build: update node.js to v16.13.0

This MR contains the following updates:

Package	Type	Update	Change
node	stage	minor	16.10.0-alpine -> 16.13.0-alpine

---

Release Notes

nodejs/node

v16.13.0

Compare Source

Notable Changes

This release marks the transition of Node.js 16.x into Long Term Support (LTS) with the codename 'Gallium'. The 16.x release line now moves into "Active LTS" and will remain so until October 2022. After that time, it will move into "Maintenance" until end of life in April 2024.

v16.12.0

Compare Source

Notable Changes

Experimental ESM Loader Hooks API

Node.js ESM Loader hooks have been consolidated to represent the steps involved needed to facilitate future loader chaining:

1. resolve: resolve [+ getFormat]
2. load: getFormat + getSource + transformSource

For consistency, getGlobalPreloadCode has been renamed to globalPreload.

A loader exporting obsolete hook(s) will trigger a single deprecation warning (per loader) listing the errant hooks.

Contributed by Jacob Smith, Geoffrey Booth, and Bradley Farias - https://github.com/nodejs/node/pull/37468

Other Notable Changes

• [8fdabcb918] - deps: upgrade npm to 8.1.0 (npm team) #​40463
• [d1d9f2de30] - doc: deprecate (doc-only) http abort related (dr-js) #​36670
• [4116b6c907] - (SEMVER-MINOR) vm: add support for import assertions in dynamic imports (Antoine du Hamel) #​40249

