Log message:
nodejs: update to version 20.0.0
Changelog:
2023-04-18, Version 20.0.0 (Current), @RafaelGSS
We're excited to announce the release of Node.js 20! Highlights include the new \
Node.js Permission Model, a synchronous import.meta.resolve, a stable \
test_runner, updates of the V8 JavaScript engine to 11.3, Ada to 2.0, and more!
As a reminder, Node.js 20 will enter long-term support (LTS) in October, but \
until then, it will be the "Current" release for the next six months. \
We encourage you to explore the new features and benefits offered by this latest \
release and evaluate their potential impact on your applications.
Notable Changes
Permission Model
Node.js now has an experimental feature called the Permission Model. It allows \
developers to restrict access to specific resources during program execution, \
such as file system operations, child process spawning, and worker thread \
creation. The API exists behind a flag --experimental-permission which when \
enabled will restrict access to all available permissions. By using this \
feature, developers can prevent their applications from accessing or modifying \
sensitive data or running potentially harmful code. More information about the \
Permission Model can be found in the Node.js documentation.
The Permission Model was a contribution by Rafael Gonzaga in #44004.
Custom ESM loader hooks run on dedicated thread
ESM hooks supplied via loaders (--experimental-loader=foo.mjs) now run in a \
dedicated thread, isolated from the main thread. This provides a separate scope \
for loaders and ensures no cross-contamination between loaders and application \
code.
Synchronous import.meta.resolve()
In alignment with browser behavior, this function now returns synchronously. \
Despite this, user loader resolve hooks can still be defined as async functions \
(or as sync functions, if the author prefers). Even when there are async resolve \
hooks loaded, import.meta.resolve will still return synchronously for \
application code.
Contributed by Anna Henningsen, Antoine du Hamel, Geoffrey Booth, Guy Bedford, \
Jacob Smith, and Michaël Zasso in #44710
V8 11.3
The V8 engine is updated to version 11.3, which is part of Chromium 113. This \
version includes three new features to the JavaScript API:
String.prototype.isWellFormed and toWellFormed
Methods that change Array and TypedArray by copy
Resizable ArrayBuffer and growable SharedArrayBuffer
RegExp v flag with set notation + properties of strings
WebAssembly Tail Call
The V8 update was a contribution by Michaël Zasso in #47251.
Stable Test Runner
The recent update to Node.js, version 20, includes an important change to the \
test_runner module. The module has been marked as stable after a recent update. \
Previously, the test_runner module was experimental, but this change marks it as \
a stable module that is ready for production use.
Contributed by Colin Ihrig in #46983
Ada 2.0
Node.js v20 comes with the latest version of the URL parser, Ada. This update \
brings significant performance improvements to URL parsing, including \
enhancements to the url.domainToASCII and url.domainToUnicode functions in \
node:url.
Ada 2.0 has been integrated into the Node.js codebase, ensuring that all parts \
of the application can benefit from the improved performance. Additionally, Ada \
2.0 features a significant performance boost over its predecessor, Ada 1.0.4, \
while also eliminating the need for the ICU requirement for URL hostname \
parsing.
Contributed by Yagiz Nizipli and Daniel Lemire in #47339
Preparing single executable apps now requires injecting a Blob
Building a single executable app now requires injecting a blob prepared by \
Node.js from a JSON config instead of injecting the raw JS file. This opens up \
the possibility of embedding multiple co-existing resources into the SEA (Single \
Executable Apps).
Contributed by Joyee Cheung in #47125
Web Crypto API
Web Crypto API functions' arguments are now coerced and validated as per their \
WebIDL definitions like in other Web Crypto API implementations. This further \
improves interoperability with other implementations of Web Crypto API.
This change was made by Filip Skokan in #46067.
Official support for ARM64 Windows
Node.js now includes binaries for ARM64 Windows, allowing for native execution \
on the platform. The MSI, zip/7z packages, and executable are available from the \
Node.js download site along with all other platforms. The CI system was updated \
and all changes are now fully tested on ARM64 Windows, to prevent regressions \
and ensure compatibility.
ARM64 Windows was upgraded to tier 2 support by Stefan Stojanovic in #47233.
WASI version must now be specified
When new WASI() is called, the version option is now required and has no default \
value. Any code that relied on the default for the version will need to be \
updated to request a specific version.
This change was made by Michael Dawson in #47391.
