Put the command examples for finding and replacing the `REPLACEME`
tags into code fences so that they are more easily copiable when
viewing the guide in the GitHub web UI.

PR-URL: https://github.com/nodejs/node/pull/39544


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>
Reviewed-By: Danielle Adams <adamzdanielle@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Add `backport-open-v1.x,backported-to-v1.x` labels to `branch-diff`
commands as these indicate pull requests that are being manually
backported and should not be cherry-picked.

PR-URL: https://github.com/nodejs/node/pull/39544


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>
Reviewed-By: Danielle Adams <adamzdanielle@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39559


Reviewed-By: Ricky Zhou <0x19951125@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>

Rather than hard-coding GitHub Actions to use Node.js 14.x, use the
`lts/*` shorthand for "most recent LTS version".

PR-URL: https://github.com/nodejs/node/pull/39538


Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39459


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Signed-off-by: Darshan Sen <darshan.sen@postman.com>

PR-URL: https://github.com/nodejs/node/pull/38468


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>

This change properly decodes the url.username and url.password for
the authorization header constructed from the URL object for
http(s) requests.

Fixes: https://github.com/nodejs/node/issues/31439

PR-URL: https://github.com/nodejs/node/pull/39310


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39454


Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39455


Reviewed-By: James M Snell <jasnell@gmail.com>

Update email for Ujjwal Sharma.

PR-URL: https://github.com/nodejs/node/pull/39521


Reviewed-By: Zeyu Yang <himself65@outlook.com>
Reviewed-By: Ujjwal Sharma <ryzokuken@disroot.org>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Update email for Shelley Vohr to correspond to what is specified in
.mailmap and what is used in more recently authored commits.

PR-URL: https://github.com/nodejs/node/pull/39521


Reviewed-By: Zeyu Yang <himself65@outlook.com>
Reviewed-By: Ujjwal Sharma <ryzokuken@disroot.org>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Update email for Zeyu Yang.

PR-URL: https://github.com/nodejs/node/pull/39521


Reviewed-By: Zeyu Yang <himself65@outlook.com>
Reviewed-By: Ujjwal Sharma <ryzokuken@disroot.org>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Update ESLint to 7.31.0

PR-URL: https://github.com/nodejs/node/pull/39424


Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>

George does not appear to be active in Node.js for quite some time
(correction welcome!) and my attempts to get in touch have failed.

PR-URL: https://github.com/nodejs/node/pull/39539


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>
Reviewed-By: George Adams <george.adams@microsoft.com>
Reviewed-By: Stewart X Addison <sxa@redhat.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>

The option buffered is not about queueing the PerformanceEntrys with
an event loop task or not. The option buffered in the spec is about
filling the observer with the global PerformanceEntry buffer. The
current (and the spec) behavior is different with Node.js
version <= v16.0.0.

PR-URL: https://github.com/nodejs/node/pull/39514
Refs: https://w3c.github.io/performance-timeline/#observe-method
Refs: https://nodejs.org/dist/latest-v14.x/docs/api/perf_hooks.html#perf_hooks_performanceobserver_observe_options
Refs: https://github.com/nodejs/node/pull/39297


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>

All API introduced in this PR are compliant with web
[performance-timeline](https://w3c.github.io/performance-timeline)
spec. "performance-timeline" is listed as supported web spec in the doc
https://nodejs.org/docs/latest/api/perf_hooks.html#perf_hooks_performance_measurement_apis.

Changes summary:
1. Add new supported wpt test subsets: user-timing and
  performance-timeline.
2. Add support for `Performance.getEntries`,
  `Performance.getEntriesByName` and `Performance.getEntriesByType`
  to synchronously fetch buffered performance entries. This means
  the user should invoke `Performance.clearMarks` and
  `Performance.clearMeasures` to clear buffered entries to prevent from
  those entries been kept alive forever.
3. Add support (again after https://github.com/nodejs/node/pull/37136)
  for `buffered` flags for `PerformanceObserver`.
3. Fixes `PerformanceMark` and `PerformanceMeasure` wpt compliance
  issues.
4. Only user-created performance entries will be buffered globally. This
  behavior should be compliant with
  https://w3c.github.io/timing-entrytypes-registry/#registry.

With the new ability to fetch user-created performance entries
synchronously, the issues raised in
https://github.com/nodejs/diagnostics/issues/464#issuecomment-861920116
could also be fixed.

PR-URL: https://github.com/nodejs/node/pull/39297


Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs-private/node-private/pull/280

This is a security release.

Notable Changes:

- CVE-2021-3672/CVE-2021-22931:
    Improper handling of untypical characters in domain names (High)
- CVE-2021-22930:
    Use after free on close http2 on stream canceling (High)
- CVE-2021-22939:
    Incomplete validation of rejectUnauthorized parameter (Low)

PR-URL: https://github.com/nodejs-private/node-private/pull/280

Refs: https://github.com/c-ares/c-ares/releases/tag/cares-1_17_2

CVE-ID: CVE-2021-3672, CVE-2021-22931
Refs: https://nvd.nist.gov/vuln/detail/CVE-2021-3672
Refs: https://nvd.nist.gov/vuln/detail/CVE-2021-22931
PR-URL: https://github.com/nodejs/node/pull/39724


Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

c-ares refactored their source tree in 1.17.0 which we did not apply in
our update to 1.17.1. This commit syncs our source with their new
structure for easier maintenance going forward. cares.gyp is updated
accordingly.