Commits

• [8bb3951e41] - build: remove duplicate check for authors.yml (Rich Trott) #​40393
• [2de57edced] - build: make scripts in gyp run with right python (Cheng Zhao) #​39730
• [a8926d199d] - crypto: remove incorrect constructor invocation (gc) #​40300
• [8fdabcb918] - deps: upgrade npm to 8.1.0 (npm team) #​40463
• [dca5ac1539] - deps: suppress zlib compiler warnings (Daniel Bevenius) #​40343
• [91c3bf6a7f] - deps: upgrade Corepack to 0.10 (Maël Nison) #​40374
• [7e02124a06] - dgram: add nread assertion to UDPWrap::OnRecv (Darshan Sen) #​40295
• [2d409ed29e] - dns: refactor and use validators (Voltrex) #​40022
• [dc7291dab8] - doc: remove ESLint comments which were breaking the CJS/ESM toggles (Mark Skelton) #​40408
• [85b7385115] - doc: add pronouns for tniessen to README (Tobias Nießen) #​40412
• [1d5857c9f4] - doc: format changelogs (Rich Trott) #​40388
• [5eb9402b50] - doc: fix missing variable in deepStrictEqual example (OliverOdo) #​40396
• [6f77d1a1d5] - doc: fix asyncLocalStorage.run() description (Constantine Kim) #​40381
• [93a48e02dc] - doc: fix typos in n-api docs (Ignacio Carbajo) #​40402
• [fb7afb91c2] - doc: format doc/guides using format-md task (Rich Trott) #​40358
• [6c091c7878] - doc: improve phrasing in fs.md (Arslan Ali) #​40255
• [38d81380ac] - doc: add link to core promises tracking issue (Michael Dawson) #​40355
• [71a94aa82a] - doc: correct ESM load hook table header (Jacob Smith) #​40234
• [5b074affb4] - doc: fix typo in esm.md (Mason Malone) #​40273
• [3b3aaa0a37] - doc: fix typo in ESM example (Tobias Nießen) #​40275
• [f848553fb8] - doc: assign missing deprecation number (Michaël Zasso) #​40324
• [d1d9f2de30] - doc: deprecate (doc-only) http abort related (dr-js) #​36670
• [1ef2cf8413] - doc: anchor link parity between markdown and html-generated docs (foxxyz) #​39304
• [3743406b0a] - (SEMVER-MINOR) esm: consolidate ESM loader hooks (Jacob Smith) #​37468
• [168020e1c8] - lib: refactor to use let (gdccwxx) #​40364
• [bcd59d70bb] - meta: consolidate AUTHORS entries for gabrielschulhof (Rich Trott) #​40420
• [80b4245db8] - meta: consolidate AUTHORS information for geirha (Rich Trott) #​40406
• [93cecb4700] - meta: consolidate duplicate AUTHORS entries for hassaanp (Rich Trott) #​40391
• [fff3135909] - meta: update AUTHORS (Node.js GitHub Bot) #​40392
• [122481713d] - meta: consolidate AUTHORS entry for thw0rted (Rich Trott) #​40387
• [7f50313fcc] - meta: update label-pr-config (Mestery) #​40199
• [5668182665] - meta: use .mailmap to consolidate AUTHORS entries for ide (Rich Trott) #​40367
• [bc86084a3e] - net: check if option is undefined (Daijiro Wachi) #​40344
• [4564a93e5e] - net: remove unused ObjectKeys (Daijiro Wachi) #​40344
• [dbb2e6f429] - net: check objectMode first and then readble || writable (Daijiro Wachi) #​40344
• [a672be57c8] - net: throw error to object mode in Socket (Daijiro Wachi) #​40344
• [faf9e28c36] - src: remove usage of AllocatedBuffer from stream_* (Darshan Sen) #​40293
• [857af2ba99] - src: add missing initialization (Michael Dawson) #​40370
• [2bfa87edbc] - stream: fix fromAsyncGen (Robert Nagy) #​40499
• [1e15137e71] - test: replace common port with specific number (Daijiro Wachi) #​40344
• [6f6b99c302] - test: fix typos in whatwg-webstreams explanations (Tobias Nießen) #​40389
• [641b1bb052] - test: add test for readStream.path when fd is specified (Qingyu Deng) #​40359
• [07dae7ff50] - test: replace .then chains with await (gdccwxx) #​40348
• [d8a36ee1de] - test: fix "test/common/debugger" identify async function (gdccwxx) #​40348
• [13d6a56c7d] - test: improve test coverage of fs.ReadStream with FileHandle (Antoine du Hamel) #​40018
• [50f91ab059] - tools: udpate @​babel/eslint-parser (Rich Trott) #​40394
• [3611073145] - tools: remove @​babel/plugin-syntax-import-assertions (Rich Trott) #​40394
• [b72d693a3a] - tools: remove @​bable/plugin-syntax-class-properties (Rich Trott) #​40394
• [d6a99b77da] - tools: remove @​babel/plugin-syntax-top-level-await (Rich Trott) #​40394
• [d9157aa5fe] - tools: update ESLint to 8.0.0 (Rich Trott) #​40394
• [43b97c7984] - tools: prepare ESLint rules for 8.0.0 requirements (Rich Trott) #​40394
• [282b6eb4b0] - tools: fix ESLint update scripts (Rich Trott) #​40394
• [c3a744f7bf] - tools: warn about duplicates when generating AUTHORS file (Rich Trott) #​40304
• [7733b5e55d] - typings: define types for os binding (Michaël Zasso) #​40222
• [ca9a854877] - typings: add missing types to options and util bindings (Michaël Zasso) #​40222
• [c3a7a0bd59] - typings: define types for timers binding (Michaël Zasso) #​40222
• [65b51d05fa] - typings: fix declaration of primordials (Michaël Zasso) #​40222
• [5f3f3a5128] - v8: remove --harmony-top-level-await (Geoffrey Booth) #​40226
• [4116b6c907] - (SEMVER-MINOR) vm: add support for import assertions in dynamic imports (Antoine du Hamel) #​40249

v16.11.1

Compare Source

This is a security release.

Notable changes

• CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
  • The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2021-22959 after publication.
• CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)
  • The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details will be available at CVE-2021-22960 after publication.

