v17.7.0 release proposal

.github/ISSUE_TEMPLATE/2-feature-request.yml

@@ -10,7 +10,7 @@ body:
         Please fill in as much of the following form as you're able.
 
         For more information on how the project manages feature
-        requests, see [Feature request management](https://github.com/nodejs/node/blob/HEAD/doc/guides/feature-request-management.md).
+        requests, see [Feature request management](https://github.com/nodejs/node/blob/HEAD/doc/contributing/feature-request-management.md).
   - type: textarea
     attributes:
       label: What is the problem this feature will solve?

.github/workflows/close-stale-feature-requests.yml

@@ -1,9 +1,12 @@
 name: Close stale feature requests
 on:
   workflow_dispatch:
-  schedule:
-    # Run every day at 1:00 AM UTC.
-    - cron: 0 1 * * *
+    inputs:
+      daysBeforeStale:
+        description: Idle number of days before marking feature requests stale
+        required: true
+        default: 906
+        type: number
 
 # yamllint disable rule:empty-lines
 env:
@@ -15,7 +18,7 @@ env:
 
     For more information on how the project manages
     feature requests, please consult the
-    [feature request management document](https://github.com/nodejs/node/blob/HEAD/doc/guides/feature-request-management.md).
+    [feature request management document](https://github.com/nodejs/node/blob/HEAD/doc/contributing/feature-request-management.md).
 
   WARN_MESSAGE: >
     There has been no activity on this feature request for
@@ -25,7 +28,7 @@ env:
 
     For more information on how the project manages
     feature requests, please consult the
-    [feature request management document](https://github.com/nodejs/node/blob/HEAD/doc/guides/feature-request-management.md).
+    [feature request management document](https://github.com/nodejs/node/blob/HEAD/doc/contributing/feature-request-management.md).
 # yamllint enable
 
 jobs:
@@ -36,13 +39,13 @@ jobs:
       - uses: actions/stale@v4
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
-          days-before-stale: 150
+          days-before-stale: ${{ github.event.inputs.daysBeforeStale }}
           days-before-close: 30
-          stale-issue-label: stalled
+          stale-issue-label: stale
           close-issue-message: ${{ env.CLOSE_MESSAGE }}
           stale-issue-message: ${{ env.WARN_MESSAGE }}
-          only-labels: feature request,test-action
+          only-labels: feature request
           exempt-pr-labels: never-stale
           # max requests it will send per run to the GitHub API before it deliberately exits to avoid hitting API rate limits
-          operations-per-run: 30
+          operations-per-run: 500
           remove-stale-when-updated: true

.github/workflows/commit-lint.yml

@@ -1,4 +1,4 @@
-name: First commit message adheres to guidelines at https://goo.gl/p2fr5Q
+name: First commit message adheres to guidelines
 
 on: [pull_request]
 

.github/workflows/tools.yml

@@ -23,6 +23,10 @@ jobs:
                 echo "NEW_VERSION=$NEW_VERSION" >> $GITHUB_ENV
                 ./update-eslint.sh
               fi
+          - id: corepack
+            run: |
+              make corepack-update
+              echo "NEW_VERSION=$(node deps/corepack/dist/corepack.js --version)" >> $GITHUB_ENV
           - id: lint-md-dependencies
             run: |
               cd tools/lint-md

.mailmap

@@ -35,6 +35,7 @@ Anna Henningsen <anna@addaleax.net> <github@addaleax.net>
 Anna Henningsen <anna@addaleax.net> <sqrt@entless.org>
 Anna Magdalena Kedzierska <anna.mag.kedzierska@gmail.com> <AnnaMag@users.noreply.github.com>
 Antoine Amara <amara.antoine@gmail.com>
+apeltop <sunshine@ptokos.com> <psycho3081@gmail.com>
 Aria Stewart <aredridel@dinhe.net> <aredridel@nbtsc.org>
 Arlo Breault <arlolra@gmail.com>
 Arnaud Lefebvre <a.lefebvre@outlook.fr>

AUTHORS

@@ -3428,5 +3428,11 @@ T•Ø•R•Ü•S <bageliq@protonmail.com>
 Sean Quinlan <1011062+sbquinlan@users.noreply.github.com>
 Derek Wolpert <48101033+derekwolpert@users.noreply.github.com>
 wbt <wbt@users.noreply.github.com>
+Alexandru Comanescu <comanescu.robert93@gmail.com>
+madflow <madflow@web.de>
+Austin Kelleher <austin.kell47@gmail.com>
+apeltop <sunshine@ptokos.com>
+Livia Medeiros <74449973+LiviaMedeiros@users.noreply.github.com>
+Nikolaos Papaspyrou <nikolaos@chromium.org>
 
