• Joao Reis
• Julien Gilli
• Michael Dawson
• Steven Loomis

Discussions

Upcoming releases

node v0.10.39

Julien: What's left to do: I suggest to revert https://github.com/joyent/node/pull/25511.

Michael: We have another security release with logjam fixes scheduled for v0.12, so that's ok with me to move that until next couple of v0.10/v0.12 releases.

Julien: I might have time to start the release process for v0.10.29 today. Once v0.10 is released, I can move on to releasing v0.12.5.

node v0.12.5

Julien: We have a PR to upgrade npm to 2.11.2. It seems to be a small change from the current version, so I would advocate for landing that now.

Michael: Playing devil's advocate: would it delay the OpenSSL upgrade? If so, then we could postpone it to 0.12.6. If the risk is low, and it's fairly quick to land it, I'm ok with that.

Julien: Breaking changes for v0.12: the OpenSSL upgrade prevents TLS clients to connect to servers that use DH params with keys that are too short to be safe.

Michael: Yes, and deferring the change to prevent servers to use shorter keys until next release.

Moving this weekly call to the LTS WG call

Julien: We have a new doodle to try to come up with the best time slot to have these meetings, please fill it out if you haven't yet.

Having more than one person managing releases

Julien: having only one person who manage releases is not sustainable, I would like to have a team of release managers for v0.10.x and v0.12.x releases, and future LTS releases.

Julien: I've made some good progress on documenting the release process and improving some of the build scripts and Jenkins jobs to make them usable by other people than me. Hopefully that will be ready not too long from now.

Julien: In the meantime, I'd like to raise that to the broader LTS group and see who would be interested in being a release manager.

Steven: I have some experience with releases in the ICU project and other open source projects, so I can definitely help, even to review and give feedback on the release process.

Julien: I'll create an issue in nodejs/LTS to gather initial feedback and see who could be interested.

Deprecation of shorter keys in DH param server side

Michael: The OpenSSL upgrade to 1.0.1o prevents clients from connecting to servers using DH parameters that have a key that is too small to be safe. We should deprecate passing DH params that are unsafe when creating TLS servers too. I suggested some changes to do that on GitHub, could you please provide feedback on these changes?

Transition from v0.12 to next converged LTS release

Michael: Julien started documenting breaking changes between v0.12.x and what's currently in the converged repository. Julien, is there any way we can help?

Julien: Documenting the changes is really the first step. What I need from you and other members of the LTS working group is to review this list and give feedback. Once we're confident that we have an accurate list of breaking changes, the next step is to reach out to various user communities and determine what we need to do to make the transition as smooth as possible.

Michael: It seems that there were some productive discussions during Nodeconf about requirements from users regarding LTS releases.

Julien: Yes, and there are other additional ways we can reach out to the broader community: leveraging the Node.js Advisory Board, reaching out to Joyent's Node.js Incubator participants, the broader community on GitHub, etc. We will need some coordination between a lot of entities within the Node.js project.

Michael: I would suggest reaching out to nan maintainers to identify V8 breaking changes that would be handled by nan.

Julien: Sounds like a good idea!

Michael: Maybe instead of commenting in an existing issue, Julien could create new issue on GitHub to get more attention with all details that he mentioned.

Julien: agreed.

Julien: One other thing that I'd like to use to make the transition even smoother is release candidates. I had started some work around that a while ago and unfortunately I haven't had the time to continue working on it. I think that Rod Vagg did some work around that for io.js and it might be ready there. Anyway, having release candidates for the next cycle of LTS releases would probably make things easier.

Michael: Definitely, this is a broader topic for the LTS working group that we should probably even consider separately.

• Julien Gilli
• Alexis Campailla
• Michael Dawson
• Colin Ihrig

Agenda

• Logjam/openssl upgrade
• Upgrade of libuv to 1.6.1
• First draft of breaking changes between io.js/Node 0.12
• Windows Installer Changes

Minutes

Logjam/openssl upgrade

Michael: Expect OpenSSL upgrade imminently. Just drop support for smaller size. Do we expect that to break users?

Michael: should also consider including:

• https://github.com/nodejs/node/pull/1739
• https://github.com/nodejs/node/pull/1831
• https://github.com/joyent/node/issues/25366 (checked and docs for io.js indicate modp1 is still there)

Michael: Stewart on my team has volunteered to create a PR against Node.js to upgrade OpenSSL.

Libuv upgrade to 1.6.1

Julien: Libuv PR, fixes annoying issue on OSX 10. Worth reviewing soon.

Colin: PR already landed in io.js

Julien: top priority to review that ABI/API hasn.t changed in a breaking way.

Julien: Julien to try and review today, likely to be included in release for openssl upgrade

Breaking changes between io.js and Node 0.12.X

First draft of doc of breaking changes between 0.12 and next LTS.

Julien: https://github.com/nodejs/node/wiki/Breaking-changes-between-v0.12-and-next-LTS-release

Based on io.js issue tracker, joyent\node backport commit log. v8 breaking changes from release notes (?)

Please review and comment on issue.

Debug port issues

Colin working to fix https://github.com/nodejs/node/pull/1949 - new debug port for each worker.

Windows installer changes

Alexis: https://github.com/joyent/node/issues/5849 - currently a hybrid/broken, will submit PR to do full install for all users, to be added to next milestone

https://github.com/joyent/node/issues/25087, same upgrade code used for 32/64 bit which is not good practice. Can result in binaries from one (32/64) being put into the other. Will move to use 2 upgrade codes, but this will break upgrade. Going to add manual action to check for old code and give message saying you cannot upgrade and that you should un-install and install again

• Colin Ihrig
• James Snell
• Julien Gilli
• Michael Dawson

Discussions

Weekly calls

Julien: Do we want to keep doing weekly calls with the current contributors to joyent/node, or should all discussions be moved to the combined Node.js TSC meeting?

James: Still has value in the short term. Maybe have them not every week but when needed?

Michael: Maybe part of the LTS working group?

Colin: Need to make sure we bring joyent/node issues to the combined TSC call, during the last two calls we had no discussions around joyent/node.

Julien: For instance adding collaborators from io.js to joyent/node is a topic that I'd like to discuss in the combined call.

Michael: Actually another topic could be this very discussion that we have now about transitioning this weekly call into the LTS working group call.

Action item: propose during next combined TSC call that this weekly call be transitioned to the LTS working group call.

Upgrade to libuv 1.6.0

Julien: the issue with OSX and tty is not severe to me. It's been present since v0.11.12, happens on OSX only and is specific to TTY handling.

Michael: It seems that there's no need to rush the next v0.12.x release for this particular issue, we should aim at including the fix in the next one when it's ready.

James, Colin, Julien: agreed.

Security report from HP

Julien: HP recently sent a security report mentioning potential security issues, but all of them seem to be false positives. Currently finishing investigations to be sure of that and communicating with them.

RC4 deprecation fixes

Julien: Did another round of review and we're making progress. James will be on vacation for the next 2 weeks so I'll do my best to take it from there. We'll revert what's landed in v0.10 so far to prevent this from holding back other changes, and submit a new single PR that contains all changes so that there's only one place to comment.

Michael: If you need help with this just let us know.

