Update Node.js to v20.18.3 - autoclosed #172
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
20.18.1->20.18.3Release Notes
nodejs/node (node)
v20.18.3: 2025-02-10, Version 20.18.3 'Iron' (LTS), @marco-ippolitoCompare Source
Notable Changes
030f155986] - esm: mark import attributes and JSON module as stable (Nicolò Ribaudo) #55333b9b006331f] - doc: add LJHarb to collaborators (Jordan Harband) #5613239b89e90b4] - doc: enforce strict policy to semver-major releases (Rafael Gonzaga) #55732247fa1959f] - crypto: update root certificates to NSS 3.104 (Richard Lau) #55681adfc2f993a] - tools: fix root certificate updater (Richard Lau) #5568129862ae105] - doc: add jazelly to collaborators (Jason Zhang) #55531Commits
b4f5da18a5] - benchmark: addtest-reporters(Aviv Keller) #55757407992e272] - benchmark: addtest_runner/mock-fn(Aviv Keller) #5577117abec4367] - benchmark: add nodeTiming.uvmetricsinfo bench (RafaelGSS) #5561443f7050338] - benchmark: add --runs support to run.js (Rafael Gonzaga) #55158470789a981] - benchmark: adjust byte size for buffer-copy (Rafael Gonzaga) #55295ea1c97ac16] - buffer: document concat zero-fill (Duncan) #55562ae683a9e1f] - build: set DESTCPU correctly for 'make binary' on loongarch64 (吴小白) #56271af020edf96] - build: fix missing fp16 dependency in d8 builds (Joyee Cheung) #56266d6a1b74404] - build: add major release action (Rafael Gonzaga) #56199bc92a96a5a] - build: allow overriding clang usage (Shelley Vohr) #56016f370ec0989] - build: remove defaults for create-release-proposal (Rafael Gonzaga) #5604225e1862e87] - build: set node_arch to target_cpu in GN (Shelley Vohr) #5596755c205e5f6] - build: add create release proposal action (Rafael Gonzaga) #556909f14ba808d] - build: implement node_use_amaro flag in GN build (Cheng) #55798046430c47e] - build: fix building with system icu 76 (Michael Cho) #555630b6d62c812] - build: fix GN arg used in generate_config_gypi.py (Shelley Vohr) #555308f9c642369] - build: fix GN build for cares/uv deps (Cheng) #55477284e932326] - build: fix uninstall script for AIX 7.1 (Cloorc) #554382f71f168ef] - build: tidy up cares.gyp (Richard Lau) #55445e89e807522] - build: synchronize list of c-ares source files (Richard Lau) #554455eb6c94851] - build: fix path concatenation (Mohammed Keyvanzadeh) #55387720d23f3ac] - build: fix make errors that occur in Makefile (minkyu_kim) #55287dc552c6739] - build,win: enable pch for clang-cl (Stefan Stojanovic) #5524964b140d484] - cli: add--heap-profflag available toNODE_OPTIONS(Juan José) #5425923fb644037] - crypto: ensure CryptoKey usages and algorithm are cached objects (Filip Skokan) #56108247fa1959f] - crypto: update root certificates to NSS 3.104 (Richard Lau) #556813c4262a171] - deps: V8: cherry-pick26fd1df(Shu-yu Guo) #55961558e6588a4] - deps: V8: backportae5a4db(Shu-yu Guo) #55961169bc58447] - deps: update simdutf to 5.6.4 (Node.js GitHub Bot) #56255bc7bb1e269] - deps: update c-ares to v1.34.4 (Node.js GitHub Bot) #56256782bb6cac4] - deps: update zlib to 1.3.0.1-motley-82a5fec (Node.js GitHub Bot) #55980f7131cf178] - deps: update corepack to 0.30.0 (Node.js GitHub Bot) #55977b09f6abcd3] - deps: update simdutf to 5.6.3 (Node.js GitHub Bot) #55973d63ccb60ea] - deps: update zlib to 1.3.0.1-motley-7e2e4d7 (Node.js GitHub Bot) #54432a2f315ef8b] - deps: update simdutf to 5.6.2 (Node.js GitHub Bot) #55889afed723b6c] - deps: update simdutf to 5.6.1 (Node.js GitHub Bot) #55850753c3b322f] - deps: update c-ares to v1.34.3 (Node.js GitHub Bot) #558034f89af8a6f] - deps: update acorn to 8.14.0 (Node.js GitHub Bot) #5569907359ec14f] - deps: update acorn to 8.13.0 (Node.js GitHub Bot) #55558c6236571fc] - deps: update googletest todf1544b(Node.js GitHub Bot) #55465f63413c6f3] - deps: update c-ares to v1.34.2 (Node.js GitHub