nodejs / node Public

PR-URL: #40518
Refs: #40509
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>

PR-URL: #40518
Refs: #40509
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>

Currently using the --openssl-is-fips configuration option in
combination with --ninja is broken.

This commit fixes two issues, one being an issue with the linker/version
script path variable. The second is that the locations of built
artifacts that differ for ninja and make.

ninja:
$ ./configure --openssl-is-fips --ninja
$ ninja -C out/Release
$ ./node --enable-fips -p 'crypto.getFips()'
1

make:
$ ./configure --openssl-is-fips
$ make -j8
$ ./node --enable-fips -p 'crypto.getFips()'
1

PR-URL: #40518
Refs: #40509
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>

Notable changes:

Fixed distribution for native addon builds

This release fixes an issue introduced in Node.js v17.0.0, where some V8
headers were missing from the distributed tarball, making it impossible
to build native addons. These headers are now included.
#40526

Fixed stream issues
* Fixed a regression in `stream.promises.pipeline`, which was introduced
  in version 16.10.0, is fixed. It is now possible again to pass an
  array of streams to the function.
  #40193
* Fixed a bug in `stream.Duplex.from`, which didn't work properly when
  an async generator function was passed to it.
  #40499

PR-URL: #40535

Fix up example and make it more explicit on how
you need to use napi_extended_error_info in order to
help people avoid what might be a common mistake that
we made in node-addon-api.

Refs: nodejs/node-addon-api#1089

Signed-off-by: Michael Dawson <mdawson@devrus.com>

PR-URL: #40458
Reviewed-By: Gabriel Schulhof <gabrielschulhof@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>

There is no need to crash the process if any of these checks fail.

Signed-off-by: Darshan Sen <darshan.sen@postman.com>

PR-URL: #40425
Reviewed-By: Anna Henningsen <anna@addaleax.net>

Notable Changes:

Experimental ESM Loader Hooks API:

Node.js ESM Loader hooks have been consolidated to represent the steps involved needed to facilitate future loader chaining:
1. `resolve`: `resolve` [+ `getFormat`]
2. `load`: `getFormat` + `getSource` + `transformSource`

For consistency, `getGlobalPreloadCode` has been renamed to `globalPreload`.

A loader exporting obsolete hook(s) will trigger a single deprecation warning (per loader) listing the errant hooks.

Contributed by Jacob Smith, Geoffrey Booth, and Bradley Farias - #37468

Other Notable Changes:

deps:
  * upgrade npm to 8.1.0 (npm team) #40463
doc:
  * deprecate (doc-only) http abort related (dr-js) #36670
vm:
  * (SEMVER-MINOR) add support for import assertions in dynamic imports (Antoine du Hamel) #40249

PR-URL: #40504

Fixes: nodejs/Release#704

PR-URL: #40526
Fixes: #40529
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>

PR-URL: #40409
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>
Reviewed-By: Qingyu Deng <i@ayase-lab.com>

Signed-off-by: Darshan Sen <darshan.sen@postman.com>

PR-URL: #40400
Reviewed-By: Anna Henningsen <anna@addaleax.net>

This merges the `IsEmpty()` call and the `ToLocalChecked()` call into a
single `ToLocal()` call.

Signed-off-by: Darshan Sen <darshan.sen@postman.com>

PR-URL: #40386
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

Fixes: #40191

PR-URL: #40193
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: #40403
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

PR-URL: #40403
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Add a section to the Major Releases section of the release guide
to cover updating the list of expected files for the promotion tool.

PR-URL: #40470
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>

Coverity scan reported a free after use and I think its
right. Tweak to avoid double free.

Signed-off-by: Michael Dawson <mdawson@devrus.com>

PR-URL: #40380
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>

Refs: nodejs/TSC#1096

PR-URL: #40523
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: #40517
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

The request uses chunked transfer encoding and the HTTP response status
code is not 400 but 200.

PR-URL: #40486
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

The `maxFreeSockets` option specifies the maximum number of free
sockets per host.

