nodejs / node

This is a security release.

Notable Changes

These are vulnerabilities in the node-tar, arborist, and npm cli modules which
are related to the initial reports and subsequent remediation of node-tar
vulnerabilities CVE-2021-32803
and CVE-2021-32804.
Subsequent internal security review of node-tar and additional external bounty
reports have resulted in another 5 CVE being remediated in core npm CLI
dependencies including node-tar, and npm arborist.

You can read more about it in:

• CVE-2021-37701
• CVE-2021-37712
• CVE-2021-37713
• CVE-2021-39134
• CVE-2021-39135

Commits

• [5b3f70bfb5] - deps: update archs files for OpenSSL-1.1.1l (Richard Lau) #39868
• [71372625ae] - deps: upgrade openssl sources to 1.1.1l (Richard Lau) #39868
• [4276984803] - deps: upgrade npm to 6.14.15 (Darcy Clarke) #39856

This is a security release.

Notable Changes

These are vulnerabilities in the node-tar, arborist, and npm cli modules which
are related to the initial reports and subsequent remediation of node-tar
vulnerabilities CVE-2021-32803
and CVE-2021-32804.
Subsequent internal security review of node-tar and additional external bounty
reports have resulted in another 5 CVE being remediated in core npm CLI
dependencies including node-tar, and npm arborist.

You can read more about it in:

• CVE-2021-37701
• CVE-2021-37712
• CVE-2021-37713
• CVE-2021-39134
• CVE-2021-39135

Commits

• [a0154b586b] - deps: update archs files for OpenSSL-1.1.1l (Richard Lau) #39869
• [7a95637eb7] - deps: upgrade openssl sources to 1.1.1l (Richard Lau) #39869
• [840b0ffff6] - deps: upgrade npm to 6.14.15 (Darcy Clarke) #39856

Notable Changes

• [2e90b10f35] - doc: deprecate type coercion for dns.lookup options (Antoine du Hamel) #38906
• [a6d50a18a0] - (SEMVER-MINOR) stream: add stream.Duplex.from utility (Robert Nagy) #39519
• [af7047a815] - (SEMVER-MINOR) stream: add isDisturbed helper (Robert Nagy) #39628
• [66400374de] - (SEMVER-MINOR) util: expose toUSVString (Robert Nagy) #39814

Commits

• [90bf247a55] - build: fix update authors commit (Mestery) #39858
• [c968372e37] - build: add authors.yml (Tierney Cyren) #35831
• [3f284cf65c] - build: add option to hide console window (Cheng Zhao) #39712
• [a01e3ab41d] - deps: V8: cherry-pick 00bb1a77c03e (Darshan Sen) #39829
• [cce95c4c5b] - deps: upgrade npm to 7.21.0 (Myles Borins) #39813
• [254810a22e] - doc: add duplicate CVE check in sec. release doc (Daniel Bevenius) #39845
• [8c50d16712] - doc: improve description of the triagers team (Michaël Zasso) #39833
• [c02165d992] - doc: update instructions for cc (Michael Dawson) #39674
• [208305fd8f] - doc: move util.toUSVString() outside of deprecated group (Luigi Pinca) #39840
• [2e90b10f35] - doc: deprecate type coercion for dns.lookup options (Antoine du Hamel) #38906
• [8460a3216c] - doc: deprecate using non-boolean values in the verbatim option (Antoine du Hamel) #38906
• [3041d57201] - doc: fix malformed changelog entries (Rich Trott) #39791
• [2b02f747c3] - doc: fix lint errors in packages.md (Rich Trott) #39792
• [a387600d8f] - doc: add example of self-reference in scoped packages (Jesús Leganés-Combarro 'piranna) #37630
• [7a25bf3a6d] - doc: add himadriganguly as a triager (Himadri Ganguly) #39757
• [d1900f43ce] - fs: combine require() and destructure (Colin Ihrig) #39806
• [158d4464d2] - meta: add gyp as owner of gyp files and tools/gyp (Mary Marchini) #34847
• [8fa38500f2] - policy: canonicalize before resolving specifiers (Bradley Farias) #37863
• [a7a217be13] - repl: fix tla function hoisting (Don Jayamanne) #39745
• [3a8399ee61] - src: return Maybe<bool> from InitializeContextRuntime() (Darshan Sen) #39695
• [a704c9dfce] - (SEMVER-MINOR) src: call overload ctor from the original ctor (Darshan Sen) #39768
• [0918ea0683] - (SEMVER-MINOR) src: add a constructor overload for CallbackScope (Darshan Sen) #39768
• [a6d50a18a0] - (SEMVER-MINOR) stream: duplexify (Robert Nagy) #39519
• [af7047a815] - (SEMVER-MINOR) stream: add isDisturbed helper (Robert Nagy) #39628
• [f98311a7c8] - tools: update workflow to open a pull request (Rich Trott) #39825
• [d33f897509] - tools: use find-inactive-collaborators to modify README.md (Rich Trott) #39825
• [d82ee96861] - tools: update gyp-next to v0.9.5 (Jiawen Geng) #39818
• [79079ea01b] - tools: fix markdown linting (Rich Trott) #39832
• [01093b07cc] - tools: update markdown linter dependencies and move to ESM (Antoine du Hamel) #39801
• [9dc0c91392] - tools: update rollup to latest version in markdown linter (Rich Trott) #39797
• [c34e2534ab] - tools: update markdown lint dependencies (Rich Trott) #39770
• [66400374de] - (SEMVER-MINOR) util: expose toUSVString (Robert Nagy) #39814