• Alexis Campailla
• James Snell
• Julien Gilli
• Michael Dawson

Upcoming releases

v0.12.4

Looking to do a 0.12.4 release soon, end of this week or early next week to address:

• breaking v8 change https://github.com/joyent/node/issues/25324 - have PR ready
• Windows XP issues, have pull request from io.js, ready to pull over

James also has RC4/Bar Mitzvah fix ready to go back in as well

If time permits Alexis will do more investigation to identify what caused the XP issue

npm testing

Michael: update to npm 2.8.4 broke our test-npm target. PR to fix is here: https://github.com/joyent/node/issues/25290. Previously you could run tests without install but now install is required or tests don't run.

Julien: we shoul talk with npm team on how to make sure the best way to run the tests

Action: Michael to follow up with Forrest Norvell to discuss

LTS

James: Some concern over moving directly to next LTS based on converged repo, we may need to allow for a 0.14.X

After discussion we agreed that we need to provide more information so that people have a better idea of what will be changing and the impact. More specifically:

• gather list of breaking changes that will be in converged repo so that we can document and better communicate what will be different

• reach out broadly to users to gather input on what their specific concerns might be in terms of an LTS release, including timing, content etc.

Overall we want to figure out what the right answer is and be open to that alternative.

Action: James will push on these 2 aspects.

Deprecation

There was some discussion about how a platform would be deprecated. One suggestion was that for platforms that no longer have vendor support (ex Windows XP) we would deprecate. It might also be appropriate for non-core platforms if there is nobody actively maintaining them. It is a relatively complex issue so Alexis will open an issue on github (in the LTS repo) to discuss.

Logjam

https://weakdh.org/

James/Julien had run tools provided in report against Node 0.10.X and 0.12.X and they don't report an issue so its only the second part which applies. This is related to allowing short key lengths. There are already some patches in io.js that may be pulled across although we likely would want a fallback option that they may not contain. Based on the report we want to move this forward but its not urgent.

• Alexis Campailla
• Colin Ihrig
• James Snell
• Julien Gilli
• Michael Dawson
• Robert Kowalski

Discussions

Upcoming releases: v0.12.3 and v0.10.39

Julien: We should release 0.10.39 and 0.12.3 next week. A few important issues affecting many users.

npm upgrade to 2.8.4

Julien: Current npm version (2.7.4) is broken for a lot of users. npm 2.8.4 fixes a lot of issues. The reason why we didn't catch it, the current makefile doesn't trigger an error if you don't have CouchDB installed. It just gives a warning, that's easy to miss.

Going to open a PR to make sure we catch these issues.

Michael: Made some progress on Jenkins job that runs npm tests. Currently passes only on OSX. I'll keep working on it.

Julien: CouchDB is the server for the npm registry. There are some tests that perform requests to CouchDB. If not installed, the tests don't run. CouchDB needs to be installed on each of the Jenkins machines.

Latest libuv release (1.5.0)

Julien: Will review changes to see if there are any important fixes, or changes to the API/ABI, to determine if we want this in the next release.

Other PRs for the upcoming release

Julien: Identified 5 different PRs that we could land before the release. Most of them already reviewed, we can land them pretty soon. https://github.com/joyent/node/pull/8875 https://github.com/joyent/node/pull/9448 https://github.com/joyent/node/issues/25137 https://github.com/joyent/node/pull/25100 https://github.com/joyent/node/pull/14193

Another issue was with inconsistency of styles of invocations of makeCallback. Trevor working on it. Might not make it for the next 0.12 release.

RC4 deprecation

James, Julien: Need to address the problem if cyphers is undefined or null. Need to do a last pass on the pull request, to review tests/documentation. If we can nail this by end of week, we could make the next release next Tuesday. If we can't land the RC4 fixes, maybe we should revert the existing fixes for now. And do the release. And make the RC4 fixes in the next release.

James: we should be able to finish the work this week. If delayed just a day, we'll wait.

More release discussions

Alexis: motivation for urgency?

Julien:

• v8 lateral upgrade. A lot of impact on users. https://github.com/joyent/node/pull/18206
• Fixes on freeBSD https://github.com/joyent/node/pull/14819 https://github.com/joyent/node/issues/8540

Colin: can we land this too? https://github.com/joyent/node/pull/9159

Michael: Christian is away for a couple weeks. I will need to take over one of the PRs on the list.

Julien: try to sprint until Friday. We only want to land stuff that meets the usual quality bar.

James: once RC4 issues are fixed in 0.12, we should be able to land them in 0.10.39.

Julien: start in 0.10.39, then port to 0.12.

Julien: Alexis, your PR should be added to to the 0.10.39 milestone. https://github.com/joyent/node/pull/25100

Julien: For 10.39, there's also a fix for timers: https://github.com/joyent/node/pull/17203 First fix was already reviewed. Then I submitted a simpler fix. Looking for a second review. It shouldn't hold up the release, but it should be pretty safe and it fixes some annoying issues.

Flaky tests support

Alexis: io.js removed support for flaky tests. https://github.com/nodejs/node/pull/812 It looks like this issue might be slightly controversial. I am guessing they thought it was a mechanism for ignoring test failures in general, while it is only meant to support the automatic merge in node-accept-pull-request.

Julien: In io.js they run CI to test every pull request, but they do the merge manually. io.js folks mentioned not been able to change the commit message as a downside of node-accept-pull-request.

Let's communicate why it's useful. We should definitely log issues for flaky tests.

Colin: how about policy for removing the test out of flaky -say- after a week? Somebody has to fix it. Or it should be deleted from the tests.

Alexis, Julien: The moment we mark a test as flaky, we should open an issue and treat it as high priority.

Node.js API working group

Alexis: there was a request for participation in this working group. Do you know more about the charter of this working group?

Julien: Dan Shaw has been trying to get together a group people for a standard on what an official Node.js API is. Maybe to enable people to implement another runtime that is compatible with Node.

Is the working group about the external or the internal API?

James to seek more clarifications on the email thread.

Convergence process

Alexis: in anticipation of the convergence work, where should we make changes? Node, io, and/or convergence repo?

James: when we do our next major release, is it going to be based on the convergence repo? If so, that's where we should be landing the new features.

Michael: But it won't be in stable working conditions for a while. So until we get the CI, we still do it in Node.

If we make a change in joyent/node master, we can also port it to the convergence repo.

Colin: what if we started cherry picking stuff to io.js?

James: that works too.

Julien: still a lot users of 0.12

James: are we going to cut new releases from joyent\node master?

Julien: not a lot of work in master at this time.

Julien: Still waiting for io.js to vote on whether they want to merge.

James: possible alternate routes. If they choose not to come into the foundation, we can still fork io.js and use it as our own converged stream. We still need to give it some thought.

Michael: agree with Julien on deferring until io.js decision takes place.

Triaging issues:

Julien: how to do a better job at triaging issues coming in on github. 948 issues open. A lot more coming in. Hard to triage them all, let alone fix them. Could we spend a little time every day to review the issues?

Michael: schedule a slot to do everything together.

Robert: using this process in CouchDB with very good results.

Robert: we are using Jira.

Alexis: increase the bandwidth by doing it in smaller groups or individually?

Julien: good team exercise to do it together.

Robert: let's just try it for a few weeks and see how it goes.

Julien: schedule something just to try it out, see if it works.

