Update Node.js 17.3.1 → 22.4.0

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

Release Notes

22.4.0

Sorry, we couldn't find anything useful about this release.

22.3.0

Notable Changes

[5a41bcf9ca] - (SEMVER-MINOR) src: traverse parent folders while running --run (Yagiz Nizipli) #53154

[1d5934524b] - (SEMVER-MINOR) buffer: add .bytes() method to Blob (Matthew Aitken) #53221

[75e5612fae] - (SEMVER-MINOR) src,permission: --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124

[b5c30e2f5e] - (SEMVER-MINOR) module: print amount of load time of a cjs module (Vinicius Lourenço) #52213

[8c6dffc269] - (SEMVER-MINOR) test_runner: add snapshot testing (Colin Ihrig) #53169

[048478d351] - (SEMVER-MINOR) doc: add context.assert docs (Colin Ihrig) #53169

[f6d2af8ee7] - (SEMVER-MINOR) test_runner: add context.fullName (Colin Ihrig) #53169

[a0766bdf0e] - (SEMVER-MINOR) net: add new net.server.listen tracing channel (Paolo Insogna) #53136

[374743cd4e] - (SEMVER-MINOR) process: add process.getBuiltinModule(id) (Joyee Cheung) #52762

[1eb55f3550] - (SEMVER-MINOR) doc: improve explanation about built-in modules (Joyee Cheung) #52762

[6165894774] - fs: mark recursive cp methods as stable (Théo LUDWIG) #53127

[db5dd0c6df] - doc: add StefanStojanovic to collaborators (StefanStojanovic) #53118

[cfcde78513] - (SEMVER-MINOR) cli: add NODE_RUN_PACKAGE_JSON_PATH env (Yagiz Nizipli) #53058

[7a67ecf161] - (SEMVER-MINOR) test_runner: support module mocking (Colin Ihrig) #52848

[ee56aecced] - (SEMVER-MINOR) lib: add EventSource Client (Aras Abbasi) #51575

[6413769bc7] - (SEMVER-MINOR) lib: replace MessageEvent with undici's (Matthew Aitken) #52370

[c70b2f7a76] - (SEMVER-MINOR) cli: add NODE_RUN_SCRIPT_NAME env to node --run (Yagiz Nizipli) #53032

[badec0c38b] - doc: add Marco Ippolito to TSC (Rafael Gonzaga) #53008

Commits

[feb0ba2860] - benchmark: fix napi/ref addon (Michaël Zasso) #53233

[bb844de4e1] - benchmark: fix api restriction for the permission category (Ryan Tsien) #51528

[1d5934524b] - (SEMVER-MINOR) buffer: add .bytes() method to Blob (Matthew Aitken) #53221

[d87f9af5aa] - buffer: make compare/equals faster (Tobias Nießen) #52993

[ec83431d71] - build: generate binlog in out directories (Chengzhong Wu) #53325

[0976439417] - build: fix --v8-lite-mode build (Daeyeon Jeong) #52725

[350c733ae6] - build: support python 3.13 (Chengzhong Wu) #53190

[74cefa55a2] - build: update ruff to v0.4.5 (Yagiz Nizipli) #53180

[33242ff042] - build: add --skip-tests to test-ci-js target (Antoine du Hamel) #53105

[edcadf7f8a] - build: fix building embedtest in GN build (Cheng) #53145

[d711942fce] - build: use broader detection for 'help' (Aviv Keller) #53045

[ca655b61a7] - build: fix -j propagation to ninja (Tobias Nießen) #53088

[5fba67ff9f] - build: exit on unsupported host OS for Android (Mohammed Keyvanzadeh) #52882

[b7d7e9a084] - build: fix --enable-d8 builds (Richard Lau) #53106

[14547c5d32] - build: fix ./configure --help format error (Zhenwei Jin) #53066

[f9490806d3] - build: set "clang" in config.gypi in GN build (Cheng) #53004

[638b510ce7] - cli: add --expose-gc flag available to NODE_OPTIONS (Juan José) #53078

