Node.js Blog

Node v7.1.0 (Current)

Evan Lucas — Tue, 08 Nov 2016 21:17:10 GMT

Notable changes

buffer: add buffer.transcode to transcode a buffer's content from one encoding to another primarily using ICU (James M Snell) #9038
child_process: add public API for IPC channel (cjihrig) #9322
icu:
- Upgraded to ICU 58 - small icu (Steven R. Loomis) #9234
- Add cldr, tz, and unicode to process.versions (Steven R. Loomis) #9266
lib: make String(global) === '\[object global\]' (Anna Henningsen) #9279
libuv: Upgraded to 1.10.0 (cjihrig) #9267
readline: use icu based string width calculation (James M Snell) #9040
src:
- add NODE_PRESERVE_SYMLINKS environment variable that has the same effect as the --preserve-symlinks flag (Marc Udoff) #8749
- Fix String#toLocaleUpperCase() and String#toLocaleLowerCase() (Steven R. Loomis)

Commits

[dafdb7b069] - benchmark: add trailing newline for consistency (Roman Reiss) #9410
[fab8eb660f] - benchmark: add microbenchmarks for ES Map (Rod Vagg) #7581
[44792f83bf] - benchmark,lib,test,tools: remove unneeded . escape (Rich Trott) #9449
[c70c96a3e2] - buffer: coerce offset using Math.trunc() (cjihrig) #9341
[212da12f45] - buffer: use correct name for custom inspect symbol (Charmander) #9289
[0939edd4ed] - (SEMVER-MINOR) buffer: add buffer.transcode (James M Snell) #9038
[ceec520aef] - build: add MAKEFLAGS="-j1" to node-gyp (Daniel Bevenius) #9450
[1109d0b244] - build: reduce noise from doc target (Daniel Bevenius) #9457
[90aac7ca28] - build: start comments at beginning of line (Sakthipriyan Vairamani (thefourtheye)) #9375
[b51db7120e] - build: make node-gyp output silent (Sakthipriyan Vairamani (thefourtheye)) #8990
[d8eaa14c2d] - build: prioritise --shared-X-Y over pkg-config (Rod Vagg) #9368
[f7d8481ee2] - build: use wxneeded on openbsd (Aaron Bieber) #9232
[7b0e93738b] - (SEMVER-MINOR) child_process: add public API for IPC channel (cjihrig) #9322
[4e3731c7e7] - child_process: remove unreachable code (cjihrig) #9307
[d573acf96f] - child_process: remove unreachable execSync() code (cjihrig) #9209
[f1f00df9bf] - deps: upgrade npm to 3.10.9 (Kat Marchán) #9286
[3d1766f492] - (SEMVER-MINOR) deps: Intl: ICU 58 bump - small icu (BIG COMMIT) (Steven R. Loomis) #9234
[827000ee62] - (SEMVER-MINOR) deps: Intl: ICU 58 bump: configure/LICENSE/docs (Steven R. Loomis) #9234
[0f871e1087] - deps: back port OpenBSD fix in c-ares/c-ares (Aaron Bieber) #9232
[106d71914c] - deps: upgrade libuv to 1.10.0 (cjihrig) #9267
[4c4132e5d3] - doc: update minute-taking procedure for CTC (Rich Trott) #9425
[ed8df17135] - doc: note that tests should include a description (Gibson Fahnestock) #9415
[bc2d1c9d91] - doc: do not link in the headings (Sakthipriyan Vairamani (thefourtheye)) #9416
[4bb9d21d01] - doc: update GOVERNANCE.md to use "meeting chair" (Rich Trott) #9432
[c2fab3c600] - doc: add Sakthipriyan to the CTC (Rod Vagg) #9427
[a8295d86d9] - doc: update Diagnostics WG info (Josh Gavant) #9329
[3af9453019] - doc: move stray sentences in zlib doc (Rich Trott) #9365
[d4b509584f] - doc: use 'an' over 'a', remove redundant sentence (Zeke Sikelianos) #9345
[ff69e38070] - doc: add more internal links to fs.Stats object (Zeke Sikelianos) #9345
[c554f090df] - doc: fix outdate ninja link (Yangyang Liu) #9278
[3d4a829d85] - doc: fix broken links to Buffer.from(string) (Jesse McCarthy) #9294
[225a9dfb00] - doc: fs: fix link to mkdtemp (coderaiser) #9379
[dbeadd363c] - doc: update OpenSSL links (kobelb) #9338
[eeabab3827] - doc: add 2016-10-26 CTC meeting minutes (Rich Trott) #9348
[31690a690c] - doc: add 2016-10-05 CTC meeting minutes (Josh Gavant) #9326
[7f1a40dbcf] - doc: add 2016-09-28 CTC meeting minutes (Josh Gavant) #9325
[edd89265ba] - doc: update CONTRIBUTING.md to address editing PRs (Gibson Fahnestock) #9259
[c7458909a7] - doc: reference signal(7) for the list of signals (Emanuele DelBono) #9323
[a3f6854724] - doc: more realistic custom inspect example (Ryan Scheel (Havvy)) #8875
[a0074e2232] - doc: clarify buffer toString docs. (Olan Byrne) #8984
[3f90481e20] - doc: clarify relation between a file and a module (marzelin) #9026
[82119049ef] - doc: fix typo in http.md (anu0012) #9144
[d2e7882723] - doc: add 2016-10-19 CTC meeting minutes (Josh Gavant) #9193
[ce00a9d2b6] - doc: add performance warning to require.extensions (Ben Noordhuis) #9196
[d1c32aa335] - doc: mention case-insensitive env on windows (Oliver Salzburg) #9166
[c6e429a6bc] - doc: add CTC meeting minutes for 2016-10-12 (Michael Dawson) #9070
[355041960d] - events: remove unnecessary checks (cjihrig) #9330
[0ce0abf6cb] - events,test: fix TypeError in EventEmitter warning (jseagull) #9021
[6f35e4421a] - http: add debug message for invalid header value (Evan Lucas) #9195
[173b088e1a] - inspector: do not prompt to use localhost (Eugene Ostroukhov) #9451
[939d1023c2] - inspector: switch to new inspector APIs (Eugene Ostroukhov) #9028
[2e7b078e7b] - inspector: fix request path nullptr dereference (Ben Noordhuis) #9184
[9940666c1b] - (SEMVER-MINOR) intl: Add more versions from ICU (Steven R. Loomis) #9266
[5bfefa6063] - lib: change == to === in linkedlist (jedireza) #9362
[d24bd20d2b] - lib: make String(global) === '\[object global\]' (Anna Henningsen) #9279
[9372aee4a3] - lib: fix beforeExit not working with -e (Ben Noordhuis) #8821
[c231130e06] - module: skip directories known not to exist (Ben Noordhuis) #9196
[d09eb9c6b2] - net: name anonymous functions (Pedro Victor) #9357
[a5c62cb4f2] - (SEMVER-MINOR) readline: use icu based string width calculation (James M Snell) #9040
[60461d2d90] - repl: refactor lib/repl.js (Rich Trott) #9374
[071836aa42] - repl: name anonymous functions (Pedro Victor) #9356
[0b9d80a037] - repl: don’t write to input stream in editor mode (Anna Henningsen) #9207
[1c59cefc44] - repl: make key of repl.write() optional always (Anna Henningsen) #9207
[b1ef638de3] - (SEMVER-MINOR) src: default --icu_case_mapping on as a v8 option (Steven R. Loomis) #9454
[0c236d1d36] - src: replace SetNamedPropertyHandler() (AnnaMag) #9062
[5ab172ee8f] - src: fix use of uninitialized variable (James M Snell) #9281
[57c0a9b5dc] - src: remove unused function (Brian White) #9243
[08e12c7809] - src: remove superfluous env_string string (Ben Noordhuis) #9213
[c342bda49e] - src: make cross-context MakeCallback() calls work (Ben Noordhuis) #9221
[60a5b515b8] - (SEMVER-MINOR) src: add NODE_PRESERVE_SYMLINKS environment variable (Marc Udoff) #8749
[f2a3b24611] - src: clean up program/isolate/env init logic (Ben Noordhuis) #9224
[9e753ba782] - src: simplify code, remove NodeInstanceData (Ben Noordhuis) #9224
[8b53f3c41c] - src: speed up module loading, don't resize buffer (Ben Noordhuis) #9132
[362c307f38] - src: speed up module loading, skip EOF read (Ben Noordhuis) #9132
[85a9295813] - src,tools: speed up startup by 2.5% (Ben Noordhuis) #5458
[6e1eb59fee] - test: improve test-debugger-util-regression (Santiago Gimeno) #9490
[6eb6816e22] - test: fix flaky test-net-GH-5504 (Santiago Gimeno) #9461
[f640bafc58] - test: fix flaky test-force-repl-with-eval (Santiago Gimeno) #9460
[675a4b20b6] - test: update http-header-obstext (Gibson Fahnestock) #9415
[9d9ea8127e] - test: move timer-dependent test to sequential (Rich Trott) #9431
[1c3487b5c3] - test: remove timers from streams test (Anna Henningsen)
[e696bc33eb] - test: increase test coverage for lib/zlib.js (Rich Trott) #9366
[ed3f80a988] - test: add test for HTTP client "aborted" event (Kyle E. Mitchell) #7376
[d12ed29f6a] - test: remove timer in test-dgram-send-empty-array (Rich Trott) #9361
[e451022dd9] - test: refactor test-http-client-readable (Rich Trott) #9344
[01b626a45a] - test: clean up dgram-broadcast-multi-process test (Isobel Redelmeier) #9308
[411b1339bc] - test: fix freebsd10-64 CI failures (Rich Trott) #9317
[1037463604] - test: add child_process customFds test (cjihrig) #9307
[bd9cb40977] - test: run all of test-timers-blocking-callback (Rich Trott) #9305
[8b7ce8bd11] - test: fix flaky test-fs-watch-recursive on OS X (Rich Trott) #9303
[6c9e4fddf0] - test: refactor test-async-wrap-check-providers (Gerges Beshay) #9297
[0ab008e50d] - test: fix lint error regarding unused commons const (Daniel Bevenius) #9334
[c9b67c6a91] - test: writable stream needDrain state (Italo A. Casas) #8799
[248a3200b2] - test: writable stream ending state (Italo A. Casas) #8707
[d6f688ae0d] - test: writable stream finished state (Italo A. Casas) #8791
[d49d990c42] - test: prevent workers outliving parent (Sam Roberts) #9257
[2ad81ed0e6] - test: refactor /parallel/test-cluster-uncaught-exception.js to ES6 (Deverick) #9239
[f39eb05946] - test: use strict assertions in module loader test (Ben Noordhuis) #9263
[fc9e6a37fa] - test: remove err timer from test-http-set-timeout (BethGriggs) #9264
[53520f06f3] - test: clean up test-child-process-exec-cwd.js (Jeena Lee) #9231
[deef2f6079] - test: add child_process.exec() timeout coverage (cjihrig) #9208
[5e138fe768] - test: skip whatwg url parse and setter tests when icu is missing (James M Snell) #9246
[a39b98ef73] - test: add common.hasIntl (James M Snell) #9246
[efb62aa146] - test: fix flaky test by removing timer (Evan Lucas) #9199
[44427cc1f7] - test: case sensitivity of env variables (Oliver Salzburg) #9166
[63ef0990f3] - test: add coverage for execFileSync() errors (cjihrig) #9211
[06b414078e] - test: remove test-v8-inspector-json-protocol test (Ben Noordhuis) #9184
[21ba3e3b89] - test: add more module loader test coverage (Ben Noordhuis) #9196
[204461925b] - test: make flaky pummel test more reliable (Ben Noordhuis) #9241
[4be1ba582a] - test: move flaky test to test/pummel (Ben Noordhuis) #9241
[032533954b] - tools: use long format for gpg fingerprint (Myles Borins) #9258
[aac4af2b26] - tools: enable final newline in .editorconfig (Roman Reiss) #9410
[513da404cb] - tools: enforce function name matching in linter (Rich Trott) #9408
[c23ece7056] - tools: remove dangling eslint symlink (Sam Roberts) #9299
[bdad1e28fd] - tools: make --repeat work with -j in test.py (Rich Trott) #9249
[4f0596fb03] - util: use template strings (Alejandro Oviedo Garcia) #9120
[b083086ff2] - vm: name anonymous functions (solebox) #9388

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

5ef780ab1d04674c7ec528eeb112d37a42a58f00c9f15954655929c5adaf1bbe  node-v7.1.0-aix-ppc64.tar.gz
b4615c79eac53f1a660b94e047d1dc64d797bf365f305ac9e0c2ac7304340171  node-v7.1.0-darwin-x64.tar.gz
8d597ef383eaef91f7da7fdedc0547b7ce6d2a8806f259b74ebb88bde2679df1  node-v7.1.0-darwin-x64.tar.xz
b254b8ff711e94ff59895f820ff61d9054a60c2055b5491c042d456af1f70a83  node-v7.1.0-headers.tar.gz
020f9a74cc191cb6c2ce117fda9035fe7b7dfe1f2a003cff190a04c585a450db  node-v7.1.0-headers.tar.xz
fcaa2281b2ea4e0a6b598fae4fbee3708aded5b1b0b2397f8fab18c13e3ea3be  node-v7.1.0-linux-arm64.tar.gz
88d3ceb52e5ab5fb28f0aed6078fb8a493a8ed570b174eb98db7b7abed16276e  node-v7.1.0-linux-arm64.tar.xz
2e87c4249ebd29e6022aa289ec8c7632e92ba7a5c61a5e035c0acefa8a143772  node-v7.1.0-linux-armv6l.tar.gz
69e6cc3488f48a484def2cdab3cfc4da2153e92e4883b1c13fe46cc0be6ccd78  node-v7.1.0-linux-armv6l.tar.xz
8899d4340c23282ec4dc28b6a04bb20279da46bf92db58abce50a616877cd811  node-v7.1.0-linux-armv7l.tar.gz
218d83c0dc58e94d5c3aa866495eaa39a9b5e57662fa0f296e4ea36c5a6de681  node-v7.1.0-linux-armv7l.tar.xz
6cc4ccb25c21bd2331b30aa4193c21c4d3ac2d9d1fd7300157285383c288ec29  node-v7.1.0-linux-ppc64le.tar.gz
61fcab2aa00dc5100908114cf665526921843246d36ee3aa919adc8a4c82a533  node-v7.1.0-linux-ppc64le.tar.xz
662e3806f9ce46d0f92a347db55b50c3161406439317976c5fdb51e1dd189861  node-v7.1.0-linux-ppc64.tar.gz
e7e84c6c1beff9198725b7fefe2e47933a6ccb25760345bc0f6be9e72fa893a9  node-v7.1.0-linux-ppc64.tar.xz
c642a97c368644e8808cb006c2ad5822c917fa36bce3e8f41a01a4a2bb84740c  node-v7.1.0-linux-s390x.tar.gz
b053d8e671544330fe8d55a4a0691ec5d71302c755ca003e405995c9bacc16f4  node-v7.1.0-linux-s390x.tar.xz
0d2f13477ba991950bd9938e38c8d943b9bf2e899adcd4a28e98532f029e9910  node-v7.1.0-linux-x64.tar.gz
312f24d410e60f805db927d31d3b4547f69f88f4b2176c2eeca2f042f33624ce  node-v7.1.0-linux-x64.tar.xz
f6bcb57e7e693b25ad448faf18300bb9f823bc114aa0b050b7953978511e9a1d  node-v7.1.0-linux-x86.tar.gz
310252fc6295a387e3172efad2efebbd9e32b3eba137d2ee314cbd7f3238e110  node-v7.1.0-linux-x86.tar.xz
1d73a93e60b0021f616cdf44062717f67ed6fcfaf15f1efd0fa76491cb7623d0  node-v7.1.0.pkg
3dff7316291080f351349977d431f4ee0581c6d8961ec8b4ea747c8a79edd4ab  node-v7.1.0-sunos-x86.tar.gz
131b85395c7af612efbecd215e2f9b35b3359fc5200afb60b56acf824f334b11  node-v7.1.0-sunos-x86.tar.xz
595e7e2a37d1e0573044a90077bb12c0f750e5d8851899ffa74038238da9a983  node-v7.1.0.tar.gz
55ae831a2090e3af71b8f071dc5599922e5c752a2e40d77cbfd4a39d22cf4981  node-v7.1.0.tar.xz
6261e1f4392a1e87bf4e51f94e38fdf793d111b9291e81c9fdd9c79a4954fb4e  node-v7.1.0-win-x64.7z
b86f7a789b437a801dc675ef530d7728840f51601dd8e7734b418516fca6061b  node-v7.1.0-win-x64.zip
a4f8677f716e69eea5cfe870093770aae2809d90684708ac790796562f958a3e  node-v7.1.0-win-x86.7z
bb5b52aee2b3fd2506dc825d56c1d5ced65c9fe8b6a62e5e810b73dda78629bf  node-v7.1.0-win-x86.zip
853936fe0aa946e16bbab10d1c7e964bbf7a1820d12adbfd748d7cf9f8059fa3  node-v7.1.0-x64.msi
5d95a909788239b4ed97c5f79b2d16837ea577a1a68e34e014d0a45de7f27b1d  node-v7.1.0-x86.msi
d79a95cbf4ae761ff8cb16ef93582e2f3183a2bbc09996c2f9d97829bad9f581  win-x64/node.exe
87357f758d9b522056ee458deba2316250012676b876ab7c59543be22ed037ea  win-x64/node.lib
2f76f27013dabf035ee3660a15f27a221a28c56d5c7f8b39d42c68adbf59dc37  win-x64/node_pdb.7z
bf31dc33d9a0f9da70b5b1b08ad85097d2cb2badcd661d7830e3933ce2052e21  win-x64/node_pdb.zip
5b5c5d68356c03789d782ebb0035d969495b4c1ba241dc095f8e44cb7e84b3d5  win-x86/node.exe
d50d4489ab29355dea0a53d4645662aa09ede229c252011fa811b9ff9a0db9ed  win-x86/node.lib
3fe9dd91eda7b41c5bc5791683ea9cfd63c8285e97106177efc078e578f61908  win-x86/node_pdb.7z
2cb36424fa20b0c3aa294ffbb9744cb52fdbac4333a2b80bc538f6a5ec792da6  win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCAAGBQJYIkCFAAoJELY7U1pMIGypwqsQALEg3TrBH4K2XmjaDotp95c7
IHCGv34HEkRm+VfBSquPELQv69aTWrJMcGt//pxN6vElBSAk1IKKOpQCvh6B2peW
tSnrlbX4HIGEvoW9CuEElyGNQ8bR/VWH5fa1LISV3d8MrYXrE4GGh+dujiF/+krp
b5+WM8QRvRVOQ798t1y4L73HH/HEdO+eeqrWykayUKYyy+4q85liaWVlsGA2zWqF
g8u+vOHM0MniId1zKmSWSuathRQhUTeaulCx++ZB1nlOKOUTiNDXBrNw2kjuq2Hn
v/f7OmnJLpi8Cgt6GIQ7K/i7F2DkmTZ2USSN6pE1Ic8YZD+z21qH/+AsDQukxUr7
YSkLzt75oXonEKDPZ61GwRG6pNe/yRj4tlAXCyvbHst9P/1FbtgSAPKoa2IKaBFu
FQ+GnH+ylba1WwEqVdb9SMLiAN1SbHBSFSanxV2xUiyfWFyqYVyHFUv+o/Cvcq/g
lmOyJIl3sP24YOw4RueLNle3vBf3SCOFAfOmEHP6ciQctV7c4dAr1s9m1NzbHDSR
PM/J4VX2x6/xmIgLGZHmhys9w71IkMpj6fVSOtceS/D/EzCl7rbf8sTV2rbLE+H8
9uqytWANa3mkM29poedRCfE7tphJiSrXCaJyBArci/yA4BTpRgWdUbTeY0lWzWf/
wVrzWajHNhSEaJBXDlnT
=JGy6
-----END PGP SIGNATURE-----

Node v4.6.2 (LTS)

Myles Borins — Tue, 08 Nov 2016 19:55:00 GMT

Notable Changes

build: It is now possible to build the documentation from the release tarball (Anna Henningsen) #8413
buffer: Buffer.alloc() will no longer incorrectly return a zero filled buffer when an encoding is passed (Teddy Katz) #9238
deps: upgrade npm in LTS to 2.15.11 (Kat Marchán) #8928
repl: Enable tab completion for global properties (Lance Ball) #7369
url: url.format() will now encode all # in search (Ilkka Myller) #8072

