Skip to content

Releases: nodejs/node

2024-05-21, Version 18.20.3 'Hydrogen' (LTS), @richardlau

21 May 12:18
@richardlau richardlau
v18.20.3
This tag was signed with the committer’s verified signature.
richardlau Richard Lau
GPG key ID: C43CEC45C17AB93C
Learn about vigilant mode.
64903b1
This commit was signed with the committer’s verified signature.
richardlau Richard Lau
GPG key ID: C43CEC45C17AB93C
Learn about vigilant mode.
Compare
Choose a tag to compare
2024-05-21, Version 18.20.3 'Hydrogen' (LTS), @richardlau

Notable Changes

This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections.

A fix has also been included for compiling Node.js from source with newer versions of Clang.

The list of keys used to sign releases has been synchronized with the current list from the main branch.

Updated dependencies

  • acorn updated to 8.11.3.
  • acorn-walk updated to 8.3.2.
  • ada updated to 2.7.8.
  • c-ares updated to 1.28.1.
  • corepack updated to 0.28.0.
  • nghttp2 updated to 1.61.0.
  • ngtcp2 updated to 1.3.0.
  • npm updated to 10.7.0. Includes a fix from [email protected] to limit the number of open connections npm/cli#7324.
  • simdutf updated to 5.2.4.
  • zlib updated to 1.3.0.1-motley-7d77fb7.

Commits

Assets 2
Loading

2024-05-15, Version 22.2.0 (Current), @targos

15 May 19:28
@targos targos
v22.2.0
This tag was signed with the committer’s verified signature.
targos MichaΓ«l Zasso
GPG key ID: 770F7A9A5AE15600
Learn about vigilant mode.
d57af10
This commit was signed with the committer’s verified signature.
targos MichaΓ«l Zasso
GPG key ID: 770F7A9A5AE15600
Learn about vigilant mode.
Compare
Choose a tag to compare
2024-05-15, Version 22.2.0 (Current), @targos

Notable Changes

  • [fb85d38e80] - (SEMVER-MINOR) cli: allow running wasm in limited vmem with --disable-wasm-trap-handler (Joyee Cheung) #52766
  • [23a0d3339f] - doc: add pimterry to collaborators (Tim Perry) #52874
  • [7d7a762156] - (SEMVER-MINOR) fs: allow 'withFileTypes' to be used with globs (Aviv Keller) #52837
  • [8748dd6477] - (SEMVER-MINOR) inspector: introduce the --inspect-wait flag (Kohei Ueno) #52734
  • [9a7ae9b6c4] - lib,src: remove --experimental-policy (Rafael Gonzaga) #52583
  • [1f7c2a93fc] - (SEMVER-MINOR) perf_hooks: add deliveryType and responseStatus fields (Matthew Aitken) #51589
  • [2f59529dc5] - (SEMVER-MINOR) test_runner: support test plans (Colin Ihrig) #52860
  • [6b4dac3eb5] - (SEMVER-MINOR) zlib: expose zlib.crc32() (Joyee Cheung) #52692

Commits

Read more
Assets 2
Loading

2024-05-09, Version 20.13.1 'Iron' (LTS), @marco-ippolito

09 May 10:45
@marco-ippolito marco-ippolito
v20.13.1
This tag was signed with the committer’s verified signature.
marco-ippolito Marco Ippolito
GPG key ID: 27F5E38D5B0A215F
Learn about vigilant mode.
b965ddd
Compare
Choose a tag to compare
2024-05-09, Version 20.13.1 'Iron' (LTS), @marco-ippolito

2024-05-09, Version 20.13.1 'Iron' (LTS), @marco-ippolito

Revert "tools: install npm PowerShell scripts on Windows"

Due to a regression in the npm installation on Windows, this commit reverts the change that installed npm PowerShell scripts on Windows.

