Node.js - v18.6.0

Security

Notable Changes

Experimental ESM Loader Hooks API

Node.js ESM Loader hooks now support multiple custom loaders, and composition is
achieved via "chaining": foo-loader calls bar-loader calls qux-loader
(a custom loader must now signal a short circuit when intentionally not
calling the next). See the ESM docs for details.

Real-world use-cases are laid out for end-users with working examples in the
article Custom ESM loaders: Who, what, when, where, why, how.

Contributed by Jacob Smith, Geoffrey Booth, and Bradley Farias - https://github.com/nodejs/node/pull/42623

Commits

Semver-minor commits

  • [0bca7b722e] - (SEMVER-MINOR) dns: export error code constants from dns/promises (Feng Yu) #43176
  • [da61e2330f] - (SEMVER-MINOR) esm: add chaining to loaders (Jacob Smith) #42623
  • [8c97f63401] - (SEMVER-MINOR) http: add diagnostics channel for http client (theanarkh) #43580
  • [b27856d3d4] - (SEMVER-MINOR) http: add perf_hooks detail for http request and client (theanarkh) #43361
  • [9d918d9923] - (SEMVER-MINOR) module: add isBuiltIn method (hemanth.hm) #43396
  • [a0e7b9983c] - (SEMVER-MINOR) net: add drop event for net server (theanarkh) #43582
  • [4bda6e02a3] - (SEMVER-MINOR) test_runner: expose describe and it (Moshe Atlow) #43420
  • [34e83312a4] - (SEMVER-MINOR) v8: add v8.startupSnapshot utils (Joyee Cheung) #43329

