Skip to content

chore(deps): update node.js to v16

bullshit requested to merge renovate/node-16.x into develop

This MR contains the following updates:

Package Update Change
node major v14 -> 16

Release Notes

nodejs/node

v16.13.1

Compare Source

Notable Changes
  • [c14eb2325d] - deps: upgrade npm to 8.1.2 (npm team) #​40643
  • [a901b6c53c] - deps: update c-ares to 1.18.1 (Richard Lau) #​40660
    • This release contains a c-ares update to fix a regression introduced in Node.js v16.6.2 resolving CNAME records containing underscores (#​39780).
  • [755c08573f] - doc: add VoltrexMaster to collaborators (voltrexmaster) #​40566
  • [881dd7ba2a] - lib: fix regular expression to detect `/` and `\` (Francesco Trotta) #​40325
Commits

v16.13.0

Compare Source

Notable Changes

This release marks the transition of Node.js 16.x into Long Term Support (LTS) with the codename 'Gallium'. The 16.x release line now moves into "Active LTS" and will remain so until October 2022. After that time, it will move into "Maintenance" until end of life in April 2024.

v16.12.0

Compare Source

Notable Changes
Experimental ESM Loader Hooks API

Node.js ESM Loader hooks have been consolidated to represent the steps involved needed to facilitate future loader chaining:

  1. resolve: resolve [+ getFormat]
  2. load: getFormat + getSource + transformSource

For consistency, getGlobalPreloadCode has been renamed to globalPreload.

A loader exporting obsolete hook(s) will trigger a single deprecation warning (per loader) listing the errant hooks.

Contributed by Jacob Smith, Geoffrey Booth, and Bradley Farias - https://github.com/nodejs/node/pull/37468

Other Notable Changes
Commits

v16.11.1

Compare Source

This is a security release.

Notable changes
  • CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
    • The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2021-22959 after publication.
  • CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)
    • The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details will be available at CVE-2021-22960 after publication.
Commits

v16.11.0

Compare Source

Notable Changes
  • crypto
    • update root certificates (Richard Lau) #​40280
  • deps
    • upgrade npm to 8.0.0 (npm team) #​40369
    • update nghttp2 to v1.45.1 (thunder-coding) #​40206
    • update V8 to 9.4.146.19 (Michaël Zasso) #​40285
  • tools
    • update certdata.txt (Richard Lau) #​40280
Commits

v16.10.0

Compare Source

Notable Changes
  • [fb226ff2ee] - (SEMVER-MINOR) crypto: add rsa-pss keygen parameters (Filip Skokan) #​39927
  • [85206b7311] - deps: upgrade npm to 7.24.0 (npm team) #​40167
  • [98f56d179c] - deps: update Acorn to v8.5.0 (Michaël Zasso) #​40015
  • [9655329772] - doc: add Ayase-252 to collaborators (Qingyu Deng) #​40078
  • [59fff925be] - (SEMVER-MINOR) fs: make open and close stream override optional when unused (Antoine du Hamel) #​40013
  • [a63a4bce90] - (SEMVER-MINOR) http: limit requests per connection (Artur K) #​40082
    • The maximum number of requests a socket can handle before closing keep alive connection can be set with server.maxRequestsPerSocket.
  • [9a672961fa] - (SEMVER-MINOR) src: add --no-global-search-paths cli option (Cheng Zhao) #​39754
    • Adds the --no-global-search-paths command-line option to not search modules from global paths like $HOME/.node_modules and $NODE_PATH.
  • [fe920b6cbf] - (SEMVER-MINOR) src: make napi_create_reference accept symbol (JckXia) #​39926
  • [97f3072ceb] - (SEMVER-MINOR) stream: add signal support to pipeline generators (Robert Nagy) #​39067
Commits

v16.9.1

Compare Source

Notable Changes

This release fixes a regression introduced by the V8 9.3 update in Node.js 16.9.0.

Commits

v16.9.0

Compare Source

Notable Changes
Corepack

Node.js now includes Corepack, a script that acts as a bridge between Node.js projects and the package managers they are intended to be used with during development. In practical terms, Corepack will let you use Yarn and pnpm without having to install them - just like what currently happens with npm, which is shipped in Node.js by default. Please head over to the Corepack documentation page for more information on how to use it.