Notable Changes

• fs:
  • experimental: add recursive cp method (Benjamin Coe) #39372

Commits

• [a80c989306] - async_hooks: merge resource_symbol with owner_symbol (Darshan Sen) #38468
• [69a2a6b6c3] - bootstrap: call _undestroy() inside _destroy for stdout and stderr (Matteo Collina) #39685
• [5bc31ea0aa] - buffer: add endings option, remove Node.js specific encoding option (James M Snell) #39708
• [091a579275] - (SEMVER-MINOR) buffer: add Blob.prototype.stream method and other cleanups (James M Snell) #39693
• [097d898e58] - build: run coverage for inspector protocol changes (Richard Lau) #39725
• [cf028df0ed] - build: fix V8 build with pointer compression (Michaël Zasso) #39664
• [9d38400de1] - build: exclude markdown files from some GitHub Actions (Rich Trott) #39565
• [eeb804a7b7] - build: use lts shorthand in GitHub Actions (Rich Trott) #39538
• [93a904d0ba] - (SEMVER-MINOR) crypto: implement webcrypto.randomUUID (Michaël Zasso) #39648
• [3321b65a5a] - debugger: prevent simultaneous heap snapshots (Rich Trott) #39638
• [6c375e18b6] - debugger: remove undefined parameter (Rich Trott) #39570
• [103bf20988] - deps: V8: cherry-pick 81814ed44574 (Stephen Belanger) #39719
• [cf5e5b5711] - deps: upgrade to libuv 1.42.0 (Luigi Pinca) #39525
• [5f92d2fe6d] - dgram: use simplified validator (Voltrex) #39753
• [c7e918b06a] - (SEMVER-MINOR) dns: add "tries" option to Resolve options (Luan Devecchi) #39610
• [5d66646b71] - doc: correct cjs code to match mjs code (Raz Luvaton) #39509
• [f18bb2a0f1] - doc: fix typo in hmac.paramNames default (Justin) #39766
• [338a166e83] - doc: fix fs.rmdir recursive option deprecation history (Antoine du Hamel) #39728
• [bfb1dc0a2c] - doc: fixed variable names in queueMicrotask example (ashish maurya) #39634
• [08b31f12f8] - doc: change "Version 4 UUID" to "version 4 UUID" (Tobias Nießen) #39682
• [f5200f9785] - doc: update debugger.md description and examples (Rich Trott) #39661
• [4700f1e529] - doc: fix color contrast issue in light mode (Rich Trott) #39660
• [88c83a4698] - (SEMVER-MINOR) doc: add missing change to resolver ctor (Luan Devecchi) #39610
• [760cafa5ed] - doc: fix typo in url.md (Howie Zhao) #39666
• [9ab5503693] - doc: add point to ask H1 reporter about credit (Daniel Bevenius) #39585
• [7514405456] - doc: update min mac ver + move mac arm64 to tier 1 (Ash Cripps) #39586
• [d7c8c6dcee] - doc: add missing introduced_in metadata (Richard Lau) #39575
• [8072517097] - doc: add code examples to Writable.destroy() and Writable.destroyed (Juan José Arboleda) #39491
• [55f47cc2d0] - doc: add String.prototype.at and %TypedArray%.prototype.at (Jordan Harband) #39583
• [0c0412e2c4] - doc: move NODE_MODULE_VERSION in release guide (Richard Lau) #39544
• [5df74f9b21] - doc: remove outdated ARM information from release guide (Richard Lau) #39544
• [8eccb11ea0] - doc: fence command examples in release guide (Richard Lau) #39544
• [0bd97e1f2d] - doc: update backport labels in release guide (Richard Lau) #39544
• [2129ad6a0a] - doc: add code example to fs.truncate method (Juan José Arboleda) #39454
• [3ff5e153ef] - doc: add code example to http.createServer method (Juan José Arboleda) #39455
• [7d0c869cfa] - doc: add PerformanceObserver buffered document (legendecas) #39514
• [0dc167a03f] - (SEMVER-MINOR) fs: add recursive cp method (Benjamin Coe) #39372