Semver-patch commits

  • [ef174eac87] - assert: callTracker throw a specific error message when possible (Moshe Atlow) #43640
  • [07836637af] - bootstrap: move global initialization to js (Alena Khineika) #43625
  • [e9ee7e44be] - build,test: increase stack size limit on Windows (Tobias Nießen) #43632
  • [3ca9e653a6] - child_process: improve ipc write performance (rubikscraft) #42931
  • [cad6d990ec] - child_process: speed up 'advanced' ipc receiving (rubikscraft) #42931
  • [ce3a22a9e3] - cluster: fix closing dgram sockets in cluster workers throws errors (Ouyang Yadong) #43709
  • [5d8ee519db] - cluster: fix fd leak (theanarkh) #43650
  • [fa5c4643e2] - cluster, net: fix listen pipe with readable and writable in cluster (theanarkh) #43634
  • [4df96b501d] - crypto: don't disable TLS 1.3 without suites (Adam Majer) #43427
  • [a43928ae78] - crypto: use ByteSource::Builder in To*Copy (Tobias Nießen) #43477
  • [bb326f7ece] - crypto: handle webcrypto generateKey() usages edge case (Filip Skokan) #43454
  • [9bd13bbb3a] - crypto: update Wrapping and unwrapping keys webcrypto example (Filip Skokan) #43452
  • [679f19128e] - crypto: fix webcrypto generateKey() with empty usages (Filip Skokan) #43431
  • [64a9dd7b83] - crypto: fix webcrypto digest() invalid algorithm (Filip Skokan) #43431
  • [dedb22e965] - crypto: fix webcrypto RSA generateKey() use of publicExponent (Filip Skokan) #43431
  • [018f61cb4f] - crypto: fix webcrypto AES-KW keys accepting encrypt/decrypt usages (Filip Skokan) #43431
  • [3ee0bb8d03] - crypto: fix webcrypto deriveBits for non-byte lengths (Filip Skokan) #43431
  • [7fc075b23a] - deps: update undici to 5.7.0 (Node.js GitHub Bot) #43790
  • [d6a9e93426] - deps: patch V8 to 10.2.154.13 (Michaël Zasso) #43727
  • [428d03cb94] - deps: update corepack to 0.12.0 (Node.js GitHub Bot) #43748
  • [74914698e5] - deps: upgrade npm to 8.13.2 (npm team) #43622
  • [0636f86ecc] - deps: upgrade npm to 8.13.1 (npm team) #43552
  • [2149acda60] - dns: make promise API fully constructed from lib/internal/dns/promises (Feng Yu) #43227
  • [79ea19e5e2] - errors: extract type detection & use in ERR_INVALID_RETURN_VALUE (Jacob Smith) #43558
  • [80ced1ae31] - esm: treat 307 and 308 as redirects in HTTPS imports (Kid) #43689
  • [953fefe77b] - esm: restore next<HookName>'s context as optional arg (Jacob Smith) #43553
  • [10bcad5c6e] - esm: fix chain advances when loader calls next\ multiple times (Jacob Smith) #43303
  • [50d64edd49] - esm: refactor responseURL handling (Guy Bedford) #43164
  • [254efd9e3b] - esm: fix http(s) import via custom loader (Jacob Smith) #43130
  • [061ed0e76b] - events: improve Event compatibility (Daeyeon Jeong) #43461
  • [66fb059547] - events: improve EventListener validation (Daeyeon Jeong) #43491
  • [12a591a676] - fs: refactor realpath with Map and Set (LiviaMedeiros) #43569
  • [df501316c1] - fs: don't end fs promises on Isolate termination (Santiago Gimeno) #42910
  • [e6d4837fad] - http: fix failing test (Paolo Insogna) #43641
  • [491c7619c4] - http: defer reentrant execution of Parser::Execute (Paolo Insogna) #43369
  • [d71ba322b0] - http: fix http agent keep alive (theanarkh) #43380
  • [1f4f811de5] - http2: log debug only when in debug mode (Basit) #43626
  • [c8cbec4cef] - lib: make validateObject less affected by prototype tampering (Antoine du Hamel) #42929