Deprecations and Removals
[3bed5f11e0] - (SEMVER-MAJOR) url: runtime-deprecate url.parse() with \
invalid ports (Rich Trott) #45526
url.parse() accepts URLs with ports that are not numbers. This behavior might \
result in host name spoofing with unexpected input. These URLs will throw an \
error in future versions of Node.js, as the WHATWG URL API does already. \
Starting with Node.js 20, these URLS cause url.parse() to emit a warning.
Semver-Major Commits
[9fafb0a090] - (SEMVER-MAJOR) async_hooks: deprecate the AsyncResource.bind \
asyncResource property (James M Snell) #46432
[1948d37595] - (SEMVER-MAJOR) buffer: check INSPECT_MAX_BYTES with \
validateNumber (Umuoy) #46599
[7bc0e6a4e7] - (SEMVER-MAJOR) buffer: graduate File from experimental and \
expose as global (Khafra) #47153
[671ffd7825] - (SEMVER-MAJOR) buffer: use min/max of validateNumber (Deokjin \
Kim) #45796
[ab1614d280] - (SEMVER-MAJOR) build: reset embedder string to \
"-node.0" (Michaël Zasso) #47251
[c1bcdbcf79] - (SEMVER-MAJOR) build: warn for gcc versions earlier than 10.1 \
(Richard Lau) #46806
[649f68fc1e] - (SEMVER-MAJOR) build: reset embedder string to \
"-node.0" (Yagiz Nizipli) #45579
[9374700d7a] - (SEMVER-MAJOR) crypto: remove DEFAULT_ENCODING (Tobias \
Nießen) #47182
[1640aeb680] - (SEMVER-MAJOR) crypto: remove obsolete SSL_OP_* constants \
(Tobias Nießen) #47073
[c2e4b1fa9a] - (SEMVER-MAJOR) crypto: remove ALPN_ENABLED (Tobias Nießen) #47028
[3ef38c4bd7] - (SEMVER-MAJOR) crypto: use WebIDL converters in WebCryptoAPI \
(Filip Skokan) #46067
[08af023b1f] - (SEMVER-MAJOR) crypto: runtime deprecate replaced rsa-pss \
keygen parameters (Filip Skokan) #45653
[7eb0ac3cb6] - (SEMVER-MAJOR) deps: patch V8 to support compilation on \
win-arm64 (Michaël Zasso) #47251
[a7c129f286] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël \
Zasso) #47251
[6f5655a18e] - (SEMVER-MAJOR) deps: always define V8_EXPORT_PRIVATE as no-op \
(Michaël Zasso) #47251
[f226350fcb] - (SEMVER-MAJOR) deps: update V8 to 11.3.244.4 (Michaël Zasso) \
#47251
[d6dae7420e] - (SEMVER-MAJOR) deps: V8: cherry-pick f1c888e7093e (Michaël \
Zasso) #45579
[56c436533e] - (SEMVER-MAJOR) deps: fix V8 build on Windows with MSVC \
(Michaël Zasso) #45579
[51ab98c71b] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël \
Zasso) #45579
[9f84d3eea8] - (SEMVER-MAJOR) deps: V8: fix v8-cppgc.h for MSVC (Jiawen \
Geng) #45579
[f2318cd4b5] - (SEMVER-MAJOR) deps: fix V8 build issue with inline methods \
(Jiawen Geng) #45579
[16e03e7968] - (SEMVER-MAJOR) deps: update V8 to 10.9.194.4 (Yagiz Nizipli) \
#45579
[6473f5e7f7] - (SEMVER-MAJOR) doc: update toolchains used for Node.js 20 \
releases (Richard Lau) #47352
[cc18fd9608] - (SEMVER-MAJOR) events: refactor to use validateNumber \
(Deokjin Kim) #45770
[ff92b40ffc] - (SEMVER-MAJOR) http: close the connection after sending a \
body without declared length (Tim Perry) #46333
[2a29df6464] - (SEMVER-MAJOR) http: keep HTTP/1.1 conns alive even if the \
Connection header is removed (Tim Perry) #46331
[391dc74a10] - (SEMVER-MAJOR) http: throw error if options of http.Server is \
array (Deokjin Kim) #46283
[ed3604cd64] - (SEMVER-MAJOR) http: server check Host header, to meet RFC \
7230 5.4 requirement (wwwzbwcom) #45597
[88d71dc301] - (SEMVER-MAJOR) lib: refactor to use min/max of validateNumber \
(Deokjin Kim) #45772
[e4d641f02a] - (SEMVER-MAJOR) lib: refactor to use validators in http2 \