Contributed by Maël Nison - #​39608

V8 9.3

V8 is updated to version 9.3, which includes performance improvements and new JavaScript features.

Object.hasOwn

Object.hasOwn is a static alias for Object.prototype.hasOwnProperty.call:

Object.hasOwn({ value: 42 }, 'value'); // Returns `true`.
Error cause

Errors can now be optionally constructed with a cause option, pointing to another error. This adds a cause property on the new error:

const error1 = new Error('Error one');
const error2 = new Error('Error two', { cause: error1 });
// error2.cause === error1

Contributed by Michaël Zasso - #​39947

Other Notable Changes
Commits

v16.8.0

Compare Source

Notable Changes
Commits

v16.7.0

Compare Source

Notable Changes
  • fs:
    • experimental: add recursive cp method (Benjamin Coe) #​39372
Commits

v16.6.2

Compare Source

This is a security release.

Notable Changes
  • CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)
    • Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of hostnames returned by Domain Name Servers in the Node.js DNS library which can lead to the output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22931.
  • CVE-2021-22940: Use after free on close http2 on stream canceling (High)
    • Node.js was vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix. You can read more about it at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22940.
  • CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low)
    • If the Node.js HTTPS API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22939.
Commits

v16.6.1

Compare Source

Notable Changes
  • Updated npm to 7.20.3 (npm team) #​39579
  • Reverted an ABI-breaking change from V8 9.2 that could impact some native modules (Michaël Zasso) #​39624
  • Fixed a bug in error handling known to affect at least Webpack and Jest (Guy Bedford) #​39593
Commits

v16.6.0

Compare Source

This is a security release.

Notable Changes
Say hello to V8 9.2

The V8 engine is updated to version 9.2.230.21.

It notably introduces the new Array.prototype.at method (also on Typed Arrays and strings):

const array = [1, 2, 3];

console.log(array.at(-1));
// Prints: 3

Contributed by Michaël Zasso - #​39470

Other notable changes
Commits

v16.5.0

Compare Source

Notable Changes
Experimental Web Streams API

Node.js now exposes an experimental implementation of the Web Streams API.

While it is experimental, the API is not exposed on the global object and is only accessible using the new stream/web core module:

import { ReadableStream, WritableStream } from 'stream/web';
// Or from 'node:stream/web'

Importing the module will emit a single experimental warning per process.

The raw API is implemented and we are now working on its integration with various existing core APIs.

Contributed by James M Snell - #​39062

Other notable changes
Commits

v16.4.2

Compare Source

Notable Changes

Node.js 16.4.1 introduced a regression in the Windows installer on non-English locales that is being fixed in this release. There is no need to download this release if you are not using the Windows installer.

Commits

v16.4.1

Compare Source

This is a security release.

Notable Changes

Vulnerabilities fixed:

  • CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)
    • Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918
  • CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)
    • Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22921
Commits

v16.4.0

Compare Source

Notable changes
  • async_hooks:
    • stabilize part of AsyncLocalStorage (Vladimir de Turckheim) #​37675
  • deps:
    • upgrade npm to 7.18.1 (npm team) #​39065
    • update V8 to 9.1.269.36 (Michaël Zasso) #​38273
  • dns:
    • allow --dns-result-order to change default dns verbatim (Ouyang Yadong) #​38099
Commits

v16.3.0

Compare Source

Notable Changes
  • cli:
    • add -C alias for --conditions flag (Guy Bedford) #​38755
  • deps:
    • add workspaces support to npm install commands (Ruy Adorno) #​38750
Commits

v16.2.0

Compare Source

Notable Changes
  • [36b948560c] - (SEMVER-MINOR) async_hooks: use new v8::Context PromiseHook API (Stephen Belanger) #​36394
  • [c0deeeacb2] - lib: support setting process.env.TZ on windows (James M Snell) #​38642
  • [4c4902748c] - (SEMVER-MINOR) module: add support for URL to import.meta.resolve (Antoine du Hamel) #​38587
  • [c182198c44] - (SEMVER-MINOR) process: add 'worker' event (James M Snell) #​38659
  • [fbf02e3198] - (SEMVER-MINOR) util: add util.types.isKeyObject and util.types.isCryptoKey (Filip Skokan) #​38619
Commits

