Skip to content

chore(deps): update node docker tag to v16.9.0

FW Serviceworker requested to merge deps/node-16.x into master

This MR contains the following updates:

Package Type Update Change
node final minor 16.3.0-alpine3.13 -> 16.9.0-alpine3.13
node stage minor 16.3.0-alpine3.13 -> 16.9.0-alpine3.13

Release Notes

nodejs/node

v16.9.0

Compare Source

Notable Changes
Corepack

Node.js now includes Corepack, a script that acts as a bridge between Node.js projects and the package managers they are intended to be used with during development. In practical terms, Corepack will let you use Yarn and pnpm without having to install them - just like what currently happens with npm, which is shipped in Node.js by default. Please head over to the Corepack documentation page for more information on how to use it.

Contributed by Maël Nison - #​39608

V8 9.3

V8 is updated to version 9.3, which includes performance improvements and new JavaScript features.

Object.hasOwn

Object.hasOwn is a static alias for Object.prototype.hasOwnProperty.call:

Object.hasOwn({ value: 42 }, 'value'); // Returns `true`.
Error cause

Errors can now be optionally constructed with a cause option, pointing to another error. This adds a cause property on the new error:

const error1 = new Error('Error one');
const error2 = new Error('Error two', { cause: error1 });
// error2.cause === error1

Contributed by Michaël Zasso - #​39947

Other Notable Changes
Commits

v16.8.0

Compare Source

Notable Changes
Commits

v16.7.0

Compare Source

Notable Changes
  • fs:
    • experimental: add recursive cp method (Benjamin Coe) #​39372
Commits

v16.6.2

Compare Source

This is a security release.

Notable Changes
  • CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)
    • Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of hostnames returned by Domain Name Servers in the Node.js DNS library which can lead to the output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22931.
  • CVE-2021-22930: Use after free on close http2 on stream canceling (High)
    • Node.js was vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix. You can read more about it at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930.
  • CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low)
    • If the Node.js HTTPS API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22939.
Commits

v16.6.1

Compare Source

Notable Changes
  • Updated npm to 7.20.3 (npm team) #​39579
  • Reverted an ABI-breaking change from V8 9.2 that could impact some native modules (Michaël Zasso) #​39624
  • Fixed a bug in error handling known to affect at least Webpack and Jest (Guy Bedford) #​39593
Commits

v16.6.0

Compare Source

This is a security release.

Notable Changes
Say hello to V8 9.2

The V8 engine is updated to version 9.2.230.21.

It notably introduces the new Array.prototype.at method (also on Typed Arrays and strings):

const array = [1, 2, 3];

console.log(array.at(-1));
// Prints: 3

Contributed by Michaël Zasso - #​39470

Other notable changes
Commits

v16.5.0

Compare Source

Notable Changes
Experimental Web Streams API

Node.js now exposes an experimental implementation of the Web Streams API.

While it is experimental, the API is not exposed on the global object and is only accessible using the new stream/web core module:

import { ReadableStream, WritableStream } from 'stream/web';
// Or from 'node:stream/web'

Importing the module will emit a single experimental warning per process.

The raw API is implemented and we are now working on its integration with various existing core APIs.

Contributed by James M Snell - #​39062

Other notable changes
Commits

v16.4.2

Compare Source

Notable Changes

Node.js 16.4.1 introduced a regression in the Windows installer on non-English locales that is being fixed in this release. There is no need to download this release if you are not using the Windows installer.

Commits

v16.4.1

Compare Source

This is a security release.

Notable Changes

Vulnerabilities fixed:

  • CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)
    • Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918
  • CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)
    • Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22921
Commits

v16.4.0

Compare Source

Notable changes
  • async_hooks:
    • stabilize part of AsyncLocalStorage (Vladimir de Turckheim) #​37675
  • deps:
    • upgrade npm to 7.18.1 (npm team) #​39065
    • update V8 to 9.1.269.36 (Michaël Zasso) #​38273
  • dns:
    • allow --dns-result-order to change default dns verbatim (Ouyang Yadong) #​38099
Commits

Configuration

📅 Schedule: At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about these updates again.

  • If you want to rebase/retry this MR, check this box.

Merge request reports