[cfcde78513] - (SEMVER-MINOR) cli: add NODE_RUN_PACKAGE_JSON_PATH env (Yagiz Nizipli) #53058

[c70b2f7a76] - (SEMVER-MINOR) cli: add NODE_RUN_SCRIPT_NAME env to node --run (Yagiz Nizipli) #53032

[34f20983fd] - crypto: fix propagation of "memory limit exceeded" (Tobias Nießen) #53300

[fef067f4f4] - deps: update nghttp2 to 1.62.1 (Node.js GitHub Bot) #52966

[fc949928ac] - deps: update nghttp2 to 1.62.0 (Node.js GitHub Bot) #52966

[4a17dda8dc] - deps: update undici to 6.18.2 (Node.js GitHub Bot) #53255

[e45cc2a551] - deps: update ada to 2.8.0 (Node.js GitHub Bot) #53254

[77907a2619] - deps: update corepack to 0.28.2 (Node.js GitHub Bot) #53253

[b688050778] - deps: update simdjson to 3.9.3 (Node.js GitHub Bot) #53252

[6303f19cbe] - deps: patch V8 to 12.4.254.20 (Node.js GitHub Bot) #53159

[257004c68f] - deps: update c-ares to 1.29.0 (Node.js GitHub Bot) #53155

[0b375a3e36] - deps: upgrade npm to 10.8.1 (npm team) #53207

[728c861b1c] - deps: fix FP16 bitcasts.h (Stefan Stojanovic) #53134

[52a78737b1] - deps: patch V8 to 12.4.254.19 (Node.js GitHub Bot) #53094

[4d27b32e58] - deps: update undici to 6.18.1 (Node.js GitHub Bot) #53073

[b94199240b] - deps: update undici to 6.18.0 (Node.js GitHub Bot) #53073

[793af1b3e7] - deps: update undici to 6.17.0 (Node.js GitHub Bot) #53034

[fe00becc03] - deps: update undici to 6.16.1 (Node.js GitHub Bot) #52948

[96f72ae54f] - deps: update undici to 6.15.0 (Matthew Aitken) #52763

[af60fbb12b] - deps: update googletest to 33af80a (Node.js GitHub Bot) #53053

[7b929df489] - deps: patch V8 to 12.4.254.18 (Node.js GitHub Bot) #53054

[626037c0fc] - deps: update zlib to 1.3.0.1-motley-4f653ff (Node.js GitHub Bot) #53052

[6d8589e558] - deps: patch V8 to 12.4.254.17 (Node.js GitHub Bot) #52980

[fd91eaab34] - deps: upgrade npm to 10.8.0 (npm team) #53014

[133cae0732] - doc: fix broken link in static-analysis.md (Richard Lau) #53345

[7bc5f964fd] - doc: indicate requirement on VS 17.6 or newer (Chengzhong Wu) #53301

[8c71522ced] - doc: remove cases for keys not containing "*" in PATTERN_KEY_COMPARE (Maarten Zuidhoorn) #53215

[718a3ab1ab] - doc: add err param to fs.cp callback (Feng Yu) #53234

[d89bde26ff] - doc: add err param to fs.copyFile callback (Feng Yu) #53234

[91971ee344] - doc: reserve 128 for Electron 32 (Keeley Hammond) #53203

[812f0e9e14] - doc: add note to ninjia build for macOS using -jn flag (jakecastelli) #53187

[048478d351] - (SEMVER-MINOR) doc: add context.assert docs (Colin Ihrig) #53169

[c391923445] - doc: include ESM import for HTTP (Aviv Keller) #53165

[1eb55f3550] - (SEMVER-MINOR) doc: improve explanation about built-in modules (Joyee Cheung) #52762