v16.1.0

Compare Source

Notable Changes
  • [8a90f55a05] - (SEMVER-MINOR) fs: allow no-params fsPromises fileHandle read (Nitzan Uziely) #​38287
Commits

v16.0.0

Compare Source

Notable Changes
Deprecations and Removals
  • (SEMVER-MAJOR) fs: remove permissive rmdir recursive (Antoine du Hamel) #​37216
  • (SEMVER-MAJOR) fs: runtime deprecate rmdir recursive option (Antoine du Hamel) #​37302
  • (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('http_parser') (James M Snell) #​37813
  • (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('url') (James M Snell) #​37799
  • (SEMVER-MAJOR) lib: make process.binding('util') return only type checkers (Anna Henningsen) #​37819
  • (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('crypto') (James M Snell) #​37790
  • (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('signal_wrap') (James M Snell) #​37800
  • (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('v8') (James M Snell) #​37789
  • (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('async_wrap') (James M Snell) #​37576
  • (SEMVER-MAJOR) module: remove module.createRequireFromPath (Antoine du Hamel) #​37201
  • (SEMVER-MAJOR) module: runtime deprecate subpath folder mappings (Antoine du Hamel) #​37215
  • (SEMVER-MAJOR) module: runtime deprecate "main" index and extension lookups (Antoine du Hamel) #​37206
  • (SEMVER-MAJOR) module: runtime deprecate invalid package.json main entries (Antoine du Hamel) #​37204
  • (SEMVER-MAJOR) process: runtime deprecate changing process.config (James M Snell) #​36902
Stable Timers Promises API

The Timers Promises API provides an alternative set of timer functions that return Promise objects. Added in Node.js v15.0.0, in this release they graduate from experimental status to stable.

Contributed by James Snell - #​38112

Toolchain and Compiler Upgrades

Node.js v16.0.0 will be the first release where we ship prebuilt binaries for Apple Silicon. While we’ll be providing separate tarballs for the Intel (darwin-x64) and ARM (darwin-arm64) architectures the macOS installer (.pkg) will be shipped as a ‘fat’ (multi-architecture) binary.

  • (SEMVER-MAJOR) build: remove support for Python 2 (Christian Clauss) #​36691
  • (SEMVER-MAJOR) build: default PYTHON to python3 in Makefile (Michaël Zasso) #​37764
  • build: update Makefile to support fat binary (Ash Cripps) #​37861
  • (SEMVER-MAJOR) build: enable ASLR (PIE) on OS X (woodfairy) #​35704
  • build: warn for gcc versions earlier than 8.3.0 (Richard Lau) #​37935
  • (SEMVER-MAJOR) doc: update minimum supported Xcode to 11 (Michaël Zasso) #​37872
  • (SEMVER-MAJOR) doc: update minimum supported GCC to 8.3 (Michaël Zasso) #​37871
  • (SEMVER-MAJOR) doc: update AIX to GCC8 for v16.x (Ash Cripps) #​37677
  • tools: set arch in Distribution.xml (Ash Cripps) #​38261
V8 9.0

The V8 JavaScript engine is updated to V8 9.0, including performance tweaks and improvements.

This update also brings the ECMAScript RegExp Match Indices, which provide the start and end indices of the captured string. The indices array is available via the .indices property on match objects when the regular expression has the /d flag.

