Bookmarks (84) clear filters

The February 2021 Security Releases Are Here — Updates are now available for each release line being maintained, including v15.10.0, v14.16.0, v12.21.0, and v10.24.0 to fix three security issues, one crucial. The crucial one is an HTTP2 DoS resource exhaustion vulnerability where a large number of specially crafted connection attempts could cause a file descriptor leak.

Node v15.9.0 (Current) Released — libuv gets an upgrade, fsPromises.watch() (think a promisified version of fs.watch), perf_hooks.createHistogram(), and more similarly small bits and pieces.

Node v14.15.5, v12.20.2 and v10.23.3 (LTS) Released — Brings npm up to version 6.14.11 and backports a security fix. v12.20.2 and v10.23.3 provide similar for their respective branches.

Node v15.8.0 (Current) Released — npm gets updated to 7.5 (which introduces the npm diff command), the crypto package gains a pseudo-random prime generator and checker, and readline gets some tweaks.

Node v15.7.0 (Current) Released — Nothing big, but Blob has been introduced to buffer as a first step to aligning with the Blob Web API and there’s now a base64url Buffer encoding option.

Node v15.6.0 (Current) Released — fork gains AbortSignal support, and Node’s cryptography library gains basic secure heap support, a X509Certificate API, and a randomUUID function.

The January 2021 Node Security Releases — As promised in December, we have new versions of Node all round, including Node 15.5.1, 14.15.4 12.20.1, and 10.23.1. Why? A bug in the TLS implementation mostly, but also a HTTP request header smuggling bug – neither of which you want in your production environments.

Node v15.4.0 (Current) Released — Nothing huge here, but child_process now supports abort signals, as do readable streams, the main ICU (Unicode) dependency has been updated, and there’s a “very experimental and definitely not finished” BroadcastChannel implementation for worker threads (based upon the Web feature of the same name).

Node v15.3.0 (Current) Released — A variety of relatively minor things this time for the latest version of Node although http.request has gained support for aborting requests with AbortSignal, readline.getPrompt will return the current prompt, and you can cancel DNS queries made by resolver.

Node.js November 2020 Security Releases — Node 12.19.1, 14.15.1 and 15.2.1 have been released, all to address a high severity DoS vulnerability. If your Node app lets third parties trigger DNS requests for a host of their choice, this can, in theory, be abused to bring down your app.

Node v15.2.0 (Current) Released — Last week we made a pretty big deal about Node 15.1.0, but luckily Node 15.2 is a simpler release. You can now use an abort signal to stop an ongoing read or write with fs.writeFile (example) or fs.readFile.

Node v15.1.0 (Current) Released — If you need to get away from the stresses and strains of the week for a bit, why not play with the newest Node release? It has a few neat new bits to check out: Diagnostics Channels: A new experimental module (diagnostics_channel) that lets you create named channels for passing diagnostics related messages around – check out the example...

Node 14 Becomes LTS; v14.15.0 Released — Last week we did a big feature on the release of Node 15 which became the new ‘release’ line Node release. In turn Node 14 graduates to being a ‘Long Term Support’ (LTS) release you can depend upon until at least April 2023.

Node v14.13.1 (Current) Released — A very minor release that packs in the usual tweaks and dependency updates, but also makes the fs.rmdir’s recursive option non-‘experimental’ at last for all your mass file deletion needs.

Node v14.13.0 (Current) Released — Another basic, straightforward current release without any major features. libuv gets updated to v1.40.0 and support has been added for an export patterns scheme supporting wildcards (e.g. */*.js).

Node v14.12.0 (Current) Released — Just a single release this week and not for security reasons. No new features either, just an update to uvwasi 0.0.11 (a WebAssembly system call API) and N-API to version 7.

Node 15.0 Release Candidate Zero — This is only for those of you who like to live on the edge. There’s not even an official blog post. The final Node 15 release is expected next month and we’ll cover it more as it approaches.