[67a766f7d4] - doc: fix minor grammar and style issues in SECURITY.md (Rich Trott) #53168

[afbfe8922a] - doc: mention pm is not enforced when using fd (Rafael Gonzaga) #53125

[1702d2632e] - doc: fix format in esm.md (Pop Moore) #53170

[070577e7d7] - doc: fix wrong variable name in example of timers.tick() (Deokjin Kim) #53147

[7147c1df1f] - doc: fix wrong function name in example of context.plan() (Deokjin Kim) #53140

[cf47384148] - doc: add note for windows users and symlinks (Aviv Keller) #53117

[088dff1074] - doc: move all TLS-PSK documentation to its section (Alba Mendez) #35717

[db5dd0c6df] - doc: add StefanStojanovic to collaborators (StefanStojanovic) #53118

[0f0bc98ad7] - doc: improve ninja build for --built-in-modules-path (jakecastelli) #53007

[4c65c52d30] - doc: avoid hiding by navigation bar in anchor jumping (Cloyd Lau) #45131

[63fcbcfd62] - doc: remove unavailable youtube link in pull requests (Deokjin Kim) #52982

[77fd504636] - doc: add missing supported timer values in timers.enable() (Deokjin Kim) #52969

[6708536b03] - fs: fix cp dir/non-dir mismatch error messages (Mathis Wiehl) #53150

[6165894774] - fs: mark recursive cp methods as stable (Théo LUDWIG) #53127

[7940db7be1] - fs: remove basename in favor of std::filesystem (Yagiz Nizipli) #53062

[505e9a425b] - lib: fix misleading argument of validateUint32 (Tobias Nießen) #53307

[98ae1ebdd6] - lib: fix the name of the fetch global function (Gabriel Bota) #53227

[fe007cd1b4] - lib: allow CJS source map cache to be reclaimed (Chengzhong Wu) #51711

[040be4a7b4] - lib: do not call callback if socket is closed (theanarkh) #52829

[ee56aecced] - (SEMVER-MINOR) lib: add EventSource Client (Aras Abbasi) #51575

[6413769bc7] - (SEMVER-MINOR) lib: replace MessageEvent with undici's (Matthew Aitken) #52370

[879679e5a3] - lib,doc: replace references to import assertions (Michaël Zasso) #52998

[062a0c6f67] - meta: bump ossf/scorecard-action from 2.3.1 to 2.3.3 (dependabot[bot]) #53248

[e59b744b30] - meta: bump actions/checkout from 4.1.4 to 4.1.6 (dependabot[bot]) #53247

[96924f48a0] - meta: bump github/codeql-action from 3.25.3 to 3.25.7 (dependabot[bot]) #53246

[b7f5662dee] - meta: bump codecov/codecov-action from 4.3.1 to 4.4.1 (dependabot[bot]) #53244

[e079967eb4] - meta: remove initializeCommand from devcontainer (Aviv Keller) #53137

[3afeced572] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #53065

[4b9cdea8a6] - Revert "module: have a single hooks thread for all workers" (Matteo Collina) #53183

[b5c30e2f5e] - (SEMVER-MINOR) module: print amount of load time of a cjs module (Vinicius Lourenço) #52213

[4cdb05a7a2] - module: do not set CJS variables for Worker eval (Antoine du Hamel) #53050

[a0766bdf0e] - (SEMVER-MINOR) net: add new net.server.listen tracing channel (Paolo Insogna) #53136

[374743cd4e] - (SEMVER-MINOR) process: add process.getBuiltinModule(id) (Joyee Cheung) #52762

[e66eb376a0] - repl: fix await object patterns without values (Luke Haas) #53331

[cb1329a8cf] - src: use v8::(Des|S)erializeInternalFieldsCallback (Joyee Cheung) #53217

[1886fe99af] - src: use __FUNCSIG__ on Windows in backtrace (Joyee Cheung) #53135

[3bfce6c816] - src: use new V8 API to define stream accessor (Igor Sheludko) #53084