Commits

[06a1c9bf80] - assert: remove code that is never reached (Rich Trott) #8132
[861e584d46] - async_wrap: add a missing case to test-async-wrap-throw-no-init (yorkie) #8198
[a3d08025fa] - benchmark: add benches for fs.stat & fs.statSync (Anna Henningsen) #8338
[408a585261] - buffer: fix fill with encoding in Buffer.alloc() (Teddy Katz) #9238
[17c4187949] - buffer: optimize hex_decode (Christopher Jeffrey) #7602
[50cfea0081] - build: run npm install for doc builds in tarball (Anna Henningsen) #8413
[c4be179064] - build: add missing files to zip and 7z packages (Richard Lau) #8069
[41e27f6a6a] - build: don't link against liblog on host system (Ben Noordhuis) #7762
[7766997f7e] - build: add conflict marker check during CI lint (Brian White) #7625
[2a66ddbcbb] - build: re-add --ninja option to configure (Ehsan Akhgari) #6780
[950cc1df83] - build: adding config.gypi dep to addons/.buildstamp (Daniel Bevenius) #7893
[e64063c344] - build: don't require processing docs for nightlies (Johan Bergström) #8325
[00ea7388cb] - build: fix dependencies on AIX (Michael Dawson) #8285
[8dfab3ad68] - build: fix dependencies on AIX (Michael Dawson) #8272
[1b5f35f1be] - build: turn on thin static archives (Ben Noordhuis) #7957
[c41efe4d68] - build: add node_module_version to config.gypi (Marcin Cieślak) #8171
[f556b43e3e] - build: add --enable-d8 configure option (Ben Noordhuis) #7538
[612dfeb647] - child_process: Check stderr before accessing it (Robert Chiras) #6877
[5ed5142158] - child_process: workaround fd passing issue on OS X (Santiago Gimeno) #7572
[227db0ab21] - cluster: remove bind() and self (cjihrig) #7710
[3003131e9a] - configure: reword help for --without-npm (BlackYoup) #7471
[2b933339d0] - debugger: use arrow function for lexical this (Guy Fraser) #7415
[52cba4147d] - deps: backport 2bcbe2f from V8 upstream (ofrobots) #7814
[2b01bc8e55] - deps: backport a76d133 from v8 upstream (Matt Loring) #7689
[e1f12fb358] - deps: cherry-pick b93c80a from v8 upstream (Matt Loring) #7689
[2d07fd71ee] - deps: backport e093a04, 09db540 from upstream V8 (Ali Ijaz Sheikh) #7689
[4369055878] - deps: cherry-pick 1f53e42 from v8 upstream (Ben Noordhuis) #7612
[05d40d9573] - deps: upgrade npm in LTS to 2.15.11 (Kat Marchán) #8928
[36b3ff0cfc] - deps: float gyp patch for long filenames (Anna Henningsen) #7963
[9ddc615d0e] - deps: no /safeseh for ml64.exe (Fedor Indutny) #7759
[ea36c61eda] - deps: MASM.UseSafeExceptionHandlers for OpenSSL (Fedor Indutny) #7427
[0b87b1a095] - dns: tweak regex for IPv6 addresses (Luigi Pinca) #8665
[0e2aba96bc] - doc: make sure links are correctly passed to marked (Timothy Gu) #8494
[3a43b0d981] - doc: correct metadata of Buffer.from (Anna Henningsen) #9167
[880ca99847] - doc: fix broken link in dgram doc (Brian White) #8365
[65ca2af471] - doc: add missing semicolon (Ravindra barthwal) #7915
[da3b938be3] - doc: add added: information for globals (Luigi Pinca) #8901
[b4ba4af525] - doc: add CTC meeting minutes 2016-09-07 (Josh Gavant) #8499
[4b49b0e30c] - doc: add CTC meeting minutes 2016-09-14 (Josh Gavant) #8726
[88b0067229] - doc: add CTC meeting minutes 2016-09-21 (Josh Gavant) #8727
[f7c4e9489f] - doc: update npm LICENSE using license-builder.sh (Kat Marchán) #8928
[6effc4aadc] - doc: add added: information for crypto (Luigi Pinca) #8281
[d750fc6336] - doc: add added: information for dgram (Luigi Pinca) #8196
[b92e3fc72e] - doc: add added: information for util (Luigi Pinca) #8206
[578bf511f9] - doc: add added: information for events (Luigi Pinca) #7822
[6ef58e7211] - doc: add gibfahn to collaborators (Gibson Fahnestock) #8533
[5ff1fc7d86] - doc: add imyller to collaborators (Ilkka Myller) #8530
[88bb65dd74] - doc: add not-an-aardvark to collaborators (not-an-aardvark) #8525
[5bec1eb0d4] - doc: update onboarding PR landing info (Rich Trott) #8479
[ecd2b52982] - doc: encourage 2FA before onboarding (Rich Trott) #8776
[2adbd53837] - doc: add commit formats for release blog posts (fen) #8631
[764502bb37] - doc: add CTC meeting minutes 2016-08-24 (Josh Gavant) #8423
[3037a9da08] - doc: add eugeneo to collaborators (Eugene Ostroukhov) #8696
[0fd1d8dfd7] - doc: add ak239 to collaborators (Aleksey Kozyatinskiy) #8676
[64c4bb30fe] - doc: add link to help repo in README (Rich Trott) #8570
[d123fc1307] - doc: update exercise portion of onboarding doc (Rich Trott) #8559
[c6b622f6b3] - doc: add CTC meeting minutes 2016-08-31 (Josh Gavant) #8424
[055d39c724] - doc: add CI help/support info to onboarding doc (Rich Trott) #8407
[a7e6fc08d8] - doc: add 2016-08-17 CTC meeting minutes (Josh Gavant) #8245
[ca63c127c7] - doc: add 2016-08-10 CTC meeting minutes (Josh Gavant) #8229
[3f2e3dfb32] - doc: update CI content in onboarding doc (Rich Trott) #8374
[9e1325c42e] - doc: update authors list (James M Snell) #8346
[c529bf5521] - doc: add return type of clientRequest.setTimeout (Mike Ralphson) #8356
[c094b2a51c] - doc: update targos email in readme per request (James M Snell) #8389
[5c417ee25b] - doc: update landing pr info in onboarding doc (Rich Trott) #8344
[763fa85ccf] - doc: bad/better examples for fs.access() and fs.exists() (Dan Fabulich) #7832
[0c933e5bab] - doc: adding danbev to collaborators (Daniel Bevenius) #8359
[e069dc45b0] - doc: add lpinca to collaborators (Luigi Pinca) #8331
[e5f4367da5] - doc: readline write() is processed as input (James M Snell) #8295
[b3617fcc7d] - doc: add added: information for modules (Luigi Pinca) #8250
[0b605636c5] - doc: add Myles Borins to the CTC (Rod Vagg) #8260
[a8a8f0a6f1] - doc: add added: information for cluster (Anna Henningsen) #7640
[2a2971b26e] - doc: use blockquotes for Stability: markers (Anna Henningsen) #7757
[3a3fde69c7] - doc: fix variable scoping bug in server example code (lazlojuly) #8124
[f1e14e4227] - doc: fix cluster message event docs (Zach Bjornson) #8017
[9b29cfc3a6] - doc: Clean up roff source in manpage (Alhadis) #7819
[364af49e0f] - doc: add CTC meeting minutes 2016-06-22 (Josh Gavant) #7390
[9892a5ddc3] - doc: remove extra spaces and concats in examples (Joe Esposito) #7885
[3ad74089f5] - doc: correct sample output of buf.compare (Hargobind S. Khalsa) #7777
[26e695c46c] - doc: remove "feature branch" jargon (Rich Trott) #8194
[d676467208] - doc: remove outdated LTS info from ROADMAP.md (Rich Trott) #8161
[b3545e148d] - doc: update release announce instruction to tweet (Tracy Hinds) #8126
[2032bba65f] - doc: add @joshgav to collaborators (Josh Gavant) #8146
[727c24f3a2] - doc: update Reviewing section of onboarding doc (Rich Trott)
[04515b891a] - doc: move orangemocha to collaborators list (Rich Trott) #8062
[d3344aa216] - doc: Add fhinkel to collaborators (Franziska Hinkelmann) #8052
[532bbde4bf] - doc: add CTC meeting minutes 2016-08-03 (Josh Gavant) #7980
[98fe74fbc8] - doc: fix a markdown error in CTC meeting minutes (Сковорода Никита Андреевич) #7729
[e74daadeb6] - doc: clarify collaborators & ctc members relationships (yorkie) #7996
[6bfdc92860] - doc: clarify "Reviewed-By" iff "LGTM" (Bryan English) #7183
[94a82cd0a7] - doc: add CTC meeting minutes 2016-07-13 (Josh Gavant) #7968
[012ccf010e] - doc: add CTC meeting minutes 2016-07-20 (Josh Gavant) #7970
[08111e84b1] - doc: use consistent markdown in README (Rich Trott) #7971
[009df788de] - doc: use git-secure-tag for release tags (Fedor Indutny) #7603
[abefdca5ae] - doc: piscisaureus has stepped-down from the CTC (James M Snell) #7969
[9700660d2b] - doc: add @addaleax to the CTC (Anna Henningsen) #7966
[f255180853] - doc: add CTC meeting minutes 2016-07-06 (Josh Gavant) #7570
[b60473fac7] - doc: add CTC meeting minutes 2016-06-29 (Josh Gavant) #7571
[ac40b2a9b6] - doc: add CTC meeting minutes 2016-07-27 (William Kapke) #7900
[bbbbb19658] - doc: add information about CTC quorum rules (Rich Trott) #7813
[d759d4e0a6] - doc: remove platform assumption from CONTRIBUTING (Bethany N Griggs) #7783
[b01854dd9d] - doc: add princejwesley to collaborators (Prince J Wesley) #7877
[26f5168c02] - doc: clarify that the node.js irc channel is not under tsc oversight (James M Snell) #7810
[506e367062] - doc: update readme with andrasq as a collaborator (Andras) #7801
[590c52a309] - doc: update CTC governance information (Rich Trott) #7719
[fdff642e0b] - doc: fix util.deprecate() example (Evan Lucas) #7674
[8fec02ffb8] - doc: delete non-existing zlib constants (Franziska Hinkelmann) #7520
[d6c2e383a2] - doc: minor updates to onboarding doc (Rich Trott) #8060
[e46d1e026e] - doc: add POST_STATUS_TO_PR info to onboarding doc (Rich Trott) #8059
[4f3107190d] - doc: add added: info for dgram.*Membership() (Rich Trott) #6753
[0e52861629] - doc: grammar fixes to event loop guide (Ryan Lewis) #7479
[29139bff65] - doc: improve server.listen() random port (Phillip Johnsen) #8025
[b680eb99ad] - doctool: improve the title of pages in doc (yorkie)
[3d6f107a2f] - fs: fix handling of uv_stat_t fields (Anna Henningsen) #8515
[2e29b76666] - intl: Don't crash if v8BreakIterator not available (Steven R. Loomis) #4253
[f6e332da2d] - lib: implement consistent brace style (Rich Trott) #8348
[9d9bcd7c55] - meta: clarify process for breaking changes (Rich Trott) #7955
[6d49f22e35] - meta: include a minimal CTC removal policy (Rich Trott) #7720
[7faf6dc0da] - meta: provide example activities (Rich Trott) #7744
[fe48415c60] - net: add length check when normalizing args (Brian White) #8112
[3906206ecc] - net: remove unnecessary variables (Brian White) #8112
[9f1b790f79] - net: make holding the buffer in memory more robust (Anna Henningsen) #8252
[b630be2309] - net: export isIPv4, isIPv6 directly from cares (Sakthipriyan Vairamani) #7481
[c235708bef] - readline: keypress trigger for escape character (Prince J Wesley) #7382
[8198dbc5a4] - repl: Enable tab completion for global properties (Lance Ball) #7369
[12300626d7] - src: no abort from getter if object isn't wrapped (Trevor Norris) #6184
[166a9b85d9] - src: always clear wrap before persistent Reset() (Trevor Norris) #6184
[b3149cee8c] - src: inherit first from AsyncWrap (Trevor Norris) #6184
[8b93fddd1b] - src: disable stdio buffering (Ben Noordhuis) #7610
[72be320962] - src: suppress coverity message (cjihrig) #7587
[6ba3ad5d34] - src: guard against overflow in ParseArrayIndex() (Ben Noordhuis) #7497
[e1f961d050] - src: move ParseArrayIndex() to src/node_buffer.cc (Ben Noordhuis) #7497
[57921ebec5] - src: remove unnecessary HandleScopes (Ben Noordhuis) #7711
[6838ad5f8e] - src: fix handle leak in UDPWrap::Instantiate() (Ben Noordhuis) #7711
[dadcf6b263] - src: fix handle leak in BuildStatsObject() (Ben Noordhuis) #7711
[7aa268922a] - src: fix handle leak in Buffer::New() (Ben Noordhuis) #7711
[606deecd16] - src: don't include a null character in the WriteConsoleW call (Nikolai Vavilov) #7764
[a5b6c2cdd7] - src: use RAII for mutexes and condition variables (Ben Noordhuis) #7334
[19d6f06058] - stream_base: always use Base template class (Trevor Norris) #6184
[d5f03db819] - test: fix test-cluster-dgram-1 flakiness (Santiago Gimeno)
[a83bbaa5a3] - test: refactor test-tick-processor (Rich Trott) #8180
[1c81c078c2] - test: add assert.notDeepStrictEqual() tests (Rich Trott) #8177
[57c98f18a9] - test: favor === over == in crypto tests (Rich Trott) #8176
[11f761ab1a] - test: refactor pummel/test-dtrace-jsstack (Rich Trott) #8175
[2997b79fcc] - test: favor strict equality in test-exec (Rich Trott) #8173
[558f7d999c] - test: add assert.notDeepEqual() tests (Rich Trott) #8156
[49c488625d] - test: add missing assert.deepEqual() test case (Rich Trott) #8152
[eec078cd66] - test: favor strict equality in http tests (Rich Trott) #8151
[e3669f8c21] - test: favor strict equality in pummel net tests (Rich Trott) #8135
[ac83d199fb] - test: confirm that assert truncates long values (Rich Trott) #8134
[9c826beef7] - test: favor === over == in test-timers.js (Rich Trott) #8131
[af02d2a642] - test: favor strict equality check (Rich Trott) #8130
[30034048b0] - test: fix assertion in test-watch-file.js (Rich Trott) #8129
[b063dc90b1] - test: use strict equality in regression test (Rich Trott) #8098
[dc7bc2e679] - test: add test for debug usage message (Rich Trott) #8061
[ce2cfbdc3a] - test: console constructor missing new keyword (Rich Trott) #8003
[69f4edd368] - test: speed up test-net-reconnect-error (Rich Trott) #7886
[50acf72d80] - test: increase RAM requirement for intensive tests (Rich Trott) #7772
[924ea0a2bd] - test: fix flaky test-http-server-consumed-timeout (Rich Trott) #7717
[97a3d89c80] - test: improve coverage of the util module (Michaël Zasso) #8633
[52bb37734b] - test: mark test-child-process-fork-dgram as flaky (Michael Dawson) #8274
[97c68ddaad] - test: improve error message in test-tick-processor (Rich Trott) #7693
[cd9e8e0361] - test: fix old tty tests (Jeremiah Senkpiel) #7613
[22990d8851] - test: move parallel/test-tty-* to pseudo-tty/ (Jeremiah Senkpiel) #7613
[afee32fed5] - test: fix fs-watch-recursive flakiness on OS X (Santiago Gimeno) #4629
[c543f4a879] - test: stream writable ended state (Italo A. Casas) #8778
[f46a04cc6d] - test: add tests for add/remove header after sent (Niklas Ingholt) #8682
[e79351c3ac] - test: improve test-https-agent.js (Dan.Williams) #8517
[9ffb2f3c0d] - test: add coverage for client._addHandle() (Rich Trott) #8518
[8da2dcb70a] - test: refector parallel/test-http.js (Junshu Okamoto) #8471
[69404ec473] - test: fix flaky test-force-repl (Rich Trott) #8484
[5a07bb62ea] - test: swapped == and equal to === and strictEqual (Christopher Dunavan) #8472
[ad1230e731] - test: skip pseudo-tty/no_dropped_stdio test (Michael Dawson) #8470
[6d03170751] - test: clean up net server try ports test (Thomas Hunter II) #8458
[775c84ec38] - test: add test-debug-protocol-execute (Rich Trott) #8454
[0d1082426a] - test: mark pseudo-tty/no_dropped_stdio as flaky (Michael Dawson) #8385
[c034c861bb] - test: test non-buffer/string with zlib (Rich Trott) #8350
[bb8690433c] - test: fix ::1 error in test-dns-ipv6 (Gibson Fahnestock) #8254
[2f458ea663] - test: add test for zlib.create*Raw() (Rich Trott) #8306
[a368ea673c] - test: refactor test-debug-signal-cluster (Rich Trott) #8289
[a48469f098] - test: add check in test-signal-handler (Rich Trott) #8248
[cadb2612c6] - test: add test for attempted multiple IPC channels (cjihrig) #8159
[21c1b8467e] - test: decrease inconsistency in the common.js (Vse Mozhet Byt) #7758
[d40873ddcd] - test: ensure stream preprocessing order (Vse Mozhet Byt) #7741
[0e1f098b09] - test: avoid usage of mixed IPV6 addresses (Gireesh Punathil) #7702
[741373cb49] - test: clean up test-buffer-badhex (Jeremiah Senkpiel) #7773
[58f3fa17eb] - test: s/assert.fail/common.fail as appropriate (cjihrig) #7735
[b0e2f9a37a] - test: add common.rootDir (cjihrig) #7685
[c94f3a5784] - test: handle IPv6 localhost issues within tests (Rich Trott) #7766
[b64828d8df] - test: accept expected AIX result test-stdio-closed (Rich Trott) #8755
[3dbcc3d2d9] - test: fix flaky test-*-connect-address-family (Rich Trott) #7605
[733233d3ea] - test: add uncaught exception test for debugger (Rich Trott) #8087
[c9af24d2a7] - test: add test for assert.notStrictEqual() (Rich Trott) #8091
[337d2dd381] - test: implement consistent braces (Rich Trott) #8348
[77df523264] - test: exclude tests for AIX (Michael Dawson) #8076
[50ae37e350] - test: add --repeat option to tools/test.py (Michael Dawson) #6700
[ea72e9f143] - test,doc: clarify buf.indexOf(num) input range (Anna Henningsen) #7611
[c841b5a6b9] - tls: copy the Buffer object before using (Sakthipriyan Vairamani) #8055
[6076293d6c] - tls_wrap: do not abort on new TLSWrap() (Trevor Norris) #6184
[6e5906c7f1] - tools: use long format for gpg fingerprint (Myles Borins) #9258
[7409c332b8] - tools: check tag is on github before release (Rod Vagg) #9142
[b632badda2] - tools: make detached SHASUM .sig file for releases (Rod Vagg) #9071
[5867ffe27e] - tools: explicitly set digest algo for SHASUM to 256 (Rod Vagg) #9071
[bdfa3b388b] - tools: favor === over == in license2rtf.js (Rich Trott)
[d7e3edc744] - tools: add remark-lint configuration in .remarkrc (Сковорода Никита Андреевич) #7729
[afbfbc04c9] - tools: add .vscode folder to .gitignore (Josh Gavant) #7967
[3f4a5fe61e] - tools: increase lint coverage (Rich Trott) #7647
[d1a50b3ed2] - tools: enforce JS brace style with linting (Rich Trott) #8348
[76b8d81f38] - tools,test: show signal code when test crashes (Santiago Gimeno) #7859
[389a6d2cc2] - url: fix off-by-one error in loop handling dots (Luigi Pinca) #8420
[be9d9bd7c3] - url: fix inconsistent port in url.resolveObject (Ilkka Myller) #8214
[96cfa926bd] - url: url.format() encodes all # in search (Ilkka Myller) #8072
[f7796f23e3] - util: inspect boxed symbols like other primitives (Anna Henningsen) #7641
[410e083d7c] - win,build: forward release_urlbase to configure (João Reis) #8430
[26e73740e9] - win,build: exit when addons fail to build (João Reis) #8412
[30e751f38b] - win,build: skip finding VS when not needed (João Reis) #8412
[b3090f8e64] - win,build: fail on invalid option in vcbuild (João Reis) #8412
[1b5213bfc3] - win,msi: fix inclusion of translations (João Reis) #7798
[e8be413d0d] - win,msi: add zh-CN translations for the installer (Minqi Pan) #2569
[99f85b8340] - win,msi: Added Italian translation (Matteo Collina) #4647

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

0e19ba9c0e16ea1d96df2a3a5edc07e0950325f465ab1049d6ab7b7d98d384f2  node-v4.6.2-darwin-x64.tar.gz
9d8e22131a9aa50d33b599310763f02c9c6cc1f3e8eac0b72c9998e74bd2b571  node-v4.6.2-darwin-x64.tar.xz
3b3b7045cfb372a8d1472edab596213111369d6fca30dad5714c9f22a1da9edf  node-v4.6.2-headers.tar.gz
35e654a84d75aec865de48779b22ebdf16765f10adbdabceae298dd6244fa378  node-v4.6.2-headers.tar.xz
831eab2a0fed0c3716e2c6bb9d9f2d64b8f365e5501ec373eb207ce5621ba6d2  node-v4.6.2-linux-arm64.tar.gz
389e9987852d5f813d7708602b84a9ef94b28bcfe2e080afcd5b6871ab36c0f8  node-v4.6.2-linux-arm64.tar.xz
a45b09f7b1274a5a2c494aa529fb84fbf8f3040c9b24e5be73a8896b24c803e6  node-v4.6.2-linux-armv6l.tar.gz
2f1ae711d425cec2e028917907ce82039a1422a0454480000a17281f57b271d0  node-v4.6.2-linux-armv6l.tar.xz
969fa30c2c12b6165fa9b56b8466e9a6113129bdbfe46861b0990b15ff43c483  node-v4.6.2-linux-armv7l.tar.gz
515a8f80ae7d9ba02dcec3591cf42d62716efb178f19f971da4cf58862da6161  node-v4.6.2-linux-armv7l.tar.xz
30818e8ebc302bdd5b60d0d7287d336ce4db51302eacb7ad5684d7a1f013af48  node-v4.6.2-linux-ppc64le.tar.gz
f4581c5de35968b8998f3d4761141cdd662450e6cbf0712150ca125649559091  node-v4.6.2-linux-ppc64le.tar.xz
64c06404a3b0cba67e0b62f3ecc2cb7857fd11a22535f99c97beb231520e1ae6  node-v4.6.2-linux-ppc64.tar.gz
95ffcfed1143067db5f12d62abced07257ec79feaa055e340bfa12b56f2692d3  node-v4.6.2-linux-ppc64.tar.xz
0a2d6417526509bc4c0d953e1563b0d5c972fe270a45da0ca8ed02d41fb1c223  node-v4.6.2-linux-x64.tar.gz
309f3d7bb0a4929a7e723d4fc65ee2773cf8ba334604b0d139c8691c06815cfc  node-v4.6.2-linux-x64.tar.xz
6f992d823873eebb6cb99c96f5ac4f0dd8a205824bb4a54beb93eb60f7ca22eb  node-v4.6.2-linux-x86.tar.gz
1a6e5e2c671637182c66b5c26c576fe228055a9ddaf16f1492c56a155fa3a810  node-v4.6.2-linux-x86.tar.xz
a25a61f920ca6406e525d955b89ac6347a2d9dc1d80ae6cc0f6ceb50fb8d5e30  node-v4.6.2.pkg
22c32dcfd70e556a01bb13648f240b4911cf990f1682985d4c311ecd8addcb21  node-v4.6.2-sunos-x86.tar.gz
9f7c5c60daa9f69487e6bd40b8cfe89254482302053751b04dc773d8178592e9  node-v4.6.2-sunos-x86.tar.xz
3c8f3af398c348cdf90fef9b983e4b46aae96a56238236542925e0bb4ee27ee8  node-v4.6.2.tar.gz
859458b337686556c1f9e195062abc6c394210c2280ee47ed1ddc725b2982c9e  node-v4.6.2.tar.xz
d16157a712c7bd0e65ea290606b5dcd4bbb43138760a0b4ed3ef159369352a13  node-v4.6.2-win-x64.7z
f4106162d3b7827747c6da994421474e6882caf78e0f99c50572e766e82c4e06  node-v4.6.2-win-x64.zip
6b362791d885024ebee32714a741c617d3bc789bc1dd1ac78b01af77b4c39f53  node-v4.6.2-win-x86.7z
508a0d6df3558ca0c176eda527a60ec4f4ed5feb4ba5e18b73396f055ddb6f35  node-v4.6.2-win-x86.zip
ff0a04bf22d3dd9c8885fbcce15552dc7c0d80fa60c6755a61e6568bf537cbad  node-v4.6.2-x64.msi
9ac90674c7fb6194e2c11262d9d9d8fcf83485f4bb6681204a9fdc48a7dd2f16  node-v4.6.2-x86.msi
3806127084f3b168508ba62588ae5a85ae0069910db6dcd82b35ab2c7be26d6a  win-x64/node.exe
8587d2f89a1af37741674d6e0f175c09e1711a22394d3b06e7c946aa32f94418  win-x64/node.lib
767be40936a8b887aebc9413117f67837b8c4f1aa8a9939bc2947fc9e287dbf0  win-x64/node_pdb.7z
2e0bcdf5d2a354a2fa5ba2cdd053af3a6231cfcabc5d3e473d7c1608ae0766fb  win-x64/node_pdb.zip
42bb7ad25cd214d62a14b030b207796d63f44fc1ba0c288ade74d18462831a2c  win-x86/node.exe
fb4da42d970192a805df211b53832e3e96a58a22a92b7116b8749b7d87561dd3  win-x86/node.lib
8b807d92968469e19dad255912dd7347125b1d120a0f6719f48be2959f94fa5f  win-x86/node_pdb.7z
313da37cd7efda81a1e7a381a2b98041a2409a778e208899f248fd66216863f8  win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----

iQEcBAEBCAAGBQJYIimTAAoJEJM7AfQLXKlG8XcH/Ah7jCW9/p8CSKV3Pps5+HDc
FIeQk8EannnEgX/FRhGfGsQwqI8aX0V2ocD7RB8CTh58CsBj+/W9KFSra0PLPe/i
JXI1yrPR/owpyZSbtGyBMHigyKa1U6H1gSRWQ/2Iu0hr5eX58cVtbv3CPvgv69hA
/r2GgfNeoWLfq2XTliADSTZNTrz0xhV2pkT7A2TZP3fs3Ff60ZD9maefJtLDdoM6
OiF2jrNE8bPzgDmtfYFFSGuqnDr+bwcKpyMpJsqXceGEsXAm2Prhce8yUGY278vU
4t5NQgtUx2BH7WrwEzbEBt+AwrD7J53XwdmN6FpZTdobDRWIhBCogDUgwAEEZGA=
=U59v
-----END PGP SIGNATURE-----

Weekly Update - November 4th, 2016

Minwoo Jung (github.com/JungMinu) — Fri, 04 Nov 2016 12:00:00 GMT

Node v7.1.0 proposal

Node v7.1.0 proposal. The complete changelog can be found on GitHub.

Community Updates

Node.js v7 Release Brief
Last Week in Node.js Working Groups: Last week was quieter than usual as a lot of effort was put into the new v7 Current release line. As such, this is the summary for the last two weeks.
6 of the Most Exciting ES6 Features in Node.js v6 LTS: With this article, we'll take a look at six of the best new ES6 features that are in the Node.js v6 LTS release.

If you have spotted or written something about Node.js, do come over to our Evangelism team repo and suggest it on the Issues page, specifically the Weekly Updates issue.

Upcoming Events

NodeConf Barcelona 2016: 18th November 2016 · Barcelona Mobile World Centre
NodeConf Argentina: 18 - 19 November, 2016
Node.js Interactive North America: November 29th - December 2nd · AUSTIN, TEXAS, US

Have an event about Node.js coming up? You can put your events here through the Evangelism team repo and announce it in the Issues page, specifically the Weekly Updates issue.

Weekly Update - October 28th, 2016

Minwoo Jung (github.com/JungMinu) — Fri, 28 Oct 2016 12:00:00 GMT

Node v7.0.0 (Current)

Node v7.0.0 (Current). The complete changelog from previous releases can be found on GitHub.

Community Updates

Graceful shutdown with Node.js and Kubernetes: This article helps you to understand what graceful shutdown is, what are the main benefits of it and how can you set up the graceful shutdown of a Kubernetes application.
Node Todo: Free and public gatherings for people that want to contribute to Node.js.
Node.js Examples - What Companies Use Node for in 2016: This article on Node.js examples shows how Groupon, Lowe’s Home Improvement and Skycatch have successfully deployed their enterprise applications with Node.js. If you have spotted or written something about Node.js, do come over to our Evangelism team repo and suggest it on the Issues page, specifically the Weekly Updates issue.

Upcoming Events

NodeConf Barcelona 2016: 18th November 2016 · Barcelona Mobile World Centre
NodeConf Argentina: 18 - 19 November, 2016
Node.js Interactive North America: November 29th - December 2nd · AUSTIN, TEXAS, US

Have an event about Node.js coming up? You can put your events here through the Evangelism team repo and announce it in the Issues page, specifically the Weekly Updates issue.

Node v7.0.0 (Current)

James M Snell — Tue, 25 Oct 2016 14:17:02 GMT

Node.js v7 has arrived!

This new major version of Node.js includes: V8 5.4 which brings along with 98% coverage of ES6 language features, improved reliability and performance, and a new experimental URL parser based on the WHATWG URL standard.

As an odd numbered release, in accordance with our Long Term Support plan, Node.js v7 will be supported only until about June, 2017, with Node.js v8 currently scheduled for release in April, 2017.

The general rule for deciding which version of Node.js to use is:

Stay on Node.js v4 or upgrade to Node.js v6 if you need stability and have a complex production environment, e.g. you are a medium or large enterprise.
Upgrade to Node.js v7 if you have the ability to upgrade versions quickly and easily without disrupting your environment and want to play with the latest features as they arrive.

The release notes below are annotated with the main breaking changes. Note that because this new version of Node.js is shipping with a new version of V8, existing native addons will need to be recompiled or runtime errors will occur when trying to load them. Use npm rebuild or simply remove your node_modules and npm install from scratch.

Notable changes

Buffer
- Passing invalid input to Buffer.byteLength will now throw an error #8946.
- Calling Buffer without new is now deprecated and will emit a process warning #8169.
- Passing a negative number to allocUnsafe will now throw an error #7079.
Child Process
- The fork and execFile methods now have stronger argument validation #7399.
Cluster
- The worker.suicide method is deprecated and will emit a process warning #3747.
Deps
- V8 has been updated to 5.4.500.36 #8317, #8852, #9253.
- NODE_MODULE_VERSION has been updated to 51 #8808.
File System
- A process warning is emitted if a callback is not passed to async file system methods #7897.
Intl
- Intl.v8BreakIterator constructor has been deprecated and will emit a process warning #8908.
Promises
- Unhandled Promise rejections have been deprecated and will emit a process warning #8217.
Punycode
- The punycode module has been deprecated #7941.
URL
- An Experimental WHATWG URL Parser has been introduced #7448.