Commits

  • [b7d80802cc] - Revert "tools: install npm PowerShell scripts on Windows" (marco-ippolito) #52897

Contributors

marco-ippolito
Assets 2
Loading

2024-05-07, Version 20.13.0 'Iron' (LTS), @marco-ippolito

07 May 15:53
@marco-ippolito marco-ippolito
v20.13.0
This tag was signed with the committer’s verified signature.
marco-ippolito Marco Ippolito
GPG key ID: 27F5E38D5B0A215F
Learn about vigilant mode.
0d0efa4
Compare
Choose a tag to compare
2024-05-07, Version 20.13.0 'Iron' (LTS), @marco-ippolito

2024-05-07, Version 20.13.0 'Iron' (LTS), @marco-ippolito

buffer: improve base64 and base64url performance

The performance of the base64 and base64url encoding and decoding functions has been improved significantly.

Contributed by Yagiz Nizipli in #52428

crypto: deprecate implicitly shortened GCM tags

This release, introduces a doc-only deprecation of using GCM authentication tags that are shorter than the cipher's block size, unless the user specified the authTagLength option.

Contributed by Tobias Nießen in #52345

events,doc: mark CustomEvent as stable

From this release CustomEvent has been marked stable.

Contributed by Daeyeon Jeong in #52618

fs: add stacktrace to fs/promises

Sync functions in fs throwed an error with a stacktrace which is helpful for debugging. But functions in fs/promises throwed an error without a stacktrace. This commit adds stacktraces by calling Error.captureStacktrace and re-throwing the error.

Contributed by ηΏ  / green in #49849

report: add --report-exclude-network option

New option --report-exclude-network, also available as report.excludeNetwork, enables the user to exclude networking interfaces in their diagnostic report. On some systems, this can cause the report to take minutes to generate so this option can be used to optimize that.

Contributed by Ethan Arrowood in #51645

src: add uv_get_available_memory to report and process

From this release it is possible to get the available memory in the system by calling process.getAvailableMemory().

Contributed by theanarkh #52023

stream: support typed arrays

This commit adds support for typed arrays in streams.

Contributed by IlyasShabi #51866

util: support array of formats in util.styleText

It is now possible to pass an array of format strings to util.styleText to apply multiple formats to the same text.

console.log(util.styleText(['underline', 'italic'], 'My italic underlined message'));

Contributed by Marco Ippolito in #52040

v8: implement v8.queryObjects() for memory leak regression testing

This is similar to the queryObjects() console API provided by the Chromium DevTools console. It can be used to search for objects that have the matching constructor on its prototype chain in the heap after a full garbage collection, which can be useful for memory leak regression tests.
To avoid surprising results, users should avoid using this API on constructors whose implementation they don't control, or on constructors that can be invoked by other parties in the application.

To avoid accidental leaks, this API does not return raw references to the objects found. By default, it returns the count of the objects found. If options.format is 'summary', it returns an array containing brief string representations for each object. The visibility provided in this API is similar to what the heap snapshot provides, while users can save the cost of serialization and parsing and directly filer the target objects during the search.

We have been using this API internally for the test suite, which has been more stable than any other leak regression testing strategies in the CI. With a public implementation we can now use the public API instead.

const { queryObjects } = require('node:v8');
class A { foo = 'bar'; }
console.log(queryObjects(A)); // 0
let a = new A();
console.log(queryObjects(A)); // 1
// [ "A { foo: 'bar' }" ]
console.log(queryObjects(A, { format: 'summary' }));

// Release the object.
a = null;
// Search again. queryObjects() includes a full garbage collection
// so a should disappear.
console.log(queryObjects(A)); // 0

class B extends A { bar = 'qux'; }
// The child class B's prototype has A's prototype on its prototype chain
// so the prototype object shows up too.
console.log(queryObjects(A, { format: 'summary' })); // [ A {}' ]

Contributed by Joyee Cheung in #51927

watch: mark as stable

From this release Watch Mode is considered stable.
When in watch mode, changes in the watched files cause the Node.js process to restart.