• [54dd3df943] - http: decodes url.username and url.password for authorization header (Lew Gordon) #39310
• [81e62f67bf] - inspector: update inspector_protocol to 89c4adf (Rich Trott) #39650
• [793fee4915] - inspector: update inspector_protocol to 8ec18cf (Rich Trott) #39614
• [5afdc1f4c0] - lib: simplify validators (Voltrex) #39753
• [ca3cb96d25] - lib: cleanup validation (Voltrex) #39652
• [cc08d3062f] - lib: cleanup instance validation (Voltrex) #39656
• [2751cdf6f9] - lib: use helper for readability (Voltrex) #39649
• [c68415cba2] - lib: use validators (Voltrex) #39663
• [be2d60dd1d] - lib: use validator (Voltrex) #39547
• [486d51ac0c] - lib: use validateObject (Voltrex) #39605
• [058e882a2a] - lib: use ERR_ILLEGAL_CONSTRUCTOR (Mestery) #39556
• [07cadc4432] - meta: consolidate AUTHORS entries for ooHmartY (Rich Trott) #39705
• [6c788b8030] - meta: consolidate AUTHORS entries for homosaur (Rich Trott) #39705
• [07351edebe] - meta: consolidate AUTHORS entries for Ayase-252 (Rich Trott) #39705
• [5fe282769b] - meta: consolidate AUTHORS entries for robin-drexler (Rich Trott) #39705
• [fc2a626357] - meta: consolidate AUTHORS entries for samshull (Rich Trott) #39705
• [67cfc66a47] - meta: update AUTHORS (Rich Trott) #39705
• [91008fbdeb] - meta: consolidate email addresses for MarshallOfSound (Rich Trott) #39651
• [a76b63536a] - meta: consolidate email addresses for tadjik1 (Rich Trott) #39651
• [aaab2095db] - meta: consolidate email addresses for szmarczak (Rich Trott) #39651
• [f413a9d83c] - meta: update AUTHORS (Rich Trott) #39636
• [7a91d4bfe9] - meta: simplify mailmap (Rich Trott) #39612
• [4ec5d2de5d] - meta: consolidate emails for tadhgcreedon (Rich Trott) #39611
• [bb88c38eac] - meta: consolidate emails for timcosta (Rich Trott) #39611
• [0920a8cf6f] - meta: consolidate emails for timruffles (Rich Trott) #39611
• [1474a9d4b1] - meta: update AUTHORS (Rich Trott) #39629
• [c59e3ec685] - meta: add mailmap entry for ryzokuken (Rich Trott) #39596
• [34f4bb8277] - meta: add mailmap entry for uttampawar (Rich Trott) #39596
• [fd213edda2] - meta: add mailmap entry for dmabupt (Rich Trott) #39596
• [6b664e224b] - meta: align README/.mailmap/AUTHORS email entries (Rich Trott) #39505
• [96d8ecbd66] - meta: add mailmap entry for garygsc (Rich Trott) #39588
• [16d85f3f48] - meta: add mailmap entry for ttzztztz (Rich Trott) #39588
• [60ab111fdb] - meta: update AUTHORS (Rich Trott) #39587
• [b43f87d729] - meta: update .mailmap to remove duplication in AUTHORS (Rich Trott) #39561
• [6f4a2aa5a4] - meta: add .mailmap entries to remove AUTHORS duplicates (Rich Trott) #39560
• [86d144c500] - meta: add .mailmap entry to remove duplication in AUTHORS (Rich Trott) #39559
• [110c088f02] - meta: update collaborator email in AUTHORS/.mailmap (Rich Trott) #39521
• [72af147bb5] - meta: update collaborator email in README (Rich Trott) #39521
• [23bc4cfb21] - meta: update collaborator email in AUTHORS/.mailmap (Rich Trott) #39521
• [e4289728c7] - meta: move gdams to emeritus (Rich Trott) #39539
• [4df59bc727] - module: add some typings to internal/modules/esm/resolve (Antoine du Hamel) #39504
• [b5858589d0] - node-api: handle pending exception in cb wrapper (Michael Dawson) #39476
• [016b7ba616] - perf_hooks: fix PerformanceObserver gc crash (James M Snell) #39550