Everybody: ok :)

Alexis: we'll need to find a way to use github effectively.

Michael: I assume we can invite other people too.

Julien: it's also a good way to onboard additional contributors.

Schedule first meeting with existing collaborators. And if it works, we can extend it to more collaborators.

Julien: any volunteers to lead this? If not I'll do it.

Julien: maybe we can use Slack?

Alexis: I vote for slack.

Colin: +1 for Slack.

• Colin Ihrig.
• James Snell.
• Julien Gilli.
• Michael Dawson.
• Steven Loomis.
• Trevor Norris.
• Wyatt Preul.

Discussions

Upcoming releases

0.10.39

Fixes to the bar mitzvah attacks

James: Will update recent ciphers list changes with some fixes.

Julien: Will review as soon as possible.

TLS default ciphers not used if ciphers null or undefined

Julien: See https://github.com/joyent/node/pull/23947. This must probably be considered before releasing the other changes to the default ciphers lists that have already landed in v0.10.

Timer fixes

Julien: Current PR here: https://github.com/joyent/node/pull/17203.

Julien: Need more feedback on whether to land this in v0.10.39. Recent changes to the timers module broke a lot of users in the past few v0.10.x releases, so we definitely need to be careful. This one seems safer than the previous ones though.

v0.12.3

V8 lateral upgrade and other V8 fixes

Julien: https://github.com/joyent/node/pull/18206 landed, as well as the floating patch to fix let bindings in for loops (https://github.com/joyent/node/pull/23948).

Upgrade npm to 2.8.4

Julien: There's a PR from Forrest that upgrades to npm 2.8.4. It fixes some significant issues (including security issues). We will want to include an upgraded version of npm with the next v0.12 release. Will review this PR and land if tests pass and that version is still what makes sense.

Michael: We could probably create a Jenkins job to run the test-npm make target.

net/HTTP servers with implicit binding to IPv6 addresses

Colin: This issue was reported a while ago, and we probably need to make a decision about it sooner than later: https://github.com/joyent/node/issues/9195.

James: I would suggest updating the docs in 0.12, and wait to have more input to maybe make a change in behavior on master.

Colin and ALL: agreed.

Convergence plan

James: Initial convergance plan: https://github.com/jasnell/dev-policy/pull/66.

James: nothing set in stone. Current plan:

• io.js organization transfered to nodejs organization. Will keep everything they've already setup.
• joyent/node and other joyent/node-related repos will also be transfered to this organization.
• Both joyent/node and iojs/iojs repos would be under the foundation.
• For the converged repo, a fork of iojs repo would be created.
• New repo would be the next major release.

James: Details for LTS policies still need to be figured out.

James: Next work will be focused on the CI infrastructure.

James: most importantly, need to agree that the merging process will be io.js forked and picking changes from joyent/node.

James: Will also need to catalog other resources like twitter handles, domain names, etc.

Action Item: Julien to send James the list of assets used by the current CI platform.

Intl

James: io.js not OK with current intl support in v0.12 due to lack of modularity and issues around new command line switches.

James: Putting together a plan that would make sense so that we can track that refactoring. Would be targeted to 0.13, and would make it more palatable for the io.js team.

Steven: Concerns around the data size, confident that this proposal will improve the user experience.

Steven: What it doesn't address is splitting the data in micro pieces. Not convinced by the use case for that, especially due to the amount of work required.

James: In discussions witb Bert and others to know what the use cases are for the modularity.

Michael: On board with being able to install data from npm, but not sure what the

Steven: Two different types of usage: desktop of server. ICU point of view is to support user's language on the desktop and whatever comes on the wire in the server model.

James, Steven: Working group about i18n will likely be created in the Node.js foundation, more discussions about that in upcoming convergence meetings.

• Alexis Campailla
• James Snell
• Julien Gilli
• Michael Dawson
• Steven Loomis
• TJ Fontaine
• Colin Ihrig

Upcoming releases

v0.10.39

Discussion around removal of RC4 to address Bar Mitzva attack. Progress being made, need to update to clarify precedence of command line options (https://github.com/joyent/node/pull/19148), update code/tests to match this descripton (James), finalize release notes (Julien with input from all) and then do one final review before release (all). Important that we add tests to make sure merge with 0.12.X can be easily validated.

v0.12.3

Same discussion of removal of RC4 to address Bar Mitzva attack. Just need to do commits in a way that facilitates merge from 0.10.X later

Julien: looking at completing V8 lateral upgrade. Will be v0.12.3 unless removal of RC4 is ready before it is.

Internationalization

James: io.js looking at Globalize as an alternative, because they would like it to be more modular in terms of how features (like collation)/languages get pulled in.

If the two code bases are merged not including ICU would be a forced break. Current understanding is that merged code base would be everything from both code bases.
If instead individual pieces are not going to be included then likely convergence working group would need to build list to cover these pieces and work through an appropriate approach to deal with each one.

In advance, we should start looking to see if we can make the inclusion of ICU more modular in a non breaking way. Action: Michael to setup meeting with Steven/James to better understand dependencies between startup and V8 with respect to ICU.

Windows Build Issues

Alexis working on PR to fix some windows build issues, will do review on PR

JxCore

Michael/James talked to JxCore team to see if the C API that they have for separating core from Javascript engine and multi-isolate support might be starting point for Node. JxCore team seems interested in collaborating. Next logical step likely to form working group in Foundation to cover these two.

TJ: We should also be looking at formalizing the internal layer (for example TCPWrap) as part of introducing the required separation.

Dev Policy

James: looking to add some representation for user requirements. Proposed a working group, alternative may be an evolution of the advisory board into that role.

• Alexis Campailla
• Colin Ihrig
• Julien Gilli
• Michael Dawson
• TJ Fontaine
• Steven R. Loomis (scribe)

Discussions

Releases

v0.12.3

JGI: some progress , still slow. On v8 upgrade #9185, made progress, trevor is working on until next week. Additional patches all in the comments. Help wanted to finish v8 integration.

Profiler

JGI: #14576 An issue - profiler causing v8 to stall?

FreeBSD flag

JGI: #8540 - FreeBSD flag. Input needed. The parameter is exposed to JS.

JGI: finishing other P-1 issues before release.

Other discussions

Bar Mitzvah

JGI: #15445 - Bar Mitzvah issue - 2 questions, feedback needed:

• Need to be able to get prior (insecure) behavior back if needed.
• How best to name the option?

MD: Don't want to do this in perpetuity - RC4. Expand documentation.

SRL: Should it be named 'enable-insecure'?

JGI: Always possible for users to specify custom cipher lists.

TJ: Balance between platform users and application users.

JGI: Need to get the main scenarios, come up with use cases first.

MD: This is a tempoary fix, most people (hopefully) are using defaults.

TJ: This setting is used more in minor versions, when people are bringing up [some version of an] app.

Wrong checksum for node v0.12.2

JGI: This issue will be investigated.

Leap Second

SRL: Existing issue: #9382

SRL: Probably can do more testing.

TJ / JGI: - did a test suitewith faketime. That may not work on windows.

TJ: "no known issues" - some may want more documentation.

TJ: Blog post, link to documentation/faq.

TJ/AC: Clock used on windows for 0.10 is less precise but still monotonic.

MD: Google response on v8 - "thats a good question".

