url: emit warning in url.parse() for URLs with invalid ports #45526

Trott · 2022-11-19T22:01:16Z

These URLs throw with WHATWG URL. They are permitted with url.parse() but that allows potential host spoofing by sending a domain name as the port. This warning can be changed to an error as a breaking change in a major release.

lib/url.js

Trott · 2022-11-21T00:32:07Z

@nodejs/tsc

mcollina

lgtm

Trott · 2022-11-22T02:09:03Z

CITGM: https://ci.nodejs.org/view/Node.js-citgm/job/citgm-smoker/3046/

ljharb · 2022-11-22T03:04:12Z

Should parse-github-url be added to citgm?

Trott · 2022-11-22T07:08:16Z

The deprecation rules seem to be geared to APIs that are being removed. This isn't the case here, and it seems like if I didn't bother with a warning and simply landed this as a breaking change for the next release that changes the API behavior, that would be acceptable. But providing a warning first seems like the considerate thing to do for users. But landing a runtime warning in the Current release isn't possible because we treat the warning as a breaking change too. But perhaps it shouldn't be. The current rules arguably discourage handling breaking changes responsibly.

aduh95

Can we first land a doc-only deprecation that can land on active and LTS release lines? EDIT: I've opened #45576 to land the doc-only deprecation first.

aduh95 · 2022-11-22T11:31:30Z

The deprecation rules seem to be geared to APIs that are being removed. This isn't the case here, and it seems like if I didn't bother with a warning and simply landed this as a breaking change for the next release that changes the API behavior, that would be acceptable.

I think this API change is very peculiar, as we usually wouldn't land a breaking change on a stable API without offering an option to get back to the old behavior (and we would probably deprecated that option, which would eventually be removed). However that seems unpractical for url.parse because it already accepts booleans parameters instead of an options object. (and I don't know if we want to introduce a new signature for a deprecated API at this point).

Refs: nodejs#45526 Co-authored-by: Rich Trott <rtrott@gmail.com>

These URLs throw with WHATWG URL. They are permitted with url.parse() but that allows potential host spoofing by sending a domain name as the port. PR-URL: nodejs#45526 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Robert Nagy <ronagy@icloud.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Trott · 2022-11-30T21:41:58Z