[11f790d911] - src: do not use deprecated V8 API (ishell) #53084

[6b1731cbcc] - src: convert all endian checks to constexpr (Tobias Nießen) #52974

[7aa9519ad4] - src: fix external module env and kDisableNodeOptionsEnv (Rafael Gonzaga) #52905

[838fe59787] - src: fix execArgv in worker (theanarkh) #53029

[4a2c6ff05d] - src: reduce unnecessary GetCwd calls (Yagiz Nizipli) #53064

[ec44965b49] - src: simplify node modules traverse path (Yagiz Nizipli) #53061

[190129b48e] - src: remove unused base64_table_url (Yagiz Nizipli) #53040

[d750a3c5c4] - src: remove calls to recently deprecated V8 APIs (Adam Klein) #52996

[f1890abb18] - src: replace deprecated GetImportAssertions V8 API (Michaël Zasso) #52997

[4347bd2acb] - src: improve node::Dotenv declarations (Tobias Nießen) #52973

[e26166f30b] - src,permission: handle process.chdir on pm (Rafael Gonzaga) #53175

[75e5612fae] - (SEMVER-MINOR) src,permission: --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124

[7c66b27407] - stream: micro-optimize writable condition (Orgad Shaneh) #53189

[a656cf6bc8] - stream: fix memory usage regression in writable (Orgad Shaneh) #53188

[0e85a84fdc] - test: fix test when compiled without engine support (Richard Lau) #53232

[cebbd83e47] - test: update TLS trace tests for OpenSSL >= 3.2 (Richard Lau) #53229

[45c1eb19f1] - Revert "test: skip v8-updates/test-linux-perf-logger" (Luke Albao) #52869

[c1138db3c1] - test: unskip v8-updates/test-linux-perf-logger (Luke Albao) #52869

[65b64cf0f1] - test: fix Windows native test suites (Stefan Stojanovic) #53173

[9a47792cd1] - test: skip test-setproctitle when ps is not available (Antoine du Hamel) #53104

[a371dea699] - test: increase allocation so it fails for the test (Adam Majer) #53099

[3ce7a9a1b5] - test: remove timers from test-tls-socket-close (Luigi Pinca) #53019

[494fa542af] - test: replace .substr with .slice (Antoine du Hamel) #53070

[3f7d55b7db] - test: add AbortController to knownGlobals (Luigi Pinca) #53020

[c61f909ab6] - test,doc: enable running embedtest for Windows (Vladimir Morozov) #52646

[2d1ecbf827] - test_runner: calculate executed lines using source map (Moshe Atlow) #53315

[d4f5f80f6c] - test_runner: handle file rename and deletion under watch mode (jakecastelli) #53114

[07c601e32f] - test_runner: refactor to use min/max of validateInteger (Deokjin Kim) #53148

[8c6dffc269] - (SEMVER-MINOR) test_runner: add snapshot testing (Colin Ihrig) #53169

[f6d2af8ee7] - (SEMVER-MINOR) test_runner: add context.fullName (Colin Ihrig) #53169

[7a67ecf161] - (SEMVER-MINOR) test_runner: support module mocking (Colin Ihrig) #52848

[3ff174f2bf] - test_runner: fix t.assert methods (Colin Ihrig) #53049

[e2211a07c2] - test_runner: avoid error when coverage line not found (Moshe Atlow) #53000

[c249289121] - test_runner,doc: align documentation with actual stdout/stderr behavior (Moshe Atlow) #53131

[5110b19a07] - tls: fix negative sessionTimeout handling (Tobias Nießen) #53002

[0ecb770331] - tools: remove no-goma arg from make-v8 script (Michaël Zasso) #53336

