Notable changes:

* npm: upgrade from v2.15.1 to v2.15.11, including accurate updated
  license (Jeremiah Senkpiel)
* process: `process.versions.ares` now outputs the c-ares version (Johan
  Bergström)

PR-URL: https://github.com/nodejs/node/pull/10352

PR-URL: https://github.com/nodejs/node/pull/10352

Section 3.2 of the C++ standard states that destructor definitions
implicitly "use" operator delete functions. Therefore, these operator
delete functions must be defined even if they are never called by
user code explicitly.
http://www.open-std.org/JTC1/SC22/WG21/docs/cwg_defects.html#261

gcc allows them to remain as empty definitions. However, not all
compilers allow this.

This pull request creates definitions which if ever called, result
in an abort.

PR-URL: https://github.com/nodejs/node/pull/10356


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Rod Vagg <rod@vagg.org>

Refs: https://github.com/nodejs/LTS/issues/143
PR-URL: https://github.com/nodejs/node/pull/9619


Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>

PR-URL: https://github.com/nodejs/node/pull/9150


Reviewed-By: João Reis <reis@janeasystems.com>

PR-URL: https://github.com/nodejs/node/pull/9151


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/9191


Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/9107


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

This is a security release. All Node.js users should consult the
security release summary at
https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/
for details on patched vulnerabilities.

Notable changes:

* c-ares: fix for single-byte buffer overwrite, CVE-2016-5180, more
  information at https://c-ares.haxx.se/adv_20160929.html
  (Daniel Stenberg)

PR-URL: https://github.com/nodejs/node/pull/9147

PR-URL: https://github.com/nodejs/node/pull/9155


Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Reviewed-By: João Reis <reis@janeasystems.com>

Incorrect string length calculation when passing escaped dot.

- CVE: CVE-2016-5180
- Upstream bug: https://c-ares.haxx.se/adv_20160929.html

Ref: https://github.com/nodejs/node/pull/9037
PR-URL: https://github.com/nodejs/node/pull/8849


Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

This is a security release. All Node.js users should consult the
security release summary at
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
for details on patched vulnerabilities.

Notable changes:

* buffer: Zero-fill excess bytes in new `Buffer` objects created with
  `Buffer.concat()` while providing a `totalLength` parameter that
  exceeds the total length of the original `Buffer` objects being
  concatenated. (Сковорода Никита Андреевич)
* http:
  - CVE-2016-5325 - Properly validate for allowable characters in the
    `reason` argument in `ServerResponse#writeHead()`. Fixes a
    possible response splitting attack vector. This introduces a new
    case where `throw` may occur when configuring HTTP responses,
    users should already be adopting try/catch here. Originally
    reported independently by Evan Lucas and Romain Gaucher.
    (Evan Lucas)
  - Invalid status codes can no longer be sent. Limited to 3 digit
    numbers between 100 - 999. Lack of proper validation may also
    serve as a potential response splitting attack vector. Backported
    from v4.x. (Brian White)
* openssl:
  - Upgrade to 1.0.1u, fixes a number of defects impacting Node.js:
    CVE-2016-6304 ("OCSP Status Request extension unbounded memory
    growth", high severity), CVE-2016-2183, CVE-2016-6303,
    CVE-2016-2178 and CVE-2016-6306.
  - Remove support for loading dynamic third-party engine modules.
    An attacker may be able to hide malicious code to be inserted
    into Node.js at runtime by masquerading as one of the dynamic
    engine modules. Originally reported by Ahmed Zaki (Skype).
    (Ben Noordhuis, Rod Vagg)
* tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
  check whereby a TLS server may be able to serve an invalid wildcard
  certificate for its hostname due to improper validation of `*.` in
  the wildcard string. Originally reported by Alexander Minozhenko
  and James Bunton (Atlassian). (Ben Noordhuis)

PR-URL: https://github.com/nodejs/node-private/pull/72

Compile out hardware engines.  Most are stubs that dynamically load
the real driver but that poses a security liability when an attacker
is able to create a malicious DLL in one of the default search paths.

Backport of
https://github.com/nodejs/node-private/pull/58

PR-URL: https://github.com/nodejs/node-private/pull/69


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>

This makes sure that no uninitialized bytes are leaked when the specified
`totalLength` input value is greater than the actual total length of the
specified buffers array, e.g. in Buffer.concat([Buffer.alloc(0)], 100).