Bot) #55463ad725c766d] - deps: update ada to 2.9.1 (Node.js GitHub Bot) #5467933367cbd62] - deps: update simdutf to 5.6.0 (Node.js GitHub Bot) #55379f2a55d9d2d] - deps: update c-ares to v1.34.1 (Node.js GitHub Bot) #553691d14886266] - dgram: check udp buffer size to avoid fd leak (theanarkh) #56084de265b9558] - diagnostics_channel: fix unsubscribe during publish (simon-id) #5511622e0d17097] - dns: stop using deprecatedares_query(Aviv Keller) #5543044f3b23749] - dns: honor the order option (Luigi Pinca) #55392f78508cd30] - doc: add history info for Permission Model (Antoine du Hamel) #56707f07be5e3cd] - doc: add note for features usingInternalWorkerwith permission model (Antoine du Hamel) #56706618e005672] - doc: add history entries for JSON modules stabilization (Antoine du Hamel) #55855f89f4ff856] - doc: fix color contrast issue in light mode (Rich Trott) #56272a51ef9d829] - doc: clarify util.aborted resource usage (Kunal Kumar) #557802d88c4b425] - doc: add esm examples to node:repl (Alfredo González) #55432722dada673] - doc: add esm examples to node:readline (Alfredo González) #55335090c7a3b01] - doc: fix 'which' to 'that' and add commas (Selveter Senitro) #56216ae3f6fbe59] - doc:sea.getRawAsset(key)always returns an ArrayBuffer (沈鸿飞) #56206d103917d92] - doc: update announce documentation for releases (Rafael Gonzaga) #5620080e5bb87c4] - doc: update blog link to /vulnerability (Rafael Gonzaga) #56198b739c2a926] - doc: call out import.meta is only supported in ES modules (Anton Kastritskii) #56186bbd0222a10] - doc: add ambassador message - benefits of Node.js (Michael Dawson) #560850e9abf2754] - doc: fix incorrect link to style guide (Yuan-Ming Hsu) #561811dbc7e87d7] - doc: fix c++ addon hello world sample (Edigleysson Silva (Edy)) #56172026f0198c8] - doc: update blog release-post link (Ruy Adorno) #56123c2fa359f7a] - doc: mention-aflag for the release script (Ruy Adorno) #56124b9b006331f] - doc: add LJHarb to collaborators (Jordan Harband) #561327a1365ba62] - doc: add create-release-action to process (Rafael Gonzaga) #5599351262ec84e] - doc: rename file to advocacy-ambassador-program.md (Tobias Nießen) #560466fc7328831] - doc: remove unused import from sample code (Blended Bram) #555709f3ef4a434] - doc: add FAQ to releases section (Rafael Gonzaga) #559921dcf8dfedb] - doc: move history entry to class description (Luigi Pinca) #55991e016f68c73] - doc: add history entry for textEncoder.encodeInto() (Luigi Pinca) #559901b31638262] - doc: improve GN build documentation a bit (Shelley Vohr) #55968d25bcfd0b2] - doc: remove confusing and outdated sentence (Luigi Pinca) #5598865c1784337] - doc: add doc for PerformanceObserver.takeRecords() (skyclouds2001) #55786682ae41f86] - doc: add vetted courses to the ambassador benefits (Matteo Collina) #559349b6cc54b50] - doc: doc how to add message for promotion (Michael Dawson) #55843db5378c8b9] - doc: add esm example for zlib (Leonardo Peixoto) #5594658a6fbb9cf] - doc: document approach for building wasm in deps (Michael Dawson) #5594041e3bcd752] - doc: add esm examples to node:timers (Alfredo González) #5585761de8f9b04] - doc: include git node release --promote to steps (Rafael Gonzaga) #55835559a0bfa2e] - doc: add a note on console stream behavior (Gireesh Punathil) #556163d11a85fe5] - doc: add-Sflag release preparation example (Antoine du Hamel) #55836955690e6cf] - doc: clarify UV_THREADPOOL_SIZE env var usage (Preveen P) #55832d6738e919a] - doc: add notable-change mention to sec release (Rafael Gonzaga) #5583079876f0dfd] - doc: fix history info forURL.prototype.toJSON(Antoine du Hamel) #55818c14776fbaa] - doc: correct max-semi-space-size statement (Joe Bowbeer) #5581283b415e8f3] - doc: run license-builder (github-actions[bot]) #5581307f53b1d75] - doc: clarify triager role (Gireesh Punathil) #557752abfdefcf3] - doc: clarify removal of experimental API does not require a deprecation (Antoine du Hamel) #5574639b89e90b4] - doc: enforce strict policy to semver-major releases (Rafael Gonzaga) #55732d0417eaec9] - doc: add esm example inpath.md(Aviv Keller) #55745032ff07a2d] - doc: consistent use of word child process (Gireesh Punathil) #5565416eef6461e] - doc: clarity to available addon options (Preveen P) #55715a7ce82e3cc] - doc: update--max-semi-space-sizedescription (Joe Bowbeer) #554951bb461e2b6] - doc: add write flag when open file as the demo code's intention (robberfree) #546268cd619f8d7] - doc: remove mention of ECDH-ES in crypto.diffieHellman (Filip Skokan) #556114576d14d0f] - doc: improve c++ embedder API doc (Gireesh Punathil) #5559712bd57fbaa] - doc: capitalize "MIT License" (Aviv Keller) #55575362b01b275] - doc: add esm examples to node:string_decoder (Alfredo González) #5550729862ae105] - doc: add jazelly to collaborators (Jason Zhang) #55531c1b63e5e6b] - doc: changed the command used to verify SHASUMS256 (adriancuadrado) #554209db657532b] - doc: add note about stdio streams in child_process (Ederin (Ed) Igharoro) #55322475e478713] - doc: addisBigIntObjectto documentation (leviscar) #554500487e70475] - doc: remove outdated remarks abouthighWaterMarkin fs (Ian Kerins) #55462e9a8feb44a] - doc: move Danielle Adams key to old gpg keys (RafaelGSS) #55399bfbe651626] - doc: move Bryan English key to old gpg keys (RafaelGSS) #55399c1cab9b4d7] - doc: move Beth Griggs keys to old gpg keys (RafaelGSS) #5539985d8eb397c] - doc: spell out condition restrictions (Jan Martin) #55187de8de542b5] - doc: add missing return values in buffer docs (Karl Horky) #55273a5df7087fd] - doc: fix ambasador markdown list (Rafael Gonzaga) #55361fbfcb0cc08] - doc: edit onboarding guide to clarify when mailmap addition is needed (Antoine du Hamel) #55334e70abce96a] - doc: fix the return type of outgoingMessage.setHeaders() (Jimmy Leung) #55290030f155986] - esm: mark import attributes and JSON module as stable (Nicolò Ribaudo) #5533386cb697b81] - esm: add a fallback when importer in not a file (Antoine du Hamel) #554718c8de30680] - esm: fix inconsistency withimportAssertioninresolvehook (Wei Zhu) #55365a41b0e1247] - events: optimize EventTarget.addEventListener (Robert Nagy) #553122c6dcf7209] - fs: make mutatingoptionsin Promisesreaddir()not affect results (LiviaMedeiros) #560579317feb829] - fs: lazily load ReadFileContext (Gürgün Dayıoğlu) #55998739ee18430] - http2: support ALPNCallback option (ZYSzys) #561877ba6dcf180] - http2: fix memory leak caused by premature listener removing (ywave620) #559664c15bd44a0] - http2: fix client async storage persistence (Orgad Shaneh) #55460ac57dadd9a] - lib: add validation for options in compileFunction (Taejin Kim) #56023a5b0d8900a] - lib: remove startsWith/endsWith primordials for char checks (Gürgün Dayıoğlu) #55407f10857828f] - lib: test_runner#mock:timers respeced timeout_max behaviour (BadKey) #553751a193bf256] - meta: bump github/codeql-action from 3.27.0 to 3.27.5 (dependabot[bot]) #5610323f319803d] - meta: bump actions/checkout from 4.1.7 to 4.2.2 (dependabot[bot]) #56102a953301a1c] - meta: bump step-security/harden-runner from 2.10.1 to 2.10.2 (dependabot[bot]) #56101c58065ae77] - meta: bump actions/setup-node from 4.0.3 to 4.1.0 (dependabot[bot]) #5610012b0cecc20] - meta: add releasers as CODEOWNERS to proposal action (Rafael Gonzaga) #56043070aa9d6a5] - meta: bump actions/setup-python from 5.2.0 to 5.3.0 (dependabot[bot]) #556887a46ffd18a] - meta: bump actions/setup-node from 4.0.4 to 4.1.0 (dependabot[bot]) #556878b4f2e0c6a] - meta: bump rtCamp/action-slack-notify from 2.3.0 to 2.3.2 (dependabot[bot]) #55686024c5b2ab3] - meta: bump actions/upload-artifact