Release proposal: v5.7.1 by rvagg · Pull Request #5464 · nodejs/node · GitHub

Not much meat in here yet. The path.relative(), url.parse() and dgram.send() fixes have not landed yet but there are at least 4 commits queued up in the various pull requests, plus OpenSSL.

Milestone @Fishrock123 put together for this is https://github.com/nodejs/node/milestones/5.7.1

path: fix verbose relative() output path: fix verbose relative() output #5389
path: fix win32 relative() when "to" is a prefix path: fix win32 relative() when "to" is a prefix #5456
url: fix off-by-one error with parse() url: fix off-by-one error with parse() #5394
dgram: handle default address case when offset and length are specified dgram: handle default address case when offset and length are specified #5407
OpenSSL OpenSSL upgrades: March 1st 2016 [1.0.2g, 1.0.1s] #5433 ?

We're probably going to have to hold this up until at least we have an OpenSSL risk assessment. Perhaps we can move forward without even needing to bother with an OpenSSL upgrade but more likely we'll include it anyway. Which means the release date will be the 2nd or 3rd, next week.

Will figure out if/how we coordinate across release lines ASAP.

This is all we have so far:

Notable changes

governance: The Core Technical Committee (CTC) added four new members to help guide Node.js core development: Evan Lucas, Rich Trott, Ali Ijaz Sheikh and Сковорода Никита Андреевич (Nikita Skovoroda)

Landed two of them. #5456 doesn't merge cleanly, #5407 has that Windows issue.

And #5456 is in. Leaving #5407 for @mcollina to land.

CI with latest cherry-picks https://ci.nodejs.org/job/node-test-commit/2367/

Landed #5407 in 725ffdb

I've added this PR to the milestone: #5484

Another potential path issue: #5485

One more off the list, and another added: #5490.

Okay, all known path issues are handled.

Here is branch-diff v5.7.0 master --exclude-label=semver-major,dont-land-on-v5.x --filter-release as of now, I guess we're probably gona be v5.8.0? I feel pretty bad for not getting a patch out last week to fix grunt-contrib-clean. :/