Contributed by Moshe Atlow in #52074

Other Notable Changes

  • [f8ad30048d] - benchmark: add AbortSignal.abort benchmarks (Raz Luvaton) #52408
  • [3b41da9a56] - (SEMVER-MINOR) deps: update simdutf to 5.0.0 (Daniel Lemire) #52138
  • [0a08c4a7b3] - (SEMVER-MINOR) deps: update undici to 6.3.0 (Node.js GitHub Bot) #51462
  • [f1b7bda4f5] - (SEMVER-MINOR) deps: update undici to 6.2.1 (Node.js GitHub Bot) #51278
  • [4acca8ed84] - (SEMVER-MINOR) dns: add order option and support ipv6first (Paolo Insogna) #52492
  • [cc67720ff9] - doc: update release gpg keyserver (marco-ippolito) #52257
  • [c2def7df96] - doc: add release key for marco-ippolito (marco-ippolito) #52257
  • [807c89cb26] - doc: add UlisesGascon as a collaborator (Ulises GascΓ³n) #51991
  • [5e78a20ef9] - (SEMVER-MINOR) doc: deprecate fs.Stats public constructor (Marco Ippolito) #51879
  • [722fe64ff7] - (SEMVER-MINOR) lib, url: add a windows option to path parsing (Aviv Keller) #52509
  • [d116fa1568] - (SEMVER-MINOR) net: add CLI option for autoSelectFamilyAttemptTimeout (Paolo Insogna) #52474
  • [6af7b78b0d] - (SEMVER-MINOR) src: add string_view overload to snapshot FromBlob (Anna Henningsen) #52595
  • [b3a11b574b] - (SEMVER-MINOR) src: preload function for Environment (Cheng Zhao) #51539
  • [41646d9c9e] - (SEMVER-MINOR) test_runner: add suite() (Colin Ihrig) #52127
  • [fc9ba17f6c] - (SEMVER-MINOR) test_runner: add test:complete event to reflect execution order (Moshe Atlow) #51909

Commits

  • [6fdd748b21] - benchmark: reduce the buffer size for blob (Debadree Chatterjee) #52548
  • [2274d0c868] - benchmark: inherit stdio/stderr instead of pipe (Ali Hassan) #52456
  • [0300598315] - benchmark: add ipc support to spawn stdio config (Ali Hassan) #52456
  • [f8ad30048d] - benchmark: add AbortSignal.abort benchmarks (Raz Luvaton) #52408
  • [7508d48736] - benchmark: conditionally use spawn with taskset for cpu pinning (Ali Hassan) #52253
  • [ea8e72e185] - benchmark: add toNamespacedPath bench (Rafael Gonzaga) #52236
  • [c00715cc1e] - benchmark: add style-text benchmark (Rafael Gonzaga) #52004
  • [1c1a6935ee] - buffer: add missing ARG_TYPE(ArrayBuffer) for isUtf8 (Jungku Lee) #52477
  • [1b2aff7dce] - buffer: improve base64 and base64url performance (Yagiz Nizipli) #52428
  • [328bded5ab] - buffer: improve btoa performance (Yagiz Nizipli) #52427
  • [e67bc34326] - buffer: use simdutf for atob implementation (Yagiz Nizipli) #52381
  • [5abddb45d8] - build: fix typo in node.gyp (MichaΓ«l Zasso) #52719
    ...
Read more

Contributors

marco-ippolito
Assets 2
Loading

2024-05-02, Version 22.1.0 (Current), @targos prepared by @aduh95

02 May 14:40
@targos targos
v22.1.0
This tag was signed with the committer’s verified signature.
targos MichaΓ«l Zasso
GPG key ID: 770F7A9A5AE15600
Learn about vigilant mode.
87b87a8
This commit was signed with the committer’s verified signature.
aduh95 Antoine du Hamel
GPG key ID: 21D900FFDB233756
Learn about vigilant mode.
Compare
Choose a tag to compare
2024-05-02, Version 22.1.0 (Current), @targos prepared by @aduh95

module: implement NODE_COMPILE_CACHE for automatic on-disk code caching

This patch implements automatic on-disk code caching that can be enabled
via an environment variable NODE_COMPILE_CACHE=/path/to/cache/dir.