• [b37575b67c] - perf_hooks: fix performance timeline wpt failures (legendecas) #39532
• [64c02eb3cc] - (SEMVER-MINOR) perf_hooks: web performance timeline compliance (legendecas) #39297
• [7ff21397d6] - policy: fix integrity when DEFAULT_ENCODING is set (Tobias Nießen) #39750
• [03be967cad] - src: fix TextDecoder final flush size calculation (James M Snell) #39737
• [9046e78943] - src: fix crash in AfterGetAddrInfo (Anna Henningsen) #39735
• [2a00ef5ede] - (SEMVER-MINOR) src: fix align in cares_wrap.h (Luan) #39610
• [60a2b31c68] - src: add cosmetic space character to async_wrap.h file (Juan José Arboleda) #39459
• [cd9b0bf68c] - stream: ensure text() stream consumer flushes correctly (James M Snell) #39737
• [f57a0e4d8b] - (SEMVER-MINOR) stream: utility consumers for web and node.js streams (James M Snell) #39594
• [975edf5330] - stream: clean endWritableNT (Mestery) #39645
• [9e38fc6757] - (SEMVER-MINOR) stream: add readableDidRead if has been read from (Robert Nagy) #39589
• [a5ded4a85a] - test: use simplfied validator (voltrexmaster) #39753
• [53cf53c95a] - (SEMVER-MINOR) test: enable blob.prototype.stream tests (James M Snell) #39693
• [7e9884598f] - test: update WPT abort tests (Michaël Zasso) #39697
• [94381fbdf5] - test: update WPT common and resources (Michaël Zasso) #39697
• [34a041a846] - test: fix test-debugger-heap-profiler for workers (Richard Lau) #39687
• [9f5acfa90e] - test: increase memory for coverage action (Benjamin Coe) #39690
• [0be15cedc4] - test: use template to concatenate string (Himadri Ganguly) #39621
• [952a5282e2] - (SEMVER-MINOR) test: pull Web Platform Tests for WebCryptoAPI (Michaël Zasso) #39648
• [3622fb1e03] - test: deflake test-http2-buffersize (Luigi Pinca) #39591
• [1962c7c7b3] - test: convert anonymous function to arrow function (Himadri Ganguly) #39604
• [635e1a0274] - test: add test-debugger-breakpoint-exists (Rich Trott) #39570
• [cff2aea5df] - test: add known issues test for debugger heap snapshot race (Rich Trott) #39557
• [5e1011238a] - tools: bump remark-preset-lint-node to 3.0.0 (Rich Trott) #39755
• [eb741253fd] - tools: update path-parse in markdown linter package-lock file (Rich Trott) #39729
• [52a172f983] - tools: fix more build warnings in inspector_protocol (Richard Lau) #39725
• [77f9c1fa98] - tools: cherry-pick ffb34b6 (Darshan Sen) #39725
• [b9510d21c9] - tools: update inspector_protocol to e8ba1a7 (Rich Trott) #39694
• [8d509d8773] - tools: update inspector_protocol to 39ca567 (Rich Trott) #39694
• [ee7142fa37] - tools: update inspector_protocol to 97d3146 (Rich Trott) #39694
• [c6323d847d] - Revert "tools: fix compiler warning in inspector_protocol" (Rich Trott) #39694
• [6e19c166e4] - tools: update inspector_protocol to a53e96d31a2755eb16ca37 (Rich Trott) #39694
• [61c53f39d2] - tools: update inspector_protocol to fe0467fd105a (Rich Trott) #39694
• [b1b6f20353] - tools: improve error detection in find-inactive-collaborators (Rich Trott) #39617
• [d1360fcf48] - tools: update ESLint to 7.32.0 (Luigi Pinca) #39602
• [af1c782cad] - tools: update ESLint to 7.31.0 (Colin Ihrig) #39424
• [37dda19461] - (SEMVER-MINOR) url,buffer: implement URL.createObjectURL (James M Snell) #39693
• [dcab88ad38] - worker: add brand checks for detached properties/methods (James M Snell) #39763

