diff --git a/LICENSE b/LICENSE
index a34f642b3cb..28723292ba5 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1145,3 +1145,26 @@ The externally maintained libraries used by Node.js are:
     OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     THE SOFTWARE.
   """
+
+- node-inspect, located at deps/node-inspect, is licensed as follows:
+  """
+    Copyright Node.js contributors. All rights reserved.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to
+    deal in the Software without restriction, including without limitation the
+    rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+    sell copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in
+    all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+    FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+    IN THE SOFTWARE.
+  """
diff --git a/deps/uv/src/win/tty.c b/deps/uv/src/win/tty.c
index 4cd1c72129c..05a11e88305 100644
--- a/deps/uv/src/win/tty.c
+++ b/deps/uv/src/win/tty.c
@@ -2285,13 +2285,16 @@ static DWORD WINAPI uv__tty_console_resize_message_loop_thread(void* param) {
   uv__tty_console_width = sb_info.dwSize.X;
   uv__tty_console_height = sb_info.srWindow.Bottom - sb_info.srWindow.Top + 1;
 
-  if (!SetWinEventHook(EVENT_CONSOLE_LAYOUT,
-                       EVENT_CONSOLE_LAYOUT,
-                       NULL,
-                       uv__tty_console_resize_event,
-                       0,
-                       0,
-                       WINEVENT_OUTOFCONTEXT))
+  if (pSetWinEventHook == NULL)
+    return 0;
+
+  if (!pSetWinEventHook(EVENT_CONSOLE_LAYOUT,
+                        EVENT_CONSOLE_LAYOUT,
+                        NULL,
+                        uv__tty_console_resize_event,
+                        0,
+                        0,
+                        WINEVENT_OUTOFCONTEXT))
     return 0;
 
   while (GetMessage(&msg, NULL, 0, 0)) {
diff --git a/deps/uv/src/win/winapi.c b/deps/uv/src/win/winapi.c
index aa5d719fbea..4ccdf0a5f97 100644
--- a/deps/uv/src/win/winapi.c
+++ b/deps/uv/src/win/winapi.c
@@ -52,11 +52,15 @@ sGetFinalPathNameByHandleW pGetFinalPathNameByHandleW;
 /* Powrprof.dll function pointer */
 sPowerRegisterSuspendResumeNotification pPowerRegisterSuspendResumeNotification;
 
+/* User32.dll function pointer */
+sSetWinEventHook pSetWinEventHook;
+
 
 void uv_winapi_init(void) {
   HMODULE ntdll_module;
   HMODULE kernel32_module;
   HMODULE powrprof_module;
+  HMODULE user32_module;
 
   ntdll_module = GetModuleHandleA("ntdll.dll");
   if (ntdll_module == NULL) {
@@ -156,4 +160,10 @@ void uv_winapi_init(void) {
       GetProcAddress(powrprof_module, "PowerRegisterSuspendResumeNotification");
   }
 
+  user32_module = LoadLibraryA("user32.dll");
+  if (user32_module != NULL) {
+    pSetWinEventHook = (sSetWinEventHook)
+      GetProcAddress(user32_module, "SetWinEventHook");
+  }
+
 }
diff --git a/deps/uv/src/win/winapi.h b/deps/uv/src/win/winapi.h
index 6c699bfe170..cc54b79b08d 100644
--- a/deps/uv/src/win/winapi.h
+++ b/deps/uv/src/win/winapi.h
@@ -4725,6 +4725,25 @@ typedef DWORD (WINAPI *sPowerRegisterSuspendResumeNotification)
                HANDLE        Recipient,
                _PHPOWERNOTIFY RegistrationHandle);
 
+/* from Winuser.h */
+typedef VOID (CALLBACK* WINEVENTPROC)
+             (HWINEVENTHOOK hWinEventHook,
+              DWORD         event,
+              HWND          hwnd,
+              LONG          idObject,
+              LONG          idChild,
+              DWORD         idEventThread,
+              DWORD         dwmsEventTime);
+
+typedef HWINEVENTHOOK (WINAPI *sSetWinEventHook)
+                      (UINT         eventMin,
+                       UINT         eventMax,
+                       HMODULE      hmodWinEventProc,
+                       WINEVENTPROC lpfnWinEventProc,
+                       DWORD        idProcess,
+                       DWORD        idThread,
+                       UINT         dwflags);
+
 