  • [dc484b6f6f] - lib: implement safe alternatives to Promise static methods (Antoine du Hamel) #43728
  • [2233567331] - lib: use null-prototype objects for property descriptors (Antoine du Hamel) #43473
  • [b9198d977f] - lib: refactor to avoid unsafe regex primordials (Antoine du Hamel) #43475
  • [deaf4bb5cd] - lib: fix TODO in freeze_intrinsics (Antoine du Hamel) #43472
  • [61e6d7858a] - lib,src: add source map support for global eval (Chengzhong Wu) #43428
  • [58646eaad6] - loader: make require.resolve throw for unknown builtin modules (木杉) #43336
  • [e914185c44] - module: cjs-module-lexer WebAssembly fallback (Guy Bedford) #43612
  • [3ad4d37b3c] - module: also enable subpath imports in REPL (Ray) #43450
  • [bf4ac4c55f] - net: remove redundant connecting assignment (Ouyang Yadong) #43710
  • [ad1d0541c5] - net: fix net keepalive and noDelay (theanarkh) #43561
  • [f8bdc53e4f] - net: prevent /32 ipv4 mask from matching all ips (supriyo-biswas) #43381
  • [47a252257b] - net: fix net.Server keepalive and noDelay (theanarkh) #43497
  • [d834d216f2] - perf_hooks: add initiatorType getter (Rafael Gonzaga) #43593
  • [02009b7069] - perf_hooks: fix miscounted gc performance entry starttime (#43066) (Xuguang Mei) #43066
  • [e9574f3009] - readline: fix to not access a property on an undefined value (Kohei Ueno) #43543
  • [fe1f740f61] - src: merge RunInThisContext() with RunInContext() (Daeyeon Jeong) #43225
  • [0f6d19489a] - src: fix crash on FSReqPromise destructor (Santiago Gimeno) #43533
  • [4e6a844207] - src: delegate NodeArrayBufferAllocator to v8's allocator (Jeremy Rose) #43594
  • [5ae30bf17a] - src: remove a stale comment in async_hooks (Daeyeon Jeong) #43317
  • [0b432b957e] - src: fix compiler warning in src/heap_utils.cc (Darshan Sen) #43579
  • [d3fc791c3d] - src: improve and update ByteSource description (Tobias Nießen) #43478
  • [4e0afa4133] - src: remove CopyBuffer (Tobias Nießen) #43463
  • [0659d5e3b0] - src: change FormatSize to actually accept a size_t (Tobias Nießen) #43464
  • [66ee1f1e3c] - src: register StreamBase while registering LibuvStreamWrap (Darshan Sen) #43321
  • [48ee6b9dc9] - src,bootstrap: remove NodeMainInstance::registry_ (Darshan Sen) #43392
  • [2e181f68a3] - src,stream: change return type to Maybe (Daeyeon Jeong) #43575
  • [0f07abc80d] - stream: finish pipeline if dst closes before src (Robert Nagy) #43701
  • [1617a4621e] - stream: pass error on legacy destroy (Giacomo Gregoletto) #43519
  • [40f51d8e83] - test_runner: protect internals against prototype tampering (Antoine du Hamel) #43578
  • [ddf7518520] - test_runner: cancel on termination (Moshe Atlow) #43549
  • [e51d8c6004] - test_runner: wait for stderr and stdout to complete (Moshe Atlow) #43666
  • [dda64ddfbd] - test_runner: add Subtest to tap protocol output (Moshe Atlow) #43417
  • [a1f1d3a7b3] - url: update WHATWG URL parser to align with latest spec (Feng Yu) #43190
  • [5a5c4be5a3] - util: add AggregateError.prototype.errors to inspect output (LiviaMedeiros) #43646
  • [bdca4d3ccf] - util: remove unnecessary template string (Ruben Bridgewater) #41082
  • [6b16836448] - util: mark cwd grey while inspecting errors (Ruben Bridgewater) #41082
  • [baa22a7b7d] - util: avoid inline access to Symbol.iterator (Kohei Ueno) #43683
  • [a1f581a61e] - util: fix TypeError of symbol in template literals (cola119) #42790
  • [ba9b2f021f] - wasi: use WasmMemoryObject handle for perf (#43544) (snek) #43544