 # Generated by tools/update-authors.js

BUILDING.md

@@ -273,6 +273,10 @@ $ ./configure
 $ make -j4
 ```
 
+We can speed up the builds by using [Ninja](https://ninja-build.org/). For more
+information, see
+[Building Node.js with Ninja](doc/contributing/building-node-with-ninja.md).
+
 The `-j4` option will cause `make` to run 4 simultaneous compilation jobs which
 may reduce build time. For more information, see the
 [GNU Make Documentation](https://www.gnu.org/software/make/manual/html_node/Parallel.html).

CHANGELOG.md

@@ -33,7 +33,8 @@ release.
 </tr>
 <tr>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V17.md#17.6.0">17.6.0</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V17.md#17.7.0">17.7.0</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V17.md#17.6.0">17.6.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V17.md#17.5.0">17.5.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V17.md#17.4.0">17.4.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V17.md#17.3.1">17.3.1</a><br/>

Makefile

@@ -1119,13 +1119,15 @@ pkg: $(PKG)
 
 .PHONY: corepack-update
 corepack-update:
-	rm -rf /tmp/node-corepack-clone
-	git clone 'https://github.com/nodejs/corepack.git' /tmp/node-corepack-clone
-	cd /tmp/node-corepack-clone && yarn pack
-	rm -rf deps/corepack && mkdir -p deps/corepack
-	cd deps/corepack && tar xf /tmp/node-corepack-clone/package.tgz --strip-components=1
+	mkdir -p /tmp/node-corepack
+	curl -qLo /tmp/node-corepack/package.tgz "$$(npm view corepack dist.tarball)"
+
+	rm -rf deps/corepack && mkdir deps/corepack
+	cd deps/corepack && tar xf /tmp/node-corepack/package.tgz --strip-components=1
 	chmod +x deps/corepack/shims/*
 
+	node deps/corepack/dist/corepack.js --version
+
 .PHONY: pkg-upload
 # Note: this is strictly for release builds on release machines only.
 pkg-upload: pkg

README.md

@@ -294,6 +294,8 @@ For information about the governance of the Node.js project, see
   **Bradley Farias** <<bradley.meck@gmail.com>>
 * [bnb](https://github.com/bnb) -
   **Tierney Cyren** <<hello@bnb.im>> (they/he)
+* [bnoordhuis](https://github.com/bnoordhuis) -
+  **Ben Noordhuis** <<info@bnoordhuis.nl>>
 * [boneskull](https://github.com/boneskull) -
   **Christopher Hiller** <<boneskull@boneskull.com>> (he/him)
 * [BridgeAR](https://github.com/BridgeAR) -
@@ -312,8 +314,6 @@ For information about the governance of the Node.js project, see
   **Daniel Bevenius** <<daniel.bevenius@gmail.com>> (he/him)
 * [danielleadams](https://github.com/danielleadams) -
   **Danielle Adams** <<adamzdanielle@gmail.com>> (she/her)
-* [DerekNonGeneric](https://github.com/DerekNonGeneric) -
-  **Derek Lewis** <<DerekNonGeneric@inf.is>> (he/him)
 * [devnexen](https://github.com/devnexen) -