This is a security release.

Notable Changes

• CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)
  • Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of hostnames returned by Domain Name Servers in the Node.js DNS library which can lead to the output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22931.
• CVE-2021-22930: Use after free on close http2 on stream canceling (High)
  • Node.js was vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix. You can read more about it at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930.
• CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low)
  • If the Node.js HTTPS API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22939.

Commits

• [054537cdc2] - deps: update c-ares to 1.17.2 (Beth Griggs) #39724
• [ac544905b6] - deps: reflect c-ares source tree (Beth Griggs) #39653
• [a914b23cbc] - deps: apply missed updates from c-ares 1.17.1 (Beth Griggs) #39653
• [31d5773654] - http2: add tests for cancel event while client is paused reading (Akshay K) #39622
• [a3c33d4ce7] - http2: update handling of rst_stream with error code NGHTTP2_CANCEL (Akshay K) #39622
• [6c7fff6f1d] - tls: validate "rejectUnauthorized: undefined" (Matteo Collina) nodejs-private/node-private#276

This is a security release.

Notable Changes

• CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)
  • Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of hostnames returned by Domain Name Servers in the Node.js DNS library which can lead to the output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22931.
• CVE-2021-22930: Use after free on close http2 on stream canceling (High)
  • Node.js was vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix. You can read more about it at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930.
• CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low)
  • If the Node.js HTTPS API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22939.

Commits

• [4923b59e0b] - deps: update c-ares to 1.17.2 (Beth Griggs) #39724
• [847a4c6a8a] - deps: reflect c-ares source tree (Beth Griggs) #39653
• [33208e2f89] - deps: apply missed updates from c-ares 1.17.1 (Beth Griggs) #39653
• [af5c1af9a4] - http2: add tests for cancel event while client is paused reading (Akshay K) #39622
• [434872e838] - http2: update handling of rst_stream with error code NGHTTP2_CANCEL (Akshay K) #39622
• [35b86110e4] - tls: validate "rejectUnauthorized: undefined" (Matteo Collina) nodejs-private/node-private#276

This is a security release.

Notable Changes

• CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)
  • Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of hostnames returned by Domain Name Servers in the Node.js DNS library which can lead to the output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22931.
• CVE-2021-22930: Use after free on close http2 on stream canceling (High)
  • Node.js was vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix. You can read more about it at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930.
• CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low)
  • If the Node.js HTTPS API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22939.

Commits

• [5f947db68c] - deps: update c-ares to 1.17.2 (Beth Griggs) #39724
• [42695ea34b] - deps: reflect c-ares source tree (Beth Griggs) #39653
• [e4c9156b32] - deps: apply missed updates from c-ares 1.17.1 (Beth Griggs) #39653
• [9cd1f53103] - http2: add tests for cancel event while client is paused reading (Akshay K) #39622
• [2008c9722f] - http2: update handling of rst_stream with error code NGHTTP2_CANCEL (Akshay K) #39622
• [1780bbc329] - tls: validate "rejectUnauthorized: undefined" (Matteo Collina) nodejs-private/node-private#276

Notable Changes

• Updated npm to 7.20.3 (npm team) #39579
• Reverted an ABI-breaking change from V8 9.2 that could impact some native modules (Michaël Zasso) #39624
• Fixed a bug in error handling known to affect at least Webpack and Jest (Guy Bedford) #39593

Commits

• [6c769ccedf] - build: override python executable path on configure (legendecas) #39465
• [cbf6a01c17] - crypto: fix generateKeyPair with encoding 'jwk' (himself65) #39319
• [3091295609] - deps: revert ABI-breaking change from V8 9.2 (Michaël Zasso) #39624
• [06d7b8e8c8] - deps: upgrade npm to 7.20.3 (npm team) #39579
• [7b612fadc2] - doc: fix crypto.hkdf callback derivedKey type (Filip Skokan) #39453
• [7a731efd97] - doc,lib,test: rename HKDF 'key' argument (Tobias Nießen) #39474
• [93bbaa0ce9] - module: fix ERR_REQUIRE_ESM error for null frames (Guy Bedford) #39593
• [e13162de09] - module: refine enrichCJSError (Antoine du Hamel) #39507
• [815fbec6f1] - repl: do not include legacy getter/setter methods in completion (Anna Henningsen) #39576
• [0405c8d3f0] - zlib: avoid converting Uint8Array instances to Buffer (Antoine du Hamel) #39492

This is a security release.

