Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

v4.4.2 proposal #5961

Merged
merged 41 commits into from
Apr 1, 2016
Merged

v4.4.2 proposal #5961

merged 41 commits into from
Apr 1, 2016

Conversation

MylesBorins
Copy link
Contributor

2016-03-31, Version 4.4.2 'Argon' (LTS), @thealphanerd

Notable Changes

  • https:
    • Under certain conditions ssl sockets may have been causing a memory leak when keepalive is enabled. This is no longer the case. (Alexander Penev) #5713
  • lib:
    • The way that we were internally passing arguments was causing a potential leak. By copying the arguments into an array we can avoid this. (Nathan Woltman) #4361
  • npm:
    • Upgrade to v2.15.1. Fixes a security flaw in the use of authentication tokens in HTTP requests that would allow an attacker to set up a server that could collect tokens from users of the command-line interface. Authentication tokens have previously been sent with every request made by the CLI for logged-in users, regardless of the destination of the request. This update fixes this by only including those tokens for requests made against the registry or registries used for the current install. (Forrest L Norvell)
  • repl:
    • Previously if you were using the repl in strict mode the column number would be wrong in a stack trace. This is no longer an issue. (Prince J Wesley) #5416

ToPal and others added 30 commits March 30, 2016 13:12
@ToPal
doc: updated fs #5862 removed irrelevant data in fs.markdown
b70ca4a 
fs.readFile, fs.writeFile and fs.appendFile doc changes
pulled back from master included details not relevant to
v4.

PR-URL: #5877
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@Fishrock123
doc: reformat & improve node.1 manual page
eb0ed46 
Uses better troff formatting.
Removes v8 options from the man page.

Also edits `node -h` in node.cc slightly.

PR-URL: #5497
Reviewed-By: James Snell <jasnell@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
@nwoltman
lib: copy arguments object instead of leaking it
3c8e59c 
Instead of leaking the arguments object by passing it as an
argument to a function, copy it's contents to a new array,
then pass the array. This allows V8 to optimize the function
that contains this code, improving performance.

PR-URL: #4361
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
@santigimeno
test: remove timer from test-http-1.0
f209eff 
It's possible that the `end` event is emitted after the timeout fires
causing the test to fail. Just remove the timer. If for some reason the
`end` would never fire, the test will fail with a timeout.

PR-URL: #5129
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
@benjamingr
net: remove unused var self = this from old code
07b7172 
Removed an unused `var self = this` that is no longer required.

PR-URL: #5224
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
@JacksonTian
lib: reduce usage of self = this
108fc90 
Remove unnecessary `self = this`.

PR-URL: #5231
Reviewed-By: James M Snell <jasnell@gmail.com>
@JacksonTian
lib: simplify code with String.prototype.repeat()
6daebdb 
use String.prototype.repeat() to simplify code, less code,
more semantically.

PR-URL: #5359
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@princejwesley
repl: fix stack trace column number in strict mode
acbce4b 
On strict mode, "'use strict'; void 0; " is added as prefix
in order to prevent "use strict" as the result value
for let/const statements. It causes wrong column number in
stack trace.

PR-URL: #5416
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>
@vkurchatkin
net: make isIPv4 and isIPv6 more efficient
8648420 
`isIPv4` and `isIPv6` are implemented on top of `isIP`, which in turn
checks the sting for being both IPv4 and IPv6, which can be inefficient
in some scenarios. This commit makes them use `uv_inet_pton` directly
instead.

PR-URL: #5478
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>
@mscdex
doc: fix crypto update() signatures
a6ec8a6 
PR-URL: #5500
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
@billautomata
doc: update crypto docs to use good defaults
3b8fc4f 
[Diffie-Hellman](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange#Cryptographic_explanation)
keys are composed of a `generator` a `prime` a `secret_key`
and the `public_key` resulting from the math operation:

```
(generator ^ secret_key) mod prime = public_key
```

Diffie-Hellman keypairs will compute a matching shared secret
if and only if the generator and prime match for both
recipients.  The generator is usually **2** and the prime is
what is called a [Safe Prime](https://en.wikipedia.org/wiki/Safe_prime).