 /* Ntdll function pointers */
 extern sRtlNtStatusToDosError pRtlNtStatusToDosError;
@@ -4753,4 +4772,7 @@ extern sGetFinalPathNameByHandleW pGetFinalPathNameByHandleW;
 /* Powrprof.dll function pointer */
 extern sPowerRegisterSuspendResumeNotification pPowerRegisterSuspendResumeNotification;
 
+/* User32.dll function pointer */
+extern sSetWinEventHook pSetWinEventHook;
+
 #endif /* UV_WIN_WINAPI_H_ */
diff --git a/lib/_http_server.js b/lib/_http_server.js
index bfbab222264..04161ac024b 100644
--- a/lib/_http_server.js
+++ b/lib/_http_server.js
@@ -44,6 +44,7 @@ const STATUS_CODES = {
   100: 'Continue',
   101: 'Switching Protocols',
   102: 'Processing',                 // RFC 2518, obsoleted by RFC 4918
+  103: 'Early Hints',
   200: 'OK',
   201: 'Created',
   202: 'Accepted',
diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
index d7e349b239c..1bd76a7f97c 100644
--- a/lib/_tls_wrap.js
+++ b/lib/_tls_wrap.js
@@ -280,11 +280,15 @@ function initRead(tls, wrapped) {
  * Provides a wrap of socket stream to do encrypted communication.
  */
 
-function TLSSocket(socket, options) {
-  if (options === undefined)
-    this._tlsOptions = {};
-  else
-    this._tlsOptions = options;
+function TLSSocket(socket, opts) {
+  const tlsOptions = Object.assign({}, opts);
+
+  if (tlsOptions.NPNProtocols)
+    tls.convertNPNProtocols(tlsOptions.NPNProtocols, tlsOptions);
+  if (tlsOptions.ALPNProtocols)
+    tls.convertALPNProtocols(tlsOptions.ALPNProtocols, tlsOptions);
+
+  this._tlsOptions = tlsOptions;
   this._secureEstablished = false;
   this._securePending = false;
   this._newSessionPending = false;
@@ -1099,11 +1103,7 @@ exports.connect = function(...args /* [port,] [host,] [options,] [cb] */) {
          'options.minDHSize is not a positive number: ' +
          options.minDHSize);
 
-  const NPN = {};
-  const ALPN = {};
   const context = options.secureContext || tls.createSecureContext(options);
-  tls.convertNPNProtocols(options.NPNProtocols, NPN);
-  tls.convertALPNProtocols(options.ALPNProtocols, ALPN);
 
   var socket = new TLSSocket(options.socket, {
     pipe: !!options.path,
@@ -1112,8 +1112,8 @@ exports.connect = function(...args /* [port,] [host,] [options,] [cb] */) {
     requestCert: true,
     rejectUnauthorized: options.rejectUnauthorized !== false,
     session: options.session,
-    NPNProtocols: NPN.NPNProtocols,
-    ALPNProtocols: ALPN.ALPNProtocols,
+    NPNProtocols: options.NPNProtocols,
+    ALPNProtocols: options.ALPNProtocols,
     requestOCSP: options.requestOCSP
   });
 