Notable Changes

Say hello to V8 9.2

The V8 engine is updated to version 9.2.230.21.

It notably introduces the new Array.prototype.at method (also on Typed Arrays and strings):

const array = [1, 2, 3];

console.log(array.at(-1));
// Prints: 3

Contributed by Michaël Zasso - #39470

Other notable changes

• CVE-2021-22930: Use after free on close http2 on stream canceling (High) - #39423
  • Node.js is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930
• [f93d2ac587] - inspector: mark as stable (Gireesh Punathil) #37748
• [89b4770d5c] - punycode: add pending deprecation (Antoine du Hamel) #38444
• [b67214fe31] - (SEMVER-MINOR) repl: enable --experimental-repl-await /w opt-out (hemanth.hm) #34733

Commits

• [b5248d4000] - async_hooks: emit promise trace events from JS (Stephen Belanger) #39135
• [e18778d409] - async_hooks: eliminate native PromiseHook (Stephen Belanger) #39135
• [90b9bb1a7d] - build: use Node.js 14 in commit-lint.yml (Rich Trott) #39506
• [5182e26f14] - build: reset embedder string to "-node.0" (Michaël Zasso) #39470
• [e1910ef290] - build: fix host_arch_cc() for AIX/IBM i (Richard Lau) #39481
• [ce2011b7a1] - build: update coverage Makefile target comments (Richard Lau) #39365
• [6b055f17b6] - build: run workflows when a PR is ready for review (Michaël Zasso) #39405
• [25f45d5018] - build: update to setup-node@v2 (Rich Trott) #39366
• [a7472576d7] - build: add library_files to gyp variables (himself65) #39293
• [d16d36f1c2] - crypto: support Big(U)Int64Array in getRandomValues (Michaël Zasso) #39443
• [95db54482a] - debugger: validate sec-websocket-accept response header (Chris Opperwall) #39357
• [3751b92fa2] - debugger: rename internal module (Rich Trott) #39378
• [0e5eb8b17d] - deps: restore minimum ICU version to 68 (Michaël Zasso) #39470
• [e8da1f25fb] - (SEMVER-MINOR) deps: make V8 9.2 abi-compatible with 9.0 (Michaël Zasso) #39470
• [a93e6ef777] - deps: V8: backport 5c76da8ddcf8 (Michaël Zasso) #39337
• [d612544199] - deps: V8: cherry-pick 359d44df4cdd (Michaël Zasso) #39337
• [c6ec2b4817] - deps: V8: cherry-pick 3805a698f7b6 (Michaël Zasso) #39337
• [e6b84dfe84] - deps: V8: cherry-pick 56fe020eec0c (Michaël Zasso) #39337
• [2393fae427] - deps: V8: cherry-pick 2b77ca200c56 (Michaël Zasso) #39337
• [c8e7d80475] - deps: V8: cherry-pick 53784bdb8f01 (Michaël Zasso) #39337
• [65062b3e0d] - deps: V8: cherry-pick 7ff6609a5385 (Michaël Zasso) #38990
• [c3efc70df7] - deps: V8: cherry-pick a5cea1bfc38c (Michaël Zasso) #38990
• [201da87bc1] - deps: V8: cherry-pick 986299250e6d (Richard Lau) #38990
• [794ad2e016] - deps: V8: backport 71e8f8bb3c26 (Michaël Zasso) #38990
• [53cc6c8000] - deps: V8: cherry-pick 3d24b3ab8af0 (Michaël Zasso) #38990
• [7f7cb8bfe1] - deps: silence irrelevant V8 warning (Michaël Zasso) #38990
• [16cbd8c8b6] - deps: silence irrelevant V8 warnings (Michaël Zasso) #37587
• [98150e2bc6] - deps: fix V8 build issue with inline methods (Jiawen Geng) #35415
• [3f3e167fea] - deps: make v8.h compatible with VS2015 (Joao Reis) #32116
• [785b8990de] - deps: V8: forward declaration of Rtl*FunctionTable (Refael Ackermann) #32116
• [38cb655f04] - deps: V8: patch register-arm64.h (Refael Ackermann) #32116
• [9082ecef66] - deps: V8: un-cherry-pick bd019bd (Refael Ackermann) #32116
• [6114198717] - (SEMVER-MINOR) deps: update V8 to 9.2.230.21 (Michaël Zasso) #39470
• [89796d0c7f] - deps: bump HdrHistogram_C to 0.11.2 (Matteo Collina) #39462