   **David Carlier** <<devnexen@gmail.com>>
 * [devsnek](https://github.com/devsnek) -
@@ -354,12 +354,12 @@ For information about the governance of the Node.js project, see
   **Fedor Indutny** <<fedor@indutny.com>>
 * [JacksonTian](https://github.com/JacksonTian) -
   **Jackson Tian** <<shyvo1987@gmail.com>>
+* [JakobJingleheimer](https://github.com/JakobJingleheimer) -
+  **Jacob Smith** <<jacob@frende.me>> (he/him)
 * [jasnell](https://github.com/jasnell) -
   **James M Snell** <<jasnell@gmail.com>> (he/him)
 * [jkrems](https://github.com/jkrems) -
   **Jan Krems** <<jan.krems@gmail.com>> (he/him)
-* [joaocgreis](https://github.com/joaocgreis) -
-  **João Reis** <<reis@janeasystems.com>>
 * [joesepi](https://github.com/joesepi) -
   **Joe Sepi** <<sepi@joesepi.com>> (he/him)
 * [joyeecheung](https://github.com/joyeecheung) -
@@ -478,8 +478,6 @@ For information about the governance of the Node.js project, see
   **Alexey Orlenko** <<eaglexrlnk@gmail.com>> (he/him)
 * [bmeurer](https://github.com/bmeurer) -
   **Benedikt Meurer** <<benedikt.meurer@gmail.com>>
-* [bnoordhuis](https://github.com/bnoordhuis) -
-  **Ben Noordhuis** <<info@bnoordhuis.nl>>
 * [brendanashworth](https://github.com/brendanashworth) -
   **Brendan Ashworth** <<brendan.ashworth@me.com>>
 * [calvinmetcalf](https://github.com/calvinmetcalf) -
@@ -530,6 +528,8 @@ For information about the governance of the Node.js project, see
   **John-David Dalton** <<john.david.dalton@gmail.com>>
 * [jhamhader](https://github.com/jhamhader) -
   **Yuval Brik** <<yuval@brik.org.il>>
+* [joaocgreis](https://github.com/joaocgreis) -
+  **João Reis** <<reis@janeasystems.com>>
 * [joshgav](https://github.com/joshgav) -
   **Josh Gavant** <<josh.gavant@outlook.com>>
 * [julianduque](https://github.com/julianduque) -
@@ -652,6 +652,8 @@ maintaining the Node.js project.
   **Frank Qiu** <<iam.frankqiu@gmail.com>> (he/him)
 * [marsonya](https://github.com/marsonya) -
   **Akhil Marsonya** <<akhil.marsonya27@gmail.com>> (he/him)
+* [meixg](https://github.com/meixg) -
+  **Xuguang Mei** <<meixg@foxmail.com>> (he/him)
 * [Mesteery](https://github.com/Mesteery) -
   **Mestery** <<mestery@protonmail.com>> (he/him)
 * [PoojaDurgad](https://github.com/PoojaDurgad) -
@@ -667,6 +669,8 @@ Primary GPG keys for Node.js Releasers (some Releasers sign with subkeys):
 
 * **Beth Griggs** <<bgriggs@redhat.com>>
   `4ED778F539E3634C779C87C6D7062848A1AB005C`
+* **Bryan English** <<bryan@bryanenglish.com>>
+  `141F07595B7B3FFE74309A937405533BE57C7D57`
 * **Colin Ihrig** <<cjihrig@gmail.com>>
   `94AE36675C464D64BAFA68DD7434390BDBE9B9C5`
 * **Danielle Adams** <<adamzdanielle@gmail.com>>
@@ -693,6 +697,7 @@ to sign releases):
 