Usually this matching is accomplished by using
[standard published groups](http://tools.ietf.org/html/rfc3526).
We expose access those groups with the `crypto.getDiffieHellman`
function.

`createDiffieHellman` is trickier to use.  The original example
had the user creating 11 bit keys, and creating random groups of
generators and primes. 11 bit keys are very very small, can be
cracked by a single person on a single sheet of paper.  A
byproduct of using such small keys were that it was a high
likelihood that two calls of `createDiffieHellman(11)` would
result in using the same 11 bit safe prime.

The original example code would fail when the safe primes generated
at 11 bit lengths did not match for alice and bob.

If you want to use your own generated safe `prime` then the proper
use of `createDiffieHellman` is to pass the `prime` and `generator`
to the recipient's constructor, so that when they compute the shared
secret their `prime` and `generator` match, which is fundamental to
the algorithm.

PR-URL: #5505
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@santigimeno
test: repl tab completion test
b258ddd 
It checks that `eval` is called with `.scope` as an input string.

PR-URL: #5534
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
test: add test-npm-install to parallel tests suite
7520100 
Currently we are not testing that `npm install` works.

This is a very naive / basic test that shells out to `npm install`
in an empty `tempDir`. While this test will not be able to check
that `npm install` is 100% working, it should catch certain edge
cases that break it.

PR-URL: #5166
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Alexis Campailla <orangemocha@nodejs.org>
@santigimeno
test: improve test-npm-install
d506eea 
Make npm install a dependency that is defined as a relative path, so it
avoids any network interaction.

PR-URL: #5613
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Claudio Rodriguez <cjrodr@yahoo.com>
@bnoordhuis
deps: remove unused openssl files
1d0e4a9 
Refs: #5615
PR-URL: #5619
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Reviewed-By: Rod Vagg <rod@vagg.org>
@Trott
console: check that stderr is writable
0c6f674 
`Console` constructor checks that `stdout.write()` is a function but
does not do an equivalent check for `stderr.write()`. If `stderr` is not
specified in the constructor, then `stderr` is set to be `stdout`.
However, if `stderr` is specified, but `stderr.write()` is not a
function, then an exception is not thrown until `console.error()` is
called.

This change adds the same check for 'stderr' in the constructor that is
there for `stdout`. If `stderr` fails the check, then a `TypeError` is
thrown.

Took the opportunity to copyedit the `console` doc a little too.

PR-URL: #5635
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>
@cjihrig
test: add batch of known issue tests
78effc3 
This commit adds tests for several known issues.

Refs: #1901
Refs: #728
Refs: #4778
Refs: #947
Refs: #2734
PR-URL: #5653
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
@mithun-daa
doc: Add windows example for Path.format
bf1fe46 
PR-URL: #5700
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
@claudiorodriguez
doc: fix multiline return comments in querystring
c0a24e4 
Changes the multiline return example commments in querystring
which have the example out-of-comment, into single comment
lines to remain consistent with other docs.

PR-URL: #5705
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
@alexpenev-s
https: fix ssl socket leak when keepalive is used
8187661 
SSL sockets leak whenever keep alive is enabled, ca option is set in
the global agent, and requests are sent without the ca property.
In the following case at Agent.prototype.createSocket a socket will
be created with a hashtag name that includes data from the global
agents’ ca property.

On subsequent requests at Agent.prototype.addRequest we do not find
the free socket, because the hashtag name generated there does not
take into account the global agents’ ca property, thus creating a new
socket and leaving the first socket to timeout. closes: #5699

PR-URL: #5713
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@Trott
test: minimize test-http-get-pipeline-problem
7e45d4f 
Reduce resoures required by test.

Clarify comment explaining source of test and what the test is looking
for.

Fixes: #5725
PR-URL: #5728
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@santigimeno
test: remove the use of curl in the test suite
1b266fc 
There were 2 tests using curl:

`test-http-304.js` is removed because it was initially included to test
that the 304 response does not contain a body, and this is already
covered by `test-http-chunked-304.js`.

