-private/pull/538
  * use cache fs internals against path traversal (RafaelGSS) https://github.com/nodejs-private/node-private/pull/516
src:
  * fix HasOnly(capability) in node::credentials (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/505
src,deps:
  * disable setuid() etc if io_uring enabled (Tobias Nießen) https://github.com/nodejs-private/node-private/pull/528
test,doc:
  * clarify wildcard usage (RafaelGSS) https://github.com/nodejs-private/node-private/pull/517
zlib:
  * pause stream if outgoing buffer is full (Matteo Collina) https://github.com/nodejs-private/node-private/pull/540

PR-URL: https://github.com/nodejs-private/node-private/pull/543
 2024-02-13 18:38:14 -03:00
Tobias Nießen fc2454f29c src,deps: disable setuid() etc if io_uring enabled 
Within Node.js, attempt to determine if libuv is using io_uring. If it
is, disable process.setuid() and other user identity setters.

We cannot fully prevent users from changing the process's user identity,
but this should still prevent some accidental, dangerous scenarios.

PR-URL: https://github.com/nodejs-private/node-private/pull/528
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2024-22017
 2024-02-13 15:26:53 +01:00
Tobias Nießen 666096298c deps: disable io_uring support in libuv by default 
setuid() does not affect libuv's internal io_uring operations if
initialized before the call to setuid(). This potentially allows the
process to perform privileged operations despite presumably having
dropped such privileges through a call to setuid(). Similar concerns
apply to other functions that modify the process's user identity.

This commit changes libuv's io_uring behavior from opt-out (through
UV_USE_IO_URING=0) to opt-in (through UV_USE_IO_URING=1) until we figure
out a better long-term solution.

PR-URL: https://github.com/nodejs-private/node-private/pull/528
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2024-22017
 2024-02-13 15:26:52 +01:00
Paolo Insogna 6155a1ffaf http: add maximum chunk extension size 
PR-URL: https://github.com/nodejs-private/node-private/pull/518
Fixes: https://hackerone.com/reports/2233486
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2024-22019
 2024-02-13 15:26:52 +01:00
RafaelGSS ef3eea20be test,doc: clarify wildcard usage 
Follow-up: https://github.com/nodejs/node/pull/51209
PR-URL: https://github.com/nodejs-private/node-private/pull/517
Fixes: https://hackerone.com/bugs?subject=nodejs&report_id=2257156
CVE-ID: CVE-2024-21890
 2024-02-13 15:26:52 +01:00
RafaelGSS f38a9a5918 2024-01-15, Version 21.6.0 (Current) 
Notable changes:

doc:
  * (SEMVER-MINOR) add documentation for --build-snapshot-config (Anna Henningsen) https://github.com/nodejs/node/pull/50453
lib,src,permission:
  * (SEMVER-MINOR) port path.resolve to C++ (Rafael Gonzaga) https://github.com/nodejs/node/pull/50758
net:
  * (SEMVER-MINOR) add connection attempt events (Paolo Insogna) https://github.com/nodejs/node/pull/51045
src:
  * (SEMVER-MINOR) support configurable snapshot (Joyee Cheung) https://github.com/nodejs/node/pull/50453
src,permission:
  * (SEMVER-MINOR) add --allow-addon flag (Rafael Gonzaga) https://github.com/nodejs/node/pull/51183
timers:
  * (SEMVER-MINOR) export timers.promises (Marco Ippolito) https://github.com/nodejs/node/pull/51246

PR-URL: https://github.com/nodejs/node/pull/51342
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
 2024-01-11 10:36:14 -03:00
Davy Landman 84127514ba doc: improve localWindowSize event descriptions 
The documentation listed the wrong event to subscribe to when calling
`localWindowSize`. Also properly point out the correct event for http2
clients.

Fixes: https://github.com/nodejs/node/issues/51014
Refs: https://github.com/nodejs/node/issues/38426
PR-URL: https://github.com/nodejs/node/pull/51071
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2024-01-02 15:05:26 -03:00
Antoine du Hamel 8ee882a49c doc: mark --jitless as experimental 
It's already documented as such, but it doesn't have the label.

PR-URL: https://github.com/nodejs/node/pull/51247
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Akhil Marsonya <akhil.marsonya27@gmail.com>
 2024-01-02 15:05:26 -03:00