Refs: https://github.com/c-ares/c-ares/pull/349
Refs: https://github.com/nodejs/node/pull/36207

PR-URL: https://github.com/nodejs/node/pull/39653


Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39653
Refs: https://github.com/c-ares/c-ares/pull/349
Refs: https://github.com/nodejs/node/pull/36207


Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Incomplete validation of rejectUnauthorized parameter (Low)

If the Node.js https API was used incorrectly and "undefined" was passed
in for the "rejectUnauthorized" parameter, no error was returned and
connections to servers with an expired certificate would have been
accepted.

CVE-ID: CVE-2021-22939
Refs: https://nvd.nist.gov/vuln/detail/CVE-2021-22939
Refs: https://hackerone.com/reports/1278254
PR-URL: https://github.com/nodejs-private/node-private/pull/276


Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Akshay K <iit.akshay@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Richard Lau <rlau@redhat.com>

PR-URL: https://github.com/nodejs/node/pull/39622
Refs: https://github.com/nodejs/node/pull/39423


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>

The PR updates the handling of rst_stream frames and adds all streams
to the pending list on receiving rst frames with the error code
NGHTTP2_CANCEL.

The changes will remove dependency on the stream state that may allow
bypassing the checks in certain cases. I think a better solution is to
delay streams in all cases if rst_stream is received for the cancel
events.

The rst_stream frames can be received for protocol/connection error as
well it should be handled immediately. Adding streams to the pending
list in such cases may cause errors.

CVE-ID: CVE-2021-22930
Refs: https://nvd.nist.gov/vuln/detail/CVE-2021-22930
PR-URL: https://github.com/nodejs/node/pull/39622
Refs: https://github.com/nodejs/node/pull/39423


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>

PR-URL: https://github.com/nodejs/node/pull/39631

Notable changes:

* Updated npm to 7.20.3 (npm team)
  https://github.com/nodejs/node/pull/39579
* Reverted an ABI-breaking change from V8 9.2 that could impact some
  native modules (Michaël Zasso)
  https://github.com/nodejs/node/pull/39624
* Fixed a bug in error handling known to affect at least Webpack and
  Jest (Guy Bedford) https://github.com/nodejs/node/pull/39593

PR-URL: https://github.com/nodejs/node/pull/39631

Refs: https://github.com/v8/v8/commit/a7980d43e030ba4bdb36813d4bc99f85982bf4ee
Refs: https://github.com/v8/v8/commit/ad4eab00e7ec96730eb2c1b6ddcef14ba2e4becd
Fixes: https://github.com/nodejs/node/issues/39623

PR-URL: https://github.com/nodejs/node/pull/39624


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>

Updates npm from 7.19.1 to 7.20.3.

Refs: https://github.com/nodejs/node/pull/39403
PR-URL: https://github.com/nodejs/node/pull/39579
Backport-PR-URL: https://github.com/nodejs/node/pull/39590


Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>

For every object that inherits from `Object.prototype`, the REPL
includes the `Object.prototype` methods in its autocompletion.

This is already a little noisy, but in particular, this also
includes the legacy `__defineGetter__` family of methods;
since those are deprecated and not in practical use anymore,
it helps reduce noise a bit to remove them.

This commit does not remove `__proto__` as it is a little
more popular and, despite its downsides, a slightly more convenient
way to access the prototype of an object in the REPL than
`Object.getPrototypeOf(...)`.

PR-URL: https://github.com/nodejs/node/pull/39576


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39593


Reviewed-By: Bradley Farias <bradley.meck@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39465
Fixes: https://github.com/nodejs/node/issues/39408
Fixes: https://github.com/nodejs/node/issues/39456


Reviewed-By: Zeyu Yang <himself65@outlook.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39453


Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39492


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Zeyu Yang <himself65@outlook.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39507


Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Fixes: https://github.com/nodejs/node/issues/39205

PR-URL: https://github.com/nodejs/node/pull/39319


Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39474
Refs: https://github.com/nodejs/node/issues/39471


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Zeyu Yang <himself65@outlook.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39534

This is a security release.

Notable Changes:

- CVE-2021-22930: Use after free on close http2 on stream canceling
  (High) [#39423](https://github.com/nodejs/node/pull/39423)
- (SEMVER-MINOR) deps: update V8 to 9.2.230.21 (Michaël Zasso)
  [#39470](https://github.com/nodejs/node/pull/39470)
- inspector: mark as stable (Gireesh Punathil)
  [#37748](https://github.com/nodejs/node/pull/37748)
- punycode: add pending deprecation (Antoine du Hamel)
  [#38444](https://github.com/nodejs/node/pull/38444)
- (SEMVER-MINOR) repl: enable --experimental-repl-await /w opt-out
  (hemanth.hm) [#34733](https://github.com/nodejs/node/pull/34733)

PR-URL: https://github.com/nodejs/node/pull/39534

All of our workflows use Node.js 14.x or 16.x except for commit-lint.yml
which has 12.x hard-coded. Update it to 14.x and change it to using an
environment variable so it is consistent with our other workflows.

PR-URL: https://github.com/nodejs/node/pull/39506


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Per instructions from Fedor, I'm updating their email address in the
README.

PR-URL: https://github.com/nodejs/node/pull/39510


Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>