 ```bash
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 4ED778F539E3634C779C87C6D7062848A1AB005C
+gpg --keyserver hkps://keys.openpgp.org --recv-keys 141F07595B7B3FFE74309A937405533BE57C7D57
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 94AE36675C464D64BAFA68DD7434390BDBE9B9C5
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 74F12602B6F1C4E913FAA37AD3A89613643B6201
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 71DCFD284A79C3B38668286BC97EC7A07EDE3FC1

SECURITY.md

@@ -22,14 +22,7 @@ the HackerOne platform. See <https://hackerone.com/nodejs> for further details.
 ## Reporting a bug in a third party module
 
 Security bugs in third party modules should be reported to their respective
-maintainers and should also be coordinated through the Node.js Ecosystem
-Security Team via [HackerOne](https://hackerone.com/nodejs-ecosystem).
-
-Details regarding this process can be found in the
-[Security Working Group repository](https://github.com/nodejs/security-wg/blob/HEAD/processes/third_party_vuln_process.md).
-
-Thank you for improving the security of Node.js and its ecosystem. Your efforts
-and responsible disclosure are greatly appreciated and will be acknowledged.
+maintainers.
 
 ## Disclosure policy
 

benchmark/crypto/webcrypto-digest.js

@@ -3,11 +3,9 @@
 const common = require('../common.js');
 const {
   createHash,
-  webcrypto: {
-    subtle,
-    getRandomValues
-  }
+  webcrypto,
 } = require('crypto');
+const { subtle } = webcrypto;
 
 const bench = common.createBenchmark(main, {
   sync: ['createHash', 'subtle'],
@@ -50,7 +48,7 @@ function measureSubtle(n, data, method) {
 }
 
 function main({ n, sync, data, method }) {
-  data = getRandomValues(Buffer.alloc(data));
+  data = webcrypto.getRandomValues(Buffer.alloc(data));
   switch (sync) {
     case 'createHash': return measureLegacy(n, data, method);
     case 'subtle': return measureSubtle(n, data, method);

common.gypi

@@ -36,7 +36,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.13',
+    'v8_embedder_string': '-node.15',
 
     ##### V8 defaults for Node.js #####
 

deps/nghttp2/lib/Makefile.in

@@ -362,6 +362,8 @@ LIBMRUBY_LIBS = @LIBMRUBY_LIBS@
 LIBNGHTTP3_CFLAGS = @LIBNGHTTP3_CFLAGS@
 LIBNGHTTP3_LIBS = @LIBNGHTTP3_LIBS@
 LIBNGTCP2_CFLAGS = @LIBNGTCP2_CFLAGS@
+LIBNGTCP2_CRYPTO_BORINGSSL_CFLAGS = @LIBNGTCP2_CRYPTO_BORINGSSL_CFLAGS@
+LIBNGTCP2_CRYPTO_BORINGSSL_LIBS = @LIBNGTCP2_CRYPTO_BORINGSSL_LIBS@
 LIBNGTCP2_CRYPTO_OPENSSL_CFLAGS = @LIBNGTCP2_CRYPTO_OPENSSL_CFLAGS@
 LIBNGTCP2_CRYPTO_OPENSSL_LIBS = @LIBNGTCP2_CRYPTO_OPENSSL_LIBS@
 LIBNGTCP2_LIBS = @LIBNGTCP2_LIBS@
@@ -408,6 +410,7 @@ PYTHON_EXTRA_LDFLAGS = @PYTHON_EXTRA_LDFLAGS@
 PYTHON_EXTRA_LIBS = @PYTHON_EXTRA_LIBS@
 PYTHON_LIBS = @PYTHON_LIBS@
 PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PLATFORM_SITE_PKG = @PYTHON_PLATFORM_SITE_PKG@
 PYTHON_PREFIX = @PYTHON_PREFIX@
 PYTHON_SITE_PKG = @PYTHON_SITE_PKG@
 PYTHON_VERSION = @PYTHON_VERSION@

deps/nghttp2/lib/includes/Makefile.in

@@ -271,6 +271,8 @@ LIBMRUBY_LIBS = @LIBMRUBY_LIBS@
 LIBNGHTTP3_CFLAGS = @LIBNGHTTP3_CFLAGS@
 LIBNGHTTP3_LIBS = @LIBNGHTTP3_LIBS@
 LIBNGTCP2_CFLAGS = @LIBNGTCP2_CFLAGS@
+LIBNGTCP2_CRYPTO_BORINGSSL_CFLAGS = @LIBNGTCP2_CRYPTO_BORINGSSL_CFLAGS@
+LIBNGTCP2_CRYPTO_BORINGSSL_LIBS = @LIBNGTCP2_CRYPTO_BORINGSSL_LIBS@
 LIBNGTCP2_CRYPTO_OPENSSL_CFLAGS = @LIBNGTCP2_CRYPTO_OPENSSL_CFLAGS@
 LIBNGTCP2_CRYPTO_OPENSSL_LIBS = @LIBNGTCP2_CRYPTO_OPENSSL_LIBS@
 LIBNGTCP2_LIBS = @LIBNGTCP2_LIBS@
@@ -317,6 +319,7 @@ PYTHON_EXTRA_LDFLAGS = @PYTHON_EXTRA_LDFLAGS@
 PYTHON_EXTRA_LIBS = @PYTHON_EXTRA_LIBS@
 PYTHON_LIBS = @PYTHON_LIBS@
 PYTHON_PLATFORM = @PYTHON_PLATFORM@
+PYTHON_PLATFORM_SITE_PKG = @PYTHON_PLATFORM_SITE_PKG@
 PYTHON_PREFIX = @PYTHON_PREFIX@
 PYTHON_SITE_PKG = @PYTHON_SITE_PKG@
 PYTHON_VERSION = @PYTHON_VERSION@

deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h

@@ -29,14 +29,14 @@
  * @macro
  * Version number of the nghttp2 library release
  */
-#define NGHTTP2_VERSION "1.45.1"
+#define NGHTTP2_VERSION "1.47.0"
 
