Skip to content

Releases: nodejs/node

2023-09-04, Version 20.6.0 (Current), @juanarbol prepared by @UlisesGascon

04 Sep 20:30
@UlisesGascon UlisesGascon
v20.6.0
9700344
This commit was signed with the committer’s verified signature.
UlisesGascon Ulises Gascón
GPG key ID: 04CD3F2FDE079578
Learn about vigilant mode.
Compare
Choose a tag to compare
2023-09-04, Version 20.6.0 (Current), @juanarbol prepared by @UlisesGascon

Notable changes

built-in .env file support

Starting from Node.js v20.6.0, Node.js supports .env files for configuring environment variables.

Your configuration file should follow the INI file format, with each line containing a key-value pair for an environment variable.
To initialize your Node.js application with predefined configurations, use the following CLI command: node --env-file=config.env index.js.

For example, you can access the following environment variable using process.env.PASSWORD when your application is initialized:

PASSWORD=nodejs

In addition to environment variables, this change allows you to define your NODE_OPTIONS directly in the .env file, eliminating the need to include it in your package.json.

This feature was contributed by Yagiz Nizipli in #48890.

import.meta.resolve unflagged

In ES modules, import.meta.resolve(specifier) can be used to get an absolute URL string to which specifier resolves, similar to require.resolve in CommonJS. This aligns Node.js with browsers and other server-side runtimes.

This feature was contributed by Guy Bedford in #49028

New node:module API register for module customization hooks; new initialize hook

There is a new API register available on node:module to specify a file that exports module customization hooks, and pass data to the hooks, and establish communication channels with them. The “define the file with the hooks” part was previously handled by a flag --experimental-loader, but when the hooks moved into a dedicated thread in 20.0.0 there was a need to provide a way to communicate between the main (application) thread and the hooks thread. This can now be done by calling register from the main thread and passing data, including MessageChannel instances.

We encourage users to migrate to an approach that uses --import with register, such as:

node --import ./file-that-calls-register.js ./app.js

Using --import ensures that the customization hooks are registered before any application code runs, even the entry point.

This feature was contributed by Izaak Schroeder in #48842 and #48559

Module customization load hook can now support CommonJS

Authors of module customization hooks can how handle both ES module and CommonJS sources in the load hook. This works for CommonJS modules referenced via either import or require, so long as the main entry point of the application is handled by the ES module loader (such as because the entry point is an ES module file, or if the --import flag is passed). This should simplify the customization of the Node.js module loading process, as package authors can customize more of Node.js without relying on deprecated APIs such as require.extensions.

This feature was contributed by Antoine du Hamel in #47999

Node.js C++ addons now have experimental support for cppgc (Oilpan), a C++ garbage collection library in V8.

Now when Node.js starts up, it makes sure that there is a v8::CppHeap attached to the V8 isolate. This enables users to allocate in the v8::CppHeap using <cppgc/*> headers from V8, which are now also included into the Node.js headers available to addons. Note that since Node.js only bundles the cppgc library coming from V8, the ABI stability of cppgc is currently not guaranteed in semver-minor and -patch updates, but we do not expect the ABI to break often, as it has been stable and battle-tested in Chromium for years. We may consider including cppgc into the ABI stability guarantees when it gets enough adoption internally and externally.

To help addon authors create JavaScript-to-C++ references of which V8's garbage collector can be aware, a helper function node::SetCppgcReference(isolate, js_object, cppgc_object) has been added to node.h. V8 may provide a native alternative in the future, which could then replace this Node.js-specific helper. In the mean time, users can use this API to avoid having to hard-code the layout of JavaScript wrapper objects. An example of how to create garbage-collected C++ objects in the unified heap and wrap it in a JavaScript object can be found in the Node.js addon tests.

The existing node::ObjectWrap helper would continue to work, while cppgc-based object management serves as an alternative with some advantages mentioned in the V8 blog post about Oilpan.