[e7f3a3c296] - tools: use sccache Github action (Moshe Atlow) #53316

[98cc094bc5] - tools: update eslint to 9.4.0 (Node.js GitHub Bot) #53298

[6409b1fe65] - tools: update gyp-next to 0.18.1 (Node.js GitHub Bot) #53251

[86e80dcb9b] - tools: move webcrypto into no-restricted-properties (Zihong Qu) #53023

[6022346f0e] - tools: update error message for Type Error (Aviv Keller) #53047

[c1b3e0ed6f] - Revert "tools: add --certify-safe to nci-ci" (Antoine du Hamel) #53098

[9f764a873c] - tools: update ESLint to v9 and use flat config (Michaël Zasso) #52780

[2859f4c027] - watch: fix variable naming (jakecastelli) #53101

22.2.0

Sorry, we couldn't find anything useful about this release.

22.1.0

Sorry, we couldn't find anything useful about this release.

22.0.0

Sorry, we couldn't find anything useful about this release.

21.0.0

Sorry, we couldn't find anything useful about this release.

20.0.0

We're excited to announce the release of Node.js 20! Highlights include the new Node.js Permission Model, a synchronous import.meta.resolve, a stable test_runner, updates of the V8 JavaScript engine to 11.3, Ada to 2.0, and more!

As a reminder, Node.js 20 will enter long-term support (LTS) in October, but until then, it will be the "Current" release for the next six months. We encourage you to explore the new features and benefits offered by this latest release and evaluate their potential impact on your applications.

Notable Changes

Permission Model

Node.js now has an experimental feature called the Permission Model. It allows developers to restrict access to specific resources during program execution, such as file system operations, child process spawning, and worker thread creation. The API exists behind a flag --experimental-permission which when enabled will restrict access to all available permissions. By using this feature, developers can prevent their applications from accessing or modifying sensitive data or running potentially harmful code. More information about the Permission Model can be found in the Node.js documentation.

The Permission Model was a contribution by Rafael Gonzaga in #44004.

Custom ESM loader hooks run on dedicated thread

ESM hooks supplied via loaders (--experimental-loader=foo.mjs) now run in a dedicated thread, isolated from the main thread. This provides a separate scope for loaders and ensures no cross-contamination between loaders and application code.

Synchronous import.meta.resolve()

In alignment with browser behavior, this function now returns synchronously. Despite this, user loader resolve hooks can still be defined as async functions (or as sync functions, if the author prefers). Even when there are async resolve hooks loaded, import.meta.resolve will still return synchronously for application code.

Contributed by Anna Henningsen, Antoine du Hamel, Geoffrey Booth, Guy Bedford, Jacob Smith, and Michaël Zasso in #44710

19.0.0

Node.js 19 is here! Highlights include the update of the V8 JavaScript engine to 10.7, HTTP(s)/1.1 KeepAlive enabled by default, and ESM Resolution adjusts.

Node.js 19 will replace Node.js 18 as our ‘Current’ release line when Node.js 18 enters long-term support (LTS) later this month. As per the release schedule, Node.js 19 will be ‘Current' release for the next 6 months, until April 2023.

Notable Changes

Deprecations and Removals

[7dd2f41c73] - (SEMVER-MAJOR) module: runtime deprecate exports double slash maps (Guy Bedford) #44495

[ada2d053ae] - (SEMVER-MAJOR) process: runtime deprecate coercion to integer in process.exit() (Daeyeon Jeong) #44711

18.0.0

Node.js 18 is here! Highlights include the update of the V8 JavaScript engine to 10.1, global fetch enabled by default, and a core test runner module.

Initially, Node.js 18 will replace Node.js 17 as our ‘Current’ release line. As per the release schedule, Node.js 18 will be the ‘Current’ release for the next 6 months and then promoted to Long-term Support (LTS) in October 2022. Once promoted to long-term support the release will be designated the codename ‘Hydrogen’. Node.js 18 will be supported until April 2025.

