News from 2016
-
Node v4.4.1 (LTS)
- build:
- tools:
- Gyp now works on OSX without XCode
- (Shigeki Ohtsu) nodejs/node#1325
- Gyp now works on OSX without XCode
- Node v5.9.0 (Stable)
- contextify: Fixed a memory consumption issue related to heavy use of
vm.createContextandvm.runInNewContext. (Ali Ijaz Sheikh) https://github.com/nodejs/node/pull/5392 - governance: The following members have been added as collaborators:
- Andreas Madsen (@AndreasMadsen)
- Benjamin Gruenbaum (@benjamingr)
- Claudio Rodriguez (@claudiorodriguez)
- Glen Keane (@thekemkid)
- Jeremy Whitlock (@whitlockjc)
- Matt Loring (@matthewloring)
- Phillip Johnsen (@phillipj)
- lib: copy arguments object instead of leaking it (Nathan Woltman) https://github.com/nodejs/node/pull/4361
- src: allow both -i and -e flags to be used at the same time (Rich Trott) https://github.com/nodejs/node/pull/5655
- timers: Internal Node.js timeouts now use the same logic path as those created with
setTimeout()(Jeremiah Senkpiel) #4007- This may cause a slightly different performance profile in some situations. So far, it has shown to be positive in most cases.
- v8: backport fb4ccae from v8 upstream (Vladimir Krivosheev) #4231
- breakout events from v8 to offer better support for external debuggers
- zlib: add support for concatenated members (Kári Tristan Helgason)
https://github.com/nodejs/node/pull/5120
- Previously, if multiple members were in the same archive, only the first would be read. The others are no longer thrown away.
- AppDynamics, New Relic, Opbeat and Sphinx Join the Node.js Foundation as Silver Members
SAN FRANCISCO, Mar. 9, 2016 — The Node.js Foundation, a community-led and industry-backed consortium to advance the development of the Node.js platform, today announced AppDynamics, New Relic, Opbeat and Sphinx are joining the Foundation as Silver Members to continue to sustain and grow the Node.js platform.
- Node v4.4.0 (LTS)
The SEMVER-MINOR changes include:
- deps:
- An update to v8 that introduces a new flag --perf_basic_prof_only_functions (Ali Ijaz Sheikh) #3609
- http:
- A new feature in http(s) agent that catches errors on keep alived connections (José F. Romaniello) #4482
- src:
- Better support for Big-Endian systems (Bryon Leung) #3410
- tls:
- A new feature that allows you to pass common SSL options to
tls.createSecurePair(Коренберг Марк) #2441
- A new feature that allows you to pass common SSL options to
- tools:
- a new flag
--prof-processwhich will execute the tick processor on the provided isolate files (Matt Loring) #4021
- a new flag
- Node v5.8.0 (Stable)
- child_process:
send()now accepts an options parameter (cjihrig) #5283.- Currently the only option is
keepOpen, which keeps the underlying socket open after the message is sent.
- Currently the only option is
- constants:
ENGINE_METHOD_RSAis now correctly exposed (Sam Roberts) #5463. - Fixed two regressions which originated in v5.7.0:
- repl:
start()no longer requires an options parameter (cjihrig) #5388. - util: Improved
format()performance 50-300% (Evan Lucas) #5360.
- Node v0.12.12 (LTS)
- openssl: Fully remove SSLv2 support, the
--enable-ssl2command line argument will now produce an error. The DROWN Attack (https://drownattack.com/) creates a vulnerability where SSLv2 is enabled by a server, even if a client connection is not using SSLv2. The SSLv2 protocol is widely considered unacceptably broken and should not be supported. More information is available at https://www.openssl.org/news/vulnerabilities.html#2016-0800
- Weekly Update - Mar 7th, 2016
Node v0.10.43 (Maintenance), Node v0.12.11 (LTS), Node v5.7.1 (Stable) and Node v4.3.2 (LTS) are released.
We have four releases: Node v0.10.43 (Maintenance), Node v0.12.11 (LTS), Node v5.7.1 (Stable) and Node v4.3.2 (LTS). Complete changelog from previous releases can be found on GitHub.
- Node v0.10.43 (Maintenance)
This release contains security updates. OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js. See our impact assessment for full details.
- Node v0.12.11 (LTS)
This release contains security updates. OpenSSL 1.0.1s fixes some low-severity defects that impact Node.js. See our impact assessment for full details.
- Node v5.7.1 (Stable)
↑ Scroll to top- governance: The Core Technical Committee (CTC) added four new members to help guide Node.js core development: Evan Lucas, Rich Trott, Ali Ijaz Sheikh and Сковорода Никита Андреевич (Nikita Skovoroda).
- openssl: Upgrade from 1.0.2f to 1.0.2g (Ben Noordhuis) #5507.
- Fix a double-free defect in parsing malformed DSA keys that may potentially be used for DoS or memory corruption attacks. It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users. More info is available at CVE-2016-0705.
- Fix a defect that can cause memory corruption in certain very rare cases relating to the internal
BN_hex2bn()andBN_dec2bn()functions. It is believed that Node.js is not invoking the code paths that use these functions so practical attacks via Node.js using this defect are unlikely to be possible. More info is available at CVE-2016-0797. - Fix a defect that makes the CacheBleed Attack possible. This defect enables attackers to execute side-channel attacks leading to the potential recovery of entire RSA private keys. It only affects the Intel Sandy Bridge (and possibly older) microarchitecture when using hyper-threading. Newer microarchitectures, including Haswell, are unaffected. More info is available at CVE-2016-0702.
- Fixed several regressions that appeared in v5.7.0:
- Node v4.3.2 (LTS)
- Weekly Update - Mar 1st, 2016
- OpenSSL updates, 1.0.2g and 1.0.1s
- Weekly Update - Feb 23rd, 2016
- Node v5.7.0 (Stable)
- Node v4.3.1 (LTS)
- Weekly Update - Feb 15th, 2016
- Node.js Foundation to Add Express to its Incubator Program
- February 2016 Security Release Summary
- Node v0.10.42 (LTS)
- Node v0.12.10 (LTS)
- Node v4.3.0 (LTS)
- Node v5.6.0 (Stable)
- Weekly Update - Feb 8th, 2016
- Weekly Update - Jan 29th, 2016
- OpenSSL upgrade low-severity Node.js security fixes
- Weekly Update - Jan 22th, 2016
- Node v4.2.6 (LTS)
- Node v5.5.0 (Stable)
- Node v4.2.5 (LTS)
- Weekly Update - Jan 18th, 2016
- Node v5.4.1 (Stable)
- Weekly Update - Jan 11th, 2016
- Node v5.4.0 (Stable)
- Weekly Update - Jan 1st, 2016