PR-URL: #39635
Reviewed-By: Bradley Farias <bradley.meck@gmail.com>

PR-URL: #40041
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Geoffrey Booth <webmaster@geoffreybooth.com>

There is no reason to hide FIPS functionality behind build flags.
OpenSSL always provide the information about FIPS availability via
`FIPS_mode()` function.

This makes the user experience more consistent, because the OpenSSL
library is always queried and the `crypto.getFips()` always returns
OpenSSL settings.

Fixes: #34903
Backport-PR-URL: #40241
PR-URL: #36341
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>

This commit turns on `-fno-strict-aliasing` in libuv.

Fixes: #40368
Refs: libuv/libuv#1230

PR-URL: #40631
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Voltrex <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

This updates all sources in deps/openssl/openssl by:
    $ cd deps/openssl/
    $ rm -rf openssl
    $ tar zxf ~/tmp/openssl-1.1.1m.tar.gz
    $ mv openssl-1.1.1m openssl
    $ git add --all openssl
    $ git commit openssl

PR-URL: #41173
Refs: https://mta.openssl.org/pipermail/openssl-announce/2021-December/000211.html
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Derek Lewis <DerekNonGeneric@inf.is>

After an OpenSSL source update, all the config files need to be
regenerated and committed by:
    $ make -C deps/openssl/config
    $ git add deps/openssl/config/archs
    $ git add deps/openssl/openssl/include/crypto/bn_conf.h
    $ git add deps/openssl/openssl/include/crypto/dso_conf.h
    $ git add deps/openssl/openssl/include/openssl/opensslconf.h
    $ git commit

PR-URL: #41173
Refs: https://mta.openssl.org/pipermail/openssl-announce/2021-December/000211.html
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Derek Lewis <DerekNonGeneric@inf.is>

Refs: https://github.com/unicode-org/icu/releases/tag/release-70-1

PR-URL: #40658
Backport-PR-URL: #41526
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

Backport-PR-URL: #40094
PR-URL: #39977
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Bradley Farias <bradley.meck@gmail.com>
Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>

Due to a bug in top-level await implementation, it used to default to
exit code 13.

PR-URL: #41388
Backport-PR-URL: #41508
Fixes: #40808
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Guy Bedford <guybedford@gmail.com>

PR-URL: #41434
Backport-PR-URL: #41518
Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Refs: #41434

PR-URL: #41516
Backport-PR-URL: #41518
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

PR-URL: #41603
Reviewed-By: Richard Lau <rlau@redhat.com>

Corepack provides shims for Yarn and pnpm in order to soften the
developer experience when working on Node projects.

Refs: #15244
Refs: nodejs/TSC#904

PR-URL: #39608
Backport-PR-URL: #40479
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

PR-URL: #40374
Backport-PR-URL: #40479
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: #41060
Backport-PR-URL: #40479
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

When the file read position is moved passing zero is
not respected and `null` is used instead. PR fixes the
issues by using nullish coalescing which will return
the rhs only when the lhs is `null` or `undefined`;
respecting the zero.

Fixes: #40715

PR-URL: #40716
Fixes: #40699
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Evan Lucas <evanlucas@me.com>

PR-URL: #39926
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

This is the certdata.txt[0] from NSS 3.71, released on 2021-09-30.

This is the version of NSS that will ship in Firefox 94 on
2021-11-02.

[0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_71_RTM/lib/ckfw/builtins/certdata.txt

PR-URL: #40280
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>

Update the list of root certificates in src/node_root_certs.h with
tools/mk-ca-bundle.pl.

Certificates added:
- Trustwave Global Certification Authority
- Trustwave Global ECC P256 Certification Authority
- Trustwave Global ECC P384 Certification Authority
- NAVER Global Root Certification Authority
- AC RAIZ FNMT-RCM SERVIDORES SEGUROS
- GlobalSign Root R46
- GlobalSign Root E46
- GLOBALTRUST 2020
- ANF Secure Server Root CA
- Certum EC-384 CA
- Certum Trusted Root CA
- TunTrust Root CA
- HARICA TLS RSA Root CA 2021
- HARICA TLS ECC Root CA 2021

Certificates removed:
- GeoTrust Global CA
- GeoTrust Universal CA
- GeoTrust Universal CA 2
- QuoVadis Root CA
- Sonera Class 2 Root CA
- Taiwan GRCA
- GeoTrust Primary Certification Authority
- thawte Primary Root CA
- VeriSign Class 3 Public Primary Certification Authority - G5
- OISTE WISeKey Global Root GA CA
- GeoTrust Primary Certification Authority - G3
- thawte Primary Root CA - G2
- thawte Primary Root CA - G3
- GeoTrust Primary Certification Authority - G2
- VeriSign Universal Root Certification Authority
- VeriSign Class 3 Public Primary Certification Authority - G4
- Chambers of Commerce Root - 2008
- Global Chambersign Root - 2008
- Trustis FPS Root CA
- EE Certification Centre Root CA
- Staat der Nederlanden Root CA - G3

PR-URL: #40280
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>

PR-URL: #40433
Reviewed-By: Vladimir de Turckheim <vlad2t@hotmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Bryan English <bryan@bryanenglish.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>

PR-URL: #40433
Reviewed-By: Vladimir de Turckheim <vlad2t@hotmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Bryan English <bryan@bryanenglish.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>

PR-URL: #40762
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Voltrex <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Notable changes:

Corepack:
Node.js now includes Corepack, a script that acts as a bridge between
Node.js projects and the package managers they are intended to be used
with during development.
In practical terms, Corepack will let you use Yarn and pnpm without
having to install them - just like what currently happens with npm,
which is shipped in Node.js by default.

Contributed by Maël Nison - #39608

ICU updated:
ICU has been updated to 70.1. This updates timezone database to 2021a3,
including bringing forward the start for DST for Jordan from March to
February.

Contributed by Michaël Zasso - #40658

New option to disable loading of native addons:
A new command line option `--no-addons` has been added to disallow
loading of native addons.

Contributed by Dominic Elm - #39977

Updated Root Certificates:
Root certificates have been updated to those from Mozilla's Network
Security Services 3.71.

Contributed by Richard Lau - #40280

Other Notable Changes:

crypto:
  * (SEMVER-MINOR) make FIPS related options always available (Vít Ondruch) #36341
lib:
  * (SEMVER-MINOR) add unsubscribe method to non-active DC channels (simon-id) #40433
  * (SEMVER-MINOR) add return value for DC channel.unsubscribe (simon-id) #40433
module:
  * (SEMVER-MINOR) support pattern trailers (Guy Bedford) #39635
src:
  * (SEMVER-MINOR) make napi_create_reference accept symbol (JckXia) #39926

PR-URL: #41696