`test-http-curl-chunk-problem` has been renamed and refactored so
instead of using curl, it uses 2 child node processes: one for sending
the HTTP request and the other to calculate the sha1sum. Originally,
this test was introduced to fix a bug in `nodejs@0.2.x`, and it was not
fixed until `nodejs@0.2.5`. A modified version of this test has been run
with `nodejs@0.2.0` and reproduces the problem. This same test has been
run with `nodejs@0.2.6` and runs correctly.

Fixes: #5174
PR-URL: #5750
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
@thefourtheye
tools: remove unused imports
3a901b0 
PR-URL: #5765
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
@Fishrock123
doc: add a cli options doc page
e43e8e3 
This page is mostly a mirror of the updated manual page.

PR-URL: #5787
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell jasnell@gmail.com>
Reviewed-By: Bryan English <bryan@bryanenglish.com>
Reviewed-By: Robert Lindstädt <robert.lindstaedt@gmail.com>
@mhdawson
test: make test-net-connect-options-ipv6.js better
e57355c 
Improve the robustness of test-net-connect-options-ipv6.js

PPC Suse build team encountered intermittent failures related
to dns.  Improve test to make it more robust in the face
of intermittent dns issues.

PR-URL: #5791
Reviewed-By: James M Snell <jasnell@gmail.com>
@eversojk
doc: explain path.format expected properties
79d26ae 
Explain the expected properties in path.format

Fixes: #5746
PR-URL: #5801
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
@claudiorodriguez
test: fix flaky test-cluster-shared-leak
0836d7e 
Test was flaky on centos7-64 due to an uncaught ECONNRESET
on the worker code. This catches the error so the process
will exit with code 0.

Fixes: #5604
PR-URL: #5802
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@benjamingr
dns: use template literals
d55599f 
Prefer the use of template string literals over string concatenation
in the dns module, makes dns consistent with other modules basically
doing #5778 for it.

PR-URL: #5809
Reviewed-By: James M Snell <jasnell@gmail.com>
@drywolf
doc: explain error message on missing main file
20faf90 
Added a hint saying that node uses the default "Cannot find module"
error when requiring a module for which the "main" file specified in
the package.json is missing.

PR-URL: #5812
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@kapouer
test: strip non-free icc profile from person.jpg
1135ee9 
Fixes: #5749
PR-URL: #5813
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>
Fishrock123 and others added 3 commits March 30, 2016 13:14
@Fishrock123
doc: add instructions to only sign a release
60ddab8 
PR-URL: #5876
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@jasnell
Add @mhdawson back to the CTC
42bbdc9 
Now that the CTC has expanded, this PR calls for a vote of the CTC
to reinstate Michael Dawson (@mhdawson) as a full voting member.

Voted on and approved by the CTC on 2016-03-23

PR-URL: #5633
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Alexis Campailla <orangemocha@nodejs.org>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
@kosak
doc: typo: interal->internal.
8d86d23 
Fixes a copy typo in the events.md docs.

PR-URL: #5849
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@MylesBorins MylesBorins changed the title V4.4.2 proposal v4.4.2 proposal Mar 30, 2016
@MylesBorins MylesBorins added meta Issues and PRs related to the general management of the project. v4.x labels Mar 30, 2016
MylesBorins pushed a commit that referenced this pull request Mar 30, 2016
2016-03-30, Version v4.4.2 'Argon' (LTS)
4b15023 
Notable Changes

* https:
  - Under certain conditions ssl sockets may have been causing a memory
  leak when keepalive is enabled. This is no longer the case.
    - (Alexander Penev) #5713

* lib:
  - The way that we were internally passing arguments was causing a
  potential leak. By copying the arguments into an array we can avoid this
    - (Nathan Woltman) #4361

* repl:
  - Previously if you were using the repl in strict mode the column number
  would be wrong in a stack trace. This is no longer an issue.
    - (Prince J Wesley) #5416

PR-URL: #5961
@MylesBorins
Copy link
Contributor Author

ci: https://ci.nodejs.org/job/node-test-pull-request/2099/
citgm: https://ci.nodejs.org/job/thealphanerd-smoker/164/

edit: ci is green 🎉
edit: citgm is green 🎉

@AndreasMadsen
Copy link
Member

When are the AsyncWrap changes scheduled to land in 4.x ? see: nodejs/Release#86

@MylesBorins
Copy link
Contributor Author

@AndreasMadsen those changes will come in when they have been back ported by @trevnorris

My assumption is that he is waiting for the implementation changes to calm down before moving them all at once.