PR-URL: #40483
Fixes: #40446
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>

Notable Changes:

Deprecations and Removals:

- (SEMVER-MAJOR) dns: runtime deprecate type coercion of `dns.lookup`
  options
  (Antoine du Hamel) [#39793]
- doc: deprecate (doc-only) http abort related
  (dr-js) [#36670]
- (SEMVER-MAJOR) module: subpath folder mappings EOL
  (Guy Bedford) [#40121]
- (SEMVER-MAJOR) module: runtime deprecate trailing slash patterns
  (Guy Bedford) [#40117]

OpenSSL 3.0:

Node.js now includes OpenSSL 3.0, specifically https://github.com/quictls/openssl
which provides QUIC support.

While OpenSSL 3.0 APIs should be mostly compatible with those provided
by OpenSSL 1.1.1, we do anticipate some ecosystem impact due to
tightened restrictions on the allowed algorithms and key sizes.

If you hit an `ERR_OSSL_EVP_UNSUPPORTED` error in your application with
Node.js 17, it’s likely that your application or a module you’re using
is attempting to use an algorithm or key size which is no longer allowed
by default with OpenSSL 3.0. A command-line option,
`--openssl-legacy-provider`, has been added to revert to the legacy
provider as a temporary workaround for these tightened restrictions.

For details about all the features in
OpenSSL 3.0 please see https://www.openssl.org/blog/blog/2021/09/07/OpenSSL3.Final.
(Daniel Bevenius) [#38512]

Contributed in #38512, #40478

V8 9.5:

The V8 JavaScript engine is updated to V8 9.5. This release comes with
additional supported types for the `Intl.DisplayNames` API and Extended
`timeZoneName` options in the `Intl.DateTimeFormat` API. You can read
more details in the V8 9.5 release post https://v8.dev/blog/v8-release-95.
(Michaël Zasso) [#40178]

Readline Promise API:

The `readline` module provides an interface for reading data from a
Readable stream (such as `process.stdin`) one line at a time.
(Antoine du Hamel) [#37947]

Other Notable Changes:

- (SEMVER-MAJOR) dns: default to verbatim=true in dns.lookup()
  (treysis) [#39987]
- (SEMVER-MAJOR) errors: print Node.js version on fatal exceptions that
  cause exit
  (Divlo) [#38332]
- deps: upgrade npm to 8.1.0
  (npm team) [#40463]
- (SEMVER-MINOR) fs: add FileHandle.prototype.readableWebStream()
  (James M Snell) [#39331]
- (SEMVER-MAJOR) lib: add structuredClone() global
  (Ethan Arrowood) [#39759]
- (SEMVER-MAJOR) lib: expose `DOMException` as global
  (Khaidi Chu) [#39176]
- (SEMVER-MAJOR) stream: finished should error on errored stream
  (Robert Nagy) [#39235]

Semver-Major Commits:

- (SEMVER-MAJOR) build: compile with C++17 (MSVC)
  (Richard Lau) [#38807]
- (SEMVER-MAJOR) build: compile with --gnu++17
  (Richard Lau) [#38807]
- (SEMVER-MAJOR) deps: update V8 to 9.5.172.19
  (Michaël Zasso) [#40178]
- (SEMVER-MAJOR) deps,test,src,doc,tools: update to OpenSSL 3.0
  (Daniel Bevenius) [#38512]
- (SEMVER-MAJOR) dgram: tighten `address` validation in `socket.send`
  (Voltrex) [#39190]
- (SEMVER-MAJOR) dns: runtime deprecate type coercion of `dns.lookup` options
  (Antoine du Hamel) [#39793]
- (SEMVER-MAJOR) dns: default to verbatim=true in dns.lookup()
  (treysis) [#39987]
- (SEMVER-MAJOR) doc: update minimum supported FreeBSD to 12.2
  (Michaël Zasso) [#40179]
- (SEMVER-MAJOR) errors: disp ver on fatal except that causes exit
  (Divlo) [#38332]
- (SEMVER-MAJOR) fs: fix rmsync error swallowing
  (Nitzan Uziely) [#38684]
- (SEMVER-MAJOR) fs: aggregate errors in fsPromises to avoid error swallowing
  (Nitzan Uziely) [#38259]
- (SEMVER-MAJOR) lib: add structuredClone() global
  (Ethan Arrowood) [#39759]
- (SEMVER-MAJOR) lib: expose `DOMException` as global
  (Khaidi Chu) [#39176]
- (SEMVER-MAJOR) module: subpath folder mappings EOL
  (Guy Bedford) [#40121]
- (SEMVER-MAJOR) module: runtime deprecate trailing slash patterns
  (Guy Bedford) [#40117]
- (SEMVER-MAJOR) readline: validate `AbortSignal`s and remove unused event listeners
  (Antoine du Hamel) [#37947]
- (SEMVER-MAJOR) readline: introduce promise-based API
  (Antoine du Hamel) [#37947]
- (SEMVER-MAJOR) readline: refactor `Interface` to ES2015 class
  (Antoine du Hamel) [#37947]
- (SEMVER-MAJOR) src: allow CAP\_NET\_BIND\_SERVICE in SafeGetenv
  (Daniel Bevenius) [#37727]
- (SEMVER-MAJOR) src: return Maybe from a couple of functions
  (Darshan Sen) [#39603]
- (SEMVER-MAJOR) src: allow custom PageAllocator in NodePlatform
  (Shelley Vohr) [#38362]
- (SEMVER-MAJOR) stream: fix highwatermark threshold and add the missing error
  (Rongjian Zhang) [#38700]
- (SEMVER-MAJOR) stream: don't emit 'data' after 'error' or 'close'
  (Robert Nagy) [#39639]
- (SEMVER-MAJOR) stream: do not emit `end` on readable error
  (Szymon Marczak) [#39607]
- (SEMVER-MAJOR) stream: forward errored to callback
  (Robert Nagy) [#39364]
- (SEMVER-MAJOR) stream: destroy readable on read error
  (Robert Nagy) [#39342]
- (SEMVER-MAJOR) stream: validate abort signal
  (Robert Nagy) [#39346]
- (SEMVER-MAJOR) stream: unify stream utils
  (Robert Nagy) [#39294]
- (SEMVER-MAJOR) stream: throw on premature close in Readable\
  (Darshan Sen) [#39117]
- (SEMVER-MAJOR) stream: finished should error on errored stream
  (Robert Nagy) [#39235]
- (SEMVER-MAJOR) stream: error Duplex write/read if not writable/readable
  (Robert Nagy) [#34385]
- (SEMVER-MAJOR) stream: bypass legacy destroy for pipeline and async iteration
  (Robert Nagy) [#38505]
- (SEMVER-MAJOR) url: throw invalid this on detached accessors
  (James M Snell) [#39752]
- (SEMVER-MAJOR) url: forbid certain confusable changes from being introduced by toASCII
  (Timothy Gu) [#38631]

PR-URL: #40119

PR-URL: #40433
Reviewed-By: Vladimir de Turckheim <vlad2t@hotmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Bryan English <bryan@bryanenglish.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>

PR-URL: #40433
Reviewed-By: Vladimir de Turckheim <vlad2t@hotmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Bryan English <bryan@bryanenglish.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>

Fixes: #40497

PR-URL: #40499
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>

PR-URL: #40490
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>

PR-URL: #40239
Refs: #38905
Refs: #37476
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: #40239
Refs: #38905
Refs: #37476
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Split test-crypto-dh.js so that it is less likely to timeout on
less powerful bots.

PR-URL: #40451
Refs: nodejs/reliability#86
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

This missing initialization was reported by the coverity scans
we are in the process of re-enabling.

Signed-off-by: Michael Dawson <mdawson@devrus.com>

PR-URL: #40379
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>

PR-URL: #40463
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>

This commit adds an option to Node.js named --openssl-legacy-provider
and if specified will load OpenSSL 3.0 Legacy provider.

$ ./node --help
...
--openssl-legacy-provider  enable OpenSSL 3.0 legacy provider

Example usage:

$ ./node --openssl-legacy-provider  -p 'crypto.createHash("md4")'
Hash {
  _options: undefined,
  [Symbol(kHandle)]: Hash {},
  [Symbol(kState)]: { [Symbol(kFinalized)]: false }
}

Co-authored-by: Richard Lau <rlau@redhat.com>

Refs: #40455
PR-URL: #40478
Refs: #40455
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

Co-authored-by: Richard Lau <rlau@redhat.com>

PR-URL: #40478
Refs: #40455
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

This commit add the missing legacy provider source code which is
requried for statically linking the OpenSSL legacy provider.

Co-authored-by: Richard Lau <rlau@redhat.com>

PR-URL: #40478
Refs: #40455
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

PR-URL: #40494
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Qingyu Deng <i@ayase-lab.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

PR-URL: #40485
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>