Landed in e6abf3d

PR-URL: #45576 Refs: #45526 Co-authored-by: Rich Trott <rtrott@gmail.com> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Notable Changes: crypto: * (SEMVER-MAJOR) use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 deps: * update ada to 2.0.0 (Node.js GitHub Bot) #47339 src,process: * (SEMVER-MINOR) add permission model (Rafael Gonzaga) #44004 url: * drop ICU requirement for parsing hostnames (Yagiz Nizipli) #47339 * use ada::url_aggregator for parsing urls (Yagiz Nizipli) #47339 * (SEMVER-MAJOR) runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 Semver-Major Commits: * [9fafb0a] - (SEMVER-MAJOR) async_hooks: deprecate the AsyncResource.bind asyncResource property (James M Snell) #46432 * [1948d37] - (SEMVER-MAJOR) buffer: check INSPECT_MAX_BYTES with validateNumber (Umuoy) #46599 * [7bc0e6a] - (SEMVER-MAJOR) buffer: graduate File from experimental and expose as global (Khafra) #47153 * [671ffd7] - (SEMVER-MAJOR) buffer: use min/max of `validateNumber` (Deokjin Kim) #45796 * [ab1614d] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #47251 * [c1bcdbc] - (SEMVER-MAJOR) build: warn for gcc versions earlier than 10.1 (Richard Lau) #46806 * [649f68f] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Yagiz Nizipli) #45579 * [9374700] - (SEMVER-MAJOR) crypto: remove DEFAULT_ENCODING (Tobias Nießen) #47182 * [1640aeb] - (SEMVER-MAJOR) crypto: remove obsolete SSL_OP_* constants (Tobias Nießen) #47073 * [c2e4b1f] - (SEMVER-MAJOR) crypto: remove ALPN_ENABLED (Tobias Nießen) #47028 * [3ef38c4] - (SEMVER-MAJOR) crypto: use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 * [08af023] - (SEMVER-MAJOR) crypto: runtime deprecate replaced rsa-pss keygen parameters (Filip Skokan) #45653 * [7eb0ac3] - (SEMVER-MAJOR) deps: patch V8 to support compilation on win-arm64 (Michaël Zasso) #47251 * [a7c129f] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #47251 * [6f5655a] - (SEMVER-MAJOR) deps: always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #47251 * [f226350] - (SEMVER-MAJOR) deps: update V8 to 11.3.244.4 (Michaël Zasso) #47251 * [d6dae74] - (SEMVER-MAJOR) deps: V8: cherry-pick f1c888e7093e (Michaël Zasso) #45579 * [56c4365] - (SEMVER-MAJOR) deps: fix V8 build on Windows with MSVC (Michaël Zasso) #45579 * [51ab98c] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #45579 * [9f84d3e] - (SEMVER-MAJOR) deps: V8: fix v8-cppgc.h for MSVC (Jiawen Geng) #45579 * [f2318cd] - (SEMVER-MAJOR) deps: fix V8 build issue with inline methods (Jiawen Geng) #45579 * [16e03e7] - (SEMVER-MAJOR) deps: update V8 to 10.9.194.4 (Yagiz Nizipli) #45579 * [6473f5e] - (SEMVER-MAJOR) doc: update toolchains used for Node.js 20 releases (Richard Lau) #47352 * [cc18fd9] - (SEMVER-MAJOR) events: refactor to use `validateNumber` (Deokjin Kim) #45770 * [ff92b40] - (SEMVER-MAJOR) http: close the connection after sending a body without declared length (Tim Perry) #46333 * [2a29df6] - (SEMVER-MAJOR) http: keep HTTP/1.1 conns alive even if the Connection header is removed (Tim Perry) #46331 * [391dc74] - (SEMVER-MAJOR) http: throw error if options of http.Server is array (Deokjin Kim) #46283 * [ed3604c] - (SEMVER-MAJOR) http: server check Host header, to meet RFC 7230 5.4 requirement (wwwzbwcom) #45597 * [4b08c4c] - (SEMVER-MAJOR) lib: runtime deprecate punycode (Yagiz Nizipli) #47202 * [88d71dc] - (SEMVER-MAJOR) lib: refactor to use min/max of `validateNumber` (Deokjin Kim) #45772 * [e4d641f] - (SEMVER-MAJOR) lib: refactor to use validators in http2 (Debadree Chatterjee) #46174 * [0f3e531] - (SEMVER-MAJOR) lib: performance improvement on readline async iterator (Thiago Oliveira Santos) #41276 * [5b5898a] - (SEMVER-MAJOR) lib,src: update exit codes as per todos (Debadree Chatterjee) #45841 * [8b51c1a] - (SEMVER-MAJOR) net: enable autoSelectFamily by default (Paolo Insogna) #46790 * [2d0d997] - (SEMVER-MAJOR) process: remove `process.exit()`, `process.exitCode` coercion to integer (Daeyeon Jeong) #43716 * [dc06df3] - (SEMVER-MAJOR) readline: refactor to use `validateNumber` (Deokjin Kim) #45801 * [295b2f3] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 115 (Michaël Zasso) #47251 * [3803b02] - (SEMVER-MAJOR) src: share common code paths for SEA and embedder script (Anna Henningsen) #46825 * [e8bddac] - (SEMVER-MAJOR) src: apply ABI-breaking API simplifications (Anna Henningsen) #46705 * [f84de0a] - (SEMVER-MAJOR) src: use uint32_t for process initialization flags enum (Anna Henningsen) #46427 * [a624277] - (SEMVER-MAJOR) src: fix ArrayBuffer::Detach deprecation (Michaël Zasso) #45579 * [dd5c39a] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 112 (Yagiz Nizipli) #45579 * [63eca7f] - (SEMVER-MAJOR) stream: validate readable defaultEncoding (Marco Ippolito) #46430 * [9e7093f] - (SEMVER-MAJOR) stream: validate writable defaultEncoding (Marco Ippolito) #46322 * [fb91ee4] - (SEMVER-MAJOR) test: make trace-gc-flag tests less strict (Yagiz Nizipli) #45579 * [eca6180] - (SEMVER-MAJOR) test: adapt test-v8-stats for V8 update (Michaël Zasso) #45579 * [c03354d] - (SEMVER-MAJOR) test: test case for multiple res.writeHead and res.getHeader (Marco Ippolito) #45508 * [c733cc0] - (SEMVER-MAJOR) test_runner: mark module as stable (Colin Ihrig) #46983 * [7ce2232] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.1 (Michaël Zasso) #47251 * [ca4bd30] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.0 (Michaël Zasso) #47251 * [58b06a2] - (SEMVER-MAJOR) tools: update V8 gypfiles (Michaël Zasso) #45579 * [027841c] - (SEMVER-MAJOR) url: use private properties for brand check (Yagiz Nizipli) #46904 * [3bed5f1] - (SEMVER-MAJOR) url: runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 * [7c76fdd] - (SEMVER-MAJOR) util,doc: mark parseArgs() as stable (Colin Ihrig) #46718 * [7efae93] - (SEMVER-MAJOR) wasi: make version non-optional (Michael Dawson) #47391 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #47441

Notable Changes: crypto: * (SEMVER-MAJOR) use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 deps: * update ada to 2.0.0 (Node.js GitHub Bot) #47339 sea: * use JSON configuration and blob content for SEA (Joyee Cheung) #47125 src,process: * (SEMVER-MINOR) add permission model (Rafael Gonzaga) #44004 url: * drop ICU requirement for parsing hostnames (Yagiz Nizipli) #47339 * use ada::url_aggregator for parsing urls (Yagiz Nizipli) #47339 * (SEMVER-MAJOR) runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 Semver-Major Commits: * [9fafb0a] - (SEMVER-MAJOR) async_hooks: deprecate the AsyncResource.bind asyncResource property (James M Snell) #46432 * [1948d37] - (SEMVER-MAJOR) buffer: check INSPECT_MAX_BYTES with validateNumber (Umuoy) #46599 * [7bc0e6a] - (SEMVER-MAJOR) buffer: graduate File from experimental and expose as global (Khafra) #47153 * [671ffd7] - (SEMVER-MAJOR) buffer: use min/max of `validateNumber` (Deokjin Kim) #45796 * [ab1614d] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #47251 * [c1bcdbc] - (SEMVER-MAJOR) build: warn for gcc versions earlier than 10.1 (Richard Lau) #46806 * [649f68f] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Yagiz Nizipli) #45579 * [9374700] - (SEMVER-MAJOR) crypto: remove DEFAULT_ENCODING (Tobias Nießen) #47182 * [1640aeb] - (SEMVER-MAJOR) crypto: remove obsolete SSL_OP_* constants (Tobias Nießen) #47073 * [c2e4b1f] - (SEMVER-MAJOR) crypto: remove ALPN_ENABLED (Tobias Nießen) #47028 * [3ef38c4] - (SEMVER-MAJOR) crypto: use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 * [08af023] - (SEMVER-MAJOR) crypto: runtime deprecate replaced rsa-pss keygen parameters (Filip Skokan) #45653 * [7eb0ac3] - (SEMVER-MAJOR) deps: patch V8 to support compilation on win-arm64 (Michaël Zasso) #47251 * [a7