Documentation commits

Other commits

  • [7ee0be71f9] - benchmark: fix output regression (Brian White) #43635
  • [d90a6f9bda] - benchmark: fix fork detection (Paolo Insogna) #43601
  • [f9c30abcdc] - benchmark: forcefully close processes (Paolo Insogna) #43557
  • [ebf962c053] - build: enable GitPod prebuilds (Rich Trott) #43698
  • [482bd53357] - build: clarify missing clang-format tool (Tobias Nießen) #42762
  • [919c5ee5c2] - build: update main branch name in GH workflow (Feng Yu) #43481
  • [3b08dfdc5d] - meta: update AUTHORS (Node.js GitHub Bot) #43750
  • [508cbbcbf9] - meta: update AUTHORS (Node.js GitHub Bot) #43660
  • [d650c9c6b0] - meta: update AUTHORS (Node.js GitHub Bot) #43573
  • [b9204c9be8] - meta: update AUTHORS (Node.js GitHub Bot) #43480
  • [294f0ef4df] - test: mark test-net-connect-reset-until-connected flaky on freebsd (Feng Yu) #43613
  • [f2f7d7b207] - test: remove unnecessary .toString() calls in HTTP tests (Anna Henningsen) #43731
  • [38e92fd88f] - test: mark test-gc-http-client-timeout as flaky on arm (Chengzhong Wu) #43754
  • [b164848c55] - test: fix typo in file name (Antoine du Hamel) #43764
  • [a0b799f645] - test: add test for profile command of node inspect (Kohei Ueno) #43058
  • [c4d88b3345] - test: use Object for tests variable in fs trace test (Feng Yu) #43585
  • [c9f130e1cf] - test: improve code coverage for performance_entry (Kohei Ueno) #43434
  • [0b4956079a] - test: add test to ensure repl doesn't support --input-type (cola119) #43507
  • [2adf4e7727] - test: fix flaky test-perf-hooks-histogram (Santiago Gimeno) #43567
  • [043756d540] - test: fill DOMException names (LiviaMedeiros) #43615
  • [e718a6e913] - test: fix Buffer.from(ArrayBufferView) call (LiviaMedeiros) #43614
  • [ac72f4e812] - test: mark test-worker-http2-stream-terminate flaky on all platforms (Finn Yu) #43620
  • [dabccef69f] - test: mark flaky tests on smartos (Feng Yu) #43596
  • [705e85e736] - test: improve code coverage for SourceMap class (italo jose) #43285
  • [7c6f548382] - test: mark test-http-server-request-timeouts-mixed flaky on macOS (F3n67u) #43597
  • [bd91337988] - test: refactor to top-level await (Meek Simbule) #43500
  • [9940dc38c1] - test: skip test-v8-serialize-leak on IBM i (Richard Lau) #43511
  • [17b92f0679] - test: use unique file names in fs trace test (Ben Noordhuis) #43504
  • [7ca58b8ee7] - test: allow EOVERFLOW errors in fs position tests (Richard Lau) #43510
  • [eece34cddb] - test: add WPT tests for dom/events (Daiki Nishikawa) #43151
  • [70d297c271] - test: replace gc(true) with gc({ type: 'minor' }) (Tobias Nießen) #43493
  • [1022c0d0d4] - test: fix flaky test-https-server-close- tests (Santiago Gimeno) #43216
  • [a9ab41cb38] - test: refactor to top-level await (Meek Simbule) #43366
  • [b1a7798821] - test: skip test-net-connect-reset-until-connected on SmartOS (Filip Skokan) #43449
  • [3b0703fd0d] - test: rename test-eventtarget-whatwg-*.js (Daeyeon Jeong) #43467
  • [5c0a24d5be] - test: mark test-worker-http2-stream-terminate flaky on Windows (Darshan Sen) #43425
  • [48ae00c0b1] - test: improve coverage for load hooks (Antoine du Hamel) #43374
  • [2b55b606f7] - Revert "test: mark test_buffer/test_finalizer flaky" (Matteo Collina) #43418
  • [3948accbf4] - test: make node-api/test_buffer/test_finalizer not flaky (Matteo Collina) #43418
  • [c954bcd20b] - tools: remove rpm build scripts (Ben Noordhuis) #43647
  • [8a06b7b9d0] - tools: update lint-md-dependencies to rollup\@2.76.0 (Node.js GitHub Bot) #43749
  • [aafdf1239e] - tools: refactor tools/license2rtf to ESM (Feng Yu) #43232
  • [99ffabf2dd] - tools: update eslint to 8.19.0 (Node.js GitHub Bot) #43662
  • [c6396c179f] - tools: update lint-md-dependencies (Node.js GitHub Bot) #43572
  • [8d14d6e215] - tools: fix CJS/ESM toggle on small screens (Antoine du Hamel) #43506
  • [59d4da699e] - tools: update eslint to 8.18.0 (Node.js GitHub Bot) #43479
  • [752380a959] - tools: update main branch name (Feng Yu) #43440
  • [06c367ef8b] - tools: update lint-md-dependencies to rollup\@2.75.6 (Node.js GitHub Bot) #43386

Security

Security wording was detected, but no CVEs were found.

Details

date
July 13, 2022, 8:59 p.m.
name
2022-07-13, Version 18.6.0 (Current), @targos
type
Minor
👇
Register or login to:
  • 🔍View and search all Node.js releases.
  • 🛠️Create and share lists to track your tools.
  • 🚨Setup notifications for major, security, feature or patch updates.
  • 🚀Much more coming soon!
Continue with GitHub
Continue with Google
or