TJ: This should be first class documentation.

Action: SRL to open a new ticket. Document that Date.now != how timers work. (in doc/timers).

Documentation of OpenSSL upgrades

JGI: Need to document openssl upgrades:

• Upgrades can be confusing
• Often these upgrades are done in 'less than ideal' situations (pressure to fix a critical issue).

Documenting how to upgrade v8

James and Julien are working on docs of how to do the update,. Missing some of the history, but at least it can be well understood. Ideally anyone on the team or community can understand how it is done.

TJ: no specific home for this doc, in the wiki right now (link)

JGI: Current state of the documentation may not include all floating patches.

TJ: docs should live in the code eventually. JGI: may take another form.

Action: SRL: document how to upgrade ICU.

Joint node.js/io.js meetings

CI: joint TC call.

ALL: People don't want extra meetings - may be a little disorganized.

TJ: - hard but necessary -- there's a lot of work to do around merging two projects:

• Need to work together to maintain stable release (LTS/platform etc) has to be comfortable integrating into the entire project.
• Innovation + ideals of LTS working group. Required amount of tension.
• Hopefully good agendas.

SRL: More of a concatenation than a merge. agenda and time management will become critical.

TJ: Needs time management - "we have 5 minutes to discuss this".

ALL: Proposed time is "Wednesday and it has been 1pm-2pm pacific since PDT kicked in (it was noon-1 before that)."

ALL: This time seemed good.

SRL: Formal scheduling of agenda items?

TJ: Yes, people should propose a time length when items come in.

JGI: Two goals - 1. identify divergence, and 2. get used to other members.

JGI: Maybe 15 minutes joint meeting, then individual meetings if needed.

Call for help triaging incoming bugs

JGI: Help wanted triaging incoming bugs.

Crash from command line (Intl)

SRL: investigating crash from command line #9361.

• Alexis Campailla
• Colin Ihrig
• Julien Gilli
• James Snell
• Michael Dawson
• TJ Fontaine

Discussions

Agenda

• RC4 vulnerability.
• v0.12.3 status.
• dev policy sync before meeting.

RC4 vulnerability

We want to iterate a few more times before we release.

James has a new set of PRs for review.

Julien ran the ssl upgrade test, and found a potential security issue.

There is an additional note for getLegacyCiphers, throwing for an unknown string.

How do we want to release this? Is it separate, or should we include it along with a blog post and documentation about the changes?

IBM security identified it as being important enough to have a fix.

Are we doing our normal v0.12.3 gestation, or are we doing a v0.12.2 with only this fix?

io.js updated their defaults a month ago.

Continue conversation on email and make a decision on the release for Monday.

This particular issue should be handled for v0.10.39, but for v0.12.3 we include what has been already landed.

Potential Security Issue:

• Julien will send an email to security@ with a description for a discussion.
• Validate the concerns of this issue and determine if it should be included with the RC4 fix.

IBM runs a lot of tests on multiple platforms for their releases, and the RC4 fixes for v0.10 have been internally validated.

James is looking at improving the SSL/TLS cipher test suite

v0.12.3

Not much has changed since last week, as many people were working on Foundation pieces.

Many of the P-1 issues can be easily managed once we have more time.

Are any small enough for inclusion before Monday.

A FreeBSD fix still needs more iteration.

Ideally we continue focusing on the RC4 and related security issues.

No one has indicated being blocked on others.

Release Candidate work

Julien submitted a PR to describe the policy.

Ideally running the release of v0.12.4 in this policy.

Some platform providers are not sure about the RC portion will be useful for them.

TJ would like to introduce the Yahoo team to Julien to see if they'd be interested in release candidates.

Also would be good to reach out to Forrest for npm mechanisms.

node-gyp still relies on the internet.

Windows MSI install

We should look to unify on install.py and the location.

Deployment on windows is particularly hard.

Compilers for production deployments is odd.

JXCore has an API/ABI shim and engine abstraction layer.

Development Policy

Meeting today at 12PM PDT.

Work between James and Mikeal on describing the iojs policy and adding in the things that the Node.js core team cares about.

Trying to walk the line and balance innovation and speed with stability.

The core team needs to provide feedback, before and during the meeting.

Convergence Working Group would merge the code bases between iojs and Node.js, in the mean time the projects would work independently.

The potential release number would be 2.0.0.

• Alexis Campailla
• Colin Ihrig
• James Snell
• Julien Gilli
• Michael Dawson
• Robert Kowalski
• TJ Fontaine
• Trevor Norris
• Wyatt Preul

Discussions

Foundation charter

TJ: We want to make sure that we're participating in this process.

TJ: Now could be a good time for everyone to talk about tools they know that would work well to help the work done by the foundation.

Benchmarks

Michael: We'd like to have tools to make sure there's no performance regression between releases.

Michael: We could use https://github.com/acmeair/acmeair, and there's a Node.js version: https://github.com/acmeair/acmeair-nodejs.

Michael: Have talked to maintainer of acme-air and they are willing to collaborate, we could also get them to give us an intro to the benchmark if that makes sense.

TJ: We also want a benchmark specifically for low-latency and high concurrency.

TJ: How do we want to start with that? Also should assess what we already have.

Michael: Might want to form a performance working group.

Michael: Good idea to reach out to io.js too.

TJ to forward to Michael contacts at Yahoo, Netflix and Paypal that might be interested in participating.

OOB OSX

v0.10.37 fixed an issue in kqueue regarding out of band data. The reporter never heard back from Apple, and no CVE has been assigned. Could lead to a DOS scenario.

Security issue in vm.js

TJ: Got an email about a user concerned about the fact that the parent of a sliced buffer can be traversed across VMs.

Trevor: this has been known for a while.

TJ: sandbox is a not a security context sandbox, but more a "programming sandbox".

TJ: In my opinion, mostly a documentation bug on our part.

Putting a link to IBM Node.js SDK on nodejs.org

TJ: I don't have any objection. What link would we use?

James: We have a landing page for this SDK for Node.js. Easiest thing would be to land to this page.

TJ: I want to avoid confusion if the versions are not in sync between the two projects.

James: We can make it clear on this landing page.

TJ: Can the additional debugging stuff be upstreamed?

Michael: We want to make that available, maybe via npm. Same for IDDE.

TJ: Would be great to have the additional debugging support in the code base too, so that people can load core files from z platforms and do debugging.

Releases

v0.10.38

Julien: Would be great to document how to upgrade OpenSSL.

James: Had an item in my todo list to do that.

Julien: We can team up to do that.

TJ: I would suggest to start shipping an alternate binary linked with shared dynamic libraries for libuv, OpenSSL, etc.

TJ: Might be difficult to do that for dependencies where we have floating patches.

v0.12.2

Julien: New P-1 issue added: debugger is very slow, takes 1 or 2 minutes to do basic operations, see https://github.com/joyent/node/issues/9125 for more information.

Trevor: There's a major issue with buffer (https://github.com/joyent/node/issues/9180) that causes asserts for a lot of users, can we get a v0.12.2 release asap with the current state of v0.12, and move everything else from the 0.12.2 milestone to 0.12.3?

Julien: We may also want to add an upgrade to npm 2.7.3 for this release.

Trevor: See also https://github.com/joyent/node/issues/14165.