• [9dd232c42b] - deps: update to cjs-module-lexer@1.2.2 (Guy Bedford) #39402
• [626eb07fda] - deps: extract gtest source files to deps/googletest (legendecas) #39386
• [487c45ffd9] - doc: move lball@redhat.com to emeritus (Lance Ball) #39501
• [5f84f47e13] - doc: update AUTHORS (Rich Trott) #39488
• [1d27ae1514] - doc: update strategic initiative champion (Rich Trott) #39487
• [e552b1a791] - doc: improve node.js+fips instructions (Benjamin Mayr) #39390
• [aa1dfb3111] - doc: simplify unnecessarily specific .mailmap entries (Rich Trott) #39430
• [ae69656c61] - doc: update checkbox label in backporting guide (Darshan Sen) #39420
• [4fd8db687d] - doc: remove _Addenda_ from headers (Rich Trott) #39427
• [cefd2fb1e4] - doc: simplify .mailmap file (Rich Trott) #39418
• [ade2eed9a6] - doc: fix broken internal link in http.md (Rich Trott) #39425
• [5fdfcc069f] - doc: remove outdated step in onboarding exercise (Rich Trott) #39410
• [94706c7012] - doc: revise strategic initiatives text (Rich Trott) #39417
• [9932e3589c] - doc: remove typo (extra ' character) (Nikita Rykov) #39414
• [2b92b4ea2d] - doc: update mailmap and AUTHORS (Rich Trott) #39393
• [6d6396594b] - doc: use a details tag for completed initiatves (Rich Trott) #39416
• [ac43e3331c] - doc: update commit-queue.md to indicate GitHub Actions are checked (Rich Trott) #39411
• [75130c94d1] - doc: use _pull request_ instead of _PR_ in onboarding doc (Rich Trott) #39409
• [20bb3f6df0] - doc: add strategic initiatives from TSC repo (Rich Trott) #39394
• [6979313abb] - doc: standardize on _pull request_ (Rich Trott) #39384
• [20124cc275] - doc: make minor edits to pull request text (Rich Trott) #39383
• [11482f02cf] - doc: add docker-node and build-wg issue contents (Daniel Bevenius) #39215
• [c535956b6e] - doc: add instructions for core vuln files (Daniel Bevenius) #39220
• [353a8bb27b] - doc: standardize on not capitalizing _collaborator_ (Rich Trott) #39379
• [9b15e5c155] - doc: update mailmap and deduplicate AUTHORS entry (Rich Trott) #39391
• [e44ccd9aad] - doc: update AUTHORS (Rich Trott) #39367
• [39e6536a87] - doc: move jdalton to emeritus (Rich Trott) #39380
• [bbff5a9e47] - doc: edit guide on pull requests (Rich Trott) #39359
• [902ef9aca0] - doc,meta: update email addresses for misterdjules (Rich Trott) #39433
• [cc7b61721c] - doc,tools: remove checkLinks.mjs (Antoine du Hamel) #39206
• [e2fd015cda] - domain: do not add domain to promise from other context (Stephen Belanger) #39135
• [93eff3f5a6] - esm: refine ERR_REQUIRE_ESM errors (Guy Bedford) #39175
• [1fb0954202] - events: allow an event to be dispatched multiple times (Luigi Pinca) #39395
• [6f2989c346] - events: allow the options argument to be null (Luigi Pinca) #39486
• [72ad6d3f27] - fs: check closing_ in FileHandle::Close (James M Snell) #39472
• [8b58e574ba] - fs: fix FileHandle::ClosePromise to return persisted Promise (James M Snell) #39331
• [9d950a0956] - http2: on receiving rst_stream with cancel code add it to pending list (Akshay K) #39423
• [19e9accf91] - inspector: mark as stable (Gireesh Punathil) #37748
• [e4331cd43d] - lib: comment explaining special-case handling of promises (Stephen Belanger) #39135
• [0a47f5fc54] - meta: update collaborator email in README (Rich Trott) #39510
• [65020110e8] - meta: remove unneeded .mailmap entry (Rich Trott) #39512
• [864ef11be8] - meta: update email address for collaborator (Rich Trott) #39511