diff --git a/src/node_http2.h b/src/node_http2.h
index 39ed27249d3..a19e032ccef 100644
--- a/src/node_http2.h
+++ b/src/node_http2.h
@@ -158,6 +158,7 @@ HTTP_KNOWN_HEADER_MAX
   V(CONTINUE, 100)                                                            \
   V(SWITCHING_PROTOCOLS, 101)                                                 \
   V(PROCESSING, 102)                                                          \
+  V(EARLY_HINTS, 103)                                                         \
   V(OK, 200)                                                                  \
   V(CREATED, 201)                                                             \
   V(ACCEPTED, 202)                                                            \
diff --git a/src/node_http2_core-inl.h b/src/node_http2_core-inl.h
index eda8a93ee79..c78e5d673f4 100644
--- a/src/node_http2_core-inl.h
+++ b/src/node_http2_core-inl.h
@@ -503,7 +503,7 @@ inline void Nghttp2Session::SendPendingData() {
   while ((srcLength = nghttp2_session_mem_send(session_, &src)) > 0) {
     if (req == nullptr) {
       req = AllocateSend();
-      destRemaining = req->self_size();
+      destRemaining = req->ExtraSize();
       dest = req->Extra();
     }
     DEBUG_HTTP2("Nghttp2Session %s: nghttp2 has %d bytes to send\n",
@@ -525,7 +525,7 @@ inline void Nghttp2Session::SendPendingData() {
       srcRemaining -= destRemaining;
       srcOffset += destRemaining;
       req = AllocateSend();
-      destRemaining = req->self_size();
+      destRemaining = req->ExtraSize();
       dest = req->Extra();
     }
 
diff --git a/src/stream_base-inl.h b/src/stream_base-inl.h
index 667c0a9ffbd..e1e50802f2a 100644
--- a/src/stream_base-inl.h
+++ b/src/stream_base-inl.h
@@ -160,6 +160,10 @@ char* WriteWrap::Extra(size_t offset) {
          offset;
 }
 
+size_t WriteWrap::ExtraSize() const {
+  return storage_size_ - ROUND_UP(sizeof(*this), kAlignSize);
+}
+
 }  // namespace node
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/stream_base.h b/src/stream_base.h
index 9833a82636d..20cb0155c9d 100644
--- a/src/stream_base.h
+++ b/src/stream_base.h
@@ -77,6 +77,7 @@ class WriteWrap: public ReqWrap<uv_write_t>,
                                size_t extra = 0);
   inline void Dispose();
   inline char* Extra(size_t offset = 0);
+  inline size_t ExtraSize() const;
 