Commits

• [af488f8dc8] - deps: update llhttp to 6.0.4 (Matteo Collina) nodejs-private/node-private#​284
• [2d1eefad98] - http: add regression test for smuggling content length (Matteo Collina) nodejs-private/node-private#​284
• [45d419ab1c] - http: add regression test for chunked smuggling (Matteo Collina) nodejs-private/node-private#​284

v16.11.0

Compare Source

Notable Changes

• crypto
  • update root certificates (Richard Lau) #​40280
• deps
  • upgrade npm to 8.0.0 (npm team) #​40369
  • update nghttp2 to v1.45.1 (thunder-coding) #​40206
  • update V8 to 9.4.146.19 (Michaël Zasso) #​40285
• tools
  • update certdata.txt (Richard Lau) #​40280

Commits

• [34f3021ca3] - benchmark: add util.toUSVString()'s benchmark (Khaidi Chu) #​40203
• [f83b9bcb6f] - build: support Python 3.10.0 (FrankQiu) #​40296
• [3148f9b64e] - build: check for duplicates in new AUTHORS entries (Rich Trott) #​40264
• [48c162d457] - build: set DESTCPU correctly for 'make binary' on Apple Silicon (Chris Heisterkamp) #​40147
• [7fbfb66d41] - build: limit update authors CI scope (Jiawen Geng) #​40219
• [a1bee94502] - build: pass a tuple of alternatives to str.endswith() (Christian Clauss) #​40017
• [eaf9d08332] - build: add --no-user for pip commands in Makefile (Rich Trott) #​40169
• [e22ca06ac4] - build: fix "test-internet.yml" workflows (SURYAMRATAP SINGH SURYAVANSHI) #​40177
• [4da73d09bf] - (SEMVER-MINOR) build: reset embedder string to "-node.0" (Michaël Zasso) #​40285
• [4b117fbc81] - console: use validators for consistency (Voltrex) #​39812
• [6489423187] - console: avoid unnecessary variables (Pancake) #​40183
• [9af2592e69] - crypto: update root certificates (Richard Lau) #​40280
• [2fa5e5011f] - crypto: handle initEDRaw pkey failure (Shelley Vohr) #​40188
• [7968c79301] - crypto: don't call callback twice in case crypto.randomBytes fails (Guilherme Bernal) #​40157
• [b89c7ae297] - deps: upgrade npm to 8.0.0 (npm team) #​40369
• [947f3dc9af] - deps: V8: patch jinja2 for Python 3.10 compat (Michaël Zasso) #​40296
• [685c7d43a5] - (SEMVER-MINOR) deps: update nghttp2 to v1.45.1 (thunder-coding) #​40206
• [e7046e0ff1] - deps: restore minimum ICU version to 68 (Michaël Zasso) #​39470
• [a3db2033d4] - (SEMVER-MINOR) deps: make V8 9.4 abi-compatible with 9.0 (Michaël Zasso) #​40285
• [5cc24e6d76] - deps: V8: cherry-pick 9a60704 (Jiawen Geng) #​40046
• [8de5eb88d3] - deps: V8: cherry-pick 5681a65 (Michaël Zasso) #​39945
• [150d816edb] - deps: V8: cherry-pick bdcda72 (Michaël Zasso) #​39945
• [807b68b430] - deps: V8: cherry-pick 00bb1a7 (Darshan Sen) #​39829
• [be016948df] - deps: silence irrelevant V8 warning (Michaël Zasso) #​38990
• [22dcd3e4dc] - deps: silence irrelevant V8 warnings (Michaël Zasso) #​37587
• [1aea6a771b] - deps: fix V8 build issue with inline methods (Jiawen Geng) #​40060
• [e9812157f0] - deps: make v8.h compatible with VS2015 (Joao Reis) #​32116
• [88ae710057] - deps: V8: forward declaration of Rtl*FunctionTable (Refael Ackermann) #​32116
• [e810f0766f] - deps: V8: patch register-arm64.h (Refael Ackermann) #​32116