Contributed by Michaël Zasso - #​37587

Other Notable Changes
  • (SEMVER-MINOR) assert: graduate assert.match and assert.doesNotMatch (James M Snell) #​38111
  • (SEMVER-MAJOR) buffer: expose btoa and atob as globals (James M Snell) #​37786
  • (SEMVER-MAJOR) deps: bump minimum ICU version to 68 (Michaël Zasso) #​37330
  • deps: update ICU to 69.1 (Michaël Zasso) #​38178
  • deps: update llhttp to 6.0.0 (Fedor Indutny) #​38277
  • deps: upgrade npm to 7.10.0 (Ruy Adorno) #​38254
  • (SEMVER-MINOR) http: add http.ClientRequest.getRawHeaderNames() (simov) #​37660
  • (SEMVER-MAJOR) lib,src: update cluster to use Parent (Michael Dawson) #​36478
  • (SEMVER-MINOR) module: add support for node:‑prefixed require(…) calls (ExE Boss) #​37246
  • (SEMVER-MINOR) perf_hooks: add histogram option to timerify (James M Snell) #​37475
  • (SEMVER-MINOR) repl: add auto‑completion for node:‑prefixed require(…) calls (ExE Boss) #​37246
  • (SEMVER-MINOR) util: add getSystemErrorMap() impl (eladkeyshawn) #​38101
Semver-Major Commits
  • [324a6c235a] - (SEMVER-MAJOR) async_hooks: add thisArg to AsyncResource.bind (James M Snell) #​36782
  • [d1e2184c8e] - (SEMVER-MAJOR) buffer: expose btoa and atob as globals (James M Snell) #​37786
  • [4268fae04a] - (SEMVER-MAJOR) build: remove support for Python 2 (Christian Clauss) #​36691
  • [c3a5e15ebe] - (SEMVER-MAJOR) build: default PYTHON to python3 in Makefile (Michaël Zasso) #​37764
  • [1d8c022544] - (SEMVER-MAJOR) build: update Makefile to support fat binary (Ash Cripps) #​37861
  • [38f32386c1] - (SEMVER-MAJOR) build: include minimal V8 headers in distribution (Michaël Zasso) #​37570
  • [a19af5ee71] - (SEMVER-MAJOR) build: use C++11 ABI with libstdc++ (Anna Henningsen) #​36634
  • [8d6b74d347] - (SEMVER-MAJOR) build: enable ASLR (PIE) on OS X (woodfairy) #​35704
  • [732ad99e47] - (SEMVER-MAJOR) deps: update V8 to 9.0.257.11 (Michaël Zasso) #​37587
  • [43cc8e4b2e] - (SEMVER-MAJOR) deps: bump minimum ICU version to 68 (Michaël Zasso) #​37330
  • [c5ff019a4e] - (SEMVER-MAJOR) deps: update V8 to 8.9.255.19 (Michaël Zasso) #​37330
  • [c7b3292251] - (SEMVER-MAJOR) deps: update V8 to 8.8.278.17 (Michaël Zasso) #​36139
  • [48db20f6f5] - (SEMVER-MAJOR) deps: update V8 to 8.7.220 (Michaël Zasso) #​35700
  • [d85e1f0703] - (SEMVER-MAJOR) dns: use url module instead of punycode for IDNA (Antoine du Hamel) #​35091
  • [290c158018] - (SEMVER-MAJOR) doc: update minimum supported Xcode to 11 (Michaël Zasso) #​37872
  • [1ff2918d80] - (SEMVER-MAJOR) doc: update minimum supported GCC to 8.3 (Michaël Zasso) #​37871
  • [2706e67116] - (SEMVER-MAJOR) doc: update AIX to GCC8 for v16.x (Ash Cripps) #​37677
  • [5ae5ca90ef] - (SEMVER-MAJOR) doc: add http.IncomingMessage#connection (Pranshu Srivastava) #​33768
  • [83d6e63aee] - (SEMVER-MAJOR) events: change EventTarget handler exception behavior (Nitzan Uziely) #​37237
  • [9948036ee0] - (SEMVER-MAJOR) fs: remove permissive rmdir recursive (Antoine du Hamel) #​37216
  • [d4693ff430] - (SEMVER-MAJOR) fs: add validation for fd and path (Dylan Elliott) #​35187
  • [0ddd75bcd8] - (SEMVER-MAJOR) fs: runtime deprecate rmdir recursive option (Antoine du Hamel) #​37302
  • [da217d0773] - (SEMVER-MAJOR) fs: fix flag and mode validation (James M Snell) #​37480
  • [2ef9a76ece] - (SEMVER-MAJOR) http: use objects with null prototype in Agent (Michaël Zasso) #​36409
  • [25e30005b8] - (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('http_parser') (James M Snell) #​37813