Notable Changes

Deprecations and Removals

(SEMVER-MAJOR) fs: runtime deprecate string coercion in fs.write, fs.writeFileSync (Livia Medeiros) #42607

(SEMVER-MAJOR) dns: remove dns.lookup and dnsPromises.lookup options type coercion (Antoine du Hamel) #41431

(SEMVER-MAJOR) process: runtime deprecate multipleResolves (Benjamin Gruenbaum) #41896

(SEMVER-MAJOR) stream: remove thenable support (Robert Nagy) #40773

(SEMVER-MAJOR) tls: move tls.parseCertString to end-of-life (Tobias Nießen) #41479

fetch (experimental)

An experimental fetch API is available on the global scope by default. The implementation is based upon undici, an HTTP/1.1 client written for Node.js by contributors to the project.
const res = await fetch('https://nodejs.org/api/documentation.json');
if (res.ok) {
  const data = await res.json();
  console.log(data);
}
Through this addition, the following globals are made available: fetch, FormData, Headers, Request, Response.

Disable this API with the --no-experimental-fetch command-line flag.

Contributed by Michaël Zasso in #41811.

HTTP Timeouts

server.headersTimeout which limits the amount of time the parser will wait to receive the complete HTTP headers is now set to 60000 (60 seconds) by default.

server.requestTimeout which sets the timeout value in milliseconds for receiving the entire request from the client is now set to 300000 (5 minutes) by default.

If these timeouts expire, the server responds with status 408 without forwarding the request to the request listener and then closes the connection.

Both timeouts must be set to a non-zero value to protect against potential Denial-of-Service attacks in case the server is deployed without a reverse proxy in front.

Contributed by Paolo Insogna in #41263.

Test Runner module (experimental)

The node:test module facilitates the creation of JavaScript tests that report results in TAP format. To access it:

import test from 'node:test';

This module is only available under the node: scheme.

The following is an example implementation of a parent test with two subtests:
test('top level test', async (t) => {
  await t.test('subtest 1', (t) => {
    assert.strictEqual(1, 1);
  });

  await t.test('subtest 2', (t) => {
    assert.strictEqual(2, 2);
  });
});
Read more in https://nodejs.org/dist/latest-v18.x/docs/api/test.html.

Contributed by Colin Ihrig in #42325.

Toolchain and Compiler Upgrades

Prebuilt binaries for Linux are now built on Red Hat Enterprise Linux (RHEL) 8 and are compatible with Linux distributions based on glibc 2.28 or later, for example, Debian 10, RHEL 8, Ubuntu 20.04.

Prebuilt binaries for macOS now require macOS 10.15 or later.

For AIX the minimum supported architecture has been raised from Power 7 to Power 8.

Prebuilt binaries for 32-bit Windows will initially not be available due to issues building the V8 dependency in Node.js. We hope to restore 32-bit Windows binaries for Node.js 18 with a future V8 update.

Node.js does not support running on operating systems that are no longer supported by their vendor. For operating systems where their vendor has planned to end support earlier than April 2025, such as Windows 8.1 (January 2023) and Windows Server 2012 R2 (October 2023), support for Node.js 18 will end at the earlier date.

Full details about the supported toolchains and compilers are documented in the Node.js BUILDING.md file.

Contributed by Richard Lau in #42292, #42604 and #42659,and Michaël Zasso in #42105 and #42666.

All Depfu comment commands

@depfu refresh
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Pauses all engine updates and closes this PR

yetanother-blog / indiepen

Update Node.js 17.3.1 → 22.4.0 #252

What changed?

22.4.0

22.3.0

Notable Changes

Commits

22.2.0

22.1.0

22.0.0

21.0.0

20.0.0

Notable Changes

Permission Model

Custom ESM loader hooks run on dedicated thread

19.0.0

Notable Changes

Deprecations and Removals

18.0.0

Notable Changes

Deprecations and Removals

fetch (experimental)

HTTP Timeouts

Test Runner module (experimental)

Toolchain and Compiler Upgrades