(Debadree Chatterjee) #46174
[0f3e531096] - (SEMVER-MAJOR) lib: performance improvement on readline async \
iterator (Thiago Oliveira Santos) #41276
[5b5898ac86] - (SEMVER-MAJOR) lib,src: update exit codes as per todos \
(Debadree Chatterjee) #45841
[55321bafd1] - (SEMVER-MAJOR) net: enable autoSelectFamily by default (Paolo \
Insogna) #46790
[2d0d99733b] - (SEMVER-MAJOR) process: remove process.exit(), \
process.exitCode coercion to integer (Daeyeon Jeong) #43716
[dc06df31b6] - (SEMVER-MAJOR) readline: refactor to use validateNumber \
(Deokjin Kim) #45801
[295b2f3ff4] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 115 \
(Michaël Zasso) #47251
[3803b028dd] - (SEMVER-MAJOR) src: share common code paths for SEA and \
embedder script (Anna Henningsen) #46825
[e8bddac3e9] - (SEMVER-MAJOR) src: apply ABI-breaking API simplifications \
(Anna Henningsen) #46705
[f84de0ad4c] - (SEMVER-MAJOR) src: use uint32_t for process initialization \
flags enum (Anna Henningsen) #46427
[a6242772ec] - (SEMVER-MAJOR) src: fix ArrayBuffer::Detach deprecation \
(Michaël Zasso) #45579
[dd5c39a808] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 112 (Yagiz \
Nizipli) #45579
[63eca7fec0] - (SEMVER-MAJOR) stream: validate readable defaultEncoding \
(Marco Ippolito) #46430
[9e7093f416] - (SEMVER-MAJOR) stream: validate writable defaultEncoding \
(Marco Ippolito) #46322
[fb91ee4f26] - (SEMVER-MAJOR) test: make trace-gc-flag tests less strict \
(Yagiz Nizipli) #45579
[eca618071e] - (SEMVER-MAJOR) test: adapt test-v8-stats for V8 update \
(Michaël Zasso) #45579
[c03354d3e0] - (SEMVER-MAJOR) test: test case for multiple res.writeHead and \
res.getHeader (Marco Ippolito) #45508
[c733cc0c7f] - (SEMVER-MAJOR) test_runner: mark module as stable (Colin \
Ihrig) #46983
[7ce223273d] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.1 (Michaël \
Zasso) #47251
[ca4bd3023e] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.0 (Michaël \
Zasso) #47251
[58b06a269a] - (SEMVER-MAJOR) tools: update V8 gypfiles (Michaël Zasso) #45579
[027841c964] - (SEMVER-MAJOR) url: use private properties for brand check \
(Yagiz Nizipli) #46904
[3bed5f11e0] - (SEMVER-MAJOR) url: runtime-deprecate url.parse() with \
invalid ports (Rich Trott) #45526
[7c76fddf25] - (SEMVER-MAJOR) util,doc: mark parseArgs() as stable (Colin \
Ihrig) #46718
[4b52727976] - (SEMVER-MAJOR) wasi: make version non-optional (Michael \
Dawson) #47391
Semver-Minor Commits
[d4b440bfac] - (SEMVER-MINOR) fs: implement byob mode for \
readableWebStream() (Debadree Chatterjee) #46933
[00c222593e] - (SEMVER-MINOR) src,process: add permission model (Rafael \
Gonzaga) #44004
[978b57d750] - (SEMVER-MINOR) wasi: no longer require flag to enable wasi \
(Michael Dawson) #47286
Semver-Patch Commits
[e50c6b9a22] - bootstrap: do not expand process.argv[1] for snapshot entry \
points (Joyee Cheung) #47466
[c81e1143e4] - bootstrap: store internal loaders in C++ via a binding (Joyee \
Cheung) #47215
[8e673bdb84] - build: add node-core-utils to setup (Jiawen Geng) #47442
[5b561d72a6] - build: sync cares source change (Jiawen Geng) #47359
[8e6ee53e4e] - build: remove non-exist build file (Jiawen Geng) #47361
[9a4d21d1d9] - build, deps, tools: avoid excessive LTO (Konstantin Demin) #47313
[48c01485cd] - crypto: replace THROW with CHECK for scrypt keylen (Tobias \
Nießen) #47407