 /**
  * @macro
  * Numerical representation of the version number of the nghttp2 library
  * release. This is a 24 bit number with 8 bits for major number, 8 bits
  * for minor and 8 bits for patch. Version 1.2.3 becomes 0x010203.
  */
-#define NGHTTP2_VERSION_NUM 0x012d01
+#define NGHTTP2_VERSION_NUM 0x012f00
 
 #endif /* NGHTTP2VER_H */

deps/nghttp2/lib/nghttp2_buf.h

@@ -99,7 +99,7 @@ void nghttp2_buf_free(nghttp2_buf *buf, nghttp2_mem *mem);
  * |new_cap|. If extensions took place, buffer pointers in |buf| will
  * change.
  *
- * This function returns 0 if it succeeds, or one of the followings
+ * This function returns 0 if it succeeds, or one of the following
  * negative error codes:
  *
  * NGHTTP2_ERR_NOMEM

deps/nghttp2/lib/nghttp2_frame.c

@@ -654,8 +654,6 @@ int nghttp2_frame_unpack_goaway_payload2(nghttp2_goaway *frame,
     var_gift_payloadlen = 0;
   }
 
-  payloadlen -= var_gift_payloadlen;
-
   if (!var_gift_payloadlen) {
     var_gift_payload = NULL;
   } else {

deps/nghttp2/lib/nghttp2_frame.h

@@ -46,7 +46,7 @@
 #define NGHTTP2_MAX_FRAME_SIZE_MIN (1 << 14)
 
 #define NGHTTP2_MAX_PAYLOADLEN 16384
-/* The one frame buffer length for tranmission.  We may use several of
+/* The one frame buffer length for transmission.  We may use several of
    them to support CONTINUATION.  To account for Pad Length field, we
    allocate extra 1 byte, which saves extra large memcopying. */
 #define NGHTTP2_FRAMEBUF_CHUNKLEN                                              \

deps/nghttp2/lib/nghttp2_hd.c

@@ -1263,6 +1263,8 @@ int nghttp2_hd_inflate_change_table_size(
     return NGHTTP2_ERR_INVALID_STATE;
   }
 
+  inflater->settings_hd_table_bufsize_max = settings_max_dynamic_table_size;
+
   /* It seems that encoder is not required to send dynamic table size
      update if the table size is not changed after applying
      SETTINGS_HEADER_TABLE_SIZE.  RFC 7541 is ambiguous here, but this
@@ -1275,13 +1277,12 @@ int nghttp2_hd_inflate_change_table_size(
     /* Remember minimum value, and validate that encoder sends the
        value less than or equal to this. */
     inflater->min_hd_table_bufsize_max = settings_max_dynamic_table_size;
-  }
 
-  inflater->settings_hd_table_bufsize_max = settings_max_dynamic_table_size;
+    inflater->ctx.hd_table_bufsize_max = settings_max_dynamic_table_size;
 
-  inflater->ctx.hd_table_bufsize_max = settings_max_dynamic_table_size;
+    hd_context_shrink_table_size(&inflater->ctx, NULL);
+  }
 
-  hd_context_shrink_table_size(&inflater->ctx, NULL);
   return 0;
 }
 

deps/nghttp2/lib/nghttp2_map.c

@@ -189,6 +189,7 @@ static int map_resize(nghttp2_map *map, uint32_t new_tablelen,
   nghttp2_map_bucket *new_table;
   nghttp2_map_bucket *bkt;
   int rv;
+  (void)rv;
 
   new_table =
       nghttp2_mem_calloc(map->mem, new_tablelen, sizeof(nghttp2_map_bucket));

deps/nghttp2/lib/nghttp2_net.h

@@ -42,7 +42,7 @@
 #if defined(WIN32)
 /* Windows requires ws2_32 library for ntonl family functions.  We
    define inline functions for those function so that we don't have
-   dependeny on that lib. */
+   dependency on that lib. */
 
 #  ifdef _MSC_VER
 #    define STIN static __inline

deps/nghttp2/lib/nghttp2_outbound_item.h

@@ -111,7 +111,7 @@ struct nghttp2_outbound_item {
      to this structure to avoid frequent memory allocation. */
   nghttp2_ext_frame_payload ext_frame_payload;
   nghttp2_aux_data aux_data;
-  /* The priority used in priority comparion.  Smaller is served
+  /* The priority used in priority comparison.  Smaller is served
      earlier.  For PING, SETTINGS and non-DATA frames (excluding
      response HEADERS frame) have dedicated cycle value defined above.
      For DATA frame, cycle is computed by taking into account of