This is a security release impacting Windows 10 users.

Notable changes:

* crypto: The `Decipher` methods `setAuthTag()` and `setAAD` now return
`this`. (Kirill Fomichev) https://github.com/nodejs/node/pull/9398
* dns: Implemented `{ttl: true}` for `resolve4()` and `resolve6()`.
(Ben Noordhuis) https://github.com/nodejs/node/pull/9296 &
https://github.com/nodejs/node/pull/9296
* libuv: Upgrade to v1.10.1 (cjihrig)
https://github.com/nodejs/node/pull/9647
  - Fixed a potential buffer overflow when writing data to console on
Windows 10. (CVE-2016-9551)
* process: Added a new `external` property to the data returned by
`memoryUsage()`. (Fedor Indutny)
https://github.com/nodejs/node/pull/9587
* tls: Fixed a memory leak when writes were queued on TLS connection
that was destroyed during handshake. (Fedor Indutny)
https://github.com/nodejs/node/pull/9626
* V8 (dep): Upgrade to v5.4.500.43 (Michaël Zasso)
https://github.com/nodejs/node/pull/9697
* v8: The data returned by `getHeapStatistics()` now includes three new
fields: `malloced_memory`, `peak_malloced_memory`, and
`does_zap_garbage`. (Gareth Ellis)
https://github.com/nodejs/node/pull/8610

PR-URL: https://github.com/nodejs/node/pull/9745

Updates to build the shared library version of node on AIX. Adds the
same functionality to AIX that was added on Linux under this:

Ref: https://github.com/nodejs/node/pull/6994/

PR-URL: https://github.com/nodejs/node/pull/9675


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Required to support the shared library builds on AIX - this sets the
shared library suffix within GYP to .a instead of .so on AIX
My patch: https://codereview.chromium.org/2492233002/ was landed as
as part of this one which fixed some other (not required, but
included for completeness of the backport) changes:

Ref: https://codereview.chromium.org/2511733005/

Fixes: https://github.com/nodejs/node/issues/9714
PR-URL: https://github.com/nodejs/node/pull/9723


Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Previously not all codepaths set `timer._idleTimeout = -1` for canceled
or closed timers, and not all codepaths checked it either.

Unenroll uses this to say that a timer is indeed closed and it is the
closest thing there is to an authoritative source for this.

Refs: https://github.com/nodejs/node/pull/9606
Fixes: https://github.com/nodejs/node/issues/9561
PR-URL: https://github.com/nodejs/node/pull/9685


Reviewed-By: Rich Trott <rtrott@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/9704


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/9697


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

markdown had a dispensation because 2 or more trailing spaces triggers a
new paragraph. There are no examples of that usage in Node, all trailing
whitespace found were mistakes, and the dispensation is now removed.

See: https://github.com/nodejs/node/pull/9620
PR-URL: https://github.com/nodejs/node/pull/9676


Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>

Add a test that checks that new.target inheritance works when inheriting
from a constructor defined in C++.

PR-URL: https://github.com/nodejs/node/pull/9689
Refs: https://github.com/nodejs/node/issues/9288
Refs: https://github.com/nodejs/node/pull/9293


Reviewed-By: Anna Henningsen <anna@addaleax.net>

The ./configure python script searches `gcc -dM -E -` for the ARCH
flags. On AIX, gcc builds in 32 bit mode by default prior to gcc v6, so
you don't get the __PPC64__ flag unless you run `gcc -maix64 -dM -E -`.

We don't support ppc 32 bit for any OS, so always use ppc64 as the
host_arch.

PR-URL: https://github.com/nodejs/node/pull/9645



Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

* `assert.equal()` -> `assert.strictEqual()`
* add duration to `setTimeout()`

PR-URL: https://github.com/nodejs/node/pull/9663


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Prince John Wesley <princejohnwesley@gmail.com>

src: Add does_zap_garbage, malloced_memory and
peak_malloced_memory to v8 HeapStatistics

Following https://github.com/nodejs/code-and-learn/issues/56 I
have exposed does_zap_garbage to HeapStatistics.
The other fields, malloced_memory and peak_malloced_memory don't
seem to be in the current version of v8 in master.

PR-URL: https://github.com/nodejs/node/pull/8610


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

* add additional newline to HTTP GET JSON responses
* SendTargentsListResponse -> SendListResponse

PR-URL: https://github.com/nodejs/node/pull/9627


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

1aa595e5 introduced a `throw` for accessing `Symbol` properties of
`process.env`. However, this breaks `util.inspect(process)` and
things like `Object.prototype.toString.call(process.env)`, so this
patch changes the behaviour for the getter to just always return
`undefined`.