[4c1a27716b] - crypto: re-add padding for AES-KW wrapped JWKs (Filip Skokan) \
#46563
[b66eb15d12] - deps: update simdutf to 3.2.7 (Node.js GitHub Bot) #47473
[3fc11477ba] - deps: update corepack to 0.17.2 (Node.js GitHub Bot) #47474
[c1776531ab] - deps: upgrade npm to 9.6.4 (npm team) #47432
[e7ca09f310] - deps: update zlib to upstream 5edb52d4 (Luigi Pinca) #47151
[88387ccd12] - deps: update ada to 2.0.0 (Node.js GitHub Bot) #47339
[9f468cc37e] - deps: cherry-pick Windows ARM64 fix for openssl (Richard Lau) \
#46570
[eeab210b1b] - deps: update archs files for quictls/openssl-3.0.8+quic \
(RafaelGSS) #46570
[d93d7716c7] - deps: upgrade openssl sources to quictls/openssl-3.0.8+quic \
(RafaelGSS) #46571
[0f69ec4dd7] - deps: patch V8 to 10.9.194.9 (Michaël Zasso) #45995
[5890d09644] - deps: patch V8 to 10.9.194.6 (Michaël Zasso) #45748
[c02a7e7e93] - diagnostics_channel: fix ref counting bug when reaching zero \
subscribers (Stephen Belanger) #47520
[c7ad5bb37d] - doc: info on handling unintended breaking changes (Michael \
Dawson) #47426
[7d2d40ed0d] - doc: add performance initiative (Yagiz Nizipli) #47424
[d56c0f7318] - doc: do not create a backup file (Luigi Pinca) #47151
[412d27b65b] - doc: add MoLow to the TSC (Colin Ihrig) #47436
[f131cca0c0] - doc: reserve 116 for Electron 25 (Keeley Hammond) #47375
[1022c6f424] - doc: add experimental stages (Geoffrey Booth) #46100
[42d3d74717] - doc: clarify release notes for Node.js 16.19.0 (Richard Lau) \
#45846
[533c6512da] - doc: clarify release notes for Node.js 14.21.2 (Richard Lau) \
#45846
[97165fc1a6] - doc: fix doc metadata for Node.js 16.19.0 (Richard Lau) #45863
[a266b8b702] - doc: add registry number for Electron 23 & 24 (Keeley \
Hammond) #45661
[2613a9ced9] - esm: move hook execution to separate thread (Jacob Smith) #44710
[841f6b3abf] - esm: increase test coverage of edge cases (Antoine du Hamel) \
#47033
[0d575fe61a] - gyp: put filenames in variables (Cheng Zhao) #46965
[41b186722c] - lib: distinguish webidl interfaces with the extended property \
"Exposed" (Chengzhong Wu) #46809
[9b7db62276] - lib: makeRequireFunction patch when experimental policy \
(RafaelGSS) nodejs-private/node-private#358
[d43b532789] - lib: refactor to use validateBuffer (Deokjin Kim) #46489
[9a76a2521b] - meta: ping security-wg team on permission model changes \
(Rafael Gonzaga) #47483
[a4dadde1ba] - meta: ping startup and realm team on src/node_realm* changes \
(Joyee Cheung) #47448
[631c3ef3de] - module: do less CJS module loader initialization at run time \
(Joyee Cheung) #47194
[8bcf0a42f7] - permission: fix chmod,chown improve fs coverage (Rafael \
Gonzaga) #47529
[54d17ff4b5] - permission: support fs.mkdtemp (Rafael Gonzaga) #47470
[b441b5dc65] - permission: drop process.permission.deny (Rafael Gonzaga) #47335
[aa30e16716] - permission: fix some vulnerabilities in fs (Tobias Nießen) #47091
[1726da9300] - permission: add path separator to loader check (Rafael \
Gonzaga) #47030
[b164038c86] - permission: fix spawnSync permission check (RafaelGSS) #46975
[af91400886] - policy: makeRequireFunction on mainModule.require (RafaelGSS) \
nodejs-private/node-private#358
[f8b4e26aee] - quic: add more QUIC impl (James M Snell) #47348
[d65ae9f678] - quic: add additional quic implementation utilities (James M \
Snell) #47289
[9b104be502] - quic: do not dereference shared_ptr after move (Tobias \
Nießen) #47294