No objection from anyone.

Tool for testing npm modules

James: Currently porting from Python to Node.js. Will put in a separate repo. Some issues regarding non-uniform tests output and additional npm dependencies.

Discussions with PM2 developers

TJ: Met recently with developers from PM2. Would like to have a discussion with them around potential improvements to the cluster module.

Crypto performance

James: Interested in getting some work to propose enhancements to crypto performance. What do you think about adding async mechanisms to crypto?

TJ: Could have a discussion of what we'd like as an async API. Could also broaden the discussion to a long term goal of having better TLS performance. That will be even more important with HTTP/2.

James: Can start the conversation with a proposal of improvements.

Website

TJ: We'll have a new single certificate with support for subdomains.

Robert: Need some feedback on https://github.com/joyent/node- website/issues/81.

Robert: Made changes to the license here: https://github.com/joyent/node- website/pull/93.

• Alexis Campailla
• James Snell
• Julien Gilli
• Michael Dawson
• Steven Loomis
• TJ Fontaine
• Trevor Norris

Discussion

New Openssl vulnerabilities reported today. Important but not a panic. Node uses openssl 1.0.1 and higher severity issues were reported against 1.0.2. James will create pull request and we'd like to see the update go out either Friday (torrow) or Monday.

We discussed different options and agreed that 0.10.38 will be the same as 0.10.37 plus the new openssl level and similarlty 0.12.1 will be the same as 0.12.0 plus the new openssl level.

There was some discussion about including the changes that have gone into the existing 0.12.1 branch but we agreed it was best not to do this.

Upcoming releases

v0.10.38

Only discussion was related to openssl issue as covered above.

v0.12.1

Trevor: still having some issues with building on BSD 10.1. TJ is going to have a look at it to see if he can help out.

Libuv upgrade, should be ready just need to run accept job to pull it in.

Michael raised issue 9439 which covers a patch to v8 to bring profiling for 0.12.X back up to the level of 0.10.X. TJ identified that the next steps for 0.12.2 are:

• Libuv update.
• Lateral V8 change.
• floating patches for v8.
• Look at adding the floating patch for 9439.

Update on workflow/issues management proposal

Julien: We will roll this out in stages over the new few weeks. At this point we should be using the node-accept-pull-request jenkins jobs to accept/validate pull requests. Julien will add to node websites the parts we are putting into use. Next to be added is nomination for milestones which we'll probably start using in a couple of weeks.

General

Next V8 upgrade

Michael asked about how we'd choose the next V8 version. TJ confirmed it would most likely be the current stable V8 level when 0.13/0.14 get started, however there are issues around the toolset needed to support the latest V8 releases and how we can maintain support for older OS levels might affect this.

ICU crash - Issue 9361

Fix for this is already integrated in a later V8 version. Steven Loomis is looking at this and there is a pull request ready to backport the existing fix. There was some discussion about the best approach and in the end we agreed the existing fix is appropriate and we should just backport it to 0.12.2.

Testing release candidates

Julien is talking with some groups about doing some pre-release testing on release candidates. TJ suggested we should ask for volunteers on the blog or twitter. It will need to be a full blown release candiate due to gyp dependencies etc. Julien will write up a proposal.

Tooling around issues/PR triaging

There was some discussion about whether GitHub is the best tooling, in general more investigation/discussion is required before doing anything.

• Alexis Campailla
• Julien Gilli
• Michael Dawson
• Steven Loomis
• TJ Fontaine
• Trevor Norris

Discussion

Upcoming releases

v0.10.37

Julien: All binaries, files and tarballs are available at https://nodejs.org/dist/v0.10.37. I'm currently coordinating with people from Heroku and New Relic to have it tested. Once I hear back from them, we can make the announcement.

TJ: It would be great to have a channel where we announce release candidates, and have other people willing to test them subscribe to it.

Michael: Once we know there are binaries we can put that into our testing queue.

Alexis: Microsoft doesn't have additional tests besides the ones that already run on Jenkins.

TJ: We should write a proposal for an improved release workflow.

v0.12.1

libuv upgrade to 1.4.0

Julien: Discussion around floating patches on top of 1.4.0 or waiting for 1.5.0 to float less patches.

TJ,Trevor: Upgrade to the latest 1.4.x, float patches and rerun the tests.

Trevor: We should probably make sure to integrate https://github.com/joyent/node/issues/9342.

V8 "lateral" upgrade

Trevor: Almost there.

Various V8 bugs

TJ: It would be great to track down current V8 bugs with people who have experience with codegen in V8.

Michael: We can probably work on that.

ICU related issues

Steven: Looking into doing an npm based install of full-ICU data.

FreeBSD crash

TJ will provision a FreeBSD server for Trevor to take a look at this issue.

Other issues

Michael: https://github.com/joyent/node/issues/9317, I will create a PR for that.

Michael: https://github.com/joyent/node/issues/9334, I'll take a look at the comments.

VM module

TJ: VM module leaks a lot of memory, basically never frees any resource.

Port of V8 to Power and other IBM architectures

Michael: We are well into our testing cycle for v0.12.0 on power.

Floating patches on top of V8

Michael: How open are we to floating patches on V8? For instance, issue with profiler performance.

Steven: Also https://code.google.com/p/v8/issues/detail?id=3348.

TJ: We're going to have more scenarios where we need to float patches. We need a way to manage a queue of patches (e.g quilt). Long term solution: have a vanilla V8 in tree and a queue of patches.

Alexis: Other way is to fork repositories, didn't have time to write the proposal I talked about last time, but will do as soon as possible.

TJ: Problem with having our own forks is not every dependency uses Git.

Leap second

Steven: started an FAQ on leap seconds: https://gist.github.com/srl295/e74710ae42e8d13b96e7.

TJ: Does faketime have a way to "simulate leap seconds"?

Julien: I don't think so, but it's worth taking a look.

TJ: Maybe Steven you could use that to run tests regarding leap seconds.

TJ: libuv uses monotonic time for all its operations. In node, the last remaining place where we were using wall clock has been fixed in 0.10.30 or 0.10.31.

Trevor: libuv uses epoll_wait, does it use monotonic/hrtime on all systems?

TJ: Generally yes.

Alexis: On Windows, for node v0.12 yes, for node v0.10 no.

Alexis: We can backport the hrtime fix for v0.10.

Michael: OpenSSL, c-ares and npm seem to use wall clock (gettimeofday).

TJ: Apparently c-ares uses gettimeofday only if it can't use a clock monotonic.

Alexis, Steven: Potential issues with leap seconds: negative time difference, minutes taking more than 60 seconds.

Julien: OpenSSL might be using wall clock not for comparing dates/times, but for instance for inserting dates into certificates.

TJ: To conclude, largest concern is backporting hrtime fix to v0.10 on windows.

Steven: Would be great to have a statement from V8 and OpenSSL.

Governance proposal

TJ: I want to make sure that everyone can give feedback, so please reach out to me if you'd like to talk about it.

Steven, Michael: Could be useful to have a separate meeting soon to discuss that.

TJ: Will find a time slot that works for everyone soon.

Update on workflow/issues management proposal

Julien: Still gathering feedback from other projects, goal is to start using it starting next week.