Ref: https://github.com/nodejs/node/pull/9446
Fixes: https://github.com/nodejs/node/issues/9641
PR-URL: https://github.com/nodejs/node/pull/9631


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Allow method chaining as with setAutoPadding and other methods.

PR-URL: https://github.com/nodejs/node/pull/9398


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Sam Roberts <sam@strongloop.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: James M Snell <jasnell@gmail.com>

e.g., to e.g. at BUILDING.md line 116

PR-URL: https://github.com/nodejs/node/pull/9569


Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Removing backticks will make the doctool emit links to the man pages.

PR-URL: https://github.com/nodejs/node/pull/9632


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

In practice, manpage names may contain dots (e.g. `resolv.conf(5)`).

PR-URL: https://github.com/nodejs/node/pull/9632


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/9649


Reviewed-By: Trevor Norris <trev.norris@gmail.com>
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

The description of urlObject.query is ambiguous about when it's an
object vs when it's a string. Added a sentence pointing to the option
that determines this in url.parse().

Also fixed the missing parentheses in the first sentence by rewording it to
avoid nested parentheses.

PR-URL: https://github.com/nodejs/node/pull/9625


Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

1. Consistent template literals in `console.log()`.
2. === instead of ==.
3. const instead of var.

PR-URL: https://github.com/nodejs/node/pull/9628


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Jackson Tian <shyvo1987@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/9666


Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Document that `execFileSync`, `execSync` and `spawnSync` also support
`stdio` as an Array.

PR-URL: https://github.com/nodejs/node/pull/9637
Fixes: https://github.com/nodejs/node/issues/9636


Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Sam Roberts <sam@strongloop.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>

PR-URL: https://github.com/nodejs/node/pull/9611
Fixes: https://github.com/nodejs/node/issues/9609


Reviewed-By: Claudio Rodriguez <cjrodr@yahoo.com>
Reviewed-By: Sam Roberts <sam@strongloop.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>

PR-URL: https://github.com/nodejs/node/pull/9648


Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Prince John Wesley <princejohnwesley@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Add an option to retrieve the Time-To-Live of the AAAA record.

PR-URL: https://github.com/nodejs/node/pull/9296
Refs: https://github.com/nodejs/node/issues/5893


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>

Add an option to retrieve the Time-To-Live of the A record.

PR-URL: https://github.com/nodejs/node/pull/9296
Refs: https://github.com/nodejs/node/issues/5893


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>

Make cctest valgrind-clean again by freeing heap-allocated memory.
Overlooked in commit ea94086a ("src: provide allocation + nullptr check
shortcuts.")

PR-URL: https://github.com/nodejs/node/pull/9667
Refs: https://github.com/nodejs/node/pull/8482


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>

Fix leaking the BIO in the error path.  Introduced in commit 34febfbf
("crypto: fix handling of root_cert_store").

PR-URL: https://github.com/nodejs/node/pull/9604
Refs: https://github.com/nodejs/node/pull/9409


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Rod Vagg <rod@vagg.org>

PR-URL: https://github.com/nodejs/node/pull/9677


Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Currently if the os.cpus() call fails every test will fail. As there is
already a test for os.cpus(), the other tests should run even if the
os.cpus() call fails.

PR-URL: https://github.com/nodejs/node/pull/9616



Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/9620


Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/9665


Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

PR-URL: https://github.com/nodejs/node/pull/9665


Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

PR-URL: https://github.com/nodejs/node/pull/9665


Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

PR-URL: https://github.com/nodejs/node/pull/9665


Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Fixes: https://github.com/nodejs/node/issues/9083

PR-URL: https://github.com/nodejs/node/pull/9115


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

The TSC and CTC meeting minutes are more properly placed in
the nodejs/tsc and nodejs/ctc repositories, respectively.

PR-URL: https://github.com/nodejs/node/pull/9503


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>

use setImmediate() insted of setTimeout()
 in test of stream2 push.
The test is in test/parallel/test-stream2-push.js

Fixes: https://github.com/nodejs/code-and-learn/issues/58
PR-URL: https://github.com/nodejs/node/pull/9583


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>

fix doc/api/repl.md line 6 "includable" => "includible"

Fixes: https://github.com/nodejs/code-and-learn/issues/58
PR-URL: https://github.com/nodejs/node/pull/9582


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>