• [b8aabd5622] - deps: V8: un-cherry-pick bd019bd (Refael Ackermann) #​32116
• [309c4f05df] - (SEMVER-MINOR) deps: update V8 to 9.4.146.19 (Michaël Zasso) #​40285
• [69eaaf6321] - doc: format general markdown files (Rich Trott) #​40322
• [dc9c31985c] - doc: fix the inline code-block at the NodeDhKeyGenParams class (Justin) #​40341
• [8d0546db39] - doc: correct the codeblock for hmacImportParams.hash (Justin) #​40340
• [1db2ffd008] - doc: fix typo in stream docs (Juan José Arboleda) #​40337
• [abfcbcd14c] - doc: update fast-track approval comment request (voltrexmaster) #​40316
• [e2cd2f44f2] - doc: fix CVE-2021-22940 references (Michaël Zasso) #​40308
• [88bdbf1e29] - doc: format markdown files in test directory (Rich Trott) #​40290
• [f71ac57a86] - doc: add triagers to the table of contents (FrankQiu) #​39969
• [a5218b5313] - doc: update Forrest Norvell's pronouns (Forrest L Norvell) #​40292
• [d2e54e5d0c] - doc: reorder stream 'readable' paragraphs (Vincent Weevers) #​40212
• [1d0a3e1a0c] - doc: fix typo in fs (Brian White) #​40257
• [66edb7bfe1] - doc: fix typo in fs.md (Arslan Ali) #​40254
• [614a7c21f8] - doc: fix typo in packages.md (Arslan Ali) #​40230
• [9fa6dfbe76] - doc: fix example of crypto.generateKeySync (Gary Ho) #​40225
• [9a2b94a142] - doc: update fs.watchFile doc (Clément Nardi) #​40134
• [a68f91c884] - doc: add version when diagnostics_channel APIs were added (Gerhard Stöbich) #​40208
• [6bf67909ad] - doc: fix typo in 'maxHeaderSize' (Rebhi Alfa) #​40164
• [73a127ba7b] - doc: fix buffer api example code's token error (m3m0ry) #​40125
• [59db8293f4] - doc: fix typo in async_hooks.md (xuchaobei) #​40187
• [779dfd199b] - doc: make version picker usable on mobile (Evan Lucas) #​39958
• [7bd62f4809] - doc: fix typos in http.md (Luigi Pinca) #​40161
• [94b415b980] - doc: add blank line between comments (Rich Trott) #​40160
• [847b451d88] - doc: update markdown files in src for upcoming linting/formatting (Rich Trott) #​40159
• [cea7395858] - doc: update benchmarks README.md for upcoming linting/formatting (Rich Trott) #​40158
• [c231745837] - doc: prepare markdown file for upcoming formatting/linting (Rich Trott) #​40156
• [7e58cda6e0] - doc: update tools .md files for upcoming lint/formatting (Rich Trott) #​40155
• [02a87b096c] - doc: update markdown formatting for *.md files (Rich Trott) #​40154
• [9b0e61a67f] - doc,src: update crypto/README.md (Tobias Nießen) #​40332
• [88e7bd073a] - events: allow dispatch many times without listener (MrBBot) #​39772
• [c7f3294d02] - (SEMVER-MINOR) fs: add stream utilities to FileHandle (Antoine du Hamel) #​40009
• [555af5b808] - http: remove 'data' and 'end' listener if client parser error (Matteo Collina) #​40244
• [22725f5bdd] - http: use 0 as default for requests limit (Artur K) #​40192
• [3d5eba8042] - lib: refactor to avoid unsafe array iteration (Antoine du Hamel) #​40271
• [547fc86371] - lib: use validateArray (Voltrex) #​39774
• [a37527ce8f] - meta: add mailmap entry for ratracegrad (Rich Trott) #​40291
• [a75a8f2ca0] - meta: update AUTHORS (Node.js GitHub Bot) #​40289