• Alexis Campailla
• James Snell
• Michael Dawson
• Julien Gilli
• Trevor Norris
• Steven Loomis

Discussion

General

Leap second

There will be a leap second between July 30th and June 1st. There was discussion with respect to how this might affect Node. From the consumer perspective this may seen as clock drift which is quite common. In 0.12 Node uses absolute times, not dates. 0.10.X used to use dates. Most time dependant functions are handled by either libuv or v8. We should likely ask these communities what they expect the effect of the leap second to be. Michael to open a libuv issue to ask this question and also to see if we can find who is the right person to ask in respect to V8. Steven volunteered to write up a FAQ covering the issue.

Better way to manage dependencies

Alexis initiated the discussion on a better way to manage dependencies and will write up a proposal. It would be nice if tests for Node ran in the test suites executed by the dependency teams. Failing that we should look at pulling in the dependencies more frequently in our CI, run the Node tests and provide feedback to the external teams.

Next releases

0.10.37

• Upgrade to libuv 0.10.36 in progress, code review planned for today, should land soon.

• 0.10.37 will possibly go out next week.

• Priority issues for 0.10.37 - issue #9092 and reverting change to url that caused a regression.

0.12.1 release

Key priority issues:

• libuv upgrade to 1.4.0, down to 1 test failing on OSX, ok on windows side now, Julien working on this.

• V8 lateral upgrade, Trevor still working on identifying goood V8 level (issue 9185).

• Issue #8540, #9204 discussing whether to pull fix from io.js or one developed in Node.js based on which is better.

• Issue #9245, Trevor working on this, 2 ways to make callback and depending on which one is called can lead to subtle bugs.

• Issue #9339 - to be reviewed and committed

• Issue #9317 - fix available in io.js other core team members to review to see if it can be pulled in.

• Issue #9235 - ensuring NODELAY is on for all platforms. Michael would like it on for AIX Julien/Alexis to review in context of Windows and other platforms.

• Issue #9334 - tests fail when run in deep directory paths. Julien and other core team members to review and comment.

• Alexis Campailla
• Colin Ihrig
• TJ Fontaine
• James Snell
• Robert Kowalski
• Michael Dawson
• Chris Dickinson

Discussion

General

TJ has pull request to update the core team - active contributors page. Attendees reviewed and it should go out imminently.

Discussed proposal to have github project for core team to capture discussions, initially to be used to capture some ci configuration. TJ is going to set this up.

Delivery of ICU data

Steven Loomis mentioned there was a suggestion to delivery to an npm. Attendees seemed to like this idea and discussion will be carried forward in https://github.com/joyent/node/pull/9091.

Website updates

Discussion of proposal to rewrite node.js.org to https minus a few exceptions. Expecting pull request in next week or so.

Node Internationalization

James looking at 2 aspects:

• Internationalize Node itself, going to start on this next week. Will use ICU if present, if not still need to figure out what the fallback will be.
• Resource bundle loading.

Next Releases

0.10.X

• In maintenance mode, new releases generally to address security or larger performance issues.
• 0.10.37 to go out this week, early next. Main update is newer version of libuv.
• TJ asked Michael to look to do some pre-validation on AIX.

0.12.X

• Some failing tests in 0.12 head now.
• Working to get jenkins job in place that can be run before integrating changes.
• Seeing some memory issues, some because node generates more garbage some because V8 gc is less aggressive. TJ still investigating some others which look to be real issues.

0.12.1 release

Key priority issues:

• libuv upgrade to 1.4, some issues seen on Windows, Alexis investigating.
• VM.
• joyent/node#9628 pull request for passing in 0 for port.
• Set server issue (James investigating).
• Abort on uncaught exception (io.js issue #836 for reference).

Colin raised issue of pull request to add abort to http. Since this would change the API needs to be done in 0.14 as opposed to 0.12. TJ suggested a work around for current releases.

Present

• Alexis Campailla
• Michael Dawson
• TJ Fontaine
• Julien Gilli
• Colin Ihrig
• Steven Loomis
• Bradley Meck
• Trevor Norris
• Wyatt Preul

Regrets

• James Snell

  • Working on:
    • Enabling openssl tests during the build similar to how I enabled the v8 tests.
    • Resource and message bundle support.

• Robert Kowalski

  • Progress:

    • I fixed the bad merge for https://github.com/joyent/node-documentation- generator and will continue to work on it, next items are .markdown support and sending a PR to node and node-website to make use of the module.

    • It is not possible any more to accidentally deploy an outdated version of the website.

  • Blocked by:

    • I'm still waiting for a fixed SSl Cert for https://blog.nodejs.org/ to continue with https://github.com/joyent/node-website/issues/68.

Current state of v0.12.0

V8 issues

Julien: A lot of issues related to V8 came up recently after v0.12.0 was released. I believe Trevor is working on most of them right now.

Trevor: Yes, I'm currently investigating.

V8 max_old_space issue

See https://github.com/joyent/node/pull/9200#issuecomment-75001656.

TJ: We'll float the patch as it's pretty uncontroversial.

VM module

See https://github.com/joyent/node/issues/9084.

TJ: would like to reboot the VM module. Will do a writeup in https://github.com/joyent/node/issues/9084. Who would like to work on implementing the proposed enhancements?

Colin: I would like to work on this.

TJ: alright!

let issue

See https://github.com/joyent/node/issues/9113.

TJ: This one should be able to be debugged with only d8 to identify if and what version of V8 introduced the bug.

node::Makecallback issue

See https://github.com/joyent/node/issues/9245.

Trevor: there's a case with some developers add-on where calling MakeCallback processes next tick callbacks. I'm working on a fix that would make calling MakeCallback safe in every case.

Security issue with shared OpenSSL

See https://github.com/nodejs/node/pull/800.

--abort-on-uncaught-exception and domains

Colin: abort on uncaught exception fix hasn't been forward ported to 0.12.0, so that prevents us from upgrading to 0.12.0.

Julien: There's an issue in the 0.12.1 milestone that tracks this. See https://github.com/joyent/node/issues/8877.

Installer on Windows not updating PATH

See https://github.com/joyent/node/issues/4356.

Alexis: issue with installer on Windows. Julien: fixed in io.js. Alexis: I will take care of this.

TCP_NODELAY issue

See https://github.com/joyent/node/issues/9235.

Michael Dawson: I have a candidate for a patch, would like to get feedback on that.

test-http-destroyed-socket-write2.js failing on AIX

See https://github.com/joyent/node/issues/9234.

Michael Dawson: I also have a patch for that, feedback wanted.

Website

Use tracing documentation as starting point for the general documentation.

i18n

TJ: what's the status on the bug with data customiser.

Steven: thought it was an endianness issue. Updated the wiki to warn users.

Steven: want to make full data available. Currently testing his solution.

Bradley Meck, TJ and Steven Loomis will discuss bundles and resources today.

Issues triaging and general workflow

Julien: I submitted a proposal to improve our workflow here: https://gist.github.com/misterdjules/50d78ed4b0c5a156edd1.

Steven: It would be nice to know what's the focus on a release, so that we know what issues to put in the next milestones.

Steven: Having the meeting to be a go/no-go meeting would help in being more efficient in this.

Alexis: Doing triaging during weekly meetings would also be beneficial.

TJ: call tomorrow where everyone comes up with a list of priorities for next milestone.