Commits

[1043f5d08e] - assert: name anonymous functions (Miguel Angel Asencio Hurtado) #9051
[06f37471aa] - benchmark: use node v4 syntax in common.js (Andreas Madsen) #9064
[8b152fcf47] - benchmark: change the execution order (Andreas Madsen) #9064
[a5046bf8ef] - benchmark: fixes csv parsing given no parameters (Andreas Madsen) #9064
[af01865d66] - benchmark: add info about required Unix tools (Bartosz Sosnowski) #8788
[dfb5f301cf] - benchmark: make v8-bench.js output consistent (Bartosz Sosnowski) #8564
[84481f9157] - benchmark: add --expose_internals switch (Bartosz Sosnowski) #8547
[d3834a1fa3] - benchmark: ignore significance when using --runs 1 (Andreas Madsen) #8299
[b1bbc68fb1] - benchmark: support for multiple http benchmarkers (Bartosz Sosnowski) #8140
[474e629ddb] - benchmark: add --format csv option (Adrian Nitu) #7961
[4b527a4129] - benchmark: update compare.js exit method (Adrian Nitu) #7961
[9e7fd8e810] - benchmark: fix comment typos and code format (Adrian Nitu) #7961
[d525e6c92a] - (SEMVER-MAJOR) benchmark: remove broken string-creation.js (Andreas Madsen) #7094
[6edef1deb9] - (SEMVER-MAJOR) benchmark: update docs after refactor (Andreas Madsen) #7094
[0c0f34e2fe] - (SEMVER-MAJOR) benchmark: add script for creating scatter plot (Andreas Madsen) #7094
[855009af7f] - (SEMVER-MAJOR) benchmark: use t-test for comparing node versions (Andreas Madsen) #7094
[8bb59fdb12] - (SEMVER-MAJOR) benchmark: missing process.exit after bench.end (Andreas Madsen) #7094
[f99471b2ae] - (SEMVER-MAJOR) benchmark: refactor to use process.send (Andreas Madsen) #7094
[0f9bfaa7c5] - (SEMVER-MAJOR) benchmark: move cli parts of common.js into run.js (Andreas Madsen) #7094
[edbed3f3fd] - (SEMVER-MAJOR) benchmark: move http_simple.js to http directory (Andreas Madsen) #7094
[ee2843b4ea] - (SEMVER-MAJOR) benchmark: remove unused files (Andreas Madsen) #7094
[60042ca70e] - buffer: fix range checks for slice() (Trevor Norris) #9174
[14d1a8a631] - buffer: coerce slice parameters consistently (Sakthipriyan Vairamani (thefourtheye)) #9101
[96b501d338] - (SEMVER-MAJOR) buffer: make byteLength throw on invalid input (Brian White) #8946
[c21458a15d] - (SEMVER-MINOR) buffer: expose underlying buffer object always (Sakthipriyan Vairamani) #8311
[2c9a86f01e] - buffer: directly use ArrayBuffer as the pool (Anna Henningsen) #8302
[f2fe5583c4] - (SEMVER-MAJOR) buffer: runtime deprecation of calling Buffer without new (Nikolai Vavilov) #8169
[9cee8b1b62] - (SEMVER-MAJOR) buffer: alias toLocaleString to toString (James M Snell) #8148
[8f90dcc1b8] - (SEMVER-MAJOR) buffer: throw on negative .allocUnsafe() argument (Anna Henningsen) #7079
[bd23290657] - buffer: remove obsolete and confusing comment (Nikolai Vavilov) #7264
[5292a1358f] - buffer: improve creation performance. (Ingvar Stepanyan) #6893
[c5f5bcb331] - build: fix config.gypi target (Daniel Bevenius) #9053
[b311906abf] - (SEMVER-MAJOR) build: do not clean V8 gtest directory (Michaël Zasso) #8317
[94f68b5b97] - (SEMVER-MAJOR) build: fix mkpeephole configuration (Ali Ijaz Sheikh) #8317
[8481ea1ca4] - (SEMVER-MAJOR) build: use libc++ on OSX (Ali Ijaz Sheikh) #8317
[197d18795e] - (SEMVER-MAJOR) build: define icu_use_data_file_flag (Ali Ijaz Sheikh) #8317
[eab418f7f9] - (SEMVER-MAJOR) build: update V8 gypfile paths (Michaël Zasso) #8317
[88e862ba82] - build: windows sharedlib support (Stefan Budeanu) #7487
[6eece7773e] - child_process: update outdated comment (Tanuja-Sawant)
[0548e5d12a] - (SEMVER-MAJOR) child_process: add fork/execFile arg validation (Rich Trott) #7399
[b90f3da9de] - (SEMVER-MAJOR) child_process, win: fix shell spawn with AutoRun (Bartosz Sosnowski) #8063
[f44b18f010] - (SEMVER-MAJOR) cluster: deprecate worker.suicide (Evan Lucas) #3747
[bd7d7a7e17] - console: name anonymous functions (Tyler Brazier) #9047
[c60d43b6d9] - crypto: fix faulty logic in iv size check (Ben Noordhuis) #9032
[72f1c41fb6] - crypto: naming anonymous functions (solebox) #8993
[89643b645e] - crypto: use SSL_get_SSL_CTX. (Adam Langley) #8995
[f4aa2c2c93] - (SEMVER-MAJOR) crypto: remove POINT_CONVERSION_HYBRID from documentation. (Adam Langley) #4956
[6bbdd668bd] - deps: update V8 to 5.4.500.36 (Michaël Zasso) #9253
[5e3a480ad5] - deps: revert default gtest reporter change (Brian White) #8948
[c0a3ac2e94] - deps: cherry-pick missing v8 floating patch (Michael Dawson) #8907
[bef4b3bfda] - deps: update V8 to 5.4.500.31 (Michaël Zasso) #8852
[a88bb3a758] - (SEMVER-MAJOR) deps: cherry-pick workaround for clang-3.4 ICE (Michaël Zasso) #8317
[90efff6000] - (SEMVER-MAJOR) deps: update V8 to 5.4.500.27 (Michaël Zasso) #8317
[245ac302f5] - (SEMVER-MINOR) deps: update V8 to 5.1.281.75 (Ben Noordhuis) #7615
[dc17432208] - deps: fix V8 5.1 tests (Michaël Zasso) #7488
[2cc2951796] - (SEMVER-MINOR) deps: update V8 to 5.1.281.69 (Michaël Zasso) #7016
[e9b6fbbf17] - (SEMVER-MAJOR) dgram: prefer strict equality, type validation (Claudio Rodriguez) #8011
[260f41f2cc] - dns: name anonymous functions (Miguel Angel Asencio Hurtado) #9052
[3238f15234] - doc: change os x tag to macos (Gibson Fahnestock) #9009
[1794456ebc] - doc: change solaris tag to smartos (Gibson Fahnestock) #9009
[98ca07bfe0] - doc: add teams for platform-specific issues (Gibson Fahnestock) #9009
[e4e60b45e1] - doc: add s390 and ppc architecture labels (Gibson Fahnestock) #9009
[3b580145c4] - doc: fixes formatting in process (Rod Machen) #9235
[3e2bafe053] - doc: improve header styling for API docs (Jeremiah Senkpiel) #8811
[0a307f90cd] - doc: clarify fs.link and fs.linkSync arguments (Kyle E. Mitchell) #9145
[38cf1d4739] - doc: remove confusing reference in governance doc (Rich Trott) #9073
[5bf215d6b9] - doc: suggest nodejs/help for general support (Myles Borins) #9128
[5e26980937] - doc: fix header level for crypto.constants (Evan Lucas) #9187
[89b920fead] - doc: add ctc-review label information (Rich Trott) #9072
[e6d1d54230] - doc: fix typo in zlib.md (Parambir Singh) #9123
[3b63b64992] - doc: further improve child_process doc types (Indrek Ardel) #9095
[f56bdecde1] - doc: edit Stream api grammar (Benji Marinacci) #9100
[95d45d750a] - doc: improved example for http.get (marzelin) #9065
[0022bfe42e] - doc: update reference to list hash algorithms in crypto.md (scott stern) #9043
[b0da43104f] - doc: specify that errno is a number, not a string (John Vilk) #9007
[c258dc89d9] - doc: highlight deprecated API in ToC (Ilya Frolov) #7189
[d529a46416] - doc: explains why Reviewed-By is added in PRs (jessicaquynh) #9044
[482995e7cc] - doc: explain why GitHub merge button is not used (jessicaquynh) #9044
[3735f22480] - doc: fix typo (Nikolai Vavilov) #9089
[839f1f02ed] - doc: fix broken links in changelogs (Evan Lucas) #8122
[8f6589a0ba] - doc: revise http documentation (Timothy Gu) #8486
[f3f5a89a10] - doc: *.md formatting fixes in the benchmark dir (Сковорода Никита Андреевич) #7727
[9744928cf5] - doc: fix layout problem in v4 changelog (Myles Borins) #7394
[d976d66cfc] - doc: clarify fs.access works on directories too. (Lance Ball) #7113
[8c1d5e58d4] - doc: improve rendering of v4.4.5 changelog entry (Myles Borins) #6958
[2bceda6493] - doc: get rid of sneaky hard tabs in CHANGELOG (Myles Borins) #6608
[29e49fc286] - (SEMVER-MAJOR) doc, punycode: soft-deprecation of the punycode module (James M Snell) #7941
[3b8ec68a3a] - (SEMVER-MAJOR) domain: add message for dispose deprecation (Brian White) #7053
[983775d457] - (SEMVER-MAJOR) events: make memory leak warning name more verbose (Anna Henningsen) #8341
[b7a8a691b4] - (SEMVER-MAJOR) events: unwrap #once listeners in #listeners (Owen Smith) #6881
[108c1fbbe2] - fs: clarify fs.link and fs.linkSync arguments (Kyle E. Mitchell) #9145
[7f7d1d385d] - (SEMVER-MAJOR) fs: move stringToFlags() to lib/internal (Ben Noordhuis) #7162
[fe9f5bcd75] - fs: don't alter user provided options object (Sakthipriyan Vairamani (thefourtheye)) #7831
[169f485289] - (SEMVER-MAJOR) fs: refactor "options" processing as a function (Sakthipriyan Vairamani) #7165
[21124ba23a] - (SEMVER-MAJOR) fs: do not emit 'stop' watch event synchronously (Claudio Rodriguez) #8524
[b50557b51b] - fs: use process.emitWarning to print deprecation warning (James M Snell) #8166
[dc7277909b] - fs: move SyncWriteStream to internal/fs (James M Snell) #6749
[49ef3ae90a] - (SEMVER-MAJOR) Revert "fs: add a temporary fix for re-evaluation support" (James M Snell) #6413
[f8f283b8f3] - (SEMVER-MAJOR) fs: warn if no callback is passed to async calls (Sakthipriyan Vairamani) #7897
[6f27bedfba] - governance: expand use of CTC issue tracker (Rich Trott) #8945
[179150091f] - http: name anonymous functions in http (maasencioh) #9055
[73a8d3b0da] - http: name anonymous functions in _http_server (maasencioh) #9055
[ffa5c9ea30] - http: name anonymous functions in _http_outgoing (maasencioh) #9055
[fa035ada90] - http: name anonymous functions in _http_incoming (maasencioh) #9055
[ec17e76656] - http: name anonymous functions in _http_client (maasencioh) #9055
[9099a43073] - http: name anonymous functions (maasencioh) #9054
[cde2ca96e4] - http: reject control characters in http.request() (Ben Noordhuis) #8923
[2cc7fa5e7d] - (SEMVER-MAJOR) http: remove deprecated Client interface (Brian White) #8104
[31bef6b704] - (SEMVER-MAJOR) http: correct error message for invalid trailer (Bryan English) #6308
[a54ec7f49c] - inspector: no URLs when the debugger is connected (Eugene Ostroukhov) #8919
[626a07df5b] - inspector: restore 9229 as a default port (Eugene Ostroukhov) #8550
[9f1f7e2a34] - (SEMVER-MAJOR) inspector: listen on process.debugPort (cjihrig) #8386
[7b73f55902] - internal/util: remove printDeprecationWarning (James M Snell) #8166
[9ad3082b1c] - (SEMVER-MAJOR) intl: add deprecation warning for v8BreakIterator (Michaël Zasso) #8908
[15eaba98a1] - lib: use emitWarning instead of printDeprecationMessage (James M Snell) #8166
[3a3996315c] - lib,src: reset zero fill flag on exception (Ben Noordhuis) #7093
[27e84ddd4e] - lib,src: clean up ArrayBufferAllocator (Ben Noordhuis) #7082
[334ef4f19d] - lib,src: drop dependency on v8::Private::ForApi() (Ben Noordhuis) #7082
[d582193613] - (SEMVER-MAJOR) module: Remove deprecated function requireRepl. (Adri Van Houdt) #8575
[6f1cae70eb] - net: fix ambiguity in EOF handling (Fedor Indutny) #9066
[fd6af98c2d] - (SEMVER-MAJOR) net: refactor Server.prototype.listen (Jan Schär) #4039
[5e5ec2cd1e] - (SEMVER-MAJOR) os: deprecate tmpDir() in favour of tmpdir() (Jeremiah Senkpiel) #6739
[aedb72e03b] - process: improve performance of nextTick (Evan Lucas) #8932
[bf91035364] - process: fix handling of process.noDeprecation in emitWarning (James M Snell) #8166
[62b544290a] - (SEMVER-MAJOR) process: remove deprecated process.EventEmitter (cjihrig) #6862
[07dbf7313d] - (SEMVER-MAJOR) promise: hard deprecation for unhandled promise rejection (James M Snell) #8217
[ecf474ceba] - (SEMVER-MAJOR) promise: warn on unhandled rejections (Benjamin Gruenbaum) #8217
[1a9e247c79] - (SEMVER-MAJOR) readline: show completions only after 2nd TAB (Anna Henningsen) #7754
[8a87b29034] - (SEMVER-MAJOR) readline: remove deprecated methods (cjihrig) #6423
[488d28d391] - (SEMVER-MAJOR) repl: deprecate unused function convertToContext (Prince J Wesley) #7829
[b2be04ac85] - src: refactor contextify (Franziska Hinkelmann) #8909
[e175188a94] - src: fix typo rval to value (Miguel Angel Asencio Hurtado) #9023
[1fda657cac] - (SEMVER-MAJOR) src: update module version mismatch error message (James M Snell) #8391
[96933df2ff] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 51 (Myles Borins) #8808
[b032f1cfc3] - (SEMVER-MAJOR) src: no longer need to use std::tr1:: (Michaël Zasso) #8317
[ebad04326d] - src: notify V8 for low memory when alloc fails (Anna Henningsen) #8482
[aed9792ff4] - src: provide allocation + nullptr check shortcuts (Anna Henningsen) #8482
[d2470d4dff] - src: pass desired return type to allocators (Anna Henningsen) #8482
[de946013c2] - src: add Malloc() size param + overflow detection (Anna Henningsen) #8482
[5bf94357a9] - src: remove unused StringValue macro parameters (Daniel Bevenius) #7905
[cc00be6ace] - src: fix -Wunused-result warning (Santiago Gimeno) #8450
[8e7cbe2546] - (SEMVER-MAJOR) src: make debugger listen on 127.0.0.1 by default (Ben Noordhuis) #8106
[781713d5ef] - src: remove unused isolate member (Ben Noordhuis) #7334
[de4161d367] - src: remove unused internals from node.cc (Anna Henningsen) #7117
[ac0665c908] - src: fix ArrayBuffer size for zero fill flag (Anna Henningsen) #7142
[aac79dfd78] - src: use stack-allocated Environment instances (Ben Noordhuis) #7090
[58cec4e85b] - src: move env init logic into Environment class (Ben Noordhuis) #7090
[c3cd453cba] - src: make IsolateData creation explicit (Ben Noordhuis) #7082
[0301ce9f55] - src: move IsolateData out of Environment (Ben Noordhuis) #7082
[a3c5567eb4] - (SEMVER-MAJOR) src,win: use correct exit code in old versions (yorkie) #8204
[2f05af4c06] - (SEMVER-MAJOR) stream: improve stream error messages (Italo A. Casas) #8801
[9983af0347] - (SEMVER-MAJOR) stream: improve unimplemented _write() error (ratikesh9) #7671
[0cd0118334] - (SEMVER-MAJOR) stream: 'data' argument on callback of Transform._flush() (Jesús Leganés Combarro "piranna) #3708
[a717be87a3] - test: fix flaky test-timers-blocking-callback (Rich Trott) #9198
[5ba02bf5db] - test: remove arbitrary timer (Rich Trott) #9197
[1518cc1e70] - test: remove duplicate required module (Rich Trott) #9169
[d62e7bd1f9] - test: add regression test for instanceof (Franziska Hinkelmann) #9178
[bb1e6064c1] - test: rename target to exports for consistency (Daniel Bevenius) #9135
[8788d009f8] - test: checking if error constructor is assert.AssertionError (larissayvette) #9119
[68157bd8b9] - test: remove unneeded escaping in template strings (Rich Trott) #9112
[0591362887] - test: remove unused common.libDir (Rich Trott) #9124
[0f2f4d2425] - test: fix flaky test-child-process-fork-dgram (Rich Trott) #9098
[47863a5837] - test: use npm sandbox in test-npm-install (João Reis) #9079
[67e2b92e21] - test: enable node-module-version/test.js with debug (Daniel Bevenius) #9093
[d5bdd65c6a] - test: move module out of fixture directory (Rich Trott) #9022
[0ad0e6addb] - test: fix issues reported by Coverity (Eugene Ostroukhov) #8870
[aac93a5c64] - test: refactor test-file-* (Jenna Vuong) #8999
[1bb1b3abe4] - test: fixes that do not affect performance (larissayvette) #9011
[96faba6ad8] - test: add cluster inspector debug port test (cjihrig) #8958
[7926886bf3] - test: fix test-debug-signal-cluster.js flakyness (Julien Gilli) #8568
[99cfd53097] - (SEMVER-MAJOR) test: test execFile/fork arg validation (Chuck Langford) #7399
[15cd45c6fc] - test: fix tests for non-crypto builds (Anna Henningsen) #7056
[fea3070ec4] - test: add buffer testcase for resetting kZeroFill (Сковорода Никита Андреевич) #7093
[2cdd5ccef9] - test,lib,benchmark: match function names (Rich Trott) #9113
[827660e03e] - tools: enable ES2016 syntax support in ESLint (Michaël Zasso) #9218
[a83354a567] - tools: replace custom lint rule for getter/setter (Rich Trott) #9194
[3ab8be07cb] - tools: fix release script on macOS 10.12 (Evan Lucas) #8824
[72fa9f5663] - tools: update ESLint to v3.8.0 (Rich Trott) #9112
[8ac29bd7c1] - tools: avoid let in for loops (jessicaquynh) #9049
[1a93e03a0e] - (SEMVER-MAJOR) tools: do not disable ICU's transliteration (Michaël Zasso) #8317
[6a3dbdacd6] - (SEMVER-MAJOR) udp: remove ancient check (Saúl Ibarra Corretgé) #8088
[1afd7c166e] - url: fix building when using --without-intl (James M Snell) #9041
[a8ece149e2] - (SEMVER-MINOR) url: adding WHATWG URL support (James M Snell) #7448
[336b027411] - (SEMVER-MAJOR) url: return valid file: urls fom url.format() (Rich Trott) #7234
[197a465280] - (SEMVER-MAJOR) zlib: move constants into zlib.constants (James M Snell) #7203

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

0977be0f261dd0e61433e875fbf0014773d1560b8bb5a882637e6e0289906d84  node-v7.0.0-aix-ppc64.tar.gz
2e94b2d3bae3ccac9c376379bc4d2243935c333bc1235b3d948d20d40ef26069  node-v7.0.0-darwin-x64.tar.gz
cd8f13980f935420bf0236cd7ed3c299c671b4d4f7efbf9f171de36f2904e740  node-v7.0.0-darwin-x64.tar.xz
f4792c0f40bd2eee2334424c9d65e4b4b30830507cca1b0cb88507d76044c0f7  node-v7.0.0-headers.tar.gz
8ef711371041f31faf0d0774e497a4cfc348323876613b9f5173fbbddac6b48e  node-v7.0.0-headers.tar.xz
375e897d16956b80e6c7b298f17d5b6b4a3bac1a50b297575bd50f34ce4c612c  node-v7.0.0-linux-arm64.tar.gz
9382f478f4e76f566ac34ca549ed5609f451d19df226839dd35cd86a0d654024  node-v7.0.0-linux-arm64.tar.xz
7378832687d7475074281f06dc98b2ddfc6c07cdc40e7ce4ea08a95347fd2292  node-v7.0.0-linux-armv6l.tar.gz
eb118194b7623f1389b9a0d315fd798a13fb638095b23069f6993532b53b1a1a  node-v7.0.0-linux-armv6l.tar.xz
dbcf05b10f71acf845d4c1357c627ebf2d401a11c80464cb44e475c5f0eca7e4  node-v7.0.0-linux-armv7l.tar.gz
34d65a4e27f31e716d9bdd5d62b0a0b3b2a7079613457b94b0a0b88f544bdc26  node-v7.0.0-linux-armv7l.tar.xz
5d615eefcbf76c25f760de7e94f4d4c3c1a5376978e595800313f524d9634fe5  node-v7.0.0-linux-ppc64le.tar.gz
57aae8873b09d33f362d72d5cf65fbd49faa6fb5e5c977a47f16a40f01238662  node-v7.0.0-linux-ppc64le.tar.xz
d5297fa59942a0807f785d279f311ebe8346cdedcf49b6aba6e1bf75d84d664c  node-v7.0.0-linux-ppc64.tar.gz
6d2ff843e90b279b9cd093c6b9e70c959d0b0ef9be10444a0b6596ae3ddc6101  node-v7.0.0-linux-ppc64.tar.xz
e92985271cf5efe6f0ebbf4768bcf7e7a98147da154dd5ca417d180e3c921262  node-v7.0.0-linux-s390x.tar.gz
89dd9ab01bcc3cd890cb9353cc64e6127bd3973617b5e90629c88dbf367c5b3e  node-v7.0.0-linux-s390x.tar.xz
4bc5ce31d2485f0b25e55bf8691d5dabf72c61f0c06b363728b70bfc0292ce7f  node-v7.0.0-linux-x64.tar.gz
78e042f9eb81eefed73c5e2fdccce89cbadbb4adb79de18585425be7ee8842f0  node-v7.0.0-linux-x64.tar.xz
96c61f58506725246ba246606c288809a5b7243f20ddfa464136978dd32d6917  node-v7.0.0-linux-x86.tar.gz
00526c2fbc4a84e2d00f0b90ae21618cfb8bb9ffd21d25d067bfc2a5ab37ca9c  node-v7.0.0-linux-x86.tar.xz
5d935d0e2e864920720623e629e2d4fb0d65238c110db5fbe71f73de8568c024  node-v7.0.0.pkg
4b6dcc2345b7b5229676c342d7757578973139166129cdb4c7dfddcaab3ef598  node-v7.0.0-sunos-x86.tar.gz
8663063dd1eb9d85a3f41a263f8a0769e02448266d5addf1eef8c8627c277b90  node-v7.0.0-sunos-x86.tar.xz
95ae4a37b8cf57816f96588ebe9ce5dbbb2c5452d177edd75fcfe6caf3b12b9b  node-v7.0.0.tar.gz
e16c3c76c2d6756bbfd711189cbdaf5676049b443e6817007bb537f243ca899a  node-v7.0.0.tar.xz
aa026c4e12769f39df8959374b90b481925bf44684d66bfca28d7f547e361ea6  node-v7.0.0-win-x64.7z
af130e7c5abb9be0ba96c35cfcd2002cc35535ddcda4d068b7647ce6d2ee1baf  node-v7.0.0-win-x64.zip
dd8a1049b64b121f025c8dd2870114c595300b48ec3efd18ff383fbbe142f273  node-v7.0.0-win-x86.7z
f60d01ccef511487887059f6b0f8df971b033e40862db53bbabf06278eced49c  node-v7.0.0-win-x86.zip
4729fbe4f31122b2aed25d6f82412dac255ca233ccb00c870707936e330f69d0  node-v7.0.0-x64.msi
75f9b61962884661fad941bb9c00bfc89dea78f4758cc661bb895f10d3c762d9  node-v7.0.0-x86.msi
68a150109422a9c8043fb5deae8432b38c932f0ae9dbeb6d917df1cf62693247  win-x64/node.exe
bf7efdcbd128a27aa5cc1cd03b093057ce8bbb9998ce3fd6a7371af6ebfcfb06  win-x64/node.lib
f2acc4ff4ea736ff1cfdb7e09c38fa0d0c056f4dfe2dd0b76d11530c67cf4c28  win-x64/node_pdb.7z
d787e5d9fb40d9aad86794cdcec04052be64b860c144472fa2907d80a012a48d  win-x64/node_pdb.zip
2ba6f11049660a65b0c2b761e2e8e1d150ca1460758a9163096a00541ce1687a  win-x86/node.exe
d29d974921a3a730911f0926d78c3af3db9955432355b8d20bcc53fae00235e3  win-x86/node.lib
38aa5d1f901cd7d3aeb33965de21cf576132665d46b749b5a3e6b5df7ec68ba2  win-x86/node_pdb.7z
4b0285e40131e5c8ffa10a70fb2ff6190a5cbab90ab0bcdcf9a372290aee70b7  win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQEcBAEBCAAGBQJYD2hbAAoJEHNBsVwHCHesM8UH/2GAeBw7PJl4HDO6rEdGSwER
DJ1Yb+4HJbfxTMkTiYQawfRkmL/5N5YCOWPfWuj8D7fmm7PvAC95Mq0X6PnI6/pt
h8iO2FVIkwog6Mpd5hB5NMLBy19mLKZ59ZnHUFEpXJwt1pZMimfqy2vAFGb4JIhj
gatsurF+ieqrqztxhVVyCqLoe1qLYi0VzaImzeKHcCGgdp2zkQtMmYHVH0H0/zS9
nozF1q8XSwEVbbPOSyjMkz5OvJlRftEEn711rkTXVRoiB5c+1pKl3E3j5GRR1M52
jGhdfEKfDpRpjcXRMKipLjg4eW4hZFfSnsGqWuuG/VCVX/fUx8dqKlkWWYr9sA0=
=GyFW
-----END PGP SIGNATURE-----

Node v6.9.1 (LTS)

Myles Borins — Wed, 19 Oct 2016 22:42:20 GMT

Notable changes

streams: Fix a regression introduced in v6.8.0 in readable stream that caused unpipe to remove the wrong stream (Anna Henningsen)

Commits

[2c3bbb576c] - doc: fix changelog index for v6.9.0 (Rod Vagg) #9168
[f4b766f5b7] - streams: fix regression in unpipe() (Anna Henningsen) #9171
[6072326009] - test: add regression test for unpipe() (Niels Nielsen) #9171
[9f248a4d83] - tools: check tag is on github before release (Rod Vagg) #9142
[c74d3a700a] - tools: make detached SHASUM .sig file for releases (Rod Vagg) #9071
[955bbf876f] - tools: explicitly set digest algo for SHASUM to 256 (Rod Vagg) #9071

Shasums (GPG signing hash: SHA512, file hash: SHA256):

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

77c14510c4b09188450f8c10b8c163ef4b4f616c8b7f455d538f07a810bc98bf  node-v6.9.1-aix-ppc64.tar.gz
392e511ca0d6203c80700ed753187535e04069d0df0074cbfd1e4f1bd571d4c5  node-v6.9.1-darwin-x64.tar.gz
910395e1e98fb351c62b5702a9deef22aaecf05d6df1d7edc283337542207f3f  node-v6.9.1-darwin-x64.tar.xz
bd73a816a1bfde82c5e6d0a4b5e669f7ce08e0149ba7994388a4f0b99216fb41  node-v6.9.1-headers.tar.gz
e30d67064877ed435e864ea52af20c6c54b7386bcf829a75a89ae1b666ae68bd  node-v6.9.1-headers.tar.xz
8a8da2c3aad9da2d80035eeba0b9aae41230bec394729224fafcfae152fa5f66  node-v6.9.1-linux-arm64.tar.gz
7aa69b6c8cff578d0d97d5bd4f76941b2fade5476f0408d53828666ee427dd4e  node-v6.9.1-linux-arm64.tar.xz
49a896d0a73bc9934eb62af7f3d0f5a75f286b3dfd08a310bfbfe8daa0545fe2  node-v6.9.1-linux-armv6l.tar.gz
eea12dcaead875eb58cbfc7c845c2954523e1393da027057940c64ed1e601686  node-v6.9.1-linux-armv6l.tar.xz
c4651804af2422b10cf49e1eeab96feb2664eaeb6c6ae3913933a946134e3375  node-v6.9.1-linux-armv7l.tar.gz
9a5542ef94fb9d96f1e9ce280b869396728a17461faa52593599bfe27faf9069  node-v6.9.1-linux-armv7l.tar.xz
5714678db7e6ff93ae96417c0b210a1f084ee7a0aabf0f2d33307a1f1d0445ce  node-v6.9.1-linux-ppc64le.tar.gz
6f6362cba63c20eab4914c2983edd9699c1082792d0a35ef9c54d18b6c488e59  node-v6.9.1-linux-ppc64le.tar.xz
2accb9e0f8082ea29f224cf4046d4ce318bb68b6cc41415e1291b58929de49a7  node-v6.9.1-linux-ppc64.tar.gz
cc9b4a189c78c71ac89c7030f90e472965eab75bc3c0e82841b26dda43bd4e38  node-v6.9.1-linux-ppc64.tar.xz
aa4ba50e0af65590903e4627703d90119711aea84c17f3f1b4a9211ed9cc23a8  node-v6.9.1-linux-s390x.tar.gz
92e12509b46b2ea1cfab031b571278d51db399d1d4883caed38aeaa2678035e5  node-v6.9.1-linux-s390x.tar.xz
a9d9e6308931fa2a2b0cada070516d45b76d752430c31c9198933c78f8d54b17  node-v6.9.1-linux-x64.tar.gz
d4eb161e4715e11bbef816a6c577974271e2bddae9cf008744627676ff00036a  node-v6.9.1-linux-x64.tar.xz
d2f4cb3f7e784a8c1c1b6477db613d67635d69cbf9ca80c17b87c9e85378d3bd  node-v6.9.1-linux-x86.tar.gz
f9b2ca03016e45bc35d2441a63a73db94d3e7b92350f15577d796467b9f7efb0  node-v6.9.1-linux-x86.tar.xz
cdf399288aee1cfc2fcfd301b221d7e3141f3d549ab884f36d325605f6ac98fa  node-v6.9.1.pkg
955d396a888c164d12d134baae098e2e214bfb46898e520f5be2e88a404697e2  node-v6.9.1-sunos-x64.tar.gz
d94202bc4567475ccca077f3f819a92c9d7f280bac688ec0506f9a31c3b19201  node-v6.9.1-sunos-x64.tar.xz
ec758b4a638f4599bb4a782196088f7704f4b08e70509ac235c3dd3f5b62382b  node-v6.9.1-sunos-x86.tar.gz
643d675ac6678745784b29ab829519d11c9832aa77095a9b611d71b7ac4d4321  node-v6.9.1-sunos-x86.tar.xz
a98997ca3a4d10751f0ebe97839b2308a31ae884b4203cda0c99cf36bc7fe3bf  node-v6.9.1.tar.gz
0bdd8d1305777cc8cd206129ea494d6c6ce56001868dd80147aff531d6df0729  node-v6.9.1.tar.xz
6ea6768af81948bd0e54760d948f04e0ab182411b235d2067e45a1e2b9052bcb  node-v6.9.1-win-x64.7z
e4c5a82cf481c1eb6ea7db109d70c43a0169203eae7608e2140863efc42c25ce  node-v6.9.1-win-x64.zip
aec417a95b46a21fa13190ed3f9a22de8bc1ecec77f981102345b0c7165420bd  node-v6.9.1-win-x86.7z
78716a433b7f7ca680ffb1242f233fc0fa0fd59f475bca7aed0614a059ce8a8a  node-v6.9.1-win-x86.zip
148aa14ce1491b2cdc47230c90e862e48d1af32baf5cc415b29593b6113ea1cf  node-v6.9.1-x64.msi
314eaf8b5b9e08a835cb5c005ea5f4299b9e9e4d8c97277c1617e511382c15dc  node-v6.9.1-x86.msi
513923b0490ebb7466a56483a62595814ed9d036d6f35476debb0cd606bec526  win-x64/node.exe
3951aefa4afd6fb836ab06468b1fc2a69fa75bd66ec2f5a0e08c4e32547681e3  win-x64/node.lib
a6110ec403a7a5fce0b3f4bd4667d8f31755114ab2f6720358934dc519f781b9  win-x64/node_pdb.7z
6f526496bb08d727b6d7e7c0d21de4bc9f1928878ca245f7d8e9fd51346e669e  win-x64/node_pdb.zip
017659cf538c6cd5244f386be41b6e648221a2df4c4a028759978039bd62213a  win-x86/node.exe
8584b55302cc738f6b0d9e6a8a4740654f55abae9b672a64a0abfd27d3c52627  win-x86/node.lib
6fcffec4a0d304c8c72fcdb0608a4d00c59ae8694d43032d739e0e74b74e9bb2  win-x86/node_pdb.7z
6f25d51c14d6882308e3c32eaddae84cdcd555670660e8bbf17c70ef092dd37c  win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----

iQEcBAEBCAAGBQJYB/UvAAoJEJM7AfQLXKlG57EIAJaCkjlloRKfmV/7r0A7MFTV
mkZLbHr3bOyx/6hPEcjt0Bbz9B9orIktBCKs9QWcm19aJT+pNS4MpnR/+QGbgJnL
veH8ynpojUkPJ90Cz5M+/FLUjE2Pxm8SLI8XCByncaX1QHjzahYo0mZOHcYqIwxs
T0+pJDTfCmGmW1236QmWNB7G1/WccVvDx7UElYBiVc48BWS78PUY+7M9SN6yLnH1
fl7FW7Layse2u74MWh8K1SwUi6GpYvFNlhi4wmBXAWDCIeh4jk+mBW19q1+w23p+
pJtDKJwiOn6ev9GEBhfs0Mr5ElLINPeTXGTfiSn0iiCMvnIJFOgByAmPYXPHLWU=
=w8eF
-----END PGP SIGNATURE-----

Node v6.9.0 (LTS)

Rod Vagg — Tue, 18 Oct 2016 17:25:38 GMT

This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/ for details on patched vulnerabilities.

A New LTS Release Line

v6.9.0 marks the transition of Node.js v6 into Long Term Support (LTS) with the codename "Boron". The v6 release line now moves in to "Active LTS" and will remain so until April 2018. After that time it will move in to "Maintenance" until end of life in April 2019.

LTS Migration

Some highlights for users migrating from Node.js v4 LTS "Argon" to Node.js v6 LTS "Boron":

The Buffer() constructor has been deprecated in the documentation in favour of the new Buffer.from(), Buffer.alloc() and Buffer.allocUnsafe() for security and safety. See the Buffer documentation for full details. As a documentation-only deprecation there will be no warnings printed to standard error, this is the first phase in a long deprecation cycle.
Support has been dropped for Windows Vista and earlier and macOS 10.7 and earlier.
Many warning messages and error messages have been cleaned up and made more consistent.
The --prof-process command line argument can be used to process output files created when using the V8 --prof command line argument.
A new EventEmitter#eventNames() method can be used to list all events currently being listened to on an EventEmitter.
fs.mkdtemp() is a fast and safe way to make a unique temporary directory using operating system primitives.
process.cpuUsage() will allow insight into CPU resources being consumed by the current process.
Very large arrays are now truncated when passed through util.inspect(), this also applies to console.log() and friends.
When a native Promise incurs a rejection but there is no handler to receive it, a warning will be printed to standard error.
A new experimental debugging protocol can be activated with the --inspector command line argument. This uses the "v8_inspector" protocol and can be consumed directly by Chrome DevTools, Visual Studio Code and others.