This feature was contributed by Daryl Haresign and Joyee Cheung in #48660 and #45704.

Other notable changes

Commits

Read more
Assets 2

2023-08-09, Version 20.5.1 (Current), @RafaelGSS

09 Aug 17:58
@RafaelGSS RafaelGSS
v20.5.1
This tag was signed with the committer’s verified signature. The key has expired.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Expired
Learn about vigilant mode.
9f51c55
Compare
Choose a tag to compare
2023-08-09, Version 20.5.1 (Current), @RafaelGSS

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

More detailed information on each of the vulnerabilities can be found in August 2023 Security Releases blog post.

Commits

Assets 2

2023-08-09, Version 18.17.1 'Hydrogen' (LTS), @RafaelGSS

09 Aug 17:58
@RafaelGSS RafaelGSS
v18.17.1
This tag was signed with the committer’s verified signature. The key has expired.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Expired
Learn about vigilant mode.
2e414d5
Compare
Choose a tag to compare
2023-08-09, Version 18.17.1 'Hydrogen' (LTS), @RafaelGSS

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

More detailed information on each of the vulnerabilities can be found in August 2023 Security Releases blog post.

Commits

Assets 2

2023-08-09, Version 16.20.2 'Gallium' (LTS), @RafaelGSS

09 Aug 17:57
@RafaelGSS RafaelGSS
v16.20.2
This tag was signed with the committer’s verified signature. The key has expired.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Expired
Learn about vigilant mode.
dadbde9
Compare
Choose a tag to compare
2023-08-09, Version 16.20.2 'Gallium' (LTS), @RafaelGSS

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

More detailed information on each of the vulnerabilities can be found in August 2023 Security Releases blog post.

Commits

Assets 2

2023-07-18, Version 20.5.0 (Current), @juanarbol

20 Jul 21:41
@juanarbol juanarbol
v20.5.0
f13c7f5
Compare
Choose a tag to compare
2023-07-18, Version 20.5.0 (Current), @juanarbol

Notable Changes

  • [45be29d89f] - doc: add atlowChemi to collaborators (atlowChemi) #48757
  • [a316808136] - (SEMVER-MINOR) events: allow safely adding listener to abortSignal (Chemi Atlow) #48596
  • [986b46a567] - fs: add a fast-path for readFileSync utf-8 (Yagiz Nizipli) #48658
  • [0ef73ff6f0] - (SEMVER-MINOR) test_runner: add shards support (Raz Luvaton) #48639

Commits

Read more
Assets 2

2023-07-18, Version 18.17.0 'Hydrogen' (LTS), @danielleadams

18 Jul 20:05
@danielleadams danielleadams
v18.17.0
This tag was signed with the committer’s verified signature.
danielleadams Danielle Adams
GPG key ID: D3A89613643B6201
Learn about vigilant mode.
a39b8a2
This commit was signed with the committer’s verified signature.
danielleadams Danielle Adams
GPG key ID: D3A89613643B6201
Learn about vigilant mode.
Compare
Choose a tag to compare
2023-07-18, Version 18.17.0 'Hydrogen' (LTS), @danielleadams

Notable Changes

Ada 2.0

Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements
to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url.

Ada 2.0 has been integrated into the Node.js codebase, ensuring that all parts of the application can benefit from the
improved performance. Additionally, Ada 2.0 features a significant performance boost over its predecessor, Ada 1.0.4,
while also eliminating the need for the ICU requirement for URL hostname parsing.

Contributed by Yagiz Nizipli and Daniel Lemire in #47339

Web Crypto API

Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations.
This further improves interoperability with other implementations of Web Crypto API.