TJ: call tomorrow to discuss the proposal sent by Julien.

libuv upgrade

See https://github.com/joyent/node/pull/9179.

TJ: Caveats in the GitHub issue are the only concerns that I have. enum/int ABI issue, not sure if it's an actual issue or not. Would like to get more feedback from more knowledgeable C/C++ users. Concerned by some of the behavior changes in libuv.

Alexis: Users can use type casting if they have issues with the sizeof(enum) vs sizeof(int).

TJ: also, probably doesn't affect a lot of packages since it affects only the uv_tty API.

Julien: Failures on Windows.

Alexis: I can help to look into that.

Team organization updates

TJ: I would like to propose that Colin move from apprentice to core team member, and that Michael and Steven be appointed as apprenticies.

Publication of minutes

TJ: we want to publish every meeting's minutes on the website.

Testing

Michael Dawson: what tests should be run on a regular basis by any implementation?

TJ: would like to have make test run as many tests suite as possible. At least we can make it run simple, message, gc and internet today.

Michael Dawson: When do pummel, internet and other tests are run?

TJ: Historically, we've run them when building nightlies for instance. Some pummel tests take a long time to run on virtualized windows environments.

TJ, Michael Dawson: would like to have a mechanism to have platform specific tests.

Next core team meeting

Thursday February 26th 2015.

• Alexis Campailla
• Michael Dawson
• TJ Fontaine
• Julien Gilli
• Jacob Groundwater
• Steven Loomis
• Trevor Norris
• Issac Roth
• Todd Moore
• Dan Shaw
• James Snell
• Erik Toth

TJ: Updating V8 versions

Difference between communities. Important for IBM's regarding upstream power port.

Michael Dawson: Regarding porting to power, upstreamed 2 out of the three parts. Started discussions on optimizations. Hoping to get this upstreamed this quarter. It's gonna be a little longer for the zSeries support.

TJ: proposed solution: being able to run the V8 runtome as a dynamic library. Potential issues: modules and user land code might have to perform runtime tests to figure out if specific features in the JavaScript runtime are present.

Dan Shaw: How to handle Node.js' JavaScript APIs using recent runtime's capabilities (promises) that are not present in all versions of V8?

TJ: That's already a problem today, and this proposed solution doesn't eliminate this problem. Maybe use the "engines" properties in package.json for user land modules to express their requirements.

Dan Shaw: Do we need a baseline for a minimum supported set of language/runtime level features?

TJ: Having a specification of a fundamental base layer on the runtime side.

Alexis Campailla: How to handle different versions of V8?

TJ: my preference would be to use something like node-addon-layer as an abstraction layer.

Alexis, TJ: that would become the blessed V8/JSruntime API for binary add-ons.

TJ: C++ ABI has worked so far, but probably because we've been lucky. So C API makes more sense and would be more robust accross different platforms.

Alexis Campailla: What about nan?

TJ: nan is a header only C++ library, so it wouldn't solve the case of loading runtimes dynamically. However, as a lot of users of Node.js use nan, we might have to provide a double abstraction.

Isaac Roth: All of that sounds good, but it puts a lot of burden on module authors.

TJ: Bert mentioned previously that using NaCl could be interesting.

Issues with specing what a Node.js runtime baseline is

Erik Toth: Paypal has problems with JavaScript, not with Node.js. EcmaScript standard is a bit nebulous, and so talking about a platform identified with an Ecma Script version is very confusing.

James Snell: That's why we would need a baseline spec for what would be a compatible Node.js runtime.

IBM: Specs will be unsufficient, we'll need tests also.

TJ: Asynchronous code can be made easier to troubleshoot with using other mechanisms than promises, for instance vasync module, or other tooling.

Dan Shaw: ES6 2015/2016 is coming way faster than I expected. Node.js should be a runtime where we can run untranspiled/untransformed code. Problems with JavaScript should be separated from problems that we have with Node.js itself.

Issac Roth: Promises, generators, etc. will happen anyway, so we have to support that.

Issac Roth: Promises is a core abstraction, and so promises are unavoidable.

TJ: Problem of re-using code written for the browser which uses promises.

Trevor: What is the point of the discussion?

Trevor: The interface between the JavaScript layer and the native layer is a mess, cleaning that up will allow to build whatever type of interface to the code native layer.

Trevor: You can't transition all asynchronous APIs to promises (e.g event emitters)

Trevor: 1st priority should be to refactor some core layers to use lower level APIs to improve performance (e.g http should use tcp_wrap instead of lib/net.js).

Trevor: Before supporting promises at the core layer, we'd have to do some simplification work.

Trevor: Supporting loading different runtimes will make supporting existing (memory monitors, tracking GC events, etc.) tooling much more difficult.

Issac Roth: Internationalization

Issac Roght: Ability to translate/localize error messages.

James Snell: One of IBM's mandate is to be able to ship code localized for 70 countries, otherwise needs to get exceptions.

TJ: Also, concept of cleaning up error messages/objects related to i18n of error messages.

Dan Shaw: We talked about abstracting V8, what about libuv?

TJ: libuv doesn't fit the same kind of niche as V8. However, an abstraction layer would be helpful.

Dan Shaw: Concern of how and when Node.js will catch up with libuv?

TJ: At some point in the release cycle, we have to close the gates and we can't integrate latest versions of dependencies.

TJ: Carefully scoped roadmap and more frequent releases should allow us to integrate newer versions of dependencies often.

Isaac Roth: It will be difficult to get broad agreement on a roadmap. Usually, open source projects work by integrating changes organically from contributors dependening on what they want to work on.

TJ: Have the requirement of at any time, the tip of the development branch can be used as a release candidate.

Alexis Campailla: Work to build all PRs on every supported platforms.

Alexis Campailla: I've been doing some work to be able to build/test code from any GitHub pull request.

Alexis Campailla: Running benchmarks for Windows.

Julien: Tracking benchmarks results accross every commit would be very useful to identify the causes of performance regressions.

James Snell, Michael Dawson: IBM started to run benchmarks for downstream dependencies, and wants to do more of that.

TJ: cluster

James: Cluster seems to be used only by 6 npm modules (grepped 'cluster' through 120 most used modules). However, these modules could (and probably) use pm2 or other abstraction on top of cluster.

TJ: Cluster is mostly used internally by glue code.

Alexis: Datagram socket not supported on Windows. There's a lot of room for improvement in the implementation.

Isaac: Performance of the cluster module is not satisfying, made some comparison with nginx and cluster seems to be 3x slower. Could need a rewrite.

Jacob: Lots of users who directly use cluster module, sometimes by just copy/pasting code from the doc. I would say cluster is used widely.

TJ: Preference would have been to improve child_process and have userland modules implement clustering features.

James Snell: Crypto improvements

James Snell : Better access to crypto hardware is needed.

TJ: libressl came out with a very compelling C API that Node.js could use.

Julien Gilli: stricter APIs

Julien Gilli: There are a lot of fragile APIs in Node.js. It makes these APIs hard to use correctly, and it is also very time consuming for contributors who help users troubleshoot issues related to misuses of APIs.

Julien: Example of recent improvement was making net.Socket.setTimeout's API stricter.

TJ: Differences between browser APIs strictness and Node.js API strictness. It's also a documentation effort and is related to better error messages.