He can likely chime in with more details

@richardlau
Copy link
Member

@thealphanerd An updated npm should probably be listed as a notable change.

@chorrell chorrell mentioned this pull request Mar 31, 2016
Closed
MylesBorins pushed a commit that referenced this pull request Mar 31, 2016
2016-03-31, Version v4.4.2 'Argon' (LTS)
cf5bf47 
Notable Changes

* https:
  - Under certain conditions ssl sockets may have been causing a memory
  leak when keepalive is enabled. This is no longer the case.
    - (Alexander Penev) #5713

* lib:
  - The way that we were internally passing arguments was causing a
  potential leak. By copying the arguments into an array we can avoid this
    - (Nathan Woltman) #4361

* npm:
  - Upgrade to v2.15.1. (Forrest L Norvell)

* repl:
  - Previously if you were using the repl in strict mode the column number
  would be wrong in a stack trace. This is no longer an issue.
    - (Prince J Wesley) #5416

PR-URL: #5961
2016-03-31, Version v4.4.2 'Argon' (LTS)
9ef4b1b 
Notable Changes

* https:
  - Under certain conditions ssl sockets may have been causing a memory
  leak when keepalive is enabled. This is no longer the case.
    - (Alexander Penev) #5713

* lib:
  - The way that we were internally passing arguments was causing a
  potential leak. By copying the arguments into an array we can avoid this
    - (Nathan Woltman) #4361

* npm:
  - Upgrade to v2.15.1. Fixes a security flaw in the use of authentication
  tokens in HTTP requests that would allow an attacker to set up a server
  that could collect tokens from users of the command-line interface.
  Authentication tokens have previously been sent with every request made
  by the CLI for logged-in users, regardless of the destination of the
  request. This update fixes this by only including those tokens for
  requests made against the registry or registries used for the current
  install. (Forrest L Norvell)

* repl:
  - Previously if you were using the repl in strict mode the column number
  would be wrong in a stack trace. This is no longer an issue.
    - (Prince J Wesley) #5416

PR-URL: #5961
@MylesBorins
Copy link
Contributor Author

@richardlau thanks for pointing out the bit about npm.

I was keeping things under raps until npm released their information first

--> http://blog.npmjs.org/post/142036323955/fixing-a-bearer-token-vulnerability

@MylesBorins MylesBorins merged commit 9ef4b1b into v4.x Apr 1, 2016
MylesBorins pushed a commit that referenced this pull request Apr 1, 2016
Working on v4.4.3
7384140 
PR-URL: #5961
MylesBorins pushed a commit that referenced this pull request Apr 1, 2016
2016-03-31, Version v4.4.2 'Argon' (LTS)
0551021 
Notable Changes

* https:
  - Under certain conditions ssl sockets may have been causing a memory
  leak when keepalive is enabled. This is no longer the case.
    - (Alexander Penev) #5713

* lib:
  - The way that we were internally passing arguments was causing a
  potential leak. By copying the arguments into an array we can avoid this
    - (Nathan Woltman) #4361

* npm:
  - Upgrade to v2.15.1. Fixes a security flaw in the use of authentication
  tokens in HTTP requests that would allow an attacker to set up a server
  that could collect tokens from users of the command-line interface.
  Authentication tokens have previously been sent with every request made
  by the CLI for logged-in users, regardless of the destination of the
  request. This update fixes this by only including those tokens for
  requests made against the registry or registries used for the current
  install. (Forrest L Norvell)

* repl:
  - Previously if you were using the repl in strict mode the column number
  would be wrong in a stack trace. This is no longer an issue.
    - (Prince J Wesley) #5416

PR-URL: #5961
@MylesBorins MylesBorins deleted the v4.4.2-proposal branch April 8, 2016 07:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
meta Issues and PRs related to the general management of the project.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.