While there are some breaking API changes appearing in both v5.0.0 and v6.0.0, they are relatively minor and should not have significant impact on most users.

In addition to Node.js changes, we also have a number of V8 upgrades between Node.js v4 LTS and this new v6 LTS release, including these JavaScript language enhancements:

The spread operator for arrays and function calls
Rest parameters
Default function parameters
Destructuring
Proxies
Array#includes()

It's time to start planning your migration from Node.js v4 LTS "Argon" to Node.js v6 "Boron". Argon remains in Active LTS until April, 2017 and then moves in to Maintenance until April 2018 when support will cease. These details and more can be found in the Node.js LTS plan, located at https://github.com/nodejs/LTS.

If you would like help with Node.js, please open an issue at https://github.com/nodejs/help
If you would like to report a bug with Node.js, please open an issue at https://github.com/nodejs/node

Node.js v6.9.0 LTS "Boron"

Notable changes

crypto: Don't automatically attempt to load an OpenSSL configuration file, from the OPENSSL_CONF environment variable or from the default location for the current platform. Always triggering a configuration file load attempt may allow an attacker to load compromised OpenSSL configuration into a Node.js process if they are able to place a file in a default location. (Fedor Indutny, Rod Vagg)
node: Introduce the process.release.lts property, set to "Boron". This value is "Argon" for v4 LTS releases and undefined for all other releases. (Rod Vagg)
V8: Backport fix for CVE-2016-5172, an arbitrary memory read. The parser in V8 mishandled scopes, potentially allowing an attacker to obtain sensitive information from arbitrary memory locations via crafted JavaScript code. This vulnerability would require an attacker to be able to execute arbitrary JavaScript code in a Node.js process. (Rod Vagg)
v8_inspector: Generate a UUID for each execution of the inspector. This provides additional security to prevent unauthorized clients from connecting to the Node.js process via the v8_inspector port when running with --inspect. Since the debugging protocol allows extensive access to the internals of a running process, and the execution of arbitrary code, it is important to limit connections to authorized tools only. Vulnerability originally reported by Jann Horn. (Eugene Ostroukhov)

Commits

[99e4eee8ef] - build: do not define ZLIB_CONST (Bradley T. Hughes) #9122
[cae9eb35f0] - crypto: fix openssl.cnf FIPS handling & testing (Rod Vagg) nodejs/node-private#82
[c947d448da] - deps: cherry-pick 0e14baf712 from V8 upstream (Rod Vagg) nodejs/node-private#80
[647afe9d9a] - inspector: generate UUID for debug targets (Eugene Ostroukhov) nodejs/node-private#79
[1ea0358a91] - node: --openssl-config cli argument (Fedor Indutny) nodejs/node-private#78
[455272ad33] - (SEMVER-MINOR) src: add process.release.lts property (Rod Vagg) #3212
[9ace073949] - win,build: try multiple timeservers when signing (Rod Vagg) #9155

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

a5738a8061e5964d9851047355bab10c02046997adad0592d3e0c834c19c9599  node-v6.9.0-aix-ppc64.tar.gz
fd0f58487cd72d78e857bfc24061cfe77353e1571a17182b4e38273782648edf  node-v6.9.0-darwin-x64.tar.gz
fb512f229ea2b9d55a67ec3244a37b001a4f81c0ef449df2bf4fd823c06b8571  node-v6.9.0-darwin-x64.tar.xz
c2848e6ef6de3d771d3523ca8da2de6c949729476b3723cabf82836af4b723b8  node-v6.9.0-headers.tar.gz
1f8ebe4f1bc35b4e0399c05c208e79b497f84a18de5b46b10348948e9d3241d3  node-v6.9.0-headers.tar.xz
e9ff08e622436007594dcbff1b528023aaa2397c38fdc961d130730b90fdc814  node-v6.9.0-linux-arm64.tar.gz
b118ce433fa64868a46b5bf482e5c5c698df435ea40b1ec8429b7aae828b583e  node-v6.9.0-linux-arm64.tar.xz
ce870c8839ce5d46a36d11ae882e59cff6e361c46714428da3464504a3f0769a  node-v6.9.0-linux-armv6l.tar.gz
b1db436ec7ab97b2c3cf7b495b1ac57191afd1a71dc3d939a535c7cbbbf329d0  node-v6.9.0-linux-armv6l.tar.xz
97aaf1dba42c7544f8a2ad1e34e0f032d7645227e60928b9b522e257bd219256  node-v6.9.0-linux-armv7l.tar.gz
5fedf1319d4946fda7a20f8452f5ded4fb9707ce1661710e69616884e830f96c  node-v6.9.0-linux-armv7l.tar.xz
325b89f57374627d19de246dd1148699ea88b02139cecbdbe218b519fc8a328c  node-v6.9.0-linux-ppc64le.tar.gz
5fe38d010a3bfb179c2e3394937e7eb64b0a3076aff26d776fa1c5d67d9672b9  node-v6.9.0-linux-ppc64le.tar.xz
bf21e314c2bcf0ea379d2a6b2c017b0446ad8fb822dbc3c2fc04d594b727b23a  node-v6.9.0-linux-ppc64.tar.gz
44c3c0f3cb84216ef73d47acf886ca2aed2765640b76bbabf9a4fd8dba4961c1  node-v6.9.0-linux-ppc64.tar.xz
4aa6e76334e3bba1919c65a2a0dcabd28c48a282402b2f523807f31a588896e8  node-v6.9.0-linux-s390x.tar.gz
a2069e6d13c8ed1ffd80eaf039689abf82b300463125f1753e5467ecdef1ab6d  node-v6.9.0-linux-s390x.tar.xz
a9aafa2499097b315e1554b882923a6e2f9c446d24eaea53630f0fdbe075b226  node-v6.9.0-linux-x64.tar.gz
1fec8901f9158061eeeba407103c73f627d03c856cdaeb995c274d200c004a6f  node-v6.9.0-linux-x64.tar.xz
5520dc47e11b377064ce99a60e640dfdf9abc29916bcd110307474463af9efb1  node-v6.9.0-linux-x86.tar.gz
b15ed03aa7d113b6803e7e7ec7adebd310d08e6c6c807d9a2776da7421d502e6  node-v6.9.0-linux-x86.tar.xz
c91da719ec4db0f4397f93dbf604d4d77f3424e7ac5778ca120f61d5dd0bac9e  node-v6.9.0.pkg
e623e9bd2dd3554fdb9ec53ca3fe6e0d1a3715c05766bfc9a002d3289adbbe39  node-v6.9.0-sunos-x64.tar.gz
b748b5c427acbe1e8ac0a7a2a0af88d11120fe9019509841664ce7af2111a46b  node-v6.9.0-sunos-x64.tar.xz
2e48eb1506f54549df5e7c5727cd5c171aaf838f22caa848aeb2a3011db7f171  node-v6.9.0-sunos-x86.tar.gz
148f45f8e6ccf13e477d4ad0fee91fd41fe10af1d32ff6fc48ed3271bff26e1f  node-v6.9.0-sunos-x86.tar.xz
2e2657d2ece89782ca9e2cc0300f9119998e73382caa7ad2995ab81cc26ad923  node-v6.9.0.tar.gz
656342ed8a84c95a36af902f309aeeca7103b16d61c02925bd37bd47d2194915  node-v6.9.0.tar.xz
cbf07f7e472a3e7a574aac2350b7cac42e53e71b80fe4f910b32de452ce36572  node-v6.9.0-win-x64.7z
7c1c970d957c855c37ad16843ee5eb0f5369fbc42b24a5cd3dce18597dda087d  node-v6.9.0-win-x64.zip
8547a1a8ec2cc73194f7c670fa250a1357b20d97e1d76f256964dc95d9af9008  node-v6.9.0-win-x86.7z
ce35aeea6832fec2c5237e8958953acad59fafe89424335d1d882fc23199203f  node-v6.9.0-win-x86.zip
c20bce1c2dd7b0b30ff86e6ac32b4a79357165f1a3613ef111a26a0f5c621895  node-v6.9.0-x64.msi
e73dba32de3166b5de6f15f8677b1a8f8d67fa0983e660408518a8b259a3151b  node-v6.9.0-x86.msi
9ac737d4329515114d000766bd1e7ab8803a62ad9cddcf3629b1fc65b785cc7c  win-x64/node.exe
24fed33afb5c91284aea7d1c446687bae152ab915d4394af0752c32d75649ed2  win-x64/node.lib
892723c55b31b75e87356db0915e8bb09e449d7f8c062b64ea7d21c7f9283c26  win-x64/node_pdb.7z
740bb0435e8f6ca410ea3cad0f7e52e3dc788b870d3e05580159c81b600b0cd9  win-x64/node_pdb.zip
70dfa76f7e8b59e401002cae7d23565e9fde20ede65d47a900077608d5f3b347  win-x86/node.exe
1e2b080e083684e4d1ddf2a0bdf7415006e0c5bf1bae82cc35383c8642196735  win-x86/node.lib
c1da9b46e96bfacb267cb70932069eaf1c8ed4f1a6de7920bef2ccd7a73d7b3b  win-x86/node_pdb.7z
1b22b2f42b00af17ceacc0463120dec16a9d1582a537d0865e252a51dd8bef3e  win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJYBlkOAAoJEMJzeS99g1RdBq8IAME4kDcDjbbGbw2iviVXiEm1
IzBfYYHuxc3AUzxB9kEOkoYO++lR9Uo6pbhQTzYr2cTCQ46IhrAL+xSVX+Awhv2T
BSDwGTXCDAi5jTIQFNjJXfunSIdt9qGQKI/eLQ48Q00Cz9xvrFWgyZO97wwfUXCw
S3+y5fVDDgvUcrTybr3FWbIu6cjL6UQ8rW9E/clpa3KJehPjWBLkXoFmOrhL8e5/
yKvSJLID+z8PnDceFvwK8IdEQ/cZhh6XkbE2hZfM45QPyELrAhlHompv1yDFItqm
LOnBqVa0ZyoArPeQolTy/Gt8K0K44aC7fWzGnFWc0xcuso9c5RWgWR5iNNlzUpI=
=biwr
-----END PGP SIGNATURE-----

Node v4.6.1 (LTS)

Rod Vagg — Tue, 18 Oct 2016 17:04:37 GMT

Notable Changes

c-ares: fix for single-byte buffer overwrite, CVE-2016-5180, more information at https://c-ares.haxx.se/adv_20160929.html (Daniel Stenberg)

Commits

[f3c63e7ccf] - deps: avoid single-byte buffer overwrite (Daniel Stenberg) #8849
[5a0daa6c2f] - win,build: try multiple timeservers when signing (Rod Vagg) #9155

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

e5929de3a963f9a75c5923c9c222cde401e03c4b4991ec9281bf81f878f482ff  node-v4.6.1-darwin-x64.tar.gz
18252a9261477296975317c11ee5d21c3847df0f6e4b25e210373fd839a77984  node-v4.6.1-darwin-x64.tar.xz
58ce23125a049f0098693f8c48c431d54906586007c1a8b899add656a4e5a2fe  node-v4.6.1-headers.tar.gz
7d0e7ad37175695b35c6f6761dbc5f0e3beb777f8ad5943563100efed1c0b43d  node-v4.6.1-headers.tar.xz
439a4261c13644dee42d8f5ff6a6fc7974a5c5bb169f6c79cc5852b50298a1c4  node-v4.6.1-linux-arm64.tar.gz
a8952908de2933f6702ac85e2f12ea0443ac7459176624546565ea74d2492560  node-v4.6.1-linux-arm64.tar.xz
a66310bd045260f3c1d55bbafe7bbd6477004882f8b7ef63da0b79ed3d2b9ec4  node-v4.6.1-linux-armv6l.tar.gz
8883c105c0e192ba41d882ac459a5f025a205f7d5799369f2f54c71ce84fb1f2  node-v4.6.1-linux-armv6l.tar.xz
b6883d8d3daf121c6fffcd8546747105ca46ae8b1214d2fb6f3640a8aef0879c  node-v4.6.1-linux-armv7l.tar.gz
3cd0d522ddcedd22110b0cd698c5babc3b11b3be378e79570010f6708ee9714f  node-v4.6.1-linux-armv7l.tar.xz
1c66dd602d5ac022560eb7f2cb8c1be63d7a0d9e32f8f67c0bd7d84fce7179e5  node-v4.6.1-linux-ppc64le.tar.gz
ed99067c35d478d5667789298cbd0a645c88f9be291091ae9d868ccc12e8e833  node-v4.6.1-linux-ppc64le.tar.xz
297a458edf5f0f274e8bba96dcb8cb975e47a802401087a17ba20f550fa85785  node-v4.6.1-linux-ppc64.tar.gz
84e0e9d8930cc6a6c8f519a802ad7a28f33298d71ba59e8f8a5eead5233c0030  node-v4.6.1-linux-ppc64.tar.xz
033243d4ddffd67856c9ccfb512b0d1980e8d1373554bc328472b21bc5de7675  node-v4.6.1-linux-x64.tar.gz
cafa6e4bc66e3b8047f927c6cd3549398b9c11a94c73c9d0b9fc330e85e9697b  node-v4.6.1-linux-x64.tar.xz
16e0216d35ed1f81ac9a40081fa6f9b28e63dcbb38b316956dc1badd8b4bcfa7  node-v4.6.1-linux-x86.tar.gz
ddbfd6729538da959c4444181b1860dd6bfbee927c5f0c3b9007881006f19f58  node-v4.6.1-linux-x86.tar.xz
ccf029983486ba15394bd7cf4dd23b19cd371ec58f58d60897e72d156556e8c2  node-v4.6.1.pkg
892b86782c240b1886b4b655ca266425164e928b18c75e3d3f6960172a34cedf  node-v4.6.1-sunos-x64.tar.gz
1a0d8ae76ef9c03c24bf8a46abe8e1c334be97ccec4a7b4e40ed6e00003db899  node-v4.6.1-sunos-x64.tar.xz
f87490f0764b6c0a88e3e90e2ee14eb8b67dad0245a7b20fcc4e5fe1e75d3ec9  node-v4.6.1-sunos-x86.tar.gz
3047a3ee63e8bd3fd2275daf2e9bb9be028009394751fb96b0c79f74c3cedb9c  node-v4.6.1-sunos-x86.tar.xz
b8ca4db42c5a1fed95baf6996ff776db3c95ad2bcf73c7aed2f1f921a1225de3  node-v4.6.1.tar.gz
fe2a85df8758001878abb5bbaf17a6b6cdc12b3e465b1d3bace83b37fdf0345a  node-v4.6.1.tar.xz
8a9739e505244f382d8a045464cff1c92a10977351138e7972bd3349bb4e9106  node-v4.6.1-win-x64.7z
f576f2dacc4262202ae21f7d64ab9a01b7e551795848dfa39ef39a2cd63fa42c  node-v4.6.1-win-x64.zip
9633d956e36d8196f811ff4e685261910d942b2ceaa46aa296bbbbd5fa8b2b09  node-v4.6.1-win-x86.7z
80ecda252f5d7026a73bca964369e4eff4cac7ae2c8c96728ca10ef63f8564a5  node-v4.6.1-win-x86.zip
3718c9b018751d16ac311208c1d0d8091089ce431ea32f285ddaf54884091061  node-v4.6.1-x64.msi
b75124cb64ec423142f8c27e061854848ad99bf7bb896c8072ecebb5c91f6900  node-v4.6.1-x86.msi
04e33f33ba34a3426f4f11517f6b390697af7b5635eca97ff379204fdc978635  win-x64/node.exe
8dcb77384bcdf1cb7caa9fa1a146fd89318ec484b597918350a8603e911ddb75  win-x64/node.lib
ca0431734a0f0aca4ec78ea7c97969da9d13803212a5902af64304c6f1fb99dc  win-x64/node_pdb.7z
75c3133ecc9671113057727c1bd91af489a37ed207821acc731e27389d91cd94  win-x64/node_pdb.zip
965d55bdb6e8abc4053cccf87fbb524d4e2c416eba8892705eac60acf73262e2  win-x86/node.exe
228584a3a6e4b0e50d5e56fd4d795f499df8e08b4a33f316ccf528baf49f7302  win-x86/node.lib
25e0f6f56b34b5af71d79ae88858d6f69e9c3ffb11d7db748f5a585c4777ca8d  win-x86/node_pdb.7z
1ebdf49696992aa4961a8420f6e9e629f33928043ef497a03505df635ebfdc1c  win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJYBlXZAAoJEMJzeS99g1RdmnUH/0B7JWzkfXRn0zNOMJ8dl/rC
lyxkDkQbZ7q8zQjoJaY6/53De5h2eWI1XklDjOxXjgEIwUxm6d02LjMiCu2dJTe2
dKQKr3Ip4Zjdon05mUq7/wZD98nXzPVp4uuEipM/6qRPlZeARam5LGAK1QVremYt
gagd8oN5riQ0HCJl2RIcFc/k0vZkKZykjM/LOacEKEmH2XAmBOtZ/0njYspK9X+y
QmFKpq0haCvhY7TENbHPMyT5snwI3W+xg4asNKoobX3rgDCBOumEXrUx0y5Ovef0
05MY/Mq1YSldypzZVULCyLYfP4R/dnN3ePRPYltYPvgW8uta7G9NTtfC0olkHxw=
=2XqL
-----END PGP SIGNATURE-----

Node v0.10.48 (Maintenance)

Rod Vagg — Tue, 18 Oct 2016 16:45:53 GMT

Notable changes

c-ares: fix for single-byte buffer overwrite, CVE-2016-5180, more information at https://c-ares.haxx.se/adv_20160929.html (Rod Vagg)

Commits

[a14a6a3a11] - deps: c-ares, avoid single-byte buffer overwrite (Rod Vagg) https://github.com/nodejs/node/pull/9108
[b798f598af] - tls: fix minor jslint failure (Rod Vagg) https://github.com/nodejs/node/pull/9107
[92b232ba01] - win,build: try multiple timeservers when signing (Rod Vagg) https://github.com/nodejs/node/pull/9155

SHASUMS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

6a6ce9cbc42560a1d0ed9c04dcdcb84127f0c2e90d4850fd0e3003b31549795c  node.exe
7d070b0e240bed0939841c830cb2aa087f2b83a9fe25b9318964056a5f878aae  node.exp
b186c12757de90a3554f53ed58e623aac5cdad2be8df054f39338e6e6f8f70a1  node.lib
b007eea6d7a7f4a1dbc11e1ea5771ee39f4269e99dbbbc6ecf1441db3fb6e351  node.pdb
35d510ca5e8dd0c21cb11c2bf33b90f3715f92281aaaa49645f61c565c8adceb  node-v0.10.48-darwin-x64.tar.gz
6c4a387bda0ccf2efc282fbf426e6ab18dde7f0d61db6e76f76c77ab0bdf71af  node-v0.10.48-darwin-x64.tar.xz
0054a05d99e36a1e50af321d6c13ef84afde895063abd5c5e808bb84d33c2296  node-v0.10.48-darwin-x86.tar.gz
34f698e0ab6e2687aedf66c99ab1f6e6fa39776570be287a484d0f21062cf106  node-v0.10.48-darwin-x86.tar.xz
fd9b79cfd5814aa7a6bf095e34e890206f2eea9a3e0ab7234a1c6d125b5c389f  node-v0.10.48-headers.tar.gz
1d111b1e17fddc98cabf53a178634f693bf31ee3470889036bd335ae12c0c39b  node-v0.10.48-headers.tar.xz
82f5fe186349ca69d8889d1079dbb86ae77ce54fce5282b806c359ce360cec7b  node-v0.10.48-linux-x64.tar.gz
9fdd93e14ba629f50020e283ac0d9ae183034b0f685747b3c927313feb918908  node-v0.10.48-linux-x64.tar.xz
abb69775712b947ac33f219db9bf462ddfe70e895c42ba415b79056e842f0fba  node-v0.10.48-linux-x86.tar.gz
9d2154ec399362cf94b9284c87ededf9cfc388a23d96b6e2b64b2dd2b9a6d883  node-v0.10.48-linux-x86.tar.xz
aff11080627404624c7ce64d5253806abc81a1511a9bec1d244e6f761d5f3079  node-v0.10.48.pkg
7dbb5cdecedd9d15119fa556f99ba14e900c325c550f57d4f65869c046e7eba5  node-v0.10.48-sunos-x64.tar.gz
e87740c55a6405b00dea737ac3f24ca41d130e0f077c9bd3ef2da7c9814ed1e7  node-v0.10.48-sunos-x64.tar.xz
ebb1a347363b22d5460d35c1250ffc9dde6216be4d67c3281d2702e1de403b06  node-v0.10.48-sunos-x86.tar.gz
3b68e2bb8f97d59c6fe3d5a055bf0d9fc38e591c496307a1bb685cedaabcea30  node-v0.10.48-sunos-x86.tar.xz
27a1765b86bf4ec9833e2f89e8421ba4bc01a326b883f125de2f0b3494bd5549  node-v0.10.48.tar.gz
365a93d9acc076a0d93f087d269f376abeebccad599a9dab72f2f6ed96c8ae6e  node-v0.10.48.tar.xz
834319f6f02fdf96e214a034d77352178ee4db55f2ae8463a49ea11246467adb  node-v0.10.48-x86.msi
1cdfe558099e4ec46f2b4a17e11f1ffae8eec1422532ffd6651fdb54ed7faa45  openssl-cli.exe
d27f423125232c9088b2bb65052180e0f6b7ad713856f74f1d5e530795eed039  openssl-cli.pdb
5d8cb2b12068166be30b48dcfd03bb46aee81d9e61f13fe4a650603e9ab1b951  x64/node.exe
d4f9d03e75c96262d72a47ccbc72a07f5684e2a2de78dc818c8f33e2c6de1ee3  x64/node.exp
5bbdf40545f7fde4e9d03627b26f8dd17a90acd744a836ddaa4bbe7c3b0ba608  x64/node.lib
dd62dbd0038102e0f83ac2cb1263524eadf8600a01f417285fc167027e91215a  x64/node.pdb
4f3ad54b78cdd74ee9502620815f8bbd441ee718884469795e52c1c0155dbccf  x64/node-v0.10.48-x64.msi
10f03315302c2ec0c4f610ca088b0f292f8cfcb6f4d1e41d08a3b21b7d8fce84  x64/openssl-cli.exe
73c5688003f2a7a7801bbd0f7393371018a44ab709a0473ac39a3c278f205209  x64/openssl-cli.pdb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJYBk/vAAoJEMJzeS99g1RdV1sH/RHgh/RbMRTMHyDNfrateafQ
4RZZdj6XG5Jp5dZgLIoZhJNrXw4KlBZrSulowjPBDYXfOyFnZ3FeDl/T4u1cmIEp
qCgUhmzc8JJRSsO1w47oqesXamp8NFj6Hj/GGdsfOwbekatdi649zwLxqpQ8fqzd
kj5y6dpfteIkPBQIR0uEOh2tH+c/984QGl1pC3dCsVGkAw1bPMsDHnbolK3LTfwc
qJDliVuHH4h3sn9xZ1n6MekYqBfzX62RbU/KktQ/4hpy9cIzIvPrgsvfG/xLoH+t
9CU3O/rjY0TtdtNbZquD81WL0eHlwozm0DYXob5bTjZKT0M6GShpzgGweMqx4Ow=
=G98g
-----END PGP SIGNATURE-----

Node v0.12.17 (Maintenance)

Rod Vagg — Tue, 18 Oct 2016 16:25:06 GMT

Notable changes:

c-ares: fix for single-byte buffer overwrite, CVE-2016-5180, more information at https://c-ares.haxx.se/adv_20160929.html (Daniel Stenberg)

Commits:

[c5b095ecf8] - deps: avoid single-byte buffer overwrite (Daniel Stenberg) https://github.com/nodejs/node/pull/8849

Shasums (GPG signing hash: SHA256, file hash: SHA256):

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

5a959b68bf667b89e256fd620bb88e5bef80bfa3e7cce3176b61cf4b144c5c06  node.exe
155e4f44e6ea5a37814f06f078265d2cf335ea383a161bc288b56d3093feb62a  node.exp
e6e08241c0669c67b13b3ce3bdb4019c849e09caa34150b18559b7e9ee0a3cea  node.lib
1ccbe8436699f3e33df01b66aed504a521822b5ce6eea5e529b6cc35edab3db3  node.pdb
4134958fecbc56e9a25374c80e4770ec51e5acfb5eefb67c89ee1af8d80c83da  node-v0.12.17-darwin-x64.tar.gz
618b43ff788a7fafcd44721213bc85a142390bdaf42dddfeebef4ccb34ca1625  node-v0.12.17-darwin-x64.tar.xz
5a24a5ca37ee53d45e49dafcd286b6b26e9f5e2805bb768b287bab5f289573ba  node-v0.12.17-darwin-x86.tar.gz
ae8313eeb6e886477deaf5ca29c52a6f4f9b222e6095e9d5ecf1bef52083e6d2  node-v0.12.17-darwin-x86.tar.xz
a93ceb4f049a762975c103fefc152fab486b99419fa60ea865841390d8c326ee  node-v0.12.17-headers.tar.gz
4cd5829696466bd4de72688d8ceb0315e6b3c5e7d76f2d8f3810c055a871b493  node-v0.12.17-headers.tar.xz
afeec47fc543e24a1e596d05e9bc8e019c3bdf51d45f0ddeac6aeb04f15eaece  node-v0.12.17-linux-x64.tar.gz
5a89f8bc4e8195f44499afcf60a50c198fa119dc2ca30f446b96c90bc2eea779  node-v0.12.17-linux-x64.tar.xz
5069c77361a0952d426620d9f35f87f0066ce81df4cb57612a3db145ab10c93e  node-v0.12.17-linux-x86.tar.gz
57202ae0ddf4252afb649a12ad79817ca67162220c73b57dea31abc73cee4e79  node-v0.12.17-linux-x86.tar.xz
8d65a3e5376f3adf048f0acb647085ee862b66fa7e5bd1c8fff577eb02fb58f0  node-v0.12.17.pkg
0354c8c1e636886ff1759e3106ac150350c9c2e252ac01dee7801e471ee03a96  node-v0.12.17-sunos-x64.tar.gz
557642532e608b5cda58eace551c8debdc17ff7bc8e7dda0ac3b3c4018789113  node-v0.12.17-sunos-x64.tar.xz
f17d21f5b04a1a1b21a6bed7fbcda9bc3f0d580fcc2ca8049bba0139eea2bd97  node-v0.12.17-sunos-x86.tar.gz
f9565792862d19cf160475faabe4c1066bca1e86f2018e850f79aecd40087c02  node-v0.12.17-sunos-x86.tar.xz
ddea5e253812f167608fbdda6ff29ffc30dc6f669cf2f6e4249938d28b9cd44d  node-v0.12.17.tar.gz
e2e82229200ef973e033d6dae910d789ab440e913f8c4c6225bf5e6e4a446420  node-v0.12.17.tar.xz
b0c761bd9f6506c750c3d8484c10f6725c475aa284eafba0a858ecba9a8866c9  node-v0.12.17-x86.msi
baaef9bfef68f2fc9ee49db2d71cb470c9fbdd8206e0077db0920c222ee8c14a  openssl-cli.exe
749b4673390b45c53e4a95e416ed0b74937bd390beb7c33390de7715e4df9f9e  openssl-cli.pdb
7712b7cbcb1c197cd44f7b38619a17c48d3a8b5b06911ddd91572c8e4ffe1c14  x64/node.exe
2483fed3a01e92322527da0e29d994526abc27aace3ce3829bfce0838d7d0710  x64/node.exp
17c7a61c63b96422dfd81849080a18a1b3b6d2ee500410bfb9741ce82b86544d  x64/node.lib
d373a79d76d17f813df7c5dfe3a8311d618047f4114feafd1e0551f4d84fb7a0  x64/node.pdb
a7a38396850c0c34f27165fddceef74137be4656ed636624da403a8f62441d99  x64/node-v0.12.17-x64.msi
a3fc1ecfa42913d3db21efbae13854368a05f42ebf6c1ba3578101afaf156514  x64/openssl-cli.exe
024a5c91411d2a23bca99ff49670837b0d70f06956fba5fa5d57008810af7722  x64/openssl-cli.pdb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJYBkrfAAoJEMJzeS99g1RdoWYIANySBPtGwzZU9oy/6YRAvEzo
pyNADjYmVxfwfYbf+xVhW+hmCEMG7mZLj0poGAv5S3Hjgvod7VK5aY7kDZ2pziAh
8okFiWb5XDv6IDboqsCzmSYU6dbt4KVSMLY69xsBbktHs30YMxtoBpqg7o3XvoZ4
9pi2GoR94HUP2VtkFiouHAXyt7tMyBgdmM0e2cOa+3+k8ZrdSLkB+rFWDfO0pGuq
KakDA8QSt/kc4P44sc99+EE6makOfxxnern0VI/6Vqg2VQL3Lmpg0voLsOZJob+O
js68vH/dsoOciHb2KFUfLVIyOBzrtrFhE/WvA2/wyuvEqf3DipjmYD+naDjUT80=
=oSLU
-----END PGP SIGNATURE-----

October security releases and v6 LTS "Boron" security inclusions

Rod Vagg — Sat, 15 Oct 2016 10:36:44 GMT

(Update 18-October-2016) Releases available

Updates are now available for all active Node.js release lines.