from 4.4.0 to 4.4.3 (dependabot[bot]) #556853d06971a15] - meta: bump actions/cache from 4.0.2 to 4.1.2 (dependabot[bot]) #55684c33de63a86] - meta: bump actions/checkout from 4.2.0 to 4.2.2 (dependabot[bot]) #55683ccc1ea0576] - meta: bump github/codeql-action from 3.26.10 to 3.27.0 (dependabot[bot]) #556829c2d0fd242] - meta: make review-wanted message minimal (Aviv Keller) #556070c14cae2b2] - meta: show PR/issue title on review-wanted (Aviv Keller) #55606aeae7e1e6f] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #553816d7b78c3d8] - meta: change color to blue notify review-wanted (Rafael Gonzaga) #554237441e289db] - meta: bump codecov/codecov-action from 4.5.0 to 4.6.0 (dependabot[bot]) #55222158c8ad77c] - meta: bump github/codeql-action from 3.26.6 to 3.26.10 (dependabot[bot]) #552218d3d4a9fab] - meta: bump step-security/harden-runner from 2.9.1 to 2.10.1 (dependabot[bot]) #552206797a35a5b] - module: prevent main thread exiting before esm worker ends (Shima Ryuhei) #56183bd99bf109f] - node-api: allow napi_delete_reference in finalizers (Chengzhong Wu) #556206308c18dbb] - report: fix network queries in getReport libuv with exclude-network (Adrien Foulon) #55602ff2eec7275] - sea: only assert snapshot main function for main threads (Joyee Cheung) #56120f9f3003de7] - src: fix outdated js2c.cc references (Chengzhong Wu) #56133a882536596] - src: fix kill signal on Windows (Hüseyin Açacak) #55514df1002438a] - src: improvenode:osuserInfo performance (Yagiz Nizipli) #55719f17416ec3e] - src: fix dns crash when failed to create NodeAresTask (theanarkh) #555218d5b8c31d8] - src: use NewFromUtf8Literal in NODE_DEFINE_CONSTANT (Charles Kerr) #555810977bb6c1d] - src: remove icu basedToASCIIandToUnicode(Yagiz Nizipli) #5515672817072e2] - src: fix winapi_strerror error string (Hüseyin Açacak) #552076f47f53f90] - src,lib: optimize nodeTiming.uvMetricsInfo (RafaelGSS) #55614ac583d4549] - stream: propagate AbortSignal reason (Marvin ROGER) #554731c8b474319] - test: skip test-buffer-tostring-range on smartos (Marco Ippolito) #5672739d608f9d8] - test: mark test-http-server-request-timeouts-mixed as flaky (Joyee Cheung) #565035c3f18be04] - test: temporary remove resource check from fs read-write (Rafael Gonzaga) #567894196aaf033] - test: remove exludes for sea tests on PPC (Michael Dawson) #562173ea738fc26] - test: removehasOpenSSL3xutils (Antoine du Hamel) #5616421e21a270e] - test: remove test-fs-utimes flaky designation (Luigi Pinca) #56052e464c6f7a5] - test: move test-worker-arraybuffer-zerofill to parallel (Luigi Pinca) #56053e99584cd57] - test: make HTTP/1.0 connection test more robust (Arne Keller) #559592d03f87ef7] - test: convert readdir test to use test runner (Thomas Chetwin) #55750207562fa3d] - test: make x509 crypto tests work with BoringSSL (Shelley Vohr) #55927a17d9e1acf] - test: fix determining lower priority (Livia Medeiros) #5590850b6729d8c] - test: increase coverage ofpathToFileURL(Antoine du Hamel) #554930aa9e74027] - test: improve test coverage for child process message sending (Juan José) #55710ebdbbc3ec8] - test: ensure that test priority is not higher than current priority (Livia Medeiros) #55739b40789e085] - test: add buffer to fs_permission tests (Rafael Gonzaga) #55734a9998799be] - test: improve test coverage forServerResponse(Juan José) #55711d2421f3c92] - test: ignore unrelated events in FW watch tests (Carlos Espa) #556050ac0afc4a9] - test: refactor some esm tests (Antoine du Hamel) #554720f8b8269d1] - test: split up test-runner-mock-timers test (Julian Gassner) #555068f6462f40b] - test: avoidapply()calls with large amount of elements (Livia Medeiros) #55501e9b0ff482b] - test: increase test coverage forhttp.OutgoingMessage.appendHeader()(Juan José) #55467d5ad060073] - test: fix addons and node-api