When set, whenever Node.js compiles a CommonJS or a ECMAScript Module,
it will use on-disk V8 code cache
persisted in the specified directory
to speed up the compilation. This may slow down the first load of a
module graph, but subsequent loads of the same module graph may get
a significant speedup if the contents of the modules do not change.
Locally, this speeds up loading of test/fixtures/snapshot/typescript.js
from ~130ms to ~80ms.

To clean up the generated code cache, simply remove the directory.
It will be recreated the next time the same directory is used for
NODE_COMPILE_CACHE.

Compilation cache generated by one version of Node.js may not be used
by a different version of Node.js. Cache generated by different versions
of Node.js will be stored separately if the same directory is used
to persist the cache, so they can co-exist.

Caveat: currently when using this with V8 JavaScript code coverage, the
coverage being collected by V8 may be less precise in functions that are
deserialized from the code cache. It's recommended to turn this off when
running tests to generate precise coverage.

Contributed by Joyee Cheung in #52535.

Other Notable Changes

  • [44ee04cf9f] - buffer: improve base64 and base64url performance (Yagiz Nizipli) #52428
  • [3c37ce5710] - (SEMVER-MINOR) dns: add order option and support ipv6first (Paolo Insogna) #52492
  • [3026401be1] - events,doc: mark CustomEvent as stable (Daeyeon Jeong) #52618
  • [64428dc1c9] - (SEMVER-MINOR) lib, url: add a windows option to path parsing (Aviv Keller) #52509
  • [d79ae74f71] - (SEMVER-MINOR) net: add CLI option for autoSelectFamilyAttemptTimeout (Paolo Insogna) #52474
  • [43fa6a1a45] - (SEMVER-MINOR) src: add string_view overload to snapshot FromBlob (Anna Henningsen) #52595
  • [c6fe433d42] - src,permission: throw async errors on async APIs (Rafael Gonzaga) #52730
  • [e247a61d15] - (SEMVER-MINOR) test_runner: add --test-skip-pattern cli option (Aviv Keller) #52529
  • [9b18df9dcb] - (SEMVER-MINOR) url: implement parse method for safer URL parsing (Ali Hassan) #52280

Commits

Read more
Assets 2
Loading

2024-04-24, Version 22.0.0 (Current), @RafaelGSS and @marco-ippolito

24 Apr 18:25
@RafaelGSS RafaelGSS
v22.0.0
This tag was signed with the committer’s verified signature.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Learn about vigilant mode.
12fb157
Compare
Choose a tag to compare
2024-04-24, Version 22.0.0 (Current), @RafaelGSS and @marco-ippolito

We're excited to announce the release of Node.js 22!
Highlights include require()ing ESM graphs, WebSocket client, updates of the V8 JavaScript engine, and more!
As a reminder, Node.js 22 will enter long-term support (LTS) in October, but until then, it will be the "Current" release for the next six months.
We encourage you to explore the new features and benefits offered by this latest release and evaluate their potential impact on your applications.