The following releases all contain fixes for CVE-2016-5180 "ares_create_query single byte out of buffer write":

While this is not a critical update, all users of these release lines should upgrade at their earliest convenience.

In addition, our new Node.js v6 LTS "Boron" release line is available beginning with Node.js v6.9.0 (LTS "Boron"). Along with the transition to Long Term Support, this release also contains the following security fixes, specific to v6.x:

Disable auto-loading of openssl.cnf: Don't automatically attempt to load an OpenSSL configuration file, from the OPENSSL_CONF environment variable or from the default location for the current platform. Always triggering a configuration file load attempt may allow an attacker to load compromised OpenSSL configuration into a Node.js process if they are able to place a file in a default location.
Patched V8 arbitrary memory read (CVE-2016-5172): The V8 parser mishandled scopes, potentially allowing an attacker to obtain sensitive information from arbitrary memory locations via crafted JavaScript code. This vulnerability would require an attacker to be able to execute arbitrary JavaScript code in a Node.js process.
Create a unique v8_inspector WebSocket address: Generate a UUID for each execution of the inspector. This provides additional security to prevent unauthorized clients from connecting to the Node.js process via the v8_inspector port when running with --inspect. Since the debugging protocol allows extensive access to the internals of a running process, and the execution of arbitrary code, it is important to limit connections to authorized tools only. Note that the v8_inspector protocol in Node.js is still considered an experimental feature. Vulnerability originally reported by Jann Horn.

All of these vulnerabilities are considered low-severity for Node.js users, however, users of Node.js v6.x should upgrade at their earliest convenience.

Original post is included below

Node.js v6 LTS security inclusions

Next week, on Tuesday the 18th (late evening UTC), the Node.js Foundation will be launching its second new LTS release line, a continuation of the v6.x series of releases. This line will be codenamed "Boron" and the first version will be v6.9.0.

In addition to a change to introduce the process.release.lts property, set to 'Boron', we will also be including 3 low-severity security patches that only apply to the v6.x release series.

The security vulnerabilities being addressed are all low-severity and arise from Node.js dependencies:

V8
OpenSSL when Node.js is built in FIPS-compliant mode (not official builds)
v8_inspector, a new experimental debugging protocol

These patches will also be included in the new v7.x Current (non-LTS) release series which is due to be launched later this month.

Node.js v6 is affected
Node.js v4 (LTS "Argon") is not affected
Node.js v0.12 (Maintenance) is not affected
Node.js v0.10 (Maintenance) is not affected

CVE-2016-5180 "ares_create_query single byte out of buffer write"

A security vulnerability has been discovered in the c-ares library that is bundled with all versions of Node.js. Due to the difficulty of triggering and making use of this vulnerability we currently consider this a low-severity security flaw for Node.js users.

The patch has already been included in Node.js v6 and we will ensure that patched versions of the remaining affected versions are made available by Tuesday the 18th.

Node.js v6 is not affected
Node.js v4 (LTS "Argon") is affected
Node.js v0.12 (Maintenance) is affected
Node.js v0.10 (Maintenance) is affected

We apologise for the short notice of these releases.

Node v6.8.1 (Current)

Evan Lucas — Sat, 15 Oct 2016 00:38:39 GMT

Notable changes

build: Fix building with shared zlib. (Bradley T. Hughes) #9077
stream: Fix regression in stream.Writable subclass instanceof checks. (Anna Henningsen) #9088
timers: Fix regression where immediates that are cleared in the callback would never be called. (Brian White) #9086

Commits

[8d2206fe41] - build: add -DZLIB_CONST when building with --shared-zlib (Bradley T. Hughes) #9077
[8c4fab0a28] - stream: fix Writable subclass instanceof checks (Anna Henningsen) #9088
[7171bd6311] - timers: fix regression with clearImmediate() (Brian White) #9086

Shasums (GPG signing hash: SHA512, file hash: SHA256):

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

fc42b85875c2ed593a22c4543f82f5ae4d737969c1915ac3d5f7a1fcf47a05a1  node-v6.8.1-aix-ppc64.tar.gz
36058e54c0e502c3e98f37f85533cf6148ea0232cf06cbebaee70a53719e60ca  node-v6.8.1-darwin-x64.tar.gz
0de6e5494e958abae485a89e56acfdd1c8be81f5f2c77d82fd9a90d05f226be4  node-v6.8.1-darwin-x64.tar.xz
63091ba93129536252820d0a6dc1e291d6bf602c1051a06979d45ae629265715  node-v6.8.1-headers.tar.gz
7e25a7ce6db3eda84998a41476c9cd684505839b12c79e3447d98ace81a4911b  node-v6.8.1-headers.tar.xz
d68acdedba79bb0cca9ccdb985323d18b6edbd85ee8cf896e02433c09cad1da9  node-v6.8.1-linux-arm64.tar.gz
813737086589af99cc46b35859418347dbbb8777b40fd841314d5cd44ff171d9  node-v6.8.1-linux-arm64.tar.xz
439c1018d65e224ae9b7a25bf546952c89c0d6faeddd2d932697a1bda6f6935d  node-v6.8.1-linux-armv6l.tar.gz
1424002e68f77ea4c6f2cd545e75652b97f5c2f00371df261f1d2da9f65fc5ce  node-v6.8.1-linux-armv6l.tar.xz
7afaab589165ba2e59476148010dd23d68cf67cd9f98d2522ce6e5c3430a5cc1  node-v6.8.1-linux-armv7l.tar.gz
4db9a34cde67a15680e1bfc1b80bace25475c79e554911ad62535d567b65125f  node-v6.8.1-linux-armv7l.tar.xz
7480f0b371187c3642c39ce058603b662e271823ff8fcb959fd349b580cb694b  node-v6.8.1-linux-ppc64le.tar.gz
952db6f02026b49d3a9210b4324432127e5e73038ac9f9c6dc97e7c304693454  node-v6.8.1-linux-ppc64le.tar.xz
f478521914ea5d46e0280ff5626ed2c9645acae529c4aa8a557de54353936255  node-v6.8.1-linux-ppc64.tar.gz
e0c3a1e2a500c9c4575f85a5f5f884fc765dcc3bc37913f52312d08f2799524f  node-v6.8.1-linux-ppc64.tar.xz
d6d9cd0a3164f687eaf148f37bd0a443fb5492964e5ef48bc61abafaa3fa8ac5  node-v6.8.1-linux-s390x.tar.gz
909f4992a2b5e82b3208aa51cac7289c865bca2f43ec041742ce24b3217b14dd  node-v6.8.1-linux-s390x.tar.xz
8d004e6990926508460495450a4083d40836e81710afca303d6a298e032c6b18  node-v6.8.1-linux-x64.tar.gz
ae027c59efa93823d4f8d0af296f4f0e2f54a168ca11a525f91cbbbd5f30e39e  node-v6.8.1-linux-x64.tar.xz
1247639f19a3e035bc1ec13bc546b0aea651b94836d0d814a5fe52f379c471e5  node-v6.8.1-linux-x86.tar.gz
0cbc3ace4d6fdf69f9d5db8a6f2f7f2e6fdb91e98889648af3381c2bca019479  node-v6.8.1-linux-x86.tar.xz
aa08c2fe5c97040f08935bc3e748a998d1a79205a943fecaf5abbc22726a4756  node-v6.8.1.pkg
49122d54d53ec38062fb6f66a724e28287b4bf6b67361e4020d936b28f207a59  node-v6.8.1-sunos-x64.tar.gz
3b110056957030755667cb5f71152f552cf8a88c46ddb68fdc8715370693f317  node-v6.8.1-sunos-x64.tar.xz
4b18bbaeb1f6cfc89545a5791681c40ca25f506d02170cc2d4e0d1fbbfe1da1c  node-v6.8.1-sunos-x86.tar.gz
9a0cbea79c249d19349aa9d1f0ce8ab99c88c1424118ce72d075882b22f95492  node-v6.8.1-sunos-x86.tar.xz
736f7651f59a78d5a0d88ab2430c93fc29a8efd1c06fd3fb4eb915b262bc2769  node-v6.8.1.tar.gz
a44ff48de369381c506661996dec568085d42998613ed2a23ebb37fddc12c99a  node-v6.8.1.tar.xz
99433a9e86c55dd3d8530e1e2f1a89e3c088ff62400e0cad90f362a236c945b0  node-v6.8.1-win-x64.7z
f0c13669e53682649e7e19008fae4215eff8f798924c98f25483699309bae707  node-v6.8.1-win-x64.zip
2dded7caa140a5b2a80dd98648183dfadf38f7a201a3bdf5fbe283b75a3c1331  node-v6.8.1-win-x86.7z
baacae312978ee54ee1303b9e9eebdadb1c851716890953edbe820c526953c33  node-v6.8.1-win-x86.zip
4600ed0e30a2497b6add2f53cdfccc727cf1cf9c5de6f90e89037085f489e5f4  node-v6.8.1-x64.msi
72b6bcbb0b33639d858a4fc925d2af9e0399ed59511ec7f7ad28ba08b8740866  node-v6.8.1-x86.msi
b30dee0c32a9ec7a282d55be3c8652075377adc88b7197f35f0e5aae003cae4f  win-x64/node.exe
b9038fcb8c5e75b7a6a570317baade24d32efe062defd47dd0bd63bb5438dd94  win-x64/node.lib
bfd6c8821cbe37a8343ba8da8f0b9bd66fb5bcd2ca364482c357918b2ef7a278  win-x64/node_pdb.7z
947d8c502ef60d0fc8070b3b364cff69c7d2b03c438979d721ca270f3b9b803b  win-x64/node_pdb.zip
ff1167133f9a9817248f00c48b07306888132dee2d0d12757e6206feca961cfd  win-x86/node.exe
e7d6eb9778991938228f300510dfe886fefc34590af4c45e5305fb760c049039  win-x86/node.lib
a8220b3d6b525b4104c09213999cdd445ce78d1195b5fdb924e3d42b9a4d4f78  win-x86/node_pdb.7z
7f661e5d555ef2cf177265141e7eb2252fe58e246edeecf99987b454057915b6  win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJYAXjwAAoJELY7U1pMIGyp4OMQANfvkpLDYRxF6ojEtp3A697P
thGTxHqLVE6rSa7e1x06WadSft9NFmhnn2e8+Lo6gbioBtOqpFx0OkVFlXqHMlWa
ppKmyqPlzs85qiz7mlD7V8M/mstM0lEKI2LQ58ETy9se2qDJvOxdRu/buAtDD6W9
YIC6M/IFi6c6icrzPpEqhAgV7jpMXxbSyfS27H5xnMBEc422IsDSQnYj+EPx2Ly9
/iVXC+A13JcohgzhCM26RrD1GgHHgQ0HVhv0x06Xd/7G9O9FVMV+uQwSpzPY5Z2b
EHxMq67Uj8ttxl5zhIGgjzhj4BeDAzhdIkgNpPk7WeMdDpFTF+WeVhZgA8gFXgLh
Ebf6EHMEjc4dunAuDuuKrIjYJ1K5nt19TmpAJRlmcwT68wBjLedhxlBUs3J0dbS2
cIDPlejEkA2uySImnEJzWqFnzzOxXjYUGrALgs9rcUPrL6SvkAwARY86uIwDaz7K
PJoURvwMcWDJLVRo8+501+WoEM+GzgM42rFky+/d0OLmiVlRhv1ESNiz+w1Gnlf4
K8Ko4NlRmpnBz2S0KVVaDZINpzSFknAfX5Q1tYcI7685SybWqbs8M473TSFjgEel
NO+wEuHcM4Wg9/0rtwsBVq6Lb57vqpvuzFCANXcYf1qy0+LE3B5oSBnj+n+8BfpN
+xy+k6m8TgYUdJTyCAEL
=6B+o
-----END PGP SIGNATURE-----

Node v6.8.0 (Current)

Jeremiah Senkpiel — Wed, 12 Oct 2016 21:04:45 GMT

Notable changes

fs:
- SyncWriteStream now inherits from Stream.Writable. (Anna Henningsen) #8830
  Practically, this means that when stdio is piped to a file, stdout and stderr will still be Writable streams.
- fs.existsSync() has been undeprecated. fs.exists() remains deprecated. (Dan Fabulich) #8364
http: http.request() now accepts a timeout option. (Rene Weber) #8101
module: The module loader now maintains its own realpath cache. (Anna Henningsen) #8100
npm: Upgraded to 3.10.8 (Kat Marchán) #8706
stream: Duplex streams now show proper instanceof Stream.Writable. (Anna Henningsen) #8834
timers: Improved setTimeout/Interval performance by up to 22%. (Brian White) #8661

Commits

[1a6e8983a6] - benchmark: add benchmarks for Buffer.from() (Anna Henningsen) #8738
[882f8b3d6c] - benchmark: use 'yes' instead of echo in a loop (Bartosz Sosnowski) #8721
[999f727bb5] - benchmark: add benchmark for destructuring object (Fangdun Cai (Fundon)) #8680
[5c10898e31] - buffer: fix check for .buffer property (Ojas Shirekar) #8739
[b9c2270502] - buffer: fix performance regression (Michaël Zasso) #8754
[3fcdf4e80a] - buffer: remove unnecessary argument check (Michaël Zasso) #8552
[ee319b739c] - buffer: add isSharedArrayBuffer checks (Ojas Shirekar) #8510
[38fdbcd7f7] - build: make addons build dep. on node_version.h (Anna Henningsen) #8861
[f057d193ec] - build: run cctests as part of test-ci target (Ben Noordhuis) #8034
[a202be6690] - build: don't build icu with -fno-rtti (Ben Noordhuis) #8886
[296254f141] - build: remove VS 2013 switch from vcbuild.bat (Ben Noordhuis) #8067
[a425c4da98] - build: run npm install for doc builds in tarball (Anna Henningsen) #8413
[3d3bce6ca1] - cluster: remove unused backlog argument (Brian White) #8877
[23a851dfe6] - deps: avoid single-byte buffer overwrite in ares_create_query (Daniel Stenberg) #8849
[46af58898c] - deps: make gtest output tap (Ben Noordhuis) #8034
[9d41e8913f] - deps: bump V8 patch to 84 (Myles Borins) #8851
[4d41bd9c68] - deps: hotfix upgrade npm tap version for tests (Kat Marchán) #8706
[9ecfc32fde] - deps: upgrade npm to 3.10.8 (Kat Marchán) #8706
[c4d9b54f75] - dgram: use Buffer.alloc(0) for zero-size buffers (Сковорода Никита Андреевич) #8751
[e1a774d314] - dns: remove internal variable from makeAsync (yorkie) #8800
[787558935c] - dns: tweak regex for IPv6 addresses (Luigi Pinca) #8665
[4e8c03707a] - dns: handle array holes in setServers() (cjihrig) #8567
[5e6be7b4c2] - doc: fix typo in email address in README (Rich Trott) #8941
[72ed6aa205] - doc: make node(1) more consistent with tradition (Alex Jordan) #8902
[2fad4d29b0] - doc: add example for file existence with fs.stat (Christopn Noelke) #8585
[0bdc363205] - doc: add added: information for globals (Luigi Pinca) #8901
[bc2dd3e467] - doc: change ./node to node in debugger.md (AnnaMag) #8943
[b212b9b44b] - doc: add CTC meeting minutes 2016-09-07 (Josh Gavant) #8499
[c31a3178e8] - doc: fixup link in fs.md (ss22ever) #8940
[e7039cdbb8] - doc: fix markdown formatting in url.md (Bryan Bess) #8933
[ff9a84d324] - doc: update punctuation in README.md (Abner Chou) #8892
[c36c8dc3cc] - doc: add documentation for test common module (Paul Grock) #8840
[a604a82186] - doc: recommend using port 0 instead of common.PORT (Niklas Ingholt) #8694
[77fc5caceb] - doc: add CTC meeting minutes 2016-09-14 (Josh Gavant) #8726
[505b88d3c3] - doc: add CTC meeting minutes 2016-09-21 (Josh Gavant) #8727
[3e8c8f90bc] - doc: fix typo in repl doc (Franziska Hinkelmann) #8826
[a00ae75805] - doc: improve documentation for commit subject line (Luigi Pinca) #8546
[aaebbf9708] - doc: encourage 2FA before onboarding (Rich Trott) #8776
[f07054dd49] - doc: add optional step to onboarding doc (Rich Trott) #8774
[dceaa0ba4a] - doc: remove failing workaround in BUILDING.md (Christopher Fujino) #8763
[0522aa0dc0] - doc: add commit formats for release blog posts (fen) #8631
[98e425eed4] - doc: fix title level at tls.md (yorkie) #8782
[e7c0f34f20] - doc: add added: info for crypto.timingSafeEqual() (Marc-Aurèle DARCHE) #8796
[4fb051426c] - doc: enable no-file-name-articles remark-lint rule (Сковорода Никита Андреевич) #8713
[4699e3022b] - doc: enable first-heading-level remark-lint rule (Сковорода Никита Андреевич) #8716
[3aec6a68bf] - doc: improve child_process doc types (yorkie) #8741
[6fab334a73] - doc: fix example in stream doc (Luigi Pinca) #8378
[f13089b834] - doc: update BUILDING.md (rainabba) #8704
[5c014bb532] - doc: standardize on make -j8 (Rich Trott) #8678
[98ca442cae] - doc: add CTC meeting minutes 2016-08-24 (Josh Gavant) #8423
[28264f8da4] - doc: add eugeneo to collaborators (Eugene Ostroukhov) #8696
[85ee89edd6] - doc: add ak239 to collaborators (Aleksey Kozyatinskiy) #8676
[5dd6229aeb] - doc: clarify fs.utimes() arguments (Danny Guo) #8651
[42386d7229] - doc: add link to help repo in README (Rich Trott) #8570
[2f6101ed10] - doc: fix broken link in timers doc (Ltrlg) #8562
[e16f95db4d] - doc: update exercise portion of onboarding doc (Rich Trott) #8559
[a91050c57b] - doc: fix typo in path doc (Kalman Hazins) #8527
[64b79eba42] - doc: remove extra comma in cluster docs (Teddy Katz) #8557
[2d23227060] - doc: fix a formatting error in buffer.md (Сковорода Никита Андреевич) #8553
[eebecef9a4] - doc: link onboarding to contributing guide (Rich Trott) #8529
[8a1f74338c] - doc: remove duplicate content from readline doc (Italo A. Casas) #8497
[71dd4c193a] - doc: capitalize arguments' type names in url doc (yorkie) #8489
[8e28e03fb9] - doc: add gibfahn to collaborators (Gibson Fahnestock) #8533
[c96618f241] - doc: add imyller to collaborators (Ilkka Myller) #8530
[929d9bb222] - doc: standardize rest parameters (Timothy Gu) #8485
[125df45b80] - doc: add not-an-aardvark to collaborators (not-an-aardvark) #8525
[3eb93e1fe8] - doc: add example for running with v8-inspector (Franziska Hinkelmann) #8845
[d6dcbc212b] - doc,tool: add tls.TLSSocket to typeMap (yorkie) #8742
[d69570d5fc] - doc,tool: add ref to Integer (yorkie) #8740
[688abac7b2] - (SEMVER-MINOR) fs: make SyncWriteStream inherit from Writable (Anna Henningsen) #8830
[07d97f4f3e] - fs: fix handling of uv_stat_t fields (Anna Henningsen) #8515
[14e2d67776] - (SEMVER-MINOR) fs,doc: undeprecate existsSync (Dan Fabulich) #8364
[980c1edf63] - (SEMVER-MINOR) fs,module: add module-loader-only realpath cache (Anna Henningsen) #8100
[ee7af01b93] - (SEMVER-MINOR) http: socket connection timeout for http request (Rene Weber) #8101
[7a59449478] - https: fix memory leak with https.request() (Ilkka Myller) #8647
[573d8bcee4] - inspector: fix minor issues (Brian White) #8890
[f4f9cf779f] - inspector: build file cleanup (Eugene Ostroukhov) #8753
[e80ae1350c] - inspector: address race conditions (Eugene Ostroukhov) #8672
[f817875235] - inspector: wait for both sides closing (Eugene Ostroukhov) #8505
[4ed46b47a1] - inspector: report default context (Eugene Ostroukhov) #8502
[b05ce842ce] - inspector: zero out structure members (Eugene Ostroukhov) #8536
[0b90ff7a8d] - inspector: introduce a smoke test (Eugene Ostroukhov) #8429
[3222b66abe] - inspector: fix tests on Windows (Eugene Ostroukhov) #8528
[a1925a7955] - lib: minor improvements to bootstrap_node.js (Rémy MEJA) #8906
[313a45da24] - lib: changed var to const in linkedlist (Adri Van Houdt) #8609
[6cd5588a67] - lib: fix TypeError in v8-polyfill (Wyatt Preul) #8863
[ba361a2aa0] - lib: remove let from for loops (Myles Borins) #8873
[beb288b639] - lib: changed var to const in internal/v8_polyfill (Adri Van Houdt) #8615
[858a7bbacf] - lib: changed var to const in bootstrap_node.js (Adri Van Houdt) #8588
[31232adebb] - module: fix comment from "read-only" to "shallow" (Bryan English) #8887
[0eaf3ff53c] - path: fallback to process cwd when resolving drive cwd (Jason Ginchereau) #8541
[d72a7b3d0c] - path: fix path.relative UNC path result (Jason Ginchereau) #8523
[e0c10f63b0] - process: changed var to const in internal/process.js (Adri Van Houdt) #8614
[37ce6da59a] - process: changed var to const in internal/v8_prof_processor (Adri Van Houdt) #8619
[e8f1cf1bd8] - process: changed var to const in internal/process/promises (Adri Van Houdt) #8620
[4c194ee7bd] - readline: fix concievably typo in readline.js (Miguel Angel Asencio Hurtado) #8953
[8c91a9b848] - repl: improve .help message (Roman Reiss) #8519
[443bedeb68] - src: remove out-of-date TODO comment (Daniel Bevenius) #9000
[59aa103df2] - src: fix typo in #endif comment (Juan Andres Andrango) #8989
[8a2ba6fe83] - src: fix build for older clang (Zach Bjornson) #7645
[d8df78c573] - src: remove unused function declaration (Brian White) #8878
[a6b9ffbf5b] - src: refactor reading of options in contextify (Franziska Hinkelmann) #8850
[324c8b5f7e] - src: fixes misplaced comment (Madhav Gharmalkar) #8860
[86b9db601d] - src: add missing length argument to send comment (Daniel Bevenius) #8816
[aa11205f71] - src: rename CHECK_NOT_OOB() macro (Ben Noordhuis) #8784
[8be818eb07] - src: fix minor typo in comments (Daniel Bevenius) #8736
[41ad6e3965] - src: rename handle_ to handle in HandleWrap (Daniel Bevenius) #8712
[9205edc35c] - src: don't abort when c-ares initialization fails (Ben Noordhuis) #8710
[6ddfe89fdf] - src: remove VS 2013 compatibility hacks (Ben Noordhuis) #8067
[a9491f1604] - src: make ReqWrap req_ member private (Daniel Bevenius) #8532
[5ebce30468] - src: remove unneeded ABORT after CHECK (yorkie) #8593
[2dbef79ca7] - src: handle thrown errors in CopyProperties() (cjihrig) #8649
[52f0f64e79] - src: use MaybeStackBuffer on DoSend/Writev (Paul Kiddie) #8626
[a62999ac70] - src: add /json/protocol endpoint to inspector (Ben Noordhuis) #7491
[4e7c67cf55] - (SEMVER-MINOR) stream: proper instanceof for Writables (Anna Henningsen) #8834
[56951b4367] - test: add coverage for spawnSync() killSignal (cjihrig) #8960
[05f74120e8] - test: refactor assert in internet test-dns.js (Junshu Okamoto) #8980
[1a4207d91d] - test: various test improvements (James M Snell) #8468
[c4f0bb237a] - test: expand test coverage for url.js (Junshu Okamoto) #8976
[4e9b6a0022] - test: fix test-child-process-fork-regr-gh-2847 (Santiago Gimeno) #8954
[b579fcab45] - test: remove FIXME pummel/test-tls-securepair-client (Alfred Cepeda) #8757
[9b0733fd49] - test: run faster and cleanup after run (Wyatt Preul) #8848
[df0211d95e] - test: refactor test-net-server-max-connections (Rich Trott) #8931
[147a06d4a5] - test: enable addons test to pass with debug build (Daniel Bevenius) #8836
[636026a22d] - test: remove blank lines at end of files (Rich Trott) #8920
[93c48743f1] - test: refactor test-file-write-stream (Sudaraka Wijesinghe) #8894
[516486526f] - test: cleanup/update test-dgram-empty-packet.js (Michael Macherey) #8896
[2f0f596e07] - test: fix child-process-uid-gid on Windows (Michaël Zasso) #8924
[52d0424c56] - test: mark test-tick-processor-unknown flaky (Rich Trott) #8900
[424c126742] - test: fix -Wformat warnings in inspector cctest (Ben Noordhuis) #8034
[76f80a3f74] - test: fix running child-process-uid-gid as root (Wyatt Preul) #8864
[11ba56c83d] - test: expand test coverage for url.js (Junshu Okamoto) #8859
[c9450cef1b] - test: clean up test-timers-immediate (Rich Trott) #8857
[17922de555] - test: add and assert readable/writable arguments (Daniel Bevenius) #8815
[bc710ef461] - test: cleanup/update test-os.js (Mike Woods) #8761
[fc42825530] - test: modernize syntax, add strict checks (Lydia Kats) #8841
[72de8594fe] - test: use common.skip for tap skip output (Lydia Kats) #8841
[4fa0fc59cd] - test: stream writable ended state (Italo A. Casas) #8778
[6dbda6aa86] - test: clean up test-buffer-badhex (Jeremiah Senkpiel) #7773
[af092f1fc0] - test: cleanup test-net-server-address.js (Akito Ito) #8586
[af84528d41] - test: replace indexOf, assert.equal, add mustCall() (Richard Hong) #8766
[2e95b0e24b] - test: fixed FIXME in test-repl-persistent-history (Alfred Cepeda) #8756
[76fd7db521] - test: update var to const, use arrow functions (Matt Lang) #8595
[5bd13a3d6c] - test: cleanup parallel/test-fs-readfile-unlink.js (nohmapp) #8764
[f523b82c7b] - test: cleanup parallel/test-file-write-stream2.js (Jenna Vuong) #8770
[9252e7a52d] - test: cleanup parallel/test-fs-realpath.js (mpmckenna8) #8769
[6ba8aa963e] - test: changed var to const, added strict equal checks (Lydia Katsamberis) #8762
[81ed50c5da] - test: add assertions to zero length buffer test (Lauren Spiegel) #8729
[b2aea505df] - test: use Buffer.alloc (Eugene Ostroukhov) #8748
[5e4d8984b4] - test: accept expected AIX result test-stdio-closed (Rich Trott) #8755
[906283837f] - test: skip cpu-intensive tests on slow hosts (Rich Trott) #8652
[aa5a16a8ae] - test: add expectWarning to common (Michaël Zasso) #8662
[b46d8cdcde] - test: cleanup vars to const and '==' to '===' (oogz) #8705
[5540e3d488] - test: fix test-cluster-worker-init.js flakyness (Ilkka Myller) #8703
[ed625fefd2] - test: add tests for add/remove header after sent (Niklas Ingholt) #8682
[e9d1426080] - test: enable cyrillic punycode test case (Ben Noordhuis) #8695
[b62735a302] - test: remove call to net.Socket.resume() (Alfred Cepeda) #8679
[9ca8722203] - test: cleanup stream tests (Italo A. Casas) #8668
[dfd022ff9e] - test: update test/parallel/test-child-process-stdio.js (matzavinos) #8584
[fef4341f46] - test: update test/parallel/test-eval.js (Pavol Otcenas) #8590
[43d6212257] - test: update test/parallel/test-child-process-send-utf8.js (Jonathan Prince) #8594
[6924a4d237] - test: update test/parallel/test-fs-read.js (Richard Walker) #8596
[1b494d3b96] - test: fixup parallel/test-async-wrap-post-did-throw.js (Jermaine Oppong) #8625
[edf9242f56] - test: cleanup test-os.js (delvedor) #8606
[d4ad8d9619] - test: refactor test-dgram-bind-shared-ports.js (Fikret Burak Gazioglu) #8582
[714cbfd46c] - test: update test-child-process-recv-handle (Jonathan Prince) #8648
[c664109c72] - test: improve test-child-process-stdout-flush (Wietse Venema) #8581
[c98d0c984d] - test: cleanup test-child-process-exec-env.js (Yevgen Safronov) #8600
[3269a7d6f5] - test: cleanup test-tls-connect-given-socket.js (Thomas van Lankveld) #8616
[5e5a1c0e3c] - test: cleanup test-child-process-buffering.js (Adri Van Houdt) #8578
[bcba27e8c6] - test: update test-cluster-disconnect-unshared-udp (matt-in-a-hat) #8599
[5a59ca6168] - test: changing equal to strictEqual in path (lrlna) #8628
[3ddf77fc24] - test: modernize js and tighten equality checking (Pavol Otcenas) #8618
[34f24e559d] - test: refactor parallel/test-tcp-wrap-listen (scott stern) #8640
[6fb8ebd98c] - test: cleanup cluster-disconnect-unshared-tcp test (Rachel) #8598
[fd7f87ef40] - test: var variables to const in zlib (Ishan Aditya) #8627
[fc6b4970b5] - test: modernize JS and tighten equality checking (Pavol Otcenas) #8580
[f2f6353bc4] - test: cleanup test-intl.js (Alessandro Metta) #8641
[14025db8c5] - test: cleanup test-child-process-disconnect.js (Pavol Otcenas) #8602
[9032ba60a5] - test: replace var by const test-tls-zero-clear-in (Sébastien Barbieri) #8621
[1aa1740f12] - test: improve coverage of the util module (Michaël Zasso) #8633
[28d009be76] - test: refactored test-crypto-random.js (Tobias Kahse) #8632
[a89deb9c59] - test: cleanup test-c-ares.js (Yevgen Safronov) #8577
[9c3d521d90] - test: improve child_process tests (Dennis Schwartz) #8617
[ba88f5b8f8] - test: improve coverage of the buffer module (Michaël Zasso) #8552
[b10467cde2] - test: improve test-https-agent.js (Dan.Williams) #8517
[82b7894d3b] - test: make test-tick-processor.js non-flaky (Fedor Indutny) #8542
[30e995f714] - test: add coverage for client._addHandle() (Rich Trott) #8518
[ff238c8d15] - test: fix flaky test-force-repl (Rich Trott) #8484
[83ed5085f4] - test: mark test-inspector flaky on windows (Rich Trott) #8835
[5a7dd18699] - test,benchmark: fix lint errors on v6.x (Jeremiah Senkpiel) #9029
[4492cc3e25] - test,lib: align arguments in multiline calls (Rich Trott) #8642
[3a72a606cb] - timers: improve setImmediate() performance (Brian White) #8655
[06c411753e] - timers: improve setTimeout/Interval performance (Brian White) #8661
[02da155e4b] - timers: remove unreachable code (yorkie) #8487
[cf92be6939] - tls: TLSSocket emits 'error' on handshake failure (Mariusz 'koder' Chwalba) #8805
[bee1955f4e] - tls: handle error events with _tlsError (Fedor Indutny) #8889
[d2eaa12a23] - tls: improve createSecureContext in _tls_common (yorkie) #8781
[b0234e7968] - tls: add 'new' keyword for Array constructor call (Mike Ralphson) #8514
[58c55108d2] - tools: disallow extra blank lines at EOF/BOF (Rich Trott) #8920
[336d505dd9] - tools: enable more remark-lint rules (Сковорода Никита Андреевич) #8708
[0310655cda] - tools: update remark configuration (Сковорода Никита Андреевич) #8666
[5c6284a417] - tools: add additional ESLint rules (Teddy Katz) #8643
[73d54a6fc7] - tools: add eslint rule prefer-assert-methods (Dany Shaanan) #8622
[ac6927f549] - tools: make argument alignment linting more strict (Rich Trott) #8642
[8684cea9b7] - tools: make sure links are correctly passed to marked (Timothy Gu) #8494
[a12ff5cc5d] - tools: clean up icu/README.md formatting (Сковорода Никита Андреевич) #8660
[fc68b12bc3] - (SEMVER-MINOR) util: Add format for SharedArrayBuffer (Yosuke Furukawa) #8587
[38be15549e] - util: don't init Debug if it's not needed yet (Bryan English) #8452
[7728f95967] - util: simplify SIMD setup (Dany Shaanan) #8579
[8282d6fc60] - vm: add error message if we abort (Franziska Hinkelmann) #8634
[b83f51a326] - win,msi: mark INSTALLDIR property as secure (João Reis) #8795
[623d3c6eb5] - win,tools: ignore linting for line breaks (João Reis) #8785
[7403aaa13f] - zlib: tighten up dictionary tests (Tarjei Husøy) #8512
[15474951a5] - zlib: fix raw inflate with custom dictionary (Tarjei Husøy) #8512