Erik Toth: Ecma has a formal type proposal that could be related.

Julien Gilli: lldb-v8

Julien: lldb-v8 is a great tool that, if working more reliably with different versions of node, could help both users and the core team to investigate bugs.

TJ: I believe IBM has another toolchain that they use.

Erik Toth: What's the plan with async_wrap?

Dan Shaw: Gathering input from potential users currently.

TJ: Some interesting output from the meeting in Vancouver last summer.

Erik Toth: Lower level thing that we want to see where it goes.

Jacob: Various needs for tracing, some fairly basic (intercepting what is logged by console.log), some much more advanced like inspecting V8 internals. Needs to move slowly to make sure these broad needs are satisfied.

IBM: Performance is crucial.

Isaac Roth: Had to constantly reimplement tracing solutions because of changing requirements from users. Maybe need to be very generic about this.

TJ: My proposed solution was to inject calls to probes that are interpreted by platform-specific tracing frameworks (dtrace, ETW, etc.)

Issac Roth: Building a more generic layer that other user land modules can build upon.

Closing comments and action items

James Snell: Need to prioritize things.

TJ: Post ideas for roadmap somewhere where people can comment.

• Michael Dawson
• TJ Fontaine
• Julien Gilli
• Colin Ihrig
• Trevor Norris
• Wyatt Preul
• James Snell

Discussions

0.12.0 release

Julien: Remaining issues to release 0.12.0 are in the 0.11.17 milestone on GitHub. Everyone agreed that there's no blocker for this release.

TJ: will put a draft for blog post for release notes up and the rest of the team will review it.

Native modules breakage

TJ: some modules that don't use nan or other ways to build with V8 shipped by node v0.12.x will break. These modules will need to be fixed on a case by case basis.

Website

Wyatt: security page published.

Post 0.12.0

TJ: From now on, it would be nice if core team members would use https://github.com/joyent/git-apply-pr to land PRs/contributions. It's a work in progress, bug fixes/improvements are more than welcome!

TJ: We may discuss what to integrate from the core team working group of the Node.js Advisory Board (https://github.com/joyent/nodejs-advisory-board) during the next core team call.

Testing downstream modules and applications

Michael Dawson: need for higher level benchmarks (for upper layers like express, etc.).

TJ: Some people have been working on downstream integration tests (for instance, Julien with test-node-apps)

TJ: Downstream integration tests, downstream benchmarking desirable in the future.

James: identify the top 120 most depended on modules, determine what core modules they use, and create a tests framework around that.

Michael: Michael and James already have something simple that run tests for some npm modules.

Node summit

TJ: Tentative meeting on Monday 2pm to 4pm: purely technical meeting about roadmap, not a meeting about governance.

• Michal Dawson
• TJ Fontaine
• Colin Ihrig
• Julien Gilli
• Robert Kowalski
• James Snell

Website

Robert: Partially redirected http -> https for api docs and docs. Only blog page missing. Learning about SNI. Documentation generation tool: created a tests suite that runs some smoke tests. Hopes to get a PR for that next week.

TJ: We have a wildcard cert for the blog, so using this cert might be easier than using SNI.

0.11.16 release

Colin: has two bug fixes not API breaking that could go in for 0.11.16.

TJ: Would like to put https://github.com/joyent/node/pull/8966 in v0.10. Colin hasn't tried to rebase it on v0.10, but will do today.

Building dependencies

James: Working on refactoring the way dependencies (deps/) are built.

TJ: The build refactoring should target the master branch, and then might get backported to v0.12.

PRs/Issues in io.js

TJ: When we see bugs in io.js that are also in Node.js, then please report these bugs.

James: I'm going to go through the recent changes in io.js and will report issues/PRs.

PowerPC support

Michael, James and TJ: Jenkins agents building and running tests for the Power platform will be hooked up asap.

• Michael Dawson
• Chris Dickinson
• TJ Fontaine
• Julien Gilli
• Colin Ihrig
• Robert Kowalski
• Steven R Loomis
• Trevor Norris

Minutes

Update on the state of 0.11.16

Tool to update AUTHORS file

The current tooling to update the AUTHORS and .mailmap file should be refactored to:

• Order authors by name using a stable sort algorithm.
• Update the .mailmap file with authors' email addresses.

Julien has been assigned to this and work is in progress at https://github.com/joyent/node/pull/9088.

Participants agreed that eventually the project should have more tooling to land changes from contributors and that these tools would also take care of updating authors files each time a contribution is integrated in the code repository.

url.format/url.parse

The only issue non-straightforward issue remaining in the 0.11.6 milestone is a recent regression in url.format.

Two discussions started, one that was about what can be done before v0.12.0 is released, and another one about what can be done post v0.12.0. Some participants mentioned that ultimately, the goal would probably be to conform to the whatwg spec and deprecate the current url module.

All participants agreed that before v0.12.0 is released, url.format should throw on conflicting properties. Chris was assigned to this task.

Target date

The target date for releasing 0.11.16 is "as soon as possible". Being a development release, there's no constraint on which day of the week the release should be done.

Update on ICU (i18n) for 0.12.0

Steven tested the English language support included in the v0.11.15 release. He mentioned that it seems to be working fine, but that he hadn't had the opportunity to test loading additional data.

Robert, Steven and TJ also discussed updating the website to document how to load additional data.

Website / Documentation effort

Robert and TJ discussed how to to factor out the documentation from the project. Robert also mentioned that he'd like to work with Chris on the website to integrate features/tools that are now available in io.js (for instance, comments in documentation).

Robert also mentioned that he's going to check-in the website's configuration file in source control.

Node on Power processors

Michael Dawson from IBM talked about Node.js on PowerPC processors. TJ and Michael agreed that the target for such a port would likely be 0.14.0. Michael mentioned that ideally the process of upstreaming changes to V8 would be done by that time. If not, there has been discussions recently between TJ and Chris on refactoring the dependencies management so that maintaining floating patches (also for other dependencies liek c-ares and OpenSSL) would be easier.

0.10.36 release

The 0.10.36 milestone is done, and the release is planned for today (Thursday January 22nd).

• Timothy J Fontaine
• Julien Gilli
• Robert Kowalski

Topics

Website

The only topic that was discussed during this meeting was the Node.js website.

HTTPS access

Robert suggested adding HTTPS access for Node.js' website. TJ mentioned that there is already a HTTPS endpoint on the website, but that clients (browsers, etc.) are not redirected by default from http to https, because doing so was breaking a lot of people (e.g nvm).

Proposed solution by TJ: redirect everything by default to https except nodejs.org/dist.

Robert proposed to setup a clone of the website with this change to be able to test it.

Documentation versions

Robert suggested a new feature for the documentation available on Node.js' website: accessing docs for different versions.

Robert asked if regenerating the documentation for versions older than 0.10 makes sense. TJ mentioned that we probably don't want to go back further than 0.10. However, participants agreed that in the future, publishing older documentation could be fun and/or interesting.

TJ suggested that documentation generation tools could be refactored and published as npm packages so that they can work standalone. That could make generating documentation for different versions easier.

TJ also pointed out that a significant SEO effort went into making sure that the latest Node.js documentation shows up when searching for Node documentation, and that any change to the website's documentation should preserve that.