Other Notable Changes

  • [25c79f3331] - esm: drop support for import assertions (NicolΓ² Ribaudo) #52104
  • [818c10e86d] - lib: improve perf of AbortSignal creation (Raz Luvaton) #52408
  • [4f68c7c1c9] - watch: mark as stable (Moshe Atlow) #52074
  • [02b0bc01fe] - (SEMVER-MAJOR) deps: update V8 to 12.4.254.14 (MichaΓ«l Zasso) #52465
  • [c975384264] - (SEMVER-MAJOR) lib: enable WebSocket by default (Aras Abbasi) #51594
  • [1abff07392] - (SEMVER-MAJOR) stream: bump default highWaterMark (Robert Nagy) #52037
  • [1a5acd0638] - (SEMVER-MAJOR) v8: enable maglev on supported architectures (Keyhan Vakil) #51360
  • [128c60d906] - (SEMVER-MINOR) cli: implement node --run <script-in-package-json> (Yagiz Nizipli) #52190
  • [151d365ad1] - (SEMVER-MINOR) fs: expose glob and globSync (Moshe Atlow) #51912
  • [5f7fad2605] - (SEMVER-MINOR) module: support require()ing synchronous ESM graphs (Joyee Cheung) #51977

Semver-Major Commits

  • [2b1e7c2fcb] - (SEMVER-MAJOR) build: compile with C++20 support on Windows (StefanStojanovic) #52465
  • [12d00f1479] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (MichaΓ«l Zasso) #52465
  • [5f08e11a3c] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (MichaΓ«l Zasso) #52293
  • [94f0369d1d] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (MichaΓ«l Zasso) #51362
  • [58674cd1d8] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (MichaΓ«l Zasso) #50115
  • [60e836427e] - (SEMVER-MAJOR) console: treat non-strings as separate argument in console.assert() (Jacob Hummer) #49722
  • [d62ab3a1ef] - (SEMVER-MAJOR) crypto: runtime deprecate hmac constructor (Marco Ippolito) #52071
  • [de0602d190] - (SEMVER-MAJOR) crypto: runtime deprecate Hash constructor (Marco Ippolito) #51880
  • [215f4d04b7] - (SEMVER-MAJOR) crypto: move createCipher and createDecipher to eol (Marco Ippolito) #50973
  • [30801b8aaf] - (SEMVER-MAJOR) deps: V8: cherry-pick cd10ad7cdbe5 (Joyee Cheung) #52465
  • [521b629ab1] - (SEMVER-MAJOR) deps: V8: revert CL 5331688 (MichaΓ«l Zasso) #52465
  • [3795e97e6c] - (SEMVER-MAJOR) deps: patch V8 to support compilation with MSVC (StefanStojanovic) #52465
  • [5bde9e677d] - (SEMVER-MAJOR) deps: silence internal V8 deprecation warning (MichaΓ«l Zasso) #52465
  • [46e628c6f2] - (SEMVER-MAJOR) deps: patch V8 to avoid duplicated zlib symbol (MichaΓ«l Zasso) #52465
  • [f824e40a82] - (SEMVER-MAJOR) deps: remove usage of a C++20 feature from V8 (MichaΓ«l Zasso) #52465
  • [d2c84c9a13] - (SEMVER-MAJOR) deps: avoid compilation error with ASan (MichaΓ«l Zasso) #52465
  • [95d6045bdb] - (SEMVER-MAJOR) deps: disable V8 concurrent sparkplug compilation (MichaΓ«l Zasso) #52465
  • [00f55f5743] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (MichaΓ«l Zasso) #52465
  • [764085aa66] - (SEMVER-MAJOR) deps: always define V8_EXPORT_PRIVATE as no-op (MichaΓ«l Zasso) #52465
  • [02b0bc01fe] - (SEMVER-MAJOR) deps: update V8 to 12.4.254.14 (MichaΓ«l Zasso) #52465
  • [0ec50a19dd] - (SEMVER-MAJOR) deps: V8: cherry-pick cd10ad7cdbe5 (Joyee Cheung) #52293
  • [021b0b7dee] - (SEMVER-MAJOR) deps: V8: backport c4be0a97f981 (Richard Lau) #52293
  • [681aaf85c7] - (SEMVER-MAJOR) deps: silence internal V8 deprecation warning (MichaΓ«l Zasso) #52293
  • [c563a1c4e4] - (SEMVER-MAJOR) deps: patch V8 to support compilation with MSVC (Stefan Stojanovic) #52293
  • [11e94b9987] - (SEMVER-MAJOR) deps: patch V8 to avoid duplicated zlib symbol (MichaΓ«l Zasso) #52293
  • [856163e23c] - (SEMVER-MAJOR) deps: remove usage of a C++20 feature from V8 (MichaΓ«l Zasso) #52293
  • [b530214127] - (SEMVER-MAJOR) deps: avoid compilation error with ASan (MichaΓ«l Zasso) #52293
  • [8054f69dd9] - (SEMVER-MAJOR) deps: disable V8 concurrent sparkplug compilation (MichaΓ«l Zasso) #52293
  • [dee908be42] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (MichaΓ«l Zasso) #52293
  • [cf069414ee] - (SEMVER-MAJOR) deps: always define V8_EXPORT_PRIVATE as no-op (MichaΓ«l Zasso) #52293
  • [cc5792dd85] - (SEMVER-MAJOR) deps: update V8 to 12.3.219.16 (MichaΓ«l Zasso) #52293
  • [61a0d3b4c4] - (SEMVER-MAJOR) deps: V8: backport c4be0a97f981 (Richard Lau) #51362
  • [f55380a725] - (SEMVER-MAJOR) deps: V8: cherry-pick f8d5e576b814 (Richard Lau) #51362
  • [b9d806a2dd] - (SEMVER-MAJOR) deps: patch V8 to support compilation with MSVC (StefanStojanovic) #51362
  • [63b58bc17b] - (SEMVER-MAJOR) deps: patch V8 to avoid duplicated zlib symbol (MichaΓ«l Zasso) #51362
  • [86056353c4] - (SEMVER-MAJOR) deps: remove usage of a C++20 feature from V8 (MichaΓ«l Zasso) #51362
  • [[2e0efc1c8d](2e0efc1c8...
Read more
Assets 2
Loading