Shasums (GPG signing hash: SHA512, file hash: SHA256):

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

6ec44c9dd6e9e7ed5145089aeb4437893873dd4de7cd8dfd7afb875f9b8eeb77  node-v6.8.0-aix-ppc64.tar.gz
4ff13860f6bda86ce1053c673548c7f5d301a42ceb2f103c781024c3b88d2083  node-v6.8.0-darwin-x64.tar.gz
f76d896e9e48d7a7544463492f65b9cfaf15a4ccccf7aff16de5f59f5ea5971b  node-v6.8.0-darwin-x64.tar.xz
1cac1f6816e26982cb652314f84fec76c0494c1fbd080fe86a400f841ef215f1  node-v6.8.0-headers.tar.gz
d6f386113c75d360b36bb70d7a008b00ecd531fe3f8602998412d82969b9de0d  node-v6.8.0-headers.tar.xz
c7524e35bfc1fd4961dfac6bd6d602f474e909d63e3e48f892906a183bd9aa04  node-v6.8.0-linux-arm64.tar.gz
46c3a34f57ebd2f9988223d5c552fdc6f3cd96bd8611cd94f5bc5ddab762e2c6  node-v6.8.0-linux-arm64.tar.xz
2ae978777979c4af49945ce46dd014eba18d50a94520a8555e60d10113308b2f  node-v6.8.0-linux-armv7l.tar.gz
636fb4e5cd2d499cb3feb473f62c1033b5c3621256209aa13952a15c96a4b65d  node-v6.8.0-linux-armv7l.tar.xz
d955c56f404287054bb7433b934636305d8f9788294da1b34e7942288497485c  node-v6.8.0-linux-ppc64le.tar.gz
20609c3ab0c7d4429aace56d9dad43bd79d7cfc45a2134908fc6a5259be6a039  node-v6.8.0-linux-ppc64le.tar.xz
c8bfd55be7f47efa7c6d2d051eef0b99c70d222a2c70c3a013cffb4b171e1808  node-v6.8.0-linux-ppc64.tar.gz
6ef8f001dad55337321b871965816dca880b20d0c6d05a88de93afbfbde256b8  node-v6.8.0-linux-ppc64.tar.xz
76225db134036a6f2426e5c8e854ee62e8e2d4b522d916874e995f88a22ddb14  node-v6.8.0-linux-s390x.tar.gz
854830d5638dcbf448cc87eecec51aed63bafadebe42ce6eb9f1237e6e241896  node-v6.8.0-linux-s390x.tar.xz
9ddd118262cbe27fd668bc17c9c786cdd27c6a291cc712b4937013e4665f6e6d  node-v6.8.0-linux-x64.tar.gz
1db91adb194a2fa65d48311502a13aa2ab9787212364a6925544b9f20b92a97b  node-v6.8.0-linux-x64.tar.xz
d79eccb95911d3d3cf742d059e2d2f7669db33ef8f7f1f38f023c0e553f26d30  node-v6.8.0-linux-x86.tar.gz
30eecdcd99eaa8c2a4fc4c5d2c979878aeaa480b2f937c2b7c34efd1ec1b5de4  node-v6.8.0-linux-x86.tar.xz
05d4ba510fe8e9cd0cacb276979d7327ca613543fe988c668baddcadc60cb2b1  node-v6.8.0.pkg
9346655f3724e81d5fb49140d36097957f5ede725cc5070a22b3be4ce423bf48  node-v6.8.0-sunos-x64.tar.gz
9182c4ce9c9c2084efb1c90be746c87ea0ea4349a37bf326cb1798c84f60bdd7  node-v6.8.0-sunos-x64.tar.xz
7ae4a80269e254791a57b1759d4e5eeb2127a44a431444a36c02d3ff8727ac88  node-v6.8.0-sunos-x86.tar.gz
a86c7a8afcb8df73b9b22f25e5ab7bdaecb5ad566f9bd7fb0cf29f42598645da  node-v6.8.0-sunos-x86.tar.xz
a8a2d4b74734991dd45e5b2b0b13617864f1283f6d6bc262e1e4d30741114352  node-v6.8.0.tar.gz
f832ce5a90a86615c2ab5a4d485e0a60666a800f07411a3244c88c1027ff598d  node-v6.8.0.tar.xz
65f579915f01cbf361f8071e9561cbd151d7a128b1cd7171a12e5d129bf049bb  node-v6.8.0-win-x64.7z
f8ebc521d109bcc9d5b94ffef2922beb05e2e19fe8d7572333acf1b509082c3e  node-v6.8.0-win-x64.zip
b90e68d9e22e11655a9d4ce86327628f31f484108555143c838f46fc7cd57930  node-v6.8.0-win-x86.7z
e94c33550a80c1a92caba5951bfc596bf40e33fcab2fd857d795a88d163829b7  node-v6.8.0-win-x86.zip
e4ebd121116fa2d22cae6a56962b3d8a9b002c775d7db6adcdff3ba6d30ee6b0  node-v6.8.0-x64.msi
2bf4bb535f926138393766ea163af1032d469cfb704f892f5b73a98da67d131a  node-v6.8.0-x86.msi
f052f2093d0d788950a0706a21aa9252e3db19393b33588592dbd6f7052b7cbd  win-x64/node.exe
1fe7ae8725f2d172d54a9d4ae3461686f05144986905f495d6def2ace38c7203  win-x64/node.lib
fdedf887b7ace4596b9ff764a741123a7b783abce3f174a83d458cdc9bfe1d13  win-x64/node_pdb.7z
2208cb79a7c1c8ebb0d4e20cbfa2da0ef1b18da3a303715292e11602ea2eac7f  win-x64/node_pdb.zip
bbb88d6eab73ca0b8d4d5d8c3f1816820c2b3470debfb8bd8ed5b5bd98ea3d4b  win-x86/node.exe
f859a599260092e1022ed9163c2da2a5e0b644d988a7532bd013d14218e5f25e  win-x86/node.lib
de29e3e862c47541ce9bb1d00143f4e6d1fd3e283eaf0472634c7ea45a062e12  win-x86/node_pdb.7z
0d3ffdbb43a7b5b35a10df7a2d9ae76fe10b7fd7728370e61a10a9de0abc36b9  win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJX/pl4AAoJEEX17r2BPa6O5QAP/0OxoqpBq0v1IsbAkQomN+ti
Y8As8LymZzVvQvM/4Cfg/ZaQPqr6McBErJWet7KVTUArNKspqmuIu93Gq/DwcBu3
a+f0POBhZYYyVJQHo3+ZRO0jNY+hZLB/VK5TA3P1uKPHGbhSOoTpGxBYYTQ3FVY7
4Ei3j44VTiRpcYOammEcgFfTQpES7mDki/XEMbtDyk7WEwvIkfgr/hN9cSnHpafs
FRs8tkxhb+5e11+IdoSSvLEncAGt55t0awm/ctFoAEk7CSRhLnQE7ATa0mi2Lb/j
HfB3c2x3lb6QPJVOQwqdKDtJcmHLR8oonjljHBw8HAfKvEO0xLitFv5TxygbjFCT
3Nfpgmn/Ia3KQKwNeYkST7R2bMU7WU2mThvIMsmCA4OwCJSRrTrGlXMT9G1FwicD
cJ3WI4+lwIqGxSudrnVtZaBVQ3T9ArcUiELvyeqDcPm9sw8QVWkMA9F9J0Sl9yw4
aPPFSBkkStELHjkOqp0hs0Xg8/p/GfcBcizWu3zQb4Scep56H6JOeOLBeHhooEWF
WaySL0FaPfNNQwhxMOMHSkYdPR3eEoYd6k2Ea+S8kOe7BWBghCRVkou582cxZZbt
1RczdWirVL5/AI6aGoe4bZtZwRdpqFjm3wpYkNrT0KIkrRino2Y1eoNzrjB6ZvpQ
Ld4lKpKmIEH1mWDE7q7k
=oguF
-----END PGP SIGNATURE-----

Node v6.7.0 (Current)

Evan Lucas — Wed, 28 Sep 2016 00:49:35 GMT

This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities.

Notable changes

Semver Minor:

openssl:
- Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714
- Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786
- Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#73
http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) nodejs/node-private#60

Semver Patch:

buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing a totalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич) nodejs/node-private#64
src: Fix regression where passing an empty password and/or salt to crypto.pbkdf2() would cause a fatal error (Rich Trott) #8572
tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string. Originally reported by Alexander Minozhenko and James Bunton (Atlassian). (Ben Noordhuis) nodejs/node-private#75
v8: Fix regression where a regex on a frozen object was broken (Myles Borins) #8673

Commits

[8fb8c46303] - buffer: zero-fill uninitialized bytes in .concat() (Сковорода Никита Андреевич) nodejs/node-private#64
[e5998c44b4] - crypto: don't build hardware engines (Ben Noordhuis) nodejs/node-private#73
[ed4cd2eebe] - deps: cherry-pick 34880eb3dc from V8 upstream (Myles Borins) #8673
[f8ad0dc0e2] - deps: add -no_rand_screen to openssl s_client (Shigeki Ohtsu) nodejs/io.js#1836
[9181def9d4] - deps: fix asm build error of openssl in x86_win32 (Shigeki Ohtsu) iojs/io.js#1389
[2dee4af5c3] - deps: fix openssl assembly error on ia32 win32 (Fedor Indutny) iojs/io.js#1389
[4255dc82a9] - deps: copy all openssl header files to include dir (Shigeki Ohtsu) #8786
[c08d81df50] - deps: upgrade openssl sources to 1.0.2j (Shigeki Ohtsu) #8786
[2573efc9df] - deps: update openssl asm and asm_obsolete files (Shigeki Ohtsu) #8714
[67751f3d7e] - deps: add -no_rand_screen to openssl s_client (Shigeki Ohtsu) nodejs/io.js#1836
[4382de338b] - deps: fix asm build error of openssl in x86_win32 (Shigeki Ohtsu) iojs/io.js#1389
[cfa00611b0] - deps: fix openssl assembly error on ia32 win32 (Fedor Indutny) iojs/io.js#1389
[3e4ea603b3] - deps: copy all openssl header files to include dir (Shigeki Ohtsu) #8714
[8937fd0dbb] - deps: upgrade openssl sources to 1.0.2i (Shigeki Ohtsu) #8714
[c0f13e56a2] - http: check reason chars in writeHead (Evan Lucas) nodejs/node-private#60
[743f0c9164] - lib: make tls.checkServerIdentity() more strict (Ben Noordhuis) nodejs/node-private#75
[38bed98a92] - openssl: fix keypress requirement in apps on win32 (Shigeki Ohtsu) iojs/io.js#1389
[a25fc3f715] - openssl: fix keypress requirement in apps on win32 (Shigeki Ohtsu) iojs/io.js#1389
[5902ba3989] - src: Malloc/Calloc size 0 returns non-null pointer (Rich Trott) #8572
[a14d832884] - test: remove openssl options of -no_ (Shigeki Ohtsu) #8714

Shasums (GPG signing hash: SHA512, file hash: SHA256):

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

69fab7a1ebeee54d5e3160eb9366e88a61500731fad86dee98c79c4a14b56bc6  node-v6.7.0-darwin-x64.tar.gz
b10270f028be73771fa8536f0c69b33f30e1bb1fd15d9a493a7365cde56af0d2  node-v6.7.0-darwin-x64.tar.xz
42f0fdcd937409842d76a5852782acfdb0b6fa8e3520df6694f2abaa7c9e942c  node-v6.7.0-headers.tar.gz
f6ddea52f8b13bcece38c965d13f6073bd7980dadcfd903b8c1872f6d8bbacb7  node-v6.7.0-headers.tar.xz
45ffd727bcab41a544ad7862fe985f6beac4fcd96c63e116ca467d1147ba6454  node-v6.7.0-linux-arm64.tar.gz
87f59a19d9a44ff938a553425c5c82a46be1f0cd43bf7c256e1c4fb61833a82a  node-v6.7.0-linux-arm64.tar.xz
0f8e0dbaa6bcccd22db75077fed1afb28c2b225b6cdc185913178ae395a68ef9  node-v6.7.0-linux-armv6l.tar.gz
bf07229d718ebe3a8d8bc59cbf06d945b89045285e44f36f516c8e0f65a5302b  node-v6.7.0-linux-armv6l.tar.xz
1e7e138ba8c54d7a0fbf5e3f188442a14a70409dc154b74b17635bcff74e4a81  node-v6.7.0-linux-armv7l.tar.gz
18b6d9df3e2aaba2d72e1f4c3cfdd3b963c23faa64d3ad72d5690959bc3dde08  node-v6.7.0-linux-armv7l.tar.xz
87f7dd1776bffd569d4f619dde99caca215c073f7d26853e16d6f93fcf681113  node-v6.7.0-linux-ppc64le.tar.gz
fc1b70f866a1c1972c55cc5d2a506f0dcc623e749d6cbe470d650c7c631f231e  node-v6.7.0-linux-ppc64le.tar.xz
e8ce540b592d337304a10f4eb19bb4efee889c6676c5f188d072bfb2a8089927  node-v6.7.0-linux-ppc64.tar.gz
6ee874b6567f7f06708f6ccb66a27dc7317b4c493b7a6c3bb49c1e53c4bdf31e  node-v6.7.0-linux-ppc64.tar.xz
e0f2616b4beb4c2505edb19e3cbedbf3d1c958441517cc9a1e918f6feaa4b95b  node-v6.7.0-linux-s390x.tar.gz
647bacc68bd0101b04074d5740492a6511dee69e23a7ff03765674d7a9fa93df  node-v6.7.0-linux-s390x.tar.xz
abe81b4150917cdbbeebc6c6b85003b80c972d32c8f5dfd2970d32e52a6877af  node-v6.7.0-linux-x64.tar.gz
09263a844c31933c6f31e576e580faf01d3bbb056efb8713388dc8d09674f8c2  node-v6.7.0-linux-x64.tar.xz
fa94c93a4a3600d68e003a399f5cf5e109c2d10505b4d9456373c25953eb9bf5  node-v6.7.0-linux-x86.tar.gz
e89a77020bd579186adbc46f6a668d3524f980c5fc75f63e1d5b5362423bcebb  node-v6.7.0-linux-x86.tar.xz
c5d46d0f105ed652c9a353d8411558c9c4610db874f01ef07e57ad613e5d4237  node-v6.7.0.pkg
33f240dac58a1293a08b66ecd01a70849c693e3a9e58a94cb7ee92126a894984  node-v6.7.0-sunos-x64.tar.gz
9df8f3d1048065fccb1c1746cfd1f3a22ef46075399e7dc92d38949e37607de7  node-v6.7.0-sunos-x64.tar.xz
80dacf34a5e17f3eeabe15e212005daeaa189caa424a83a23f302a9fa5996565  node-v6.7.0-sunos-x86.tar.gz
14bdf36ae5510a6565af69e1db651d34e75d2846a363610b6669b8c78e404b2a  node-v6.7.0-sunos-x86.tar.xz
02b8ee1719a11b9ab22bef9279519efaaf31dd0d39cba4c3a1176ccda400b8d6  node-v6.7.0.tar.gz
ceb028324aab1ee8c7ea6a62026f036f3ea71f5ef5212593d0f833f999dd3be5  node-v6.7.0.tar.xz
2eb013b15c718ec2b26768e6a325e73571ed1d2028af411307a1bbd549f709ed  node-v6.7.0-win-x64.7z
59971f8ea9fb1ac4c55ca36303fe32a0714049cf8a10843dbb5924a5d0624659  node-v6.7.0-win-x64.zip
8b4448e56223aed8c316b67336fdd1d94aeee71033934fb6bc071a358c5c8719  node-v6.7.0-win-x86.7z
d75bebea562a1da0965adc8f94d2c5a38a22cfc57959d37c5c1aeec4ea9f1c83  node-v6.7.0-win-x86.zip
2185a16f8a32087b75708b08d7e482a14597765c41d6b3711a8e6ed3a3358213  node-v6.7.0-x64.msi
0801c283200ac263cc0ca014f5d8e0ee531e1ebec6e99645a0bdd04b996c1605  node-v6.7.0-x86.msi
7ab8714273a9a1fa464ded6b543b52b6fb56c7d2c3d08ebe312b1c1be72a1477  win-x64/node.exe
17c521d3b19886f826f818b9806bb4d2af4615d5bf850c257dcdaef897e8ccaa  win-x64/node.lib
fa2f32b9f8ac97d26bb58da59c8a7299de5bd9f25b8879f8787ecd0ffbd36c3b  win-x64/node_pdb.7z
815d202704373b9894c5dc113d2a2812be5e73431f8061707e0fd012cbc0b8cc  win-x64/node_pdb.zip
a2e58867917250e013a49c4210b36aba04715159a71edcfb510c6225e3dab184  win-x86/node.exe
641503fd3d41c1bc04a95ee38e6dc2ffd9c9e5a35b3f5bfecb25965c963f2d17  win-x86/node.lib
36265c44782a8456b289c4776bf5de5ed648982f2b8dc97e17acd76258e249cf  win-x86/node_pdb.7z
2d8a25ba8e212715050ee03e4b0b9f547163ffaeb75288c9508a06e469677ff6  win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJX6xF5AAoJELY7U1pMIGypw8sQAM0o8jAf5AlM3apyFJIm8q3P
8z7LsyOm/gX04h6U4xONVybx0uxqkoCs/Bk9JSJdxdc9qMM4FLxbf9W3se61FZQa
fYva3cXiAm/riUxO5vbghBNzKgE8aLFeOiuEIL5c+UzaxjFs8eY6oRfqYN87jNcB
95T3krvYGY9pA39Cyr1mBbCJq8AdjcM/ve6wqcjQDGswZF5Yq+yd94Z1qzCWzB2u
8yLcLaaoyVy2BvFg/11XgK9xK7w1KpxHK+jIzVVDE9dVoQc1pcQQZR72mYVIQFUt
jCJ69T5Usnil1ucswmfk7d1vvX1NdIawaol6AjEErO1APZsVew+TCJyvwq4uLAA2
kvgiVF/8Pe3ZdF1x9+vWz1JvEXpmehOlJ9fRv3bZn20W3/GIeS5NA+AgJrr6H65D
Trv6juvBceu2wGeBer8XCzql+9Pk4k87vARcExEKxsOU57lZ4mgaX5aMfTaNtTnp
zm5+ajGNnEZ4tjR91do6JXMF8/5MHmP93vFOwsrANabBe4sjd3u3BIbAVlkS74z0
bLZeo2dM18p3RdDw2Szo5jTSjuIhCV+5wNKxLoNjLSoYC6fSwAod+FuCXoWZZi6/
1eF4uFXik9m3ifInj6KKjCfKql8Rh6siHu2AsOjxaE/UyKY27HpXbtWpIhvM4Ht5
A0X+c5AUaeTAxt30L2PG
=+Moe
-----END PGP SIGNATURE-----

Node v4.6.0 (LTS)

Rod Vagg — Wed, 28 Sep 2016 00:47:06 GMT

This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities.

Notable Changes

Semver Minor:

openssl:
- Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714
- Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786
- Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#70
http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) nodejs/node-private#46

Semver Patch:

buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing a totalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич) nodejs/node-private#65
tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string. Originally reported by Alexander Minozhenko and James Bunton (Atlassian). (Ben Noordhuis) nodejs/node-private#63

Commits

[93b10fbec2] - buffer: zero-fill uninitialized bytes in .concat() (Сковорода Никита Андреевич) nodejs/node-private#65
[c214e8847d] - crypto: don't build hardware engines (Ben Noordhuis) nodejs/node-private#70
[af9dda152c] - deps: add -no_rand_screen to openssl s_client (Shigeki Ohtsu) nodejs/node#1836
[6bb9749c33] - deps: fix asm build error of openssl in x86_win32 (Shigeki Ohtsu) nodejs/node#1389
[5176a8ad57] - deps: fix openssl assembly error on ia32 win32 (Fedor Indutny) nodejs/node#1389
[aa9ed60a51] - deps: copy all openssl header files to include dir (Shigeki Ohtsu) #8786
[0c74e2ad35] - deps: upgrade openssl sources to 1.0.2j (Shigeki Ohtsu) #8786
[8f3d6760cf] - deps: update openssl asm and asm_obsolete files (Shigeki Ohtsu) #8714
[e8f29e2ba8] - deps: add -no_rand_screen to openssl s_client (Shigeki Ohtsu) nodejs/node#1836
[01cf5b0ae7] - deps: fix asm build error of openssl in x86_win32 (Shigeki Ohtsu) nodejs/node#1389
[19ae4e8ae1] - deps: fix openssl assembly error on ia32 win32 (Fedor Indutny) nodejs/node#1389
[cbed5e64be] - deps: copy all openssl header files to include dir (Shigeki Ohtsu) #8714
[e7fdace18f] - deps: upgrade openssl sources to 1.0.2i (Shigeki Ohtsu) #8714
[b5c57ff772] - http: check reason chars in writeHead (Evan Lucas) nodejs/node-private#46
[3ff82deb2c] - lib: make tls.checkServerIdentity() more strict (Ben Noordhuis) nodejs/node-private#63
[7c696e201a] - openssl: fix keypress requirement in apps on win32 (Shigeki Ohtsu) nodejs/node#1389
[44e5776c0f] - openssl: fix keypress requirement in apps on win32 (Shigeki Ohtsu) nodejs/node#1389
[c7a601c090] - test: remove openssl options of -no_ (Shigeki Ohtsu) #8714

Shasums (GPG signing hash: SHA512, file hash: SHA256):

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

525ab42c767525edb7e512c600dedb20d826a6f58e1d6d1b774651a1c782a267  node-v4.6.0-darwin-x64.tar.gz
3c728c25b541fd8b88826568e7867098658df7c45d2389b60877c093a9803bd0  node-v4.6.0-darwin-x64.tar.xz
5eb4b4324d72297066b4b8c91d0b1e7c82cabde9986c986682be66202f37176b  node-v4.6.0-headers.tar.gz
862ce573bcfd592ea0c24861c0097bd23ca842d263e03f5dfa1ce08be888f20f  node-v4.6.0-headers.tar.xz
bf03e7384b727bc80c0c59cf38ba5704d83faa7f455f40fa62a67c8331dde7d6  node-v4.6.0-linux-arm64.tar.gz
7683e664b648c4ec3f86935f4b4f9fbf56f19d171e1e29d5adf687fc4c392b5b  node-v4.6.0-linux-arm64.tar.xz
e7db1c612eb9dd55e3ff246bfa7c35f0b87664e6e2bc7b32891de8cc1e48f5a7  node-v4.6.0-linux-armv6l.tar.gz
766d10a73886bbe1a3abd4b78563a825408cab7e116e590f1bbdc9b88cc3aa09  node-v4.6.0-linux-armv6l.tar.xz
9e46082bef5b521afd483532c8d3715f33d1d4302b7980b904bea3182817275f  node-v4.6.0-linux-armv7l.tar.gz
def976771b4a2a4488b87a06c8295ffea55671f7f42df13e3718341d28bf2d40  node-v4.6.0-linux-armv7l.tar.xz
2aa9518ea637cc06877a01c40d4608cf9a7f1588000cf3e550e4ab24c170aee6  node-v4.6.0-linux-ppc64le.tar.gz
b06c39da4fae47e2d204cae183425a3a77849944c5be47c5807f4f08cef51f64  node-v4.6.0-linux-ppc64le.tar.xz
ee77fb6a1dfbe166c9faee25b4f110af25723c64b0abcb9085507b8445fa2e7b  node-v4.6.0-linux-ppc64.tar.gz
e35955a846c1082e1681fdcbf488a66e43f56fb0aa7205b86a4aa0ce69dfb1eb  node-v4.6.0-linux-ppc64.tar.xz
acf08148cecf245f28126122ac9128ff9909f00938b18d80fc0b92648d1c98a8  node-v4.6.0-linux-x64.tar.gz
a77ceb75a05984153304ad0f09b11d234ca54a67714ba575b52e4298df0343d1  node-v4.6.0-linux-x64.tar.xz
9aab75618de0dca640d747aa25073cbb5a01342dd8aa177df8112e26a39541f4  node-v4.6.0-linux-x86.tar.gz
8994ee2c180a97fc4280bfb390444a4bcb2629290aa8243e7ab6271efab593f4  node-v4.6.0-linux-x86.tar.xz
0359c50c5d7e887c7f17d7ea4f42b1776ac8df263c6471bf8054b5c9f3d42a67  node-v4.6.0.pkg
e9a02da71d0cd6a1874f4a7d227dfcbe6ab9492eba419b5c9a83c8c95065195f  node-v4.6.0-sunos-x64.tar.gz
8ea3d2887b4850fb92f75573f30bbb257b7cd11f71cda12becc34868c535acf8  node-v4.6.0-sunos-x64.tar.xz
f8536a25629ef1ad3228b2d712e2fa43bf66980673d3cdf469da37c0407e9633  node-v4.6.0-sunos-x86.tar.gz
5750a8256356f43c6b80854b7c6ce46d6933e64cf5f2efecdf4841e4fe582a28  node-v4.6.0-sunos-x86.tar.xz
0838f12e329edb252e6e6baddca85632bf5ff2ec900e737e88f9bf9b38946b1b  node-v4.6.0.tar.gz
42910dbd34e49bfc40580e06753947c30d31101455a38e9f0343a23d67c0c694  node-v4.6.0.tar.xz
0c6509c13cfa9795f08b9bf694383de7e4d93cde14a9e8979a92f21736e19498  node-v4.6.0-win-x64.7z
0782bd50251c2a159fba5b874c56fb4a6680f454cc16892cee8e62d17b7d6f60  node-v4.6.0-win-x64.zip
413f98f2b765fe862ff6971724c3f265dbfe5a2cb865dd1894b4447426542c91  node-v4.6.0-win-x86.7z
13a5dcb90a8397f62c55945b65cb1c7b9d7576af3cbfc8d9cb67f72edcf68201  node-v4.6.0-win-x86.zip
80926b2df6e7efc8adda2e1fcb6328b99fe878d728cf93f39b0c710adc1bcb35  node-v4.6.0-x64.msi
5f91bf57512c1fa96d016c8f6236c689998ed926faa13aaf2170154342ca915a  node-v4.6.0-x86.msi
7564472c672e729a724ffe890ba06ec318c9e311684516a25a47b3f1e549504e  win-x64/node.exe
24178152fc3a99b9b83a1620897c5624cb7e0ba0544da38e18ca0cde807435d4  win-x64/node.lib
44dbbec125f3c4804ed5d002628c7ddb8e51cd352af0542b9edebcfd718967b5  win-x64/node_pdb.7z
b92e5e5031f19f201ec4568d7761c263af9a20e02b34bdd9e5f7191750aee3fb  win-x64/node_pdb.zip
7c9287cec4379082393d85af919a36a3512aa6bfcbf3deba3261a472580041f8  win-x86/node.exe
7d5988939f1567a4d7180010f49ec36b8d3897a8eccb78e461a774d8d2de614e  win-x86/node.lib
98f955f69195f12ec429e4cff629c650a6b1dcb43a1c18cef9cf79a11067c88d  win-x86/node_pdb.7z
0d0faf3bf0fcf50a943d8202d24d8eb8bb0695ea99498360c1a8a745c7811fd7  win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----

iQEcBAEBAgAGBQJX6xhwAAoJEMJzeS99g1RdoksH/139ljOj+Vjc0nVNRn5m2KxC
3gldiKMaNBeefV9JOA3tG1fei3KPvO/PRHVCYogQO8IEEpJ5Yer+zQpsLOg/xGDR
nsg9xOBupnSlUAfALilWhkDkBDgcauuiII3tP98GjDaSS+cH6Pctt08l2XTCROYk
YThc0nonmobDGSsHVf4biv+ySMocmpZGU0h10xS2lRVlrxMpEzsxVuCSv52fRDKy
gD0Hf9ZSFi9i1MIxKOIolYpdIVmrS29c6J0LbjW2WcTk21jIOENXEk1uEl71OWHD
plT4hauehu/3a89FcqsOu10MqLStFuEm0T1CXtmn4/Vm2FhJnZfdiCDT1YABD00=
=LyAk
-----END PGP SIGNATURE-----

Node v0.12.16 (Maintenance)

Rod Vagg — Wed, 28 Sep 2016 00:45:43 GMT

This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities.