Contributed by Filip Skokan in #46067

  • crypto:
    • update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659
  • dns:
    • (SEMVER-MINOR) expose getDefaultResultOrder (btea) #46973
  • doc:
    • add ovflowd to collaborators (Claudio Wunder) #47844
    • add KhafraDev to collaborators (Matthew Aitken) #47510
  • events:
    • (SEMVER-MINOR) add getMaxListeners method (Matthew Aitken) #47039
  • fs:
    • (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084
    • (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) #41439
    • (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084
    • (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) #46933
  • http:
    • (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732
    • (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) #47723
    • (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) #47405
  • lib:
    • (SEMVER-MINOR) add webstreams to Duplex.from() (Debadree Chatterjee) #46190
    • (SEMVER-MINOR) implement AbortSignal.any() (Chemi Atlow) #47821
  • module:
    • change default resolver to not throw on unknown scheme (Gil Tayar) #47824
  • node-api:
    • (SEMVER-MINOR) define version 9 (Chengzhong Wu) #48151
    • (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) #46319
  • stream:
    • (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) #47413
    • (SEMVER-MINOR) add setter & getter for default highWaterMark (#46929) (Robert Nagy) #46929
  • test:
    • unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #48078
  • test_runner:
    • (SEMVER-MINOR) add shorthands to test (Chemi Atlow) #47909
    • (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) #47686
    • (SEMVER-MINOR) execute before hook on test (Chemi Atlow) #47586
    • (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) #47238
  • tools:
    • update LICENSE and license-builder.sh (Santiago Gimeno) #48078
  • url:
    • (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) #47179
  • wasi:
    • (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) #47286

Commits

  • [2ba08ac002] - benchmark: use cluster.isPrimary instead of cluster.isMaster (Deokjin Kim) #48002
  • [60ca69d96c] - benchmark: add eventtarget creation bench (Rafael Gonzaga) #47774
  • [d8233d96bb] - benchmark: add a benchmark for defaultResolve (Antoine du Hamel) #47543
  • [a1aabb6912] - benchmark: fix invalid requirementsURL (Deokjin Kim) #47378
  • [394c61caf9] - bootstrap: support namespaced builtins in snapshot scripts (Joyee Cheung) #47467
  • [0165a765a0] - bootstrap: do not expand process.argv[1] for snapshot entry points (Joyee Cheung) #47466
  • [cca557cdd9] - buffer: combine checking range of sourceStart in buf.copy (Deokjin Kim) #47758
  • [4c69be467c] - buffer: use private properties for brand checks in File (Matthew Aitken) #47154
  • [d002f9b6e2] - build: revert unkonwn ruff selector (Moshe Atlow) #48753
  • [93f77cb762] - build: set v8_enable_webassembly=false when lite mode is enabled (Cheng Shao) #48248
  • [1662e894f3] - build: add action to close stale PRs (Michael Dawson) #48051
  • [5ca437b288] - build: use pathlib for paths (Mohammed Keyvanzadeh) #47581
  • [72443bc54b] - build: refactor configure.py (Mohammed Keyvanzadeh) #47667
  • [d4eecb5be9] - build: add devcontainer configuration (Tierney Cyren) #40825
  • [803ed41144] - build: bump ossf/scorecard-action from 2.1.2 to 2.1.3 (dependabot[bot]) #47367
  • [48468c4413] - build: replace Python linter flake8 with ruff (Christian Clauss) #47519
  • [3ceb2c4387] - build: add node-core-utils to setup (Jiawen Geng) #47442
  • [fdc59b8e14] - build: bump github/codeql-action from 2.2.6 to 2.2.9 (dependabot[bot]) #47366
  • [3924893023] - build: update stale action from v7 to v8 (Rich Trott) #47357
  • [753185c5b0] - build: remove Python pip --no-user option (Christian Clauss) #47372
  • [67af0a6a2b] - build: avoid usage of pipes library (Mohammed Keyvanzadeh) #47271
  • [db910dd6b2] - build, deps, tools: avoid excessive LTO (Konstantin Demin) #47313
  • [35d1def891] - child_process: use signal.reason in child process abort (Debadree Chatterjee) #47817
  • [7692d2e7b9] - cluster: use ObjectPrototypeHasOwnProperty (Daeyeon Jeong) #48141
  • [7617772762] - crypto: use openssl's own memory BIOs in crypto_context.cc (GauriSpears) #47160
  • [8cabfe7c6e] - crypto: fix setEngine() when OPENSSL_NO_ENGINE set (Tobias Nießen) #47977
  • [de1338da05] - crypto: fix webcrypto private/secret import with empty usages (Filip Skokan) #47877
  • [27a696fda9] - crypto: update root...
Read more
Assets 2