• [66ab278bae] - meta: add .mailmap entry for Jimbly (Rich Trott) #​40267
• [e040f2cf0d] - meta: add .mailmap entry for daguej (Rich Trott) #​40223
• [d64740fbb3] - meta: update AUTHORS (Node.js GitHub Bot) #​40217
• [9ee9e41f5c] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #​40115
• [da6c82b425] - meta: update gdams contact information (Rich Trott) #​40233
• [a660017915] - meta: add .mailmap entry for kunalspathak (Rich Trott) #​40202
• [4d46bde22e] - meta: add mailmap entry for ralphtheninja (Rich Trott) #​40153
• [b856886d00] - meta: update mailmap for LakshmiSwethaG (Rich Trott) #​40172
• [972d921855] - module: fix ERR_REQUIRE_ESM for parentPath null (Guy Bedford) #​40145
• [344c03b2e6] - repl: skip EmptyStatements and return result with TLA (Mestery) #​40194
• [b694b0ca52] - src: use As() instead of Cast() for conversions (Darshan Sen) #​40287
• [383dbe940d] - src: implement changes suggested by @​addaleax (kokke) #​40128
• [a6112dd1de] - src: fix time-of-use vs time-of-check "bugs" (kokke) #​40128
• [bbf1ed7c78] - src: remove AllocatedBuffer from crypto_common.cc (Darshan Sen) #​40213
• [528f9228fd] - src: remove usage of AllocatedBuffer from udp_wrap.cc (Darshan Sen) #​40151
• [d36127d862] - src: move ToUSVString() to node_util.cc (Khaidi Chu) #​40204
• [bddf8c28d9] - src,crypto: eliminate code duplication between StatelessDiffieHellman* (Darshan Sen) #​40084
• [6a8689f1f9] - test: fix typo in test/common/index.js (Tobias Nießen) #​40297
• [dc0c2744cf] - test: suppress compiler warning in test_bigint (Daniel Bevenius) #​40253
• [18820bfa58] - tools: patch jinja2 for Python 3.10 compat (Michaël Zasso) #​40296
• [8d7710e6c3] - tools: update rollup entry in lint-md package.json (FrankQiu) #​40281
• [7bb4dc2406] - tools: update certdata.txt (Richard Lau) #​40280
• [f31b0c9700] - tools: update remark-preset-lint-node to 3.2.0 (Rich Trott) #​40278
• [9c4e7a5158] - tools: fix lint-md autolinking (Rich Trott) #​40181
• [26db6db87f] - tools: implement markdown formatting (Rich Trott) #​40181
• [67812e8c65] - tools: re-implement lint-md without unified-args (Rich Trott) #​40180
• [0232f94175] - tools: update remark-preset-lint-node to 3.1.0 (Rich Trott) #​40166
• [80fdedd184] - tools: fix find-inactive-collaborators for recent README change (Rich Trott) #​40163
• [ebf17102d1] - tools: extend default yamllint config (Michaël Zasso) #​40150
• [f7c82749a7] - tools: update V8 gypfiles for 9.4 (Michaël Zasso) #​39945
• [dd39422b8b] - typings: define types for symbols binding (Michaël Zasso) #​40143
• [ced8467e20] - typings: define types for worker and messaging bindings (Michaël Zasso) #​40143
• [66d3101677] - (SEMVER-MINOR) util: improve ansi escape code regex (Colin Ihrig) #​40214
• [f4164fa4c3] - (SEMVER-MINOR) util: expose stripVTControlCharacters() (Colin Ihrig) #​40214

---

Configuration

📅 Schedule: "after 10pm every weekday,before 5am every weekday,every weekend" (UTC).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

---

• If you want to rebase/retry this MR, click this checkbox.

---

This MR has been generated by Renovate Bot.