2024-04-10, Version 21.7.3 (Current), @RafaelGSS

10 Apr 16:35
@RafaelGSS RafaelGSS
v21.7.3
This tag was signed with the committer’s verified signature.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Learn about vigilant mode.
97297e9
Compare
Choose a tag to compare
2024-04-10, Version 21.7.3 (Current), @RafaelGSS

This is a security release.

Notable Changes

  • CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows

Commits

Assets 2
Loading

2024-04-10, Version 20.12.2 'Iron' (LTS), @RafaelGSS

10 Apr 16:35
@RafaelGSS RafaelGSS
v20.12.2
This tag was signed with the committer’s verified signature.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Learn about vigilant mode.
b3f0c61
Compare
Choose a tag to compare
2024-04-10, Version 20.12.2 'Iron' (LTS), @RafaelGSS

This is a security release.

Notable Changes

  • CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows

Commits

Assets 2
Loading

2024-04-10, Version 18.20.2 'Hydrogen' (LTS), @RafaelGSS

10 Apr 16:34
@RafaelGSS RafaelGSS
v18.20.2
This tag was signed with the committer’s verified signature.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Learn about vigilant mode.
9aedf16
Compare
Choose a tag to compare
2024-04-10, Version 18.20.2 'Hydrogen' (LTS), @RafaelGSS

This is a security release.

Notable Changes

  • CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows

Commits

Assets 2
Loading

2024-04-03, Version 21.7.2 (Current), @RafaelGSS prepared by @marco-ippolito

03 Apr 14:26
@RafaelGSS RafaelGSS
v21.7.2
This tag was signed with the committer’s verified signature.
RafaelGSS Rafael Gonzaga
GPG key ID: 8BEAB4DFCF555EF4
Learn about vigilant mode.
d4a1d05
Compare
Choose a tag to compare
2024-04-03, Version 21.7.2 (Current), @RafaelGSS prepared by @marco-ippolito

This is a security release.

Notable changes

  • CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)
  • CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation- (Medium)
  • llhttp version 9.2.1
  • undici version 6.11.1

Commits

Assets 2
Loading