2023-07-05, Version 20.4.0 (Current), @RafaelGSS

05 Jul 15:12
@RafaelGSS RafaelGSS
v20.4.0
This tag was signed with the committer’s verified signature. The key has expired.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Expired
Learn about vigilant mode.
73c632e
Compare
Choose a tag to compare
2023-07-05, Version 20.4.0 (Current), @RafaelGSS

Notable Changes

Mock Timers

The new feature allows developers to write more reliable and predictable tests for time-dependent functionality.
It includes MockTimers with the ability to mock setTimeout, setInterval from globals, node:timers, and node:timers/promises.

The feature provides a simple API to advance time, enable specific timers, and release all timers.

import assert from 'node:assert';
import { test } from 'node:test';

test('mocks setTimeout to be executed synchronously without having to actually wait for it', (context) => {
  const fn = context.mock.fn();
  // Optionally choose what to mock
  context.mock.timers.enable(['setTimeout']);
  const nineSecs = 9000;
  setTimeout(fn, nineSecs);

  const threeSeconds = 3000;
  context.mock.timers.tick(threeSeconds);
  context.mock.timers.tick(threeSeconds);
  context.mock.timers.tick(threeSeconds);

  assert.strictEqual(fn.mock.callCount(), 1);
});

This feature was contributed by Erick Wendel in #47775.

Support to the explicit resource management proposal

Node is adding support to the explicit resource management
proposal to its resources allowing users of TypeScript/babel to use using/await using with
V8 support for everyone else on the way.

This feature was contributed by Moshe Atlow and Benjamin Gruenbaum in #48518.

Other notable changes

  • [fe333d2584] - crypto: update root certificates to NSS 3.90 (Node.js GitHub Bot) #48416
  • [60c2ea4e79] - doc: add vmoroz to collaborators (Vladimir Morozov) #48527
  • [5cacdf9e6b] - doc: add kvakil to collaborators (Keyhan Vakil) #48449
  • [504d1d7bdc] - (SEMVER-MINOR) tls: add ALPNCallback server option for dynamic ALPN negotiation (Tim Perry) #45190

Commits

Read more
Assets 2

2023-06-20, Version 20.3.1 (Current), @RafaelGSS

20 Jun 20:15
@RafaelGSS RafaelGSS
v20.3.1
This tag was signed with the committer’s verified signature. The key has expired.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Expired
Learn about vigilant mode.
9869bdc
Compare
Choose a tag to compare
2023-06-20, Version 20.3.1 (Current), @RafaelGSS

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.

Commits

Assets 2

2023-06-20, Version 18.16.1 'Hydrogen' (LTS), @RafaelGSS

20 Jun 20:35
@RafaelGSS RafaelGSS
v18.16.1
This tag was signed with the committer’s verified signature. The key has expired.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Expired
Learn about vigilant mode.
8658efe
Compare
Choose a tag to compare
2023-06-20, Version 18.16.1 'Hydrogen' (LTS), @RafaelGSS

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.

Commits

Assets 2

2023-06-20, Version 16.20.1 'Gallium' (LTS), @RafaelGSS

20 Jun 19:29
@RafaelGSS RafaelGSS
v16.20.1
This tag was signed with the committer’s verified signature. The key has expired.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Expired
Learn about vigilant mode.
b53c519
Compare
Choose a tag to compare
2023-06-20, Version 16.20.1 'Gallium' (LTS), @RafaelGSS

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.

Commits

Assets 2