PR-URL: https://github.com/nodejs/node-private/pull/66


Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

CVE-2016-7099

PR-URL: https://github.com/nodejs/node-private/pull/61


Reviewed-By: Rod Vagg <rod@vagg.org>

Previously, the reason argument passed to ServerResponse#writeHead was
not being properly validated.  One could pass CRLFs which could lead to
http response splitting. This commit changes the behavior to throw an
error in the event any invalid characters are included in the reason.

CVE-2016-5325

PR-URL: https://github.com/nodejs/node-private/pull/47


Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Douglas Wilson <doug@somethingdoug.com>

Back port of
https://github.com/nodejs/node/commit/7e9b0dd6949aaa6afda4da9f41e1d60d9b
3d6225 to v0.12.

PR-URL: https://github.com/nodejs/node-private/pull/47


Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Douglas Wilson <doug@somethingdoug.com>

In openssl s_client on Windows, RAND_screen() is invoked to initialize
random state but it takes several seconds in each connection.
This added -no_rand_screen to openssl s_client on Windows to skip
RAND_screen() and gets a better performance in the unit test of
test-tls-server-verify.
Do not enable this except to use in the unit test.

(cherry picked from commit 9f0f7c38e6df975dd39735d0e9ef968076369c74)

Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/joyent/node/pull/25368

reapply b9106137

PR: #9451
PR-URL: https://github.com/joyent/node/pull/9451


Reviewed-By: Julien Gilli <julien.gilli@joyent.com>

PR: #25523
PR-URL: https://github.com/joyent/node/pull/25523


Reviewed-By: Julien Gilli <jgilli@fastmail.fm>

PR: #25654
PR-URL: https://github.com/joyent/node/pull/25654


Reviewed-By: Julien Gilli <jgilli@fastmail.fm>

`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and
perhaps others) are requiring .686 .

PR: #9451
PR-URL: https://github.com/joyent/node/pull/9451


Reviewed-By: Julien Gilli <julien.gilli@joyent.com>

PR: #25523
PR-URL: https://github.com/joyent/node/pull/25523


Reviewed-By: Julien Gilli <jgilli@fastmail.fm>

PR: #25654
PR-URL: https://github.com/joyent/node/pull/25654


Reviewed-By: Julien Gilli <jgilli@fastmail.fm>

sha256-x86_64.pl does not exist in the origin openssl distribution. It
was copied from sha512-x86_64.pl and both sha256/sha512 scripts were
modified so as to generates only one asm file specified as its key
hash length.

PR: #9451
PR-URL: https://github.com/joyent/node/pull/9451


Reviewed-By: Julien Gilli <julien.gilli@joyent.com>

PR: #25523
PR-URL: https://github.com/joyent/node/pull/25523


Reviewed-By: Julien Gilli <jgilli@fastmail.fm>

PR: #25654
PR-URL: https://github.com/joyent/node/pull/25654


Reviewed-By: Julien Gilli <jgilli@fastmail.fm>

All symlink files in `deps/openssl/openssl/include/openssl/`
are removed and replaced with real header files to avoid
issues on Windows. Two files of opensslconf.h in crypto and
include dir are replaced to refer config/opensslconf.h.

PR-URL: https://github.com/nodejs/node/pull/8718


Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Myles Borins <mborins@us.ibm.com>

This just replaces all sources of openssl-1.0.1u.tar.gz
into deps/openssl/openssl.

PR-URL: https://github.com/nodejs/node/pull/8718


Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Myles Borins <mborins@us.ibm.com>

Work around spec violations in V8 where it checks that `this == NULL`.
GCC 6 started exploiting this particular kind of UB, resulting in
runtime crashes.

Fixes: https://github.com/nodejs/node/issues/6724
PR-URL: https://github.com/nodejs/node/pull/6737


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>

This is a security release. All Node.js users should consult the security
release summary at
https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/ for
details on patched vulnerabilities.

Notable changes:

* libuv: (CVE-2014-9748) Fixes a bug in the read/write locks implementation for
  Windows XP and Windows 2003 that can lead to undefined and potentially unsafe
  behaviour. More information can be found at
  https://github.com/libuv/libuv/issues/515 or at
  https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/.
* V8: (CVE-2016-1669) Fixes a potential Buffer overflow vulnerability
  discovered in V8, more details can be found in the CVE at
  https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1669 or at
  https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/.

PR-URL: https://github.com/nodejs/node-private/pull/53

Original commit message:

    unix, win: consolidate mutex trylock errors

    Fold EAGAIN into EBUSY, and make it the only acceptable error.