   inline StreamBase* wrap() const { return wrap_; }
 
diff --git a/test/parallel/test-eslint-no-let-in-for-declaration.js b/test/parallel/test-eslint-no-let-in-for-declaration.js
index b6b7c357455..c3c1e17a729 100644
--- a/test/parallel/test-eslint-no-let-in-for-declaration.js
+++ b/test/parallel/test-eslint-no-let-in-for-declaration.js
@@ -24,14 +24,17 @@ ruleTester.run('no-let-in-for-declaration', rule, {
   invalid: [
     {
       code: 'for (let foo = 1;;);',
+      output: 'for (var foo = 1;;);',
       errors: [{ message }]
     },
     {
       code: 'for (let foo in bar);',
+      output: 'for (var foo in bar);',
       errors: [{ message }]
     },
     {
       code: 'for (let foo of bar);',
+      output: 'for (var foo of bar);',
       errors: [{ message }]
     }
   ]
diff --git a/test/parallel/test-http2-binding.js b/test/parallel/test-http2-binding.js
index 5b7a74a0324..8935e569f50 100644
--- a/test/parallel/test-http2-binding.js
+++ b/test/parallel/test-http2-binding.js
@@ -31,6 +31,7 @@ const expectedStatusCodes = {
   HTTP_STATUS_CONTINUE: 100,
   HTTP_STATUS_SWITCHING_PROTOCOLS: 101,
   HTTP_STATUS_PROCESSING: 102,
+  HTTP_STATUS_EARLY_HINTS: 103,
   HTTP_STATUS_OK: 200,
   HTTP_STATUS_CREATED: 201,
   HTTP_STATUS_ACCEPTED: 202,
diff --git a/test/parallel/test-tls-socket-constructor-alpn-npn-options-parsing.js b/test/parallel/test-tls-socket-constructor-alpn-npn-options-parsing.js
new file mode 100644
index 00000000000..fec06c94eec
--- /dev/null
+++ b/test/parallel/test-tls-socket-constructor-alpn-npn-options-parsing.js
@@ -0,0 +1,78 @@
+'use strict';
+
+// Test that TLSSocket can take arrays of strings for ALPNProtocols and
+// NPNProtocols.
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const tls = require('tls');
+
+new tls.TLSSocket(null, {
+  ALPNProtocols: ['http/1.1'],
+  NPNProtocols: ['http/1.1']
+});
+
+if (!process.features.tls_npn)
+  common.skip('node compiled without NPN feature of OpenSSL');
+
+if (!process.features.tls_alpn)
+  common.skip('node compiled without ALPN feature of OpenSSL');
+
+const assert = require('assert');
+const net = require('net');
+const fixtures = require('../common/fixtures');
+
+const key = fixtures.readKey('agent1-key.pem');
+const cert = fixtures.readKey('agent1-cert.pem');
+
+const protocols = [];
+
+const server = net.createServer(common.mustCall((s) => {
+  const tlsSocket = new tls.TLSSocket(s, {
+    isServer: true,
+    server,
+    key,
+    cert,
+    ALPNProtocols: ['http/1.1'],
+    NPNProtocols: ['http/1.1']
+  });
+
+  tlsSocket.on('secure', common.mustCall(() => {
+    protocols.push({
+      alpnProtocol: tlsSocket.alpnProtocol,
+      npnProtocol: tlsSocket.npnProtocol
+    });
+    tlsSocket.end();
+  }));
+}, 2));
+
+server.listen(0, common.mustCall(() => {
+  const alpnOpts = {
+    port: server.address().port,
+    rejectUnauthorized: false,
+    ALPNProtocols: ['h2', 'http/1.1']
+  };
+  const npnOpts = {
+    port: server.address().port,
+    rejectUnauthorized: false,
+    NPNProtocols: ['h2', 'http/1.1']
+  };
+
+  tls.connect(alpnOpts, function() {
+    this.end();
+
+    tls.connect(npnOpts, function() {
+      this.end();
+
+      server.close();
+
+      assert.deepStrictEqual(protocols, [
+        { alpnProtocol: 'http/1.1', npnProtocol: false },
+        { alpnProtocol: false, npnProtocol: 'http/1.1' }
+      ]);
+    });
+  });
+}));
diff --git a/tools/eslint-rules/no-let-in-for-declaration.js b/tools/eslint-rules/no-let-in-for-declaration.js
index 8b1a6783e07..34ad2d5761f 100644
--- a/tools/eslint-rules/no-let-in-for-declaration.js
+++ b/tools/eslint-rules/no-let-in-for-declaration.js
@@ -14,7 +14,7 @@
 
 module.exports = {
   create(context) {
-
+    const sourceCode = context.getSourceCode();
     const msg = 'Use of `let` as the loop variable in a for-loop is ' +
                 'not recommended. Please use `var` instead.';
 
@@ -23,7 +23,12 @@ module.exports = {
      */
     function testForLoop(node) {
       if (node.init && node.init.kind === 'let') {
-        context.report(node.init, msg);
+        context.report({
+          node: node.init,
+          message: msg,
+          fix: (fixer) =>
+            fixer.replaceText(sourceCode.getFirstToken(node.init), 'var')
+        });
       }
     }
 
@@ -33,7 +38,12 @@ module.exports = {
      */
     function testForInOfLoop(node) {
       if (node.left && node.left.kind === 'let') {
-        context.report(node.left, msg);
+        context.report({
+          node: node.left,
+          message: msg,
+          fix: (fixer) =>
+            fixer.replaceText(sourceCode.getFirstToken(node.left), 'var')
+        });
       }
     }
 
diff --git a/tools/license-builder.sh b/tools/license-builder.sh
index 6abeb76b1df..39b0a15b2b2 100755
--- a/tools/license-builder.sh
+++ b/tools/license-builder.sh
@@ -85,4 +85,7 @@ addlicense "nghttp2" "deps/nghttp2" "$(cat ${rootdir}/deps/nghttp2/COPYING)"
 # remark-cli
 addlicense "remark-cli" "tools/remark-cli" "$(cat ${rootdir}/tools/remark-cli/LICENSE)"
 
+# node-inspect
+addlicense "node-inspect" "deps/node-inspect" "$(cat ${rootdir}/deps/node-inspect/LICENSE)"
+
 mv $tmplicense $licensefile