Notable changes:

buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing a totalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич)
http:
- CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas)
- Invalid status codes can no longer be sent. Limited to 3 digit numbers between 100 - 999. Lack of proper validation may also serve as a potential response splitting attack vector. Backported from v4.x. (Brian White)
openssl:
- Upgrade to 1.0.1u, fixes a number of defects impacting Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306.
- Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis, Rod Vagg)
tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string. Originally reported by Alexander Minozhenko and James Bunton (Atlassian). (Ben Noordhuis)

Commits:

[38d7258d89] - buffer: zero-fill uninitialized bytes in .concat() (Сковорода Никита Андреевич) https://github.com/nodejs/node-private/pull/66
[1ba6d16786] - build: turn on -fno-delete-null-pointer-checks (Ben Noordhuis) https://github.com/nodejs/node/pull/6737
[71e4285e27] - crypto: don't build hardware engines (Rod Vagg) https://github.com/nodejs/node-private/pull/69
[b6e0105a66] - deps: add -no_rand_screen to openssl s_client (Shigeki Ohtsu) https://github.com/nodejs/node-v0.x-archive/pull/25368
[1caec97eab] - deps: fix openssl assembly error on ia32 win32 (Fedor Indutny) https://github.com/nodejs/node-v0.x-archive/pull/25654
[734bc6938b] - deps: separate sha256/sha512-x86_64.pl for openssl (Shigeki Ohtsu) https://github.com/nodejs/node-v0.x-archive/pull/25654
[7cc6d4eb5c] - deps: copy all openssl header files to include dir (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8718
[4a9da21217] - deps: upgrade openssl sources to 1.0.1u (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8718
[6d977902bd] - http: check reason chars in writeHead (Evan Lucas) https://github.com/nodejs/node-private/pull/47
[ad470e496b] - http: disallow sending obviously invalid status codes (Evan Lucas) https://github.com/nodejs/node-private/pull/47
[9dbde2fc88] - lib: make tls.checkServerIdentity() more strict (Ben Noordhuis) https://github.com/nodejs/node-private/pull/61
[db80592071] - openssl: fix keypress requirement in apps on win32 (Shigeki Ohtsu) https://github.com/nodejs/node-v0.x-archive/pull/25654

Shasums (GPG signing hash: SHA512, file hash: SHA256):

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

6e1d0df2fbdb9255b1ad7fd5b4aa96590ced9053406b9ae336535dd587ae1631  node.exe
a0b4c351cc2d3624cf07c68fa9fcec08a7aa146c4436daf1325369345f3ae2ef  node.exp
24b3e250cfa8155d2f002af8328760aaa06ddceff745794e86bb3d0e372a244b  node.lib
cc8fbc5549d4b9dfd44a7cc76619cf635712fba8ab153fcbd37d94fcad130184  node.pdb
c602cbced0d6a2fb9d97f25a72833cf564b35fdf742f8627a93b6cdb5132ea95  node-v0.12.16-darwin-x64.tar.gz
5a91d99d8944ec8f88c2c6b9d51ad4159e84c2fcfcb29ddec6ea8516b05233e0  node-v0.12.16-darwin-x64.tar.xz
2cb0b6d33deab16aa261eeadec9c0da40d23e391b626a096f36b75ded62e471f  node-v0.12.16-darwin-x86.tar.gz
d0feea70fc15b658101b3517fe57c0cc9b3dedf4116f349c4be45e4850251964  node-v0.12.16-darwin-x86.tar.xz
cb30a68fc3a03b8bb98d8b17e389537610c7cf663e7dd113868c13c99fcffee6  node-v0.12.16-headers.tar.gz
84a1b0007dbaad41f5dc15ca2b57e365fa1cd82d4b1b9d744ab62dccd920b29e  node-v0.12.16-headers.tar.xz
d9e1cd239844f2a5641e02e48b3c7955e3e73ff3c3d20629c24b561f08ab8219  node-v0.12.16-linux-x64.tar.gz
7905d4c22aab6d65121a35daeada11d217f5d9608d5bde81007ccd908f3f793f  node-v0.12.16-linux-x64.tar.xz
ea95fb22f07469d79fd0347e4f768267be50889fd6de8854bf2f834c346c93a4  node-v0.12.16-linux-x86.tar.gz
12f2f7fddf5796d07851cb3b923290925c6ca1cf77cd26e67f56e9b8f16df5d3  node-v0.12.16-linux-x86.tar.xz
bc9984523ccd944be1cb8de4f4a454b5c1325b9bfae8db8a024a3be60ea5027f  node-v0.12.16.pkg
817671fe6303a1bf2ea47876e2fbbe271ec3ba721b6e688836117a70cc2631c3  node-v0.12.16-sunos-x64.tar.gz
b59b734777b9f2ab8006f85420d3b8e24634f424b0deb3ee85ab71dd74a4a981  node-v0.12.16-sunos-x64.tar.xz
452ade498e7b4d0050cc8c60bb6aa2dcb16562026441ad78063f473435691984  node-v0.12.16-sunos-x86.tar.gz
ea0867a8df11422f72a313643a49a92a6b161706875bd4ab8c0708662f53b8ee  node-v0.12.16-sunos-x86.tar.xz
312c0b74b0815f0514de9bf00667850d4f6ce184126f02f3d8dbf40fd48235eb  node-v0.12.16.tar.gz
4ce3a862eb28be752fbd65fe032c1d55cbbc1145af39292766eea701f67ba5f6  node-v0.12.16.tar.xz
9c66769c2b40c042658e3505432f8cf3c1c700245e93be98a24c482cec5923ea  node-v0.12.16-x86.msi
92111f120281409f0f41d8afb0746cc328c56227f6264ef610673268486d2043  openssl-cli.exe
b44576e0f9ee304102038491deb77c5b2d44a0499d119d23a0da945ff54308f6  openssl-cli.pdb
16e89836b368c67759ddb115ee5ed70449686cd387918c94bc0fa384120d586f  x64/node.exe
8b0fb2ffe3fa2aedf892a338d8783ce3b49a775335af007f41e0a293e692c436  x64/node.exp
7e060f0c42315dd3267ff4ab3907ab537d6b491c52b2353f4482a39146d73864  x64/node.lib
2bcc5665344c8c625d385d293fad2d520e332d06a327cd8bc1d7ede5ddff91f8  x64/node.pdb
4dd5fb2c022dfc46dd53c68bfb2461d4a8d8d6c79351f82db48af08e6193dd18  x64/node-v0.12.16-x64.msi
a5e97c0142cdffd2ce9dfad8652e2ab52a5503f5a91c8cfdcc653836cbd0e053  x64/openssl-cli.exe
d305298bfc3348bd0b01d84a0de9a16c04ae396261663fd44122c58ba9950c3c  x64/openssl-cli.pdb
-----BEGIN PGP SIGNATURE-----

iQEcBAEBAgAGBQJX6w2WAAoJEMJzeS99g1RdK88H/iV7CbWaI9/13eez1uKRZZHz
B/gGrcaCY6zihqCX6VT8uK/xhnI+ZRtxkTzwHxMnbYAuTK1V5tf4BJQOOXygm0+U
AsQAlJEZja9vb5D4hA+4wwSct3F39cADdgebpgPpAzdwB/xAkJZDNSrP9qtJs3gC
JjBX+pxepD9UHrfr9Jjka1yntdd+LXIaS4kHbdkolHAfrFGw+iTyjzibnRHndomb
JYC10JB+IGEFletFHylfj2J5znb1F4bHhatkoPDVPjat8KZLvXZCKeCdcLEWmYa5
mSSiw0VDmBcRnxkT648RKw12vULxQOV2ahVxc402Xbc2iMaekXOC0eaW2jfTolE=
=Hxbw
-----END PGP SIGNATURE-----

Node v0.10.47 (Maintenance)

Rod Vagg — Wed, 28 Sep 2016 00:43:22 GMT

This is an important security release. All Node.js users should consult the security release summary at for details on patched vulnerabilities.

Notable changes:

buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing a totalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич)
http:
- CVE-2016-5325 - Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas)
- Invalid status codes can no longer be sent. Limited to 3 digit numbers between 100 - 999. Lack of proper validation may also serve as a potential response splitting attack vector. Backported from v4.x. (Brian White)
openssl: Upgrade to 1.0.1u, fixes a number of defects impacting Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity), CVE-2016-2183, CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306.
tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string. Originally reported by Alexander Minozhenko and James Bunton (Atlassian) (Ben Noordhuis)

Commits:

[fc259c7dc4] - buffer: zero-fill uninitialized bytes in .concat() (Сковорода Никита Андреевич) https://github.com/nodejs/node-private/pull/67
[35b49ed4bb] - build: turn on -fno-delete-null-pointer-checks (Ben Noordhuis) https://github.com/nodejs/node/pull/6738
[03f4920d6a] - crypto: don't build hardware engines (Rod Vagg) https://github.com/nodejs/node-private/pull/68
[1cbdb1957d] - deps: add -no_rand_screen to openssl s_client (Shigeki Ohtsu) https://github.com/nodejs/node-v0.x-archive/pull/25368
[c66408cd0c] - deps: fix openssl assembly error on ia32 win32 (Fedor Indutny) https://github.com/nodejs/node-v0.x-archive/pull/25654
[68f88ea792] - deps: separate sha256/sha512-x86_64.pl for openssl (Shigeki Ohtsu) https://github.com/nodejs/node-v0.x-archive/pull/25654
[884d50b348] - deps: copy all openssl header files to include dir (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8718
[bfd6cb5699] - deps: upgrade openssl sources to 1.0.1u (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8718
[3614a173d0] - http: check reason chars in writeHead (Evan Lucas) https://github.com/nodejs/node-private/pull/48
[f2433430ca] - http: disallow sending obviously invalid status codes (Evan Lucas) https://github.com/nodejs/node-private/pull/48
[0d7e21ee7b] - lib: make tls.checkServerIdentity() more strict (Ben Noordhuis) https://github.com/nodejs/node-private/pull/62
[1f4a6f5bd1] - openssl: fix keypress requirement in apps on win32 (Shigeki Ohtsu) https://github.com/nodejs/node-v0.x-archive/pull/25654
[88dcc7f5bb] - v8: fix -Wsign-compare warning in Zone::New() (Ben Noordhuis) https://github.com/nodejs/node-private/pull/62
[fd8ac56c75] - v8: fix build errors with g++ 6.1.1 (Ben Noordhuis) https://github.com/nodejs/node-private/pull/62

Shasums (GPG signing hash: SHA512, file hash: SHA256):

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

cee8789aac9e2e5b96a1e63ae5e43ed757321c565b64a3d5d239472b18254312  node.exe
6010956e477cd2494d7d7decfca672580558519f225e797a5558955a9fbf8419  node.exp
04358767337029cab84cad1e48b95587bdeca628646437b89eae877cb3506f57  node.lib
5533b872d78b6bfb1d19ef482930dae79c3e8a85915d4b26100d2067affee6de  node.pdb
6920608a46761c33056d78e504222a3a42dc8c0cf8ab6ff7497cd4a81b06d090  node-v0.10.47-darwin-x64.tar.gz
e220a658b6d52408398a2c0f88ade702154503c50183f76542292142d9686e75  node-v0.10.47-darwin-x64.tar.xz
0907e94e81dc63e284e9dcb18925ceed102ceffb8a4cefab8f729c203f371c93  node-v0.10.47-darwin-x86.tar.gz
e5d042ee7d695e5e0f5c78c59f98ae3d47de7e5a63230894a0f51010cab2376b  node-v0.10.47-darwin-x86.tar.xz
6587d1040697dc7be7168413910a912f33a73ed95e0c19739abad4a63681b74e  node-v0.10.47-headers.tar.gz
a3ed6bf32e0afae7c676fff35d6819406cc235b24f09972b82f2c15ac90dc7c0  node-v0.10.47-headers.tar.xz
80757ae8f7bc3161fe44615344c784918ebd93a51ca6f789a75e3d472972eb77  node-v0.10.47-linux-x64.tar.gz
c93a84934546d6a0835f053ffc0e6a4273d967e7db442ecbfc731fa40c4b1bc2  node-v0.10.47-linux-x64.tar.xz
3ee003748c6ce90918a909ef58e21376db05a2988ba6fad92fded28541ca4006  node-v0.10.47-linux-x86.tar.gz
b406f6ff4938c36ac327ae00160fa4581f4e3d1e504c2b534136191cc7409026  node-v0.10.47-linux-x86.tar.xz
10f2dba060e184ba274cddd61494f4054a8d6e2062c8b13a461bfb2f08df07c4  node-v0.10.47.pkg
e4c9b4ff3745477c92ebd467606a5b7af2b95a51484f1491c91e1824c7b2b4ae  node-v0.10.47-sunos-x64.tar.gz
ef6dbe022a61aba2a86784ab11463aaf8ed637f2f8a989aef4edbaa620037330  node-v0.10.47-sunos-x64.tar.xz
f79fcd0700367506b6a8a7bf8ac0253146205ecc9617cb376744b108f126b4e3  node-v0.10.47-sunos-x86.tar.gz
0a8eddac8135851b33542ca10994a6ed4911a57584df3872bd259ca7f9120d17  node-v0.10.47-sunos-x86.tar.xz
5281fa7ddff755c34602a09ef8027f0bda0f7851b1e374fd0e0c33da93123056  node-v0.10.47.tar.gz
335bdf4db702885a8acaf2c9f241c70cabd62497361da81aca65c8e8a8e7ff09  node-v0.10.47.tar.xz
3c1aee23a996dcfd853a9fec4df05e898abab5332bac542a6ccf1661e45bf9f5  node-v0.10.47-x86.msi
0ab19d1cb3aea4b3639ce2c124c47344fd9060ce659031426fe96bfa6594b5d5  openssl-cli.exe
95d8bd6120105fd6a0327e44e8556cbdb5d21f5b431451f50eb58cf3f4112b4d  openssl-cli.pdb
20d866978497f83fcf8654576a6ce42bc496096c8407e8f324eb77fa181a8a59  x64/node.exe
ceb9e983cc14076e3737153aa070fc3459e8d6a3dd81b64d5ea3298e96899c9a  x64/node.exp
3ffe2805c1032ac4d636ecae6f322da862809bbaf12344e32b3f7b336b88c04e  x64/node.lib
d42d0a8a090a409428d42aed8987a0160dd3054d8f70e00ce44a1ebdb414d70c  x64/node.pdb
871f488dae2ccf8f1727b9773bdb4c9c0f36188783ae6d403f73c00363d9a9ed  x64/node-v0.10.47-x64.msi
ec2ac36c01d2153fc814f20143d1279aba47d39b68d06753259cf2353057e036  x64/openssl-cli.exe
513827079363c3c9391f1210d224eee91e18da80a69e56e0f238acc96e7f0f0e  x64/openssl-cli.pdb
-----BEGIN PGP SIGNATURE-----

iQEcBAEBAgAGBQJX6w1sAAoJEMJzeS99g1RdN1oH/2XvMEVsuNrG1vh5ADeL2wfB
ZG2iXFKbnydKDLTtqBJuDtt7vNyat5KCzKjUMNW0gGtMp9rzE+AGP8WpuQg5xFLB
xiaGtTyQ6PuXem6g0j5dMz/D9PVRESDHz5D/WeJXHRoebtl+W8TOdVnCY0DatjHf
wCGjx7ngpEo3hN6KxBZFeI3TpK1YkVBRv+hwSsU5kPVwfbMhVQd89H/Y6VO0sydS
HJ+dMPSX/LyGjJ+oH941u5eOrnL+h4skOe1PDy0DD8HjO9oaNt8Blv4vhSdyOX2y
1e3OcS3VWQxvMWkdGEzbBX4xdjsQubs9cw2EejS6iDLrS9a6rwQjPCHQowJDg8k=
=gxlj
-----END PGP SIGNATURE-----

Security updates for all active release lines, September 2016

Rod Vagg — Fri, 23 Sep 2016 10:53:30 GMT

(Update 27-September-2016) Releases available

Updates are now available for all active Node.js release lines. These include the recently published versions of OpenSSL 1.0.1 and 1.0.2 as well as fixes for some Node.js-specific security-related defects.

The OpenSSL security fixes included in these updates that impact Node.js are:

CVE-2016-6304: "OCSP Status Request extension unbounded memory growth"
CVE-2016-2183: "SWEET32 Mitigation"
CVE-2016-6303: "OOB write in MDC2_Update()"
CVE-2016-2178: "Constant time flag not preserved in DSA signing"
CVE-2016-6306: "Certificate message OOB reads"

Details on each of these can be found in the original post below.

Additionally, OpenSSL 1.0.2j was released yesterday and included a fix for CVE-2016-7052. This flaw was introduced in last week's 1.0.2i release, and therefore does not directly impact Node.js.

Node.js-specific security flaws

Also included, are a number of fixes unrelated to the recent OpenSSL releases.

CVE-2016-7099: Wildcard certificates not properly validated

This is a high severity defect that would allow a malicious TLS server to serve an invalid wildcard certificate for its hostname and be improperly validated by a Node.js client. This is due to a flaw in the validation of *. in the wildcard name string.

Originally reported by Alexander Minozhenko and James Bunton (Atlassian).

All versions of Node.js are affected.

CVE-2016-5325: `reason` argument in `ServerResponse#writeHead()` not properly validated

This is a low severity security defect that that may make HTTP response splitting possible under certain circumstances. If user-input is passed to the reason argument to writeHead() on an HTTP response, a new-line character may be used to inject additional responses.

The fix for this defect introduces a new case where throw may occur when configuring HTTP responses. Users should already be adopting try/catch here.

This was originally reported independently by Evan Lucas and Romain Gaucher.

All versions of Node.js are affected.

Remove support for loading dynamic third-party engine modules

This is a low severity security defect. By default, OpenSSL will load a list of third-party engine modules when the ENGINE_load_builtin_engines() function is used. These are normally not present on a user's system. An attacker may be able to make Node.js load malicious code by masquerading it as one of the dynamic engine modules.

This defect primarily impacts Windows due to the standard DLL search paths. However, UNIX users may also be at risk with a poorly configured LD_LIBRARY_PATH environment variable or /etc/ld.so.conf path list.

Originally reported by Ahmed Zaki (Skype).

Node.js v6 (Current) is affected
Node.js v4 (LTS "Argon") is affected
Node.js v0.12 (Maintenance) is affected
Node.js v0.10 (Maintenance) is not affected

Downloads

Please note that this may be the final release of the v0.10 line as support ends in October. Please upgrade to v4 or above if you have not already done so.

Original post is included below

The Node.js project has scheduled updates for all of its active release lines to patch a number of security flaws. These flaws include some of those announced by the OpenSSL project as well as a number of Node.js-specific issues. We do not consider any of these updates to be critical. However, it is strongly recommended that all production instances of Node.js be upgraded when the releases are made available.

We intend to make releases available on or soon after the evening of Tuesday, the 27th of September, 2016, UTC (midday US time).

We consider some of the patches in these releases to be API breaking changes which would normally warrant an increase in the major-version number of Node.js. However, in accordance with our security procedures, we will be delivering these changes in minor-version increases (the y in x.y.z) where appropriate, and patch-version increases in v0.10 an v0.12 releases.

These are the expected version numbers for the releases:

Node.js v6.7.0 (Current)
Node.js v4.6.0 (LTS "Argon")
Node.js v0.12.16 (Maintenance)
Node.js v0.10.47 (Maintenance)

Additional notes:

As per our LTS schedule, support for Node.js v0.10 will cease in October. Therefore, this may be the final release of Node.js v0.10. If you are still using v0.10 in production, it is essential that you plan for a migration to v4 (LTS "Argon") or v6 (LTS to be announced in October) as soon as possible.
In accordance with our security release procedures, we will be limiting changes included in the LTS and Maintenance lines (v4, v0.12, and v0.10) for these updates to only security-related and other critical fixes that provide for maximum stability for users.

Node.js-specific security flaws

Included in these releases will be a number of fixes unrelated to the recent OpenSSL releases. These include:

A high-severity flaw relating to the processing of TLS certificates, impacting all versions of Node.js
A low-severity native code injection vulnerability on Windows, impacting all versions of Node.js
A low-severity HTTP validation error, impacting all versions of Node.js

Full disclosure of fixed vulnerabilities will be provided after all releases are made available for download.

September OpenSSL Releases

The OpenSSL project has announced the general availability of versions 1.0.2i (to be included in Node.js v4 and above) and 1.0.1u (to be included in Node.js v0.10 and v0.12). Our crypto team (Shigeki Ohtsu, Fedor Indutny, and Ben Noordhuis) have performed an analysis of the defects addressed in the OpenSSL releases to determine their impact on Node.js. The results of this analysis are included below.

CVE-2016-6304: OCSP Status Request extension unbounded memory growth

A malicious client can exhaust a server's memory, resulting in a denial of service (DoS) by sending very large OCSP Status Request extensions in a single session.

This flaw is labelled high severity due to the ease of use for a DoS attack and Node.js servers using TLS are vulnerable.

Assessment: All versions of Node.js are affected by this vulnerability.

CVE-2016-6305: SSL_peek() hang on empty record

OpenSSL 1.1.0 SSL/TLS will hang during a call to SSL_peek() if the peer sends an empty record.

Node.js is not yet dependent on OpenSSL 1.1.0 so it is not impacted by this flaw.

Assessment: All versions of Node.js are believed to be unaffected by this vulnerability.

CVE-2016-2183: SWEET32 Mitigation

SWEET32 is a new attack on older block cipher algorithms that use a block size of 64 bits.

As mitigation, OpenSSL has moved DES-based ciphers from the HIGH to MEDIUM group. As Node.js includes HIGH, but not MEDIUM, in its default suite, affected ciphers are no longer included unless the default suite is not used. Node's default TLS cipher suite can be found in the API documentation.

Assessment: All versions of Node.js are affected by this vulnerability.

CVE-2016-6303: OOB write in MDC2_Update()

An overflow can occur in MDC2_Update() under certain circumstances resulting in an out of bounds (OOB) error. This attack is impractical on most platforms due to the size of data required to trigger the OOB error.

Node.js is impacted by this flaw but due to the impracticalities of exploiting it and the very low usage of of MDC-2, it is very low severity for Node.js users.

Assessment: All versions of Node.js are affected by this vulnerability.

CVE-2016-6302: Malformed SHA512 ticket DoS

If a server uses SHA512 for TLS session ticket HMAC, it is vulnerable to a denial of service (DoS) attack via crash upon receiving a malformed ticket.

Node.js does not use SHA512 for session tickets and is therefore not impacted by this flaw.

Assessment: All versions of Node.js are believed to be unaffected by this vulnerability.

CVE-2016-2182: OOB write in BN_bn2dec()

An out of bounds (OOB) write can occur in BN_bn2dec() if an application uses this function with an overly large BIGNUM. TLS is not affected because record limits will reject an oversized certificate before it is parsed.

Assessment: All versions of Node.js are believed to be unaffected by this vulnerability.

CVE-2016-2180: OOB read in TS_OBJ_print_bio()

An out of bounds (OOB) read can occur when large OIDs are presented via TS_OBJ_print_bio().

Node.js does not make use of the Time Stamp Authority functionality in OpenSSL and is therefore believed to be unaffected by this flaw.

Assessment: All versions of Node.js are believed to be unaffected by this vulnerability.

CVE-2016-2177: Pointer arithmetic undefined behaviour

This programming flaw is described in the post at https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/.

It is unlikely that Node.js users are directly impacted by this.

Assessment: All versions of Node.js are believed to be unaffected by this vulnerability.

CVE-2016-2178: Constant time flag not preserved in DSA signing

A flaw in the OpenSSL DSA implementation means that a non-constant time codepath is followed for certain operations. This has been demonstrated through a cache-timing attack to be sufficient for an attacker to recover the private DSA key.

This is very low severity for Node.js users due to the difficulty in taking advantage of this attack and because DSA is very rarely used.

Assessment: All versions of Node.js are affected by this vulnerability.

CVE-2016-2179: DTLS buffered message DoS

In a DTLS connection where handshake messages are delivered out-of-order, those messages that OpenSSL is not yet ready to process will be buffered for later use. This can be exploited to cause a denial of service (DoS) via memory exhaustion.

As Node.js does not support DTLS, users are not impacted by this flaw.

Assessment: All versions of Node.js are believed to be unaffected by this vulnerability.

CVE-2016-2179: DTLS replay protection DoS

A flaw in the DTLS replay attack protection mechanism that would allow an attacker to force a server to drop legitimate packets for a DTLS connection, resulting in a denial of service (DoS) for that connection.

As Node.js does not support DTLS, users are not impacted by this flaw.

Assessment: All versions of Node.js are believed to be unaffected by this vulnerability.

CVE-2016-6306: Certificate message OOB reads

Some missing message length checks can result in out of bounds (OOB) reads of up to 2 bytes beyond an allocated buffer. There is a theoretical denial of service (DoS) risk. This only impacts a client or a server which enables client authentication.

Node.js is impacted by this low severity flaw.

Assessment: All versions of Node.js are affected by this vulnerability.

CVE-2016-6307: Excessive allocation of memory in tls_get_message_header()

Excessive allocation of memory in OpenSSL 1.1.0 can be achieved by manipulating the length component of a TLS header.

Node.js is not yet dependent on OpenSSL 1.1.0 so it is not impacted by this flaw.

Assessment: All versions of Node.js are believed to be unaffected by this vulnerability.