    PR-URL: https://github.com/libuv/libuv/pull/535


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

PR-URL: https://github.com/nodejs/node-private/pull/54


Reviewed-By: Saúl Ibarra Corretgé <saghul@gmail.com>

Original commit message:

    unix: consolidate rwlock tryrdlock trywrlock errors

    Fold EAGAIN and EBUSY into EBUSY. This makes it consistent across all
    Unix platforms and Windows.

    Refs: https://github.com/libuv/libuv/pull/525
    PR-URL: https://github.com/libuv/libuv/pull/535


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

PR-URL: https://github.com/nodejs/node-private/pull/54


Reviewed-By: Saúl Ibarra Corretgé <saghul@gmail.com>

Original commit message:

    win: don't fetch function pointers to SRWLock APIs

    They're no longer needed, since the Windows-native SRWLock functions are
    no longer used.

    PR-URL: https://github.com/libuv/libuv/pull/525


Reviewed-By: Saúl Ibarra Corretgé <saghul@gmail.com>

PR-URL: https://github.com/nodejs/node-private/pull/54


Reviewed-By: Saúl Ibarra Corretgé <saghul@gmail.com>

Original commit message:

    win: redo/fix the uv_rwlock APIs

    Previously, on Windows Vista and later, we'd use the Windows native
    SRWLock APIs. However they turned out to be semantically incompatible
    with pthread read-write locks and/or plain buggy. This patch makes sure
    that the custom implementation that was previously only used on old
    Windows versions is now used everywhere.

    This patch fixes a number of issues with the old fallback
    implementation. Specifically:

    * The reader count would not be incremented when a thread successfully
      acquired a read lock while another thread *also* held a read lock.

    * `uv_rwlock_tryrdlock()` and `uv_rwlock_trywrlock()` now
      consistently return UV_EBUSY when a lock couldn't be acquired.

    * Any unexpected errors now cause libuv to abort, with the exception of
      `uv_rwlock_init()`.

    See also https://github.com/libuv/libuv/issues/515.

    PR-URL: https://github.com/libuv/libuv/pull/525


Reviewed-By: Saúl Ibarra Corretgé <saghul@gmail.com>

PR-URL: https://github.com/nodejs/node-private/pull/54


Reviewed-By: Saúl Ibarra Corretgé <saghul@gmail.com>

Original commit message:

    win: fix unsavory rwlock fallback implementation

    Before this patch an uv_mutex_t (backed by a critical section) could be
    released by a tread different from the thread that acquired it, which is
    not allowed. This is fixed by using a semaphore instead.

    Note that the affected code paths were used on Windows XP and Windows
    Server 2003 only.

    Fixes: https://github.com/libuv/libuv/issues/515
    PR-URL: https://github.com/libuv/libuv/pull/516


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Saúl Ibarra Corretgé <saghul@gmail.com>

PR-URL: https://github.com/nodejs/node-private/pull/54


Reviewed-By: Saúl Ibarra Corretgé <saghul@gmail.com>

Original commit message:

	Fix overflow issue in Zone::New

	When requesting a large allocation near the end of the address space,
	the computation could overflow and erroneously *not* grow the Zone
	as required.

	BUG=chromium:606115
	LOG=y

	Review-Url: https://codereview.chromium.org/1930873002
	Cr-Commit-Position: refs/heads/master@{#35903}

PR-URL: https://github.com/nodejs/node-private/pull/44


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Rod Vagg <rod@vagg.org>

Back-port commit 76f40f77 ("test: stronger crypto in test fixtures") from
the master branch.

Pushes back the expiration date of test/fixtures/keys/ca2-crl.pem to
2018, fixing a CRL_HAS_EXPIRED error in simple/test-tls-server-verify.

Fixes: https://github.com/nodejs/node/issues/7194
PR-URL: https://github.com/nodejs/node/pull/7195


Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>

Notable changes:

* npm: Correct erroneous version number in v2.15.1 code
  (Forrest L Norvell) https://github.com/nodejs/node/pull/5988
* openssl: Upgrade to v1.0.1t, addressing security vulnerabilities
  (Shigeki Ohtsu) https://github.com/nodejs/node/pull/6553
  - Fixes CVE-2016-2107 "Padding oracle in AES-NI CBC MAC check"
  - Fixes CVE-2016-2105 "EVP_EncodeUpdate overflow"
  - See https://nodejs.org/en/blog/vulnerability/openssl-may-2016/
    for full details

PR-URL: https://github.com/nodejs/node/pull/5988


Reviewed-By: Myles Borins <myles.borins@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/5988


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>