test assumptions (Antoine du Hamel) #55441a28376bb85] - test: deflaketest-cluster-shared-handle-bind-privileged-port(Aviv Keller) #5537822c07867d1] - test: remove duplicate tests (Luigi Pinca) #553935489656b35] - test: update test_util.cc for coverage (minkyu_kim) #55291ceafb3250d] - test,crypto: make crypto tests work with BoringSSL (Shelley Vohr) #554917021b3b276] - test_runner: simplify hook running logic (Colin Ihrig) #55963d9fd632f56] - test_runner: error on mocking an already mocked date (Aviv Keller) #558583fcca16374] - test_runner: add support for scheduler.wait on mock timers (Erick Wendel) #55244f67147ec47] - tools: update github_reporter to 1.7.2 (Node.js GitHub Bot) #562055c819f1043] - tools: add REPLACEME check to workflow (Mert Can Altin) #56251b24a85b00b] - tools: usegithub.actorinstead of bot username for release proposals (Antoine du Hamel) #5623233cd7d3d8c] - tools: fix release proposal linter to support more than 1 folk preparing (Antoine du Hamel) #5620310d55e3d73] - tools: use commit title as PR title when creating release proposal (Antoine du Hamel) #56165b3d40e3be5] - tools: improve release proposal PR opening (Antoine du Hamel) #5616113455ca9ce] - tools: updatecreate-release-proposalworkflow (Antoine du Hamel) #56054851a3d7d8d] - tools: fix update-undici script (Michaël Zasso) #56069e1635fbd4e] - tools: allow dispatch oftools.ymlfrom forks (Antoine du Hamel) #560085f15d8b3f5] - tools: fix nghttp3 updater script (Antoine du Hamel) #56007bbf39b8c46] - tools: filter release keys to reduce interactivity (Antoine du Hamel) #55950954e60b87d] - tools: update WPT updater (Antoine du Hamel) #560031e09d258da] - tools: add WPT updater for specific subsystems (Mert Can Altin) #54460b95c4f5bf0] - tools: use tokenless Codecov uploads (Michaël Zasso) #559436327554706] - tools: add linter for release commit proposals (Antoine du Hamel) #55923aad478e58d] - tools: fix exclude labels for commit-queue (Richard Lau) #558091c8c881aef] - tools: make commit-queue check blocked label (Marco Ippolito) #55781c3913f9c87] - tools: fix c-ares updater script for Node.js 18 (Richard Lau) #55717adfc2f993a] - tools: fix root certificate updater (Richard Lau) #55681d336f8de15] - tools: compact jq output in daily-wpt-fyi.yml action (Filip Skokan) #55695cdb7839a0c] - tools: run daily WPT.fyi report on all supported releases (Filip Skokan) #55619274d0b4062] - tools: update lint-md-dependencies (Node.js GitHub Bot) #554703dceeb8b15] - tools: add script to synch c-ares source lists (Richard Lau) #55445bd0ec907da] - url: handle "unsafe" characters properly inpathToFileURL(Antoine du Hamel) #5454583137bceb6] - util: fix Latin1 decoding to return string output (Mert Can Altin) #56222195cc42935] - util: do not rely on mutableObjectandFunction'constructorprop (Antoine du Hamel) #56188cca7c518de] - util: add fast path for Latin1 decoding (Mert Can Altin) #552757ed346d8fd] - util: do not catch on circular@@​toStringTagerrors (Aviv Keller) #55544aa031b3eec] - worker: fix crash when a worker joins after exit (Stephen Belanger) #56191v20.18.2: 2025-01-21, Version 20.18.2 'Iron' (LTS), @RafaelGSSCompare Source
This is a security release.
Notable Changes
Dependency update:
Commits
df8b9f2c3e] - (CVE-2025-22150) deps: update undici to v6.21.1 (Matteo Collina) nodejs-private/node-private#66342d5821873] - (CVE-2025-23084) path: fix path traversal in normalize() on Windows (Tobias Nießen) nodejs-private/node-private#5558187a4b9bb] - src: fix HTTP2 mem leak on premature close and ERR_PROTO (RafaelGSS)389f239a28] - (CVE-2025-23083) src,loader,permission: throw on InternalWorker use (RafaelGSS) nodejs-private/node-private#652Configuration
📅 Schedule: Branch creation - "* 0-12 * * 3" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.