• [d3f58cb650] - meta: align collaborator name in .mailmap/AUTHORS with README (Rich Trott) #39489
• [5f9b2187a1] - meta: align email address in README/.mailmap/AUTHORS (Rich Trott) #39503
• [9fbe3f6b49] - meta: revise .mailmap for README consistency (Rich Trott) #39457
• [f6fbb38924] - meta: alphabetize .mailmap file (Rich Trott) #39434
• [dc9c6aa428] - meta: align collaborator email in .mailmap/AUTHORS with README (Rich Trott) #39478
• [febeb0df16] - meta: update AUTHORS (Rich Trott) #39461
• [d059ed9242] - meta: add .mailmap entry for new email for existing contributor (Rich Trott) #39431
• [cdf7251370] - process: add api to enable source-maps programmatically (legendecas) #39085
• [eccc9a6578] - punycode: add pending deprecation (Antoine du Hamel) #38444
• [a082a705b3] - (SEMVER-MINOR) repl: enable --experimental-repl-await /w opt-out (hemanth.hm) #34733
• [b230ac12d9] - src: stop using deprecated v8::ApiObject (Michaël Zasso) #38990
• [929205e6b9] - src: use non-deprecated Symbol::Description (Michaël Zasso) #38990
• [42ff6d952a] - src: print native module id on native module not found (legendecas) #39460
• [f0287e52aa] - src: close HandleWraps instead of deleting them in OnGCCollect() (Anna Henningsen) #39441
• [2cf52f8db1] - src: set SSL_OP_ALLOW_CLIENT_RENEGOTIATION (Daniel Bevenius) #38753
• [fc138376aa] - src: remove unused guards around node-api reference (legendecas) #38334
• [26ada4971c] - stream: import internal/util/types instead (James M Snell) #39331
• [e91053a465] - stream: implement TextEncoderStream and TextDecoderStream (James M Snell) #39347
• [efe74746f0] - stream: fixup property definition to avoid prototype polution (James M Snell) #39371
• [4709da0372] - test: ensure microtask queues are not automatically drained (Jochen Eisinger) #38990
• [86ca9a8a80] - test: remove test-debug-args (Michaël Zasso) #38990
• [bbcd651cfd] - test: update trace events test expectations (Michaël Zasso) #38990
• [039f64f249] - test: fix WASI link test (Richard Lau) #39485
• [b1d38ddc8a] - test: update OpenSSL3 error messages for beta-1 (Daniel Bevenius) #39437
• [db4f802fba] - Revert "test: skip tests for openssl-3.0.0-alpha15" (Daniel Bevenius) #39437
• [a30d021b94] - test: add test for WebSocket secret verification in debugger (Rich Trott) #39357
• [04355afd24] - test: add NumberFormat resolvedOptions test (Richard Lau) #39401
• [d0fb02c26a] - test: put common lint exceptions into config file (Rich Trott) #39358
• [259d091366] - test: mark test-domain-error-types flaky (James M Snell) #39369
• [5517769472] - tools: fetch googletest dependency for V8 CI (Michaël Zasso) #38990
• [5fe74aa403] - tools: update V8 gypfiles for 9.2 (Michaël Zasso) #38990
• [e58cf4e44c] - tools: flag README/mailmap mismatches in find-inactive-collaborators (Rich Trott) #39477
• [0a46e66253] - tools: use mailmap for find-inactive-collaborators (Rich Trott) #39432
• [7570f998df] - tools: email matchin is case insensitive for .mailmap (Rich Trott) #39430
• [5c11a0279d] - tools: make internal link checker more robust (Rich Trott) #39429
• [4c32aa02db] - tools: added remark-frontmatter (Ben Halverson) #38717
• [c6a7c3d00d] - tools: fix broken link hash (Rich Trott) #39426
• [0f1d51578e] - tools: change commit fetch limiting in find-inactive-collaborators (Rich Trott) #39362
• [e5d64473e8] - tools: use Node.js 16.x for GitHub workflow (Rich Trott) #39362
• [68fd6d5282] - url: prevent pathname setter from erasing path of path-only URLs (Darshan Sen) #39060