CVE-2016-6308: Excessive allocation of memory in dtls1_preprocess_fragment()

A flaw that is similar to CVE-2016-6307 but impacting DTLS.

Node.js is not yet dependent on OpenSSL 1.1.0, nor does it implement DTLS, so it is not impacted by this flaw.

Assessment: All versions of Node.js are believed to be unaffected by this vulnerability.

Contact and future updates

Please monitor the nodejs-sec Google Group for updates: https://groups.google.com/forum/#!forum/nodejs-sec or the Node.js website for release announcements: https://nodejs.org/en/blog/

The current Node.js security policy can be found at https://nodejs.org/en/security/.

Please contact security@nodejs.org if you wish to report a vulnerability in Node.js.

Subscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organisation.

Node v6.6.0 (Current)

Jeremiah Senkpiel — Thu, 15 Sep 2016 21:00:36 GMT

Notable changes

crypto: Added crypto.timingSafeEqual(). (not-an-aardvark) #8304
events: Made the "max event listeners" memory leak warning more accessible. (Anna Henningsen) #8298
promises: Unhandled rejections now emit a process warning after the first tick. (Benjamin Gruenbaum) #8223
repl: Added auto alignment for .editor mode. (Prince J Wesley) #8241
util: Some functionality has been added to util.inspect():
- Returning this from a custom inspect function now works. (Anna Henningsen) #8174
- Added support for Symbol-based custom inspection methods. (Anna Henningsen) #8174

Commits

[2ecc8c4c23] - async_wrap: add a missing case to test-async-wrap-throw-no-init (yorkie) #8198
[00f4bc3105] - benchmark: add benches for fs.stat & fs.statSync (Anna Henningsen) #8338
[7cc1391287] - benchmark: fix off-by-one error in fs benchmarks (Anna Henningsen) #8338
[6e3db283ed] - buffer: fix ArrayBuffer checks (Brian White) #8453
[dd51b1f428] - buffer,string_decoder: consolidate encoding validation logic (James M Snell) #7207
[a830e37dc9] - build: don't require processing docs for nightlies (Johan Bergström) #8325
[836bfc188b] - build: fix dependencies on AIX (Michael Dawson) #8285
[bc9d2fb543] - build: fix dependencies on AIX (Michael Dawson) #8272
[206b105b1e] - build: add missing files to zip and 7z packages (Richard Lau) #8069
[afb9917f16] - (SEMVER-MINOR) crypto: add crypto.timingSafeEqual() (not-an-aardvark) #8304
[1640e7a4da] - crypto: fix getDecoder() encoding check (atstojanov) #8301
[49f996f4f6] - crypto: make malloc failure check cross-platform (Rich Trott) #8352
[9c460d7475] - deps: add back no-op harmony shipping flags (Ali Ijaz Sheikh) #8445
[c8bcf1b591] - deps: workaround clang-3.4 ICE (Ali Ijaz Sheikh) #8343
[ac3471ca23] - deps: v8_inspector update (Eugene Ostroukhov) #8150
[f829660c71] - deps: cherry-pick 8ed65b97 from V8's upstream (Anna Henningsen) #8411
[c48cb2de48] - doc: link SIGTSTP / SIGCONT events in readline doc (Italo A. Casas) #8475
[ce1a46c02d] - doc: update onboarding PR landing info (Rich Trott) #8479
[92acff82ea] - doc: add CTC meeting minutes 2016-08-31 (Josh Gavant) #8424
[53877357fc] - doc: fix link on timers.md (yorkie) #8488
[09da5756e5] - doc: add added: information for crypto (Luigi Pinca) #8281
[19df5cef3b] - doc: fix example in repl documentation (Franziska Hinkelmann) #8469
[3ce6eaa3b9] - doc: note that listening on SIGSEGV & co is unsafe (Anna Henningsen) #8410
[c7771e6fbc] - doc: clarify sentence in event loop doc (Luigi Pinca) #8400
[2c45782b12] - doc: add CI help/support info to onboarding doc (Rich Trott) #8407
[cffe7b731d] - doc: add 2016-08-17 CTC meeting minutes (Josh Gavant) #8245
[fdd59cc04c] - doc: update BUILDING.md (Rich Trott) #8398
[d0a92be798] - doc: add 2016-08-10 CTC meeting minutes (Josh Gavant) #8229
[ca31187087] - doc: update CI content in onboarding doc (Rich Trott) #8374
[44983b1fdc] - doc: update authors list (James M Snell) #8346
[ee83f5d541] - doc: add return type of clientRequest.setTimeout (Mike Ralphson) #8356
[1695c84240] - doc: fix a wrong link,add '.md' to the link (Alexis374) #8315
[65096de443] - doc: fix typos (Mike Ralphson) #8370
[6d421a2ee2] - doc: fix broken link in dgram doc (Brian White) #8365
[fbabd36de9] - doc: update targos email in readme per request (James M Snell) #8389
[76a3050c34] - doc: update landing pr info in onboarding doc (Rich Trott) #8344
[372e4f3f79] - doc: bad/better examples for fs.access() and fs.exists() (Dan Fabulich) #7832
[9f18878eee] - doc: fix typo in stream doc (Hubert Mine) #8326
[59e96bb1af] - doc: adding danbev to collaborators (Daniel Bevenius) #8359
[b553e57f5f] - doc: clarify that path on windows accepts / and \ (James M Snell) #8291
[feab3d4c25] - doc: add lpinca to collaborators (Luigi Pinca) #8331
[d2b2abe9d9] - doc: doc that listen can be called multiple times (James M Snell) #8294
[54d76137cd] - doc: readline write() is processed as input (James M Snell) #8295
[48be8bc4e1] - doc: 'ipc' is required with fork stdio option (James M Snell) #8290
[47ecd21133] - doc: improve fs.truncate functions' documentation (Sakthipriyan Vairamani) #7648
[d565183c37] - doc: add added: information for modules (Luigi Pinca) #8250
[b6f5104145] - doc: fix onReadable reentry after unshift called (Zwb) #8200
[93ac875d53] - doc: add added: information for dgram (Luigi Pinca) #8196
[260663fbfa] - doc: add Myles Borins to the CTC (Rod Vagg) #8260
[a7c21759d9] - doc: fix buf.readUIntBE, buf.readUIntLE examples (David Keeler) #8240
[e4fcf55701] - doc: fix "timout" typo in timeout (Fangshi He) #8231
[03f5297ccd] - doc: include the optional options parameter (Sakthipriyan Vairamani) #7842
[605db31fe7] - (SEMVER-MINOR) events: make memory leak warning more accessible (Anna Henningsen) #8298
[fa4c4d655a] - http: fix connection upgrade checks (Brian White) #8238
[b603ac24cb] - inspector: use script name for target title (Eugene Ostroukhov) #8243
[13a522ac39] - inspector: make sure all messages are dispatched (Eugene Ostroukhov) #8264
[250a380231] - inspector: simplify buffer management (Eugene Ostroukhov) #8257
[354166c061] - inspector: use new inspector headers (Eugene Ostroukhov) #8150
[3ef8ba8bdc] - net: make holding the buffer in memory more robust (Anna Henningsen) #8252
[180867d6a6] - (SEMVER-MINOR) promise: warn on unhandled rejections (Benjamin Gruenbaum) #8223
[408308f2e6] - (SEMVER-MINOR) readline: key interval delay for \r & \n (Prince J Wesley) #8109
[6f20f477c4] - (SEMVER-MINOR) repl: Auto alignment for .editor mode (Prince J Wesley) #8241
[0d24247e50] - src: pull AfterConnect from pipe_wrap and tcp_wrap (Daniel Bevenius) #8448
[16202264d1] - src: remove unneeded Environment error methods (Ben Noordhuis) #8427
[8cbbb47e39] - src: update f function call comment (Daniel Bevenius) #8416
[d1d1433b02] - src: normalize malloc, realloc (Michael Dawson) #7564
[2c2a21ab56] - src: unbreak build when compiling against uclibc (Ben Noordhuis) #8308
[4e368c58ff] - src: moving f function call comment (Daniel Bevenius) #8405
[0f2c619f55] - src: avoid duplicate AtExit functions (Ali Ijaz Sheikh) #8273
[3358861470] - test: refector parallel/test-http.js (Junshu Okamoto) #8471
[2ce364ad10] - test: modernize JS and tighten equality checking (Peter Ogilvie) #8476
[1a30fe563d] - test: swapped == and equal to === and strictEqual (Christopher Dunavan) #8472
[d2b6b66037] - test: refactor test-net-pipe-connect-errors (Rich Trott) #8473
[3294c2c82b] - test: skip pseudo-tty/no_dropped_stdio test (Michael Dawson) #8470
[5baa4e0156] - test: clean up net server try ports test (Thomas Hunter II) #8458
[d0e61d4cc3] - test: make crypto.timingSafeEqual test less flaky (not-an-aardvark) #8456
[154d6893b0] - test: add test-debug-protocol-execute (Rich Trott) #8454
[6c30dddc36] - test: exercise EE function type checking paths (cjihrig) #8168
[d536d6d334] - test: increase _debugger coverage (Rich Trott) #8403
[6d07e57a36] - test: mark pseudo-tty/no_dropped_stdio as flaky (Michael Dawson) #8385
[680a4c8b8e] - test: test non-buffer/string with zlib (Rich Trott) #8350
[f0300eda27] - test: fix test-cluster-dgram-1 flakiness (Santiago Gimeno) #8383
[b8fa7c949d] - test: fix ::1 error in test-dns-ipv6 (Gibson Fahnestock) #8254
[c07e063dd9] - test: fix fs-watch-recursive flakiness on OS X (Santiago Gimeno) #4629
[1aa7168e91] - test: refactor/cleanup a number of cluster tests (James M Snell) #8261
[39cf7bf24d] - test: refactor parallel/test-process-env.js (Rich Trott) #8324
[40e84218a0] - test: add test for zlib.create*Raw() (Rich Trott) #8306
[cc61d1a3ba] - test: cleanup test require symlink (Paul Grock) #8305
[cde0a1edfd] - test: refactor test-debug-signal-cluster (Rich Trott) #8289
[bc6a7ca8e7] - test: additional refactoring/cleanup of buffer tests (James M Snell) #8283
[5d43131af4] - test: add known issue test for path parse issue #6229 (James M Snell) #8293
[d2179bd6f1] - test: make sure over truncation of file zero fills (Sakthipriyan Vairamani) #7648
[5cff625d6a] - test: add check in test-signal-handler (Rich Trott) #8248
[0b0a1ceac3] - test: clean up / refactor buffer tests, remove duplication (James M Snell) #8256
[0f977f9797] - test: mark test-child-process-fork-dgram as flaky (Michael Dawson) #8274
[6f269bed99] - test: refactor test-util-inspect (Rich Trott) #8189
[eff771f399] - tickprocessor: apply c++filt manually on mac (Fedor Indutny) #8480
[f47ce9d9f8] - tools: replace custom ESLint rule with built-in (Rich Trott) #8478
[36235ac323] - tools: update ESLint to 3.5.0 (Rich Trott) #8478
[ef5cb129ae] - tools: fix new-parens violations (Rich Trott) #8478
[773e1c1304] - tools: enable caching for jslint task (Rich Trott) #8296
[54f689fc1e] - tools: update ESLint to 3.4.0 (Rich Trott) #8296
[f840bc87d6] - url: fix off-by-one error in loop handling dots (Luigi Pinca) #8420
[6ae7af0fa3] - url: keep auth in url.resolve() if host matches (Ilkka Myller) #8215
[eec5d02266] - url: url.format() encodes all # in search (Ilkka Myller) #8072
[d67ece2f68] - util: improve function signature of util._extend (Sakthipriyan Vairamani) #8187
[e9c4805c1f] - (SEMVER-MINOR) util: allow returning this from custom inspect (Anna Henningsen) #8174
[4cb55ff392] - (SEMVER-MINOR) util: allow symbol-based custom inspection methods (Anna Henningsen) #8174
[151d1ea6a6] - vm: change ContextifyScript to Script in comment (Daniel Bevenius) #8415
[f346dee940] - win,build: forward release_urlbase to configure (João Reis) #8430
[6bb057ec6a] - win,build: exit when addons fail to build (João Reis) #8412
[14d356d0ab] - win,build: skip finding VS when not needed (João Reis) #8412
[81d063e174] - win,build: fail on invalid option in vcbuild (João Reis) #8412

Shasums (GPG signing hash: SHA512, file hash: SHA256):

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

c8d1fe38eb794ca46aacf6c8e90676eec7a8aeec83b4b09f57ce503509e7a19f  node-v6.6.0-darwin-x64.tar.gz
e5e6248714618a81595cc2c04d3420535cd8a26d74274013a0eb61e0b3d23f5f  node-v6.6.0-darwin-x64.tar.xz
60b81c7276105a51e71ad8bc7f59163105e7c5dd1d992b173b5b66449b6df3fc  node-v6.6.0-headers.tar.gz
b3b6989c12cdf3652253c1b87d4328d151576a2ff4b189e05ebcba99ed84896c  node-v6.6.0-headers.tar.xz
9abae64e411d8ea1541a4776e78d9cf53ad8e20e8b34cf77d9b3579e8edb6f65  node-v6.6.0-linux-arm64.tar.gz
fce02f2fc7bdc79899de4696395d02f3e7209e4ab4053336db790b8f58cce385  node-v6.6.0-linux-arm64.tar.xz
d311754cddc9b387a2798226ecb5487e515c555e050fdd08ef3d6665c3c0d336  node-v6.6.0-linux-armv6l.tar.gz
b6a5dce140b0795da61a9936454670887b431922e56326b53f1900e72e2ac48d  node-v6.6.0-linux-armv6l.tar.xz
e4dc3295f6602b0f4cd3433a6e520294743e2c342692b4fad388d33910cdd465  node-v6.6.0-linux-armv7l.tar.gz
a3a1aac41c21d216ef380269b80225c658188f9182fc087e1823afe66935e3e1  node-v6.6.0-linux-armv7l.tar.xz
b38ff6058f0213567d31a5d194d669ce75894336f6d0324426f01722c989d3c4  node-v6.6.0-linux-ppc64le.tar.gz
c25c106ee0540f13cd119e47b85191f8a362e48d636a9e8398f5db42ac30d755  node-v6.6.0-linux-ppc64le.tar.xz
90d483c63fdbc6594185b3e143bf8d5627812288a029f02f578363d6dd505285  node-v6.6.0-linux-ppc64.tar.gz
3a2cbd56384217df585ad81eff7ddb92cf3601374152b05eafe27a2c7ef02fa9  node-v6.6.0-linux-ppc64.tar.xz
a2f109eb0fec81d90206e9c0bca05327c706b244b5d7c5bd247ac140f811e54e  node-v6.6.0-linux-s390x.tar.gz
aa181bdba1a4f8d06e61fb5496be202c271dadc46a0ef6ecb4b7b4454f1909c4  node-v6.6.0-linux-s390x.tar.xz
c22ab0dfa9d0b8d9de02ef7c0d860298a5d1bf6cae7413fb18b99e8a3d25648a  node-v6.6.0-linux-x64.tar.gz
fdf4377ea4dc9ba2f09d81d9ad1eae42e7eb870c4b1b69f2761f22f28cb5ba31  node-v6.6.0-linux-x64.tar.xz
05f3bfdfe8e1911e66b4bf645a439480212767e71664b8c97f0cba46671e8160  node-v6.6.0-linux-x86.tar.gz
e6fcca4783491c7b5866e7f969e93b66f47380e9cc92c08607d7683cfa200775  node-v6.6.0-linux-x86.tar.xz
7a9af7bf1eb98f8c206037a0dbbcd797c5684e2570d6acc8d915351bad4a5571  node-v6.6.0.pkg
21b05b3664c338b76ec8c139a7ae80fb9b1c65215ee2da6d899dcbd6c6d67554  node-v6.6.0-sunos-x64.tar.gz
b57733493ca428b859ca6f371f6fc0f93bca77926e81e80ddabe1c5d240431e8  node-v6.6.0-sunos-x64.tar.xz
ffa81fc834a7f24958b3c1bf07dc668f6d0e0cda48582a23bc749abca42cae8c  node-v6.6.0-sunos-x86.tar.gz
3572cbe039cb4a791d4f1db3ed855250cb06c4136a5af0eb277aa27a75469c29  node-v6.6.0-sunos-x86.tar.xz
11b957de855a392ceaa8b300ec66236d6f9c6baa184837d00bdaba2da4aefe91  node-v6.6.0.tar.gz
640485d2b672d3313203eae164576539e61f1e55d68122ff2c7fb59896e21a33  node-v6.6.0.tar.xz
92d708377519f9c4cb6b6006ab50118fe98ea3b7fa49ecb8a1c02f2c13c8ab92  node-v6.6.0-win-x64.7z
5b1c49f8fd36bd9c277259773f42832db74c41f87033deaccfbd82e15330bae4  node-v6.6.0-win-x64.zip
3a3eaa4690ead41631e761f24f0e0cf2d66d1378f07a59153e397abdf470273d  node-v6.6.0-win-x86.7z
95862922b8469e00a7ae5f1f82d51c739fdc6ee12a8e1d46c0f100f2ea18c082  node-v6.6.0-win-x86.zip
675f5088021b99c53136d9f7306ba93f2a126df75777f0b97fb6013da2e5c539  node-v6.6.0-x64.msi
8ce48431e7d0182d21efc398fcc478f8852b96df8a7287dd40db9ef53cca01a3  node-v6.6.0-x86.msi
1cd746e30ce1af03495858ee3f8c3e1c18350b8a8259e560b5ac25e95bc5b5de  win-x64/node.exe
efd924b61fe3f6ba67c28ac605c13304ac16976e020a57480f555cffd0a9741d  win-x64/node.lib
84b27e00d6c562dbc6d68f32c9755874c7f29932ebc04a57580cc05aac64d78b  win-x64/node_pdb.7z
238b24d1b7c24ab7ba3c964fda775500965dbcf1dd1484fa3397eded5e9d3d94  win-x64/node_pdb.zip
708a825e7c5fdb1015ea3ca56e257c74fc5ec602a83e8794ea3ab4e100c38f0b  win-x86/node.exe
461fd40ecd79bbea9710d0a940f4d143fc344ffff62309cd86ee414ccfd3916c  win-x86/node.lib
7161b5361d67279a74d2564195be9bf5a9bb2d332d9c9dde6b59a2926bfb1636  win-x86/node_pdb.7z
2394477a698c40ae08bcb9ec01ea7ed7efe9f32498212c511bd9d67103662acc  win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJX2wmcAAoJEEX17r2BPa6OkcEP/AqvpLT+XmIHd+2S5NguUNqu
iIZIBmw/iNBomfR5X3b92+TU0zMAmiakAWR8KgiHIdausbokITWv3Qia7lWro1ue
IFuXbsP9JcN+AMHi3/JKOekcg5IBqRDrzXxfHACwLokBwY5e+PwyYtEHPBx+Ls55
QuKcR24Jo70UQ1lkXNSJPSZdn85EcQ1Dw1kdhO3Mi87n4nitTRmWnFLKeJA46Ey2
ejDRUy+xt0jsy7sDeGEKDFu5ajajIRLnaaGsr21gxpjsbPH7Tg1c0gUUbs9fhrvn
gAc8R+5iXsRi24FrlaaLkfvnhF6/7uTN4YG3fbAexT9bPftd9pn7iwHKkKaTrnw/
w+n1bgH4Ogs6w8x0SX1DcvHONj5WqoIgRWRLCnju9GpjkfJQ33qNLHBTXx4qqrb2
J2mJzmvo5T9WyrEV7aWA3Laa8Fwk6MLZe4Cu/mLT9pJ3kNj/5WXCGjpWUS90jSxn
OXWY8XXY8B3e6y0AYT4J26sKd7rIv5ux0PLor/xJT5SYH4XeKbVAn8HfhakIDvR7
oIZW2UJxd/spfIbHSeODEisS5YqDrWyzAxSJfJzt1R2oI299EEtZRIzmiWXsEEXv
ee31irYPSVg0aF+Qbps+ojeOQzbukp2HMrh2K3orVvf0PzifP1Gh76nrw4BLiKLi
sY3xYr5CG0AIAjpSw0w3
=xwUE
-----END PGP SIGNATURE-----

Node.js Foundation Announces Schedule for Second Annual Node.js Interactive North America

Node.js Foundation — Mon, 12 Sep 2016 16:00:00 GMT

IBM, Netflix, Microsoft, and leading community experts to showcase the current and future of Node.js

SAN FRANCISCO, September 12, 2016 — The Node.js Foundation, a community-led and industry-backed consortium to advance the development of the Node.js platform, today announced the keynotes and agenda for Node.js Interactive North America, November 29 - December 2, 2016, in Austin, TX. The event attracts enterprise users, developers, and community stakeholders, providing them with the tools and training they need to optimize the Node.js platform.

With almost 5 million users a month and adoption across numerous industries, Node.js is a universal platform for web applications, IoT, enterprise application development, and microservice architectures. Its liberal contribution policies have also allowed the platform to increase the number of contributors working on the project by a sustained 100% year-over-year growth for the last several years.

Node.js Interactive offers a unique mix of skill-building and knowledge-sharing sessions, panels, and workshops to help developers accelerate their use of Node.js. It is the only vendor-neutral event that offers the community better insight into Node.js and its working groups, combined with best practices and instruction on how to improve performance, debugging, security, and tooling for mainstream enterprise users.

The event is designed to appeal to both experienced and new developers and architects with a NodeSchool event happening during the conferences. Additionally, NodeTogether, a beginner tutorial event that also aims to improve diversity within the Node.js community, is holding a special teachers training at the event.

“Node.js has clearly become a high-priority platform for digital transformation. Node.js Interactive will have a roster of expert technical and community speakers who will discuss the future of Node.js and new growth in areas like artificial intelligence, cloud native architectures, container-packaged applications and more,” said Mikeal Rogers, community manager of the Node.js Foundation.

Keynotes for the conference will provide an update and future look at Node.js and its growing ecosystem of related modules. A sampling of keynotes includes:

“The Road Forward on Education and Diversity” - Tracy Hinds of the Node.js Foundation and Emily Rose of Salesforce
“npm State of the Union” - Ashley Williams of npm
“Node.js State of the Union” - Rod Vagg of NodeSource and Technical Steering Committee Director of Node.js Foundation
“Express State of the Union” - Doug Wilson, Express lead maintainer

Experts from the leading open source projects and enterprises will share their expertise with Node.js and JavaScript in areas ranging from artificial intelligence to full stack development. Highlights include:

Node.js Everywhere

“Node.js Releases, How Do They Work?” - Myles Borins of IBM
“Slaying Monoliths with Docker and Node.js” - Yunong Xiao of Netflix
“Instrumentation and Tracing in Node.js” - Thomas Watson of Opbeat
“Surviving Web Security Using Node.js” - Gergely Nemeth of RisingStack
“Writing Secure Node Code: Understanding and Avoiding the Most Common Node.js Security Mistakes” - Guy Podjarny of Snyk

Cloud and Back End

“Hitchhiker’s Guide to ‘Serverless’ Javascript” - Steven Faulkner of Bustle
“Making Magic in the Cloud with Node.js at Google” - Justin Beckwith of Google
“Buzzword Bingo: Architecting a Cloud-Native Internet Time Machine” - Ross Kukulinski of NodeSource

Diagnosing, Debugging, and DevOps

“Building and Shipping Node.js Apps with Docker” - Mano Marks of Docker
“The Morality of Code” - Glen Goodwin of SAS Institute, Inc.

Machine Learning, Big Data, Artificial Intelligence

“Real-Time Machine Learning with Node.js” - Phillip Burckhardt of Carnegie Mellon University
“Math in V8 is Broken and How We Can Fix It” - Athan Reines of Fourier

Node.js Core

“Contributing to Node.js: Coding Not Required” - William Kapke of Kap Co, LLC
“A Beginner’s Guide To Reading Node.js Core Source” - Rich Trott of University of California, San Francisco
“Node.js and ChakraCore” - Arunesh Chandra of Microsoft
“Implementing HTTP/2 for Node.js Core” - James Snell of IBM

The New Full Stack

“Serverless Front-End Deployments using npm” - Charlie Robbins of GoDaddy
“API Design Through the Lens of Photography” - Bryan Hughes of Microsoft
“JavaScript will Let Your Site Work without JavaScript” - Sarah Meyer of Buzzfeed
“Nodifying the Enterprise” - Shweta Sharma from To The New
“Full Stack Testing with Node.js” - Stacy Kirk of Quality Works

IoT

“IoT & Developer Happiness” - Emily Rose of Salesforce
“Taking on Genetically Evolving Cellular Automata with JavaScript” - Irina Shestak of Small Media Foundation

Operations and Performance

“Scaling State” - Matteo Collina of nearForm
“Don't Let Just Node.js Take the Blame!” - Daniel Khan of Dynatrace

Workshops

“Games as Conversational Interfaces” - Kevin Zurawel of Braintree
“Agile Security for Web Developers” - Kim Carter of BinaryMist
“Science Meets Industry: Online Behavioral Experiments with nodeGame” - Stefano Balietti of Northeastern University
“Building Desktop Applications With Node.js Using Electron” - Steve Kinney of Turing School of Software and Design

Free onsite childcare for attendees is available as well as ASL, interpretation and transcription assistance upon request. Please email events@node.js for more information.

Node.js Interactive is made possible by support from Platinum Sponsors IBM and Google Cloud Platform; Gold Sponsors nearForm and NodeSource; Silver Sponsors GoDaddy, Langa, Opbeat, Rollbar, and Sauce Labs; and Bronze Sponsors Codiscope, Sqreen, and Stormpath. If you are interested in sponsoring please contact Todd Benzies at tbenzies@linuxfoundation.org.

For attendees who register before November 14, the standard registration fee is $600; registration increases to $800 after November 14. Visit here to register.

About the Node.js Foundation

Node.js is used by tens of thousands of organizations in more than 200 countries and amasses more than 4.5 million active users per month. It is the runtime of choice for high-performance, low latency applications, powering everything from enterprise applications, robots, API engines, cloud stacks, and mobile websites.

The Foundation is made up of a diverse group of companies including Platinum members IBM, Intel, Joyent, Microsoft, PayPal, and Red Hat. Gold members include GoDaddy and NodeSource, and Silver members include Apigee, AppDynamics, Cars.com, Codefresh, DigitalOcean, Dynatrace, Fidelity, Google, Groupon, nearForm, New Relic, npm, Opbeat, RisingStack, Sauce Labs, SAP, StrongLoop (an IBM company), Sphinx, YLD, and Yahoo!. Get involved here: https://nodejs.org.

Media Contact

Zibby Keaton Node.js Foundation zkeaton@linuxfoundation.org

Node.js Blog

Node v7.1.0 (Current)

Notable changes

Commits

SHASUMS

Node v4.6.2 (LTS)

Notable Changes

Commits

SHASUMS

Weekly Update - November 4th, 2016

Node v7.1.0 proposal

Community Updates

Upcoming Events

Weekly Update - October 28th, 2016

Node v7.0.0 (Current)

Community Updates

Upcoming Events

Node v7.0.0 (Current)

Notable changes

Commits

SHASUMS

Node v6.9.1 (LTS)

Notable changes

Commits

Node v6.9.0 (LTS)

A New LTS Release Line

LTS Migration

Node.js v6.9.0 LTS "Boron"

Notable changes

Commits

SHASUMS

Node v4.6.1 (LTS)

Notable Changes

Commits

SHASUMS

Node v0.10.48 (Maintenance)

Notable changes

Commits

SHASUMS

Node v0.12.17 (Maintenance)

Notable changes:

Commits:

October security releases and v6 LTS "Boron" security inclusions

(Update 18-October-2016) Releases available

Node.js v6 LTS security inclusions

CVE-2016-5180 "ares_create_query single byte out of buffer write"

Node v6.8.1 (Current)

Notable changes

Commits

Node v6.8.0 (Current)

Notable changes

Commits

Node v6.7.0 (Current)

Notable changes

Commits

Node v4.6.0 (LTS)

Notable Changes

Commits

Node v0.12.16 (Maintenance)

Notable changes:

Commits:

Node v0.10.47 (Maintenance)

Notable changes:

Commits:

Security updates for all active release lines, September 2016

(Update 27-September-2016) Releases available

Node.js-specific security flaws

CVE-2016-7099: Wildcard certificates not properly validated

CVE-2016-5325: reason argument in ServerResponse#writeHead() not properly validated

Remove support for loading dynamic third-party engine modules

Downloads

Node.js-specific security flaws

September OpenSSL Releases

CVE-2016-6304: OCSP Status Request extension unbounded memory growth

CVE-2016-6305: SSL_peek() hang on empty record

CVE-2016-2183: SWEET32 Mitigation

CVE-2016-6303: OOB write in MDC2_Update()

CVE-2016-6302: Malformed SHA512 ticket DoS

CVE-2016-2182: OOB write in BN_bn2dec()

CVE-2016-2180: OOB read in TS_OBJ_print_bio()

CVE-2016-5325: `reason` argument in `ServerResponse#writeHead()` not properly validated