[09a4bb152f] - quic: add multiple internal utilities (James M Snell) #47263
[2bde0059ca] - sea: use JSON configuration and blob content for SEA (Joyee \
Cheung) #47125
[78c7475493] - src: allow simdutf::convert_* functions to return zero \
(Daniel Lemire) #47471
[5250947a53] - src: track ShadowRealm native objects correctly in the heap \
snapshot (Joyee Cheung) #47389
[8059764621] - src: use the internal field to determine if an object is a \
BaseObject (Joyee Cheung) #47217
[698508afa8] - src: bootstrap prepare stack trace callback in shadow realm \
(Chengzhong Wu) #47107
[e6b4d30a2f] - src: bootstrap Web [Exposed=*] APIs in the shadow realm \
(Chengzhong Wu) #46809
[3646a66044] - src: fix AliasedBuffer memory attribution in heap snapshots \
(Joyee Cheung) #46817
[8b2126f63f] - src: move AliasedBuffer implementation to -inl.h (Joyee \
Cheung) #46817
[3abbc3829a] - src: fix useless call in permission.cc (Tobias Nießen) #46833
[7b1e153530] - src: simplify exit code accesses (Daeyeon Jeong) #45125
[7359b92a41] - test: remove unnecessary status check on test-release-npm \
(RafaelGSS) #47516
[a5a5d2fb7e] - test: mark test/parallel/test-file-write-stream4 as flaky \
(Yagiz Nizipli) #47423
[81ad73a205] - test: remove unused callback variables (angellovc) #47167
[757a586ead] - test: migrate test runner message tests to snapshot (Moshe \
Atlow) #47392
[86f890539f] - test: remove stale entry from known_issues.status (Richard \
Lau) #47454
[1f3773d0c1] - test: move more inspector sequential tests to parallel (Joyee \
Cheung) #47412
[617b8d44c6] - test: use random port in test-inspector-enabled (Joyee \
Cheung) #47412
[ade0170c4f] - test: use random port in test-inspector-debug-brk-flag (Joyee \
Cheung) #47412
[1a78632cd3] - test: use random port in NodeInstance.startViaSignal() (Joyee \
Cheung) #47412
[23f66b137e] - test: move test-shadow-realm-gc.js to known_issues (Joyee \
Cheung) #47355
[9dfd0394c5] - test: remove useless WPT init scripts (Khafra) #47221
[1cfe058778] - test: fix test-permission-deny-fs-wildcard (win32) (Tobias \
Nießen) #47095
[b8ef1b476e] - test: add coverage for custom loader hooks with permission \
model (Antoine du Hamel) #46977
[4a7c3e9c50] - test: fix file path in permission symlink test (Livia \
Medeiros) #46859
[10005de6a8] - tools: make js2c.py usable for other build systems (Cheng \
Zhao) #46930
[1e2f9aca72] - tools: move update-acorn.sh to dep_updaters and create \
maintaining md (Marco Ippolito) #47382
[174662a463] - tools: update eslint to 8.38.0 (Node.js GitHub Bot) #47475
[a58ca61f35] - tools: update eslint to 8.38.0 (Node.js GitHub Bot) #47475
[37d12730ab] - tools: automate cjs-module-lexer dependency update (Marco \
Ippolito) #47446
[4fbfa3c9f2] - tools: fix notify-on-push Slack messages (Antoine du Hamel) #47453
[b1f2ff1242] - tools: update lint-md-dependencies to \
@rollup/plugin-node-resolve@15.0.2 (Node.js GitHub Bot) #47431
[26b2584b84] - tools: add root certificate update script (Richard Lau) #47425
[553b052648] - tools: remove targets for individual test suites in Makefile \
(Antoine du Hamel) #46892
[747ff43e5b] - url: more sophisticated brand check for URLSearchParams \
(Timothy Gu) #47414
[e727eb066f] - url: do not use object as hashmap (Timothy Gu) #47415
[81c7875eb7] - url: drop ICU requirement for parsing hostnames (Yagiz \
Nizipli) #47339
[a4895df94a] - url: use ada::url_aggregator for parsing urls (Yagiz Nizipli) \
#47339
|