This is a security release.

Notable Changes:

- CVE-2021-3672/CVE-2021-22931:
    Improper handling of untypical characters in domain names (High)
- CVE-2021-22930:
    Use after free on close http2 on stream canceling (High)
- CVE-2021-22939:
    Incomplete validation of rejectUnauthorized parameter (Low)

PR-URL: https://github.com/nodejs-private/node-private/pull/280

This is a security release.

Notable Changes:

- CVE-2021-3672/CVE-2021-22931:
    Improper handling of untypical characters in domain names (High)
- CVE-2021-22930:
    Use after free on close http2 on stream canceling (High)
- CVE-2021-22939:
    Incomplete validation of rejectUnauthorized parameter (Low)

PR-URL: https://github.com/nodejs-private/node-private/pull/279

This is a security release.

Notable Changes:

- CVE-2021-3672/CVE-2021-22931:
    Improper handling of untypical characters in domain names (High)
- CVE-2021-22930:
    Use after free on close http2 on stream canceling (High)
- CVE-2021-22939:
    Incomplete validation of rejectUnauthorized parameter (Low)

PR-URL: https://github.com/nodejs-private/node-private/pull/278

Incomplete validation of rejectUnauthorized parameter (Low)

If the Node.js https API was used incorrectly and "undefined" was passed
in for the "rejectUnauthorized" parameter, no error was returned and
connections to servers with an expired certificate would have been
accepted.

CVE-ID: CVE-2021-22939
Refs: https://nvd.nist.gov/vuln/detail/CVE-2021-22939
Refs: https://hackerone.com/reports/1278254
PR-URL: https://github.com/nodejs-private/node-private/pull/276


Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Akshay K <iit.akshay@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Richard Lau <rlau@redhat.com>

This change makes `process.stdout` and `process.stderr` to be
automatically undestroyed when ended/destrouyed, therefore making
it always possible to write/console.log to stdout.

Fixes: https://github.com/nodejs/node/issues/39447

PR-URL: https://github.com/nodejs/node/pull/39685


Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

Refs: https://github.com/c-ares/c-ares/releases/tag/cares-1_17_2

PR-URL: https://github.com/nodejs/node/pull/39724


Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39705


Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39705


Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39705


Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39705


Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39705


Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39705


Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39651


Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39651


Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39651


Reviewed-By: James M Snell <jasnell@gmail.com>

Refs: https://chromium.googlesource.com/deps/inspector_protocol/+log

PR-URL: https://github.com/nodejs/node/pull/39694


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>

Refs: https://chromium.googlesource.com/deps/inspector_protocol/+log

PR-URL: https://github.com/nodejs/node/pull/39694


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>

To apply the diff cleanly, ffb34b6d had to be reverted.

Refs: https://chromium.googlesource.com/deps/inspector_protocol/+log

PR-URL: https://github.com/nodejs/node/pull/39694


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>

This reverts commit ffb34b6d.

PR-URL: https://github.com/nodejs/node/pull/39694
Refs: https://chromium.googlesource.com/deps/inspector_protocol/+log


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>

Refs: https://chromium.googlesource.com/deps/inspector_protocol/+log

PR-URL: https://github.com/nodejs/node/pull/39694


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>

Refs: https://chromium.googlesource.com/deps/inspector_protocol/+log

PR-URL: https://github.com/nodejs/node/pull/39694


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>

Fix `sequential/test-debugger-heap-profiler` so that it can be run
in a worker thread. `process.chdir()` is not allowed in worker threads
but passing a current working directory into a spawned child process
is allowed.

PR-URL: https://github.com/nodejs/node/pull/39687


Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Refs: https://www.rfc-editor.org/rfc/rfc4122.txt

PR-URL: https://github.com/nodejs/node/pull/39682


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>

Refs: https://github.com/nodejs/TSC/issues/790#issuecomment-893457655

PR-URL: https://github.com/nodejs/node/pull/39664


Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Mary Marchini <oss@mmarchini.me>

PR-URL: https://github.com/nodejs/node/pull/39690


Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

The console captures in debugger.md are out of date, showing the
wrapper:

  function (exports, require, module, __filename, __dirname) {

That wrapper is no longer shown in debug sessions.

This also shortens and simplifies the description of the debugger in the
lede.

PR-URL: https://github.com/nodejs/node/pull/39661


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>

Signed-off-by: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39594


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Refs: https://github.com/nodejs/node/issues/39098

PR-URL: https://github.com/nodejs/node/pull/39176
Fixes: https://github.com/nodejs/node/issues/39098


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Functions affected:
* InitializeContext()
* InitializeContextForSnapshot()
* InitializePrimordials()

Signed-off-by: Darshan Sen <darshan.sen@postman.com>

PR-URL: https://github.com/nodejs/node/pull/39603


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

There is a color contrast issue with links in light mode on the API
highlight background. This only appears in modules.md. This change fixes
it without introducing other contrast issues in either light or dark
mode. Previously, the color contrast for some text on modules.html was
failing WCAG AA in light mode.

PR-URL: https://github.com/nodejs/node/pull/39660


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Derek Lewis <DerekNonGeneric@inf.is>

PR-URL: https://github.com/nodejs/node/pull/39622
Refs: https://github.com/nodejs/node/pull/39423


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>

The PR updates the handling of rst_stream frames and adds all streams
to the pending list on receiving rst frames with the error code
NGHTTP2_CANCEL.

The changes will remove dependency on the stream state that may allow
bypassing the checks in certain cases. I think a better solution is to
delay streams in all cases if rst_stream is received for the cancel
events.

The rst_stream frames can be received for protocol/connection error as
well it should be handled immediately. Adding streams to the pending
list in such cases may cause errors.

PR-URL: https://github.com/nodejs/node/pull/39622
Refs: https://github.com/nodejs/node/pull/39423


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>

c-ares refactored their source tree in 1.17.0 which we did not apply in
our update to 1.17.1. This commit syncs our source with their new
structure for easier maintenance going forward. cares.gyp is updated
accordingly.

Refs: https://github.com/c-ares/c-ares/pull/349
Refs: https://github.com/nodejs/node/pull/36207

PR-URL: https://github.com/nodejs/node/pull/39653


Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39653
Refs: https://github.com/c-ares/c-ares/pull/349
Refs: https://github.com/nodejs/node/pull/36207


Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39621


Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Co-authored-by: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39610


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

PR-URL: https://github.com/nodejs/node/pull/39610


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

PR-URL: https://github.com/nodejs/node/pull/39610


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

Adds a helper util used to determine whether a stream has been
disturbed (read or cancelled).

Refs: https://github.com/nodejs/node/issues/39627

PR-URL: https://github.com/nodejs/node/pull/39628


Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

As per doc we should not emit further events after 'close' and
only 'close' after 'error'.

Fixes: https://github.com/nodejs/node/issues/39630

PR-URL: https://github.com/nodejs/node/pull/39639


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>