  • [8bb4e048af] - (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('url') (James M Snell) #​37799
  • [fe73e4d578] - (SEMVER-MAJOR) lib: make process.binding('util') return only type checkers (Anna Henningsen) #​37819
  • [3bee6d8aad] - (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('crypto') (James M Snell) #​37790
  • [ac00df112e] - (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('signal_wrap') (James M Snell) #​37800
  • [ae595d76e3] - (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('v8') (James M Snell) #​37789
  • [104dac79cc] - (SEMVER-MAJOR) lib: aggregate errors to avoid error swallowing (Antoine du Hamel) #​37460
  • [1468c9ff7c] - (SEMVER-MAJOR) lib: runtime deprecate access to process.binding('async_wrap') (James M Snell) #​37576
  • [295e766c27] - (SEMVER-MAJOR) lib: remove usage of url.parse (raisinten) #​36853
  • [cb3020d824] - (SEMVER-MAJOR) lib: add error handling for input stream (rexagod) #​31603
  • [15164cebce] - (SEMVER-MAJOR) lib,src: update cluster to use Parent (Michael Dawson) #​36478
  • [3cc9aec988] - (SEMVER-MAJOR) module: runtime deprecate subpath folder mappings (Antoine du Hamel) #​37215
  • [9fab73c73b] - (SEMVER-MAJOR) module: runtime deprecate "main" index and extension lookups (Antoine du Hamel) #​37206
  • [76a073b67e] - (SEMVER-MAJOR) module: runtime deprecate invalid package.json main entries (Antoine du Hamel) #​37204
  • [674614b3f5] - (SEMVER-MAJOR) module: remove module.createRequireFromPath (Antoine du Hamel) #​37201
  • [aecd5ebf49] - (SEMVER-MAJOR) module: only set cache when finding module succeeds (Yongsheng Zhang) #​36642
  • [f0bf373176] - (SEMVER-MAJOR) perf_hooks: make performance a global (James M Snell) #​37970
  • [f3eb224c83] - (SEMVER-MAJOR) perf_hooks: complete overhaul of the implementation (James M Snell) #​37136
  • [f1753d4c76] - (SEMVER-MAJOR) process: disallow adding options to process.allowedNodeEnvironmentFlags (Antoine du Hamel) #​36660
  • [96f3977ded] - (SEMVER-MAJOR) process: runtime deprecate changing process.config (James M Snell) #​36902
  • [45dbcbef90] - (SEMVER-MAJOR) readline: cursorTo throw error on NaN (Zijian Liu) #​36379
  • [bf79987433] - (SEMVER-MAJOR) src: mark internally exported functions as explicitly internal (Tyler Ang-Wanek) #​37000
  • [1fe571aa0c] - (SEMVER-MAJOR) src: inline AsyncCleanupHookHandle in headers (Tyler Ang-Wanek) #​37000
  • [dfc288e7fd] - (SEMVER-MAJOR) src: clean up embedder API (Anna Henningsen) #​35897
  • [65e8864fa3] - (SEMVER-MAJOR) worker: send correct error status for worker init (Yash Ladha) #​36242
Semver-Minor Commits
  • [944a956087] - (SEMVER-MINOR) assert: graduate assert.match and assert.doesNotMatch (James M Snell) #​38111
  • [6a1986d50a] - (SEMVER-MINOR) deps: update llhttp to 5.1.0 (Fedor Indutny) #​38146
  • [069b5df4f6] - (SEMVER-MINOR) module: add support for node:‑prefixed require(…) calls (ExE Boss) #​37246
  • [b803bca4fa] - (SEMVER-MINOR) perf_hooks: add histogram option to timerify (James M Snell) #​37475
  • [95391fe689] - (SEMVER-MINOR) repl: add auto‑completion for node:‑prefixed require(…) calls (ExE Boss) #​37246
  • [15b8e6b1c4] - (SEMVER-MINOR) timers: graduate awaitable timers and improve docs (James M Snell) #​38112
  • [802171057f] - (SEMVER-MINOR) util: add getSystemErrorMap() impl (eladkeyshawn) #​38101
Semver-Patch Commits

Configuration

📅 Schedule: At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, click this checkbox.

This MR has been generated by Renovate Bot.

Merge request reports