[c1b3d78a39] - 2016-02-16, Version 4.3.1 'Argon' (LTS) (Myles Borins)
[ffdc046e5c] - benchmark: add benchmark for buf.compare() (Rich Trott) #5441
[2426b3dd86] - benchmark: move string-decoder to its own category (Andreas Madsen) #5177
[15720fa25a] - benchmark: fix configuation parameters (Andreas Madsen) #5177
[f6c505d0b1] - benchmark: merge url.js with url-resolve.js (Andreas Madsen) #5177
[d9079ab801] - benchmark: move misc to categorized directories (Andreas Madsen) #5177
[4bb529d972] - benchmark: use strict mode (Rich Trott) #5336
[2ccc275fd7] - build: update Node.js logo on OSX installer (Rod Vagg) #5401
[e854f60585] - (SEMVER-MINOR) child_process: add keepOpen option to send() (cjihrig) #5283
[1952844f45] - (SEMVER-MINOR) child_process: support options in send() (cjihrig) #5283
[292033b1f5] - (SEMVER-MINOR) constants: define ENGINE_METHOD_RSA (Sam Roberts) #5463
[da3f425506] - crypto: PBKDF2 works with int not ssize_t (Fedor Indutny) #5397
[32719950df] - deps: upgrade openssl to 1.0.2g (Ben Noordhuis) #5507
[725ffdb9b7] - dgram: handle default address case when offset and length are specified (Matteo Collina)
[3c79bbda47] - doc: fix typo in child_process documentation (Evan Lucas) #5474
[8d8fef09ee] - doc: add note for binary safe string reading (Anton Andesen) #5155
[f0c06147b3] - doc: improvements to crypto.markdown copy (Alexander Makarenko) #5230
[5298c81f42] - doc: require behavior on case-insensitive systems (Hugo Wood)
[1411e0b648] - doc: document base64url encoding support (Tristan Slominski) #5243
[c6ae7d00c6] - doc: improve httpVersionMajor / httpVersionMajor (Jackson Tian) #5296
[1c30d606b1] - doc: fix relative links in net docs (Evan Lucas) #5358
[a67d5c1034] - doc: fix crypto function indentation level (Brian White) #5460
[4e77a7ce29] - doc: link to man pages (dcposch@dcpos.ch) #5073
[9894c026f5] - doc: add missing property in cluster example (Rafael Cepeda) #5305
[1913909fce] - doc: corrected name of argument in socket.send (Chris Dew) #5449
[acee594b6e] - doc: fix links in tls, cluster docs (Alexander Makarenko) #5364
[513133c936] - (SEMVER-MINOR) doc: correct name of engine methods (Sam Roberts) #5463
[1d7c37018f] - doc: explicit about VS 2015 support in readme (Phillip Johnsen) #5406
[611b4641d9] - doc: remove out-of-date matter from internal docs (Rich Trott) #5421
[6e6ce09861] - doc: copyedit util doc (Rich Trott) #5399
[7e51966b32] - doc: fix typo in pbkdf2Sync code sample (Marc Cuva) #5306
[8b1af2f8d4] - doc: fix buf.readInt16LE output (Chinedu Francis Nwafili) #5282
[54cbf2826b] - doc: note util.isError() @@toStringTag limitations (cjihrig) #5414
[581606a5fd] - doc: clarify error handling in net.createServer (Dirceu Pereira Tiegs) #5353
[45789027ac] - doc: document fs.datasync(Sync) (Ron Korving) #5402
[0dc216f89d] - doc: add Evan Lucas to the CTC (Rod Vagg) #5275
[dae5bf0127] - doc: add Rich Trott to the CTC (Rod Vagg) #5276
[97dc810d46] - doc: add Ali Ijaz Sheikh to the CTC (Rod Vagg) #5277
[b484c2e907] - doc: add Сковорода Никита Андреевич to the CTC (Rod Vagg) #5278
[65c0feb5fe] - doc: add "building node with ninja" guide (Jeremiah Senkpiel) #4767
[10f55b0aae] - doc: mention prototype check in deepStrictEqual() (cjihrig) #5367
[3e3d941495] - doc,tools,test: lint doc-based addon tests (Rich Trott) #5427
[a7e49c886f] - http_parser: use MakeCallback (Trevor Norris) #5419
[f296a7f16f] - path: fix path.relative() for prefixes at root (Owen Smith) #5490
[4717ea9186] - path: fix win32 parse() (Zheng Chaoping) #5484
[e326950498] - path: fix win32 relative() for UNC paths (Owen Smith) #5456
[b33879d9e2] - path: fix win32 relative() when "to" is a prefix (Owen Smith) #5456
[3a331b66f8] - path: fix verbose relative() output (Brian White) #5389
[40d57b714e] - repl: fix stack trace column number in strict mode (Prince J Wesley) #5416
[ee7754be47] - (SEMVER-MINOR) repl: accept no arguments to start() (cjihrig) #5388
[33e51fe18c] - src,tools: remove null sentinel from source array (Ben Noordhuis) #5418
[96adbe9503] - src,tools: drop nul byte from built-in source code (Ben Noordhuis) #5418
[cdc7e025e0] - src,tools: allow utf-8 in built-in js source code (Ben Noordhuis) #5418
[93bacfd00f] - test: remove unneeded bind() and related comments (Aayush Naik) #5023
[98b721ed26] - test: fix flaky child-process-fork-regr-Segfault in node::StreamBase::GetFD #2847 (Santiago Gimeno) #5422
[4d6b4c30dd] - test: remove flaky designation from fixed tests (Rich Trott) #5459
[7fc6645982] - test: add test-cases for posix path.relative() (Owen Smith) #5456
[c98d159ed3] - test: fix test runner arg regression (Stefan Budeanu) #5446
[88728408e0] - test: refactor test-dgram-send-callback-recursive (Santiago Gimeno) #5079
[dff01d10c5] - test: refactor test-dgram-udp4 (Santiago Gimeno) #5339
[23a584d517] - test: allow passing args to executable (Stefan Budeanu) #5376
[8bcb174d03] - test: fix test-timers.reliability on OS X (Rich Trott) #5379
[bbf4621548] - test: mitigate flaky test-http-agent (Rich Trott) #5346
[65cd2a0f96] - test: increase timeouts on some unref timers tests (Jeremiah Senkpiel) #5352
[67963c8c66] - timers: greatly improve code comments (Jeremiah Senkpiel) #4007
[60f8c1acf4] - timers: refactor timers (Jeremiah Senkpiel) #4007
[d26417f123] - tools: apply custom buffer lint rule to /lib only (Rich Trott) #5371
[9534f6dfd5] - tools: enable additional lint rules (Rich Trott) #5357
[dcfda1007b] - tools,benchmark: increase lint compliance (Rich Trott) #5429
[610bd8d567] - url: group slashed protocols by protocol name (nettofarah) #5380
[8b16ba3bbf] - url: fix off-by-one error with parse() (Brian White) #5394

I've been avoiding semver-minor and the timers patch for this release, hence 5.7.1, so it's an easier (if just mental, but likely a little lower risk) upgrade for existing users.

@Fishrock123 also, we didn't have anything ready last week and the path fixes couldn't really be rushed so I don't think there's a whole lot we could have changed.

Pretty sure #5389 (comment) (the important patch) was. We should have just landed and released imo. My fault for forgetting about it on Thursday. :/

Pushed commits to v5.x; CI (think I ran it right) https://ci.nodejs.org/job/node-test-pull-request/1814/

Notable changes: * governance: The Core Technical Committee (CTC) added four new members to help guide Node.js core development: Evan Lucas, Rich Trott, Ali Ijaz Sheikh and Сковорода Никита Андреевич (Nikita Skovoroda). * openssl: Upgrade from 1.0.2f to 1.0.2g (Ben Noordhuis) #5507 - Fix a double-free defect in parsing malformed DSA keys that may potentially be used for DoS or memory corruption attacks. It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0705 - Fix a defect that can cause memory corruption in certain very rare cases relating to the internal `BN_hex2bn()` and `BN_dec2bn()` functions. It is believed that Node.js is not invoking the code paths that use these functions so practical attacks via Node.js using this defect are _unlikely_ to be possible. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0797 - Fix a defect that makes the CacheBleed Attack (https://ssrg.nicta.com.au/projects/TS/cachebleed/) possible. This defect enables attackers to execute side-channel attacks leading to the potential recovery of entire RSA private keys. It only affects the Intel Sandy Bridge (and possibly older) microarchitecture when using hyper-threading. Newer microarchitectures, including Haswell, are unaffected. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0702 * Fixed several regressions that appeared in v5.7.0: - path.relative(): - Output is no longer unnecessarily verbose (Brian White) #5389 - Resolving UNC paths on Windows now works correctly (Owen Smith) #5456 - Resolving paths with prefixes now works correctly from the root directory (Owen Smith) #5490 - url: Fixed an off-by-one error with `parse()` (Brian White) #5394 - dgram: Now correctly handles a default address case when offset and length are specified (Matteo Collina) #5407 PR-URL: #5464

PR-URL: #5464

CITGM before merging https://ci.nodejs.org/job/thealphanerd-smoker/100/

Building @ https://ci.nodejs.org/job/iojs+release/435/

PR-URL: #5464

Notable changes: * governance: The Core Technical Committee (CTC) added four new members to help guide Node.js core development: Evan Lucas, Rich Trott, Ali Ijaz Sheikh and Сковорода Никита Андреевич (Nikita Skovoroda). * openssl: Upgrade from 1.0.2f to 1.0.2g (Ben Noordhuis) nodejs#5507 - Fix a double-free defect in parsing malformed DSA keys that may potentially be used for DoS or memory corruption attacks. It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0705 - Fix a defect that can cause memory corruption in certain very rare cases relating to the internal `BN_hex2bn()` and `BN_dec2bn()` functions. It is believed that Node.js is not invoking the code paths that use these functions so practical attacks via Node.js using this defect are _unlikely_ to be possible. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0797 - Fix a defect that makes the CacheBleed Attack (https://ssrg.nicta.com.au/projects/TS/cachebleed/) possible. This defect enables attackers to execute side-channel attacks leading to the potential recovery of entire RSA private keys. It only affects the Intel Sandy Bridge (and possibly older) microarchitecture when using hyper-threading. Newer microarchitectures, including Haswell, are unaffected. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0702 * Fixed several regressions that appeared in v5.7.0: - path.relative(): - Output is no longer unnecessarily verbose (Brian White) nodejs#5389 - Resolving UNC paths on Windows now works correctly (Owen Smith) nodejs#5456 - Resolving paths with prefixes now works correctly from the root directory (Owen Smith) nodejs#5490 - url: Fixed an off-by-one error with `parse()` (Brian White) nodejs#5394 - dgram: Now correctly handles a default address case when offset and length are specified (Matteo Collina) nodejs#5407 PR-URL: nodejs#5464

This is really odd in here. If you look at how this displays at https://nodejs.org/en/blog/ it seems like it is related to the Version 5.7.1 release.

Shouldn't this go in a "Weekly Update"?

This was referenced Feb 27, 2016

propose v5.7.1 #5400

Closed

FIPS tests failing on v5.x #5465

Closed

mscdex added the meta Issues and PRs related to the general management of the project. label Feb 27, 2016

rvagg mentioned this pull request Feb 28, 2016

OpenSSL upgrades: March 1st 2016 [1.0.2g, 1.0.1s] #5433

Closed

rvagg force-pushed the v5.7.1-proposal branch from dc229aa to a6f4bf9 Compare February 28, 2016 01:43

silverwind mentioned this pull request Feb 29, 2016

path.relative regression in v5.7.0 #5489

Closed

paulmillr mentioned this pull request Mar 1, 2016

Test failure caused by regression in node.js path module in 5.7.0 paulmillr/chokidar#442

Closed

Fishrock123 force-pushed the v5.7.1-proposal branch 2 times, most recently from fc9d191 to 5f882fa Compare March 2, 2016 21:45

Fishrock123 force-pushed the v5.7.1-proposal branch from 5f882fa to db164cc Compare March 2, 2016 21:48

Fishrock123 force-pushed the v5.7.1-proposal branch from db164cc to 079748e Compare March 2, 2016 21:53

Fishrock123 added 2 commits March 2, 2016 16:54

Working on v5.7.1

3643670

PR-URL: #5464

Fishrock123 force-pushed the v5.7.1-proposal branch from 079748e to 3643670 Compare March 2, 2016 21:55

Fishrock123 merged commit 3643670 into v5.x Mar 2, 2016

Fishrock123 added a commit that referenced this pull request Mar 2, 2016

Working on v5.7.2

01c331e

PR-URL: #5464

chorrell mentioned this pull request Mar 2, 2016

Update for Node.js 5.7.1 nodejs/docker-node#110

Merged

chorrell mentioned this pull request Mar 2, 2016

[security] Update to Node.js v5.7.1 docker-library/official-images#1506

Merged

williamkapke reviewed Mar 7, 2016
View reviewed changes


		### Notable changes

		* governance: The Core Technical Committee (CTC) added four new members to help guide Node.js core development: Evan Lucas, Rich Trott, Ali Ijaz Sheikh and Сковорода Никита Андреевич (Nikita Skovoroda).

Release proposal: v5.7.1 by rvagg · Pull Request #5464 · nodejs/node · GitHub

Uh oh!

Uh oh!

Release proposal: v5.7.1 - #5464

Release proposal: v5.7.1#5464Fishrock123 merged 2 commits intov5.xnodejs/node:v5.xfrom v5.7.1-proposalnodejs/node:v5.7.1-proposalCopy head branch name to clipboard

Conversation

rvagg commented Feb 27, 2016

Notable changes

Uh oh!

silverwind commented Feb 27, 2016

Uh oh!

silverwind commented Feb 27, 2016

Uh oh!

rvagg commented Feb 28, 2016

Uh oh!

mcollina commented Feb 28, 2016

Uh oh!

mscdex commented Feb 29, 2016

Uh oh!

silverwind commented Feb 29, 2016

Uh oh!

silverwind commented Feb 29, 2016

Uh oh!

silverwind commented Feb 29, 2016

Uh oh!

Fishrock123 commented Mar 1, 2016

Uh oh!

rvagg commented Mar 1, 2016

Uh oh!

rvagg commented Mar 1, 2016

Uh oh!

Fishrock123 commented Mar 1, 2016

Uh oh!

Fishrock123 commented Mar 2, 2016

Uh oh!

Fishrock123 commented Mar 2, 2016

Uh oh!

Fishrock123 commented Mar 2, 2016

Uh oh!

williamkapke Mar 7, 2016

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Release proposal: v5.7.1#5464
Fishrock123 merged 2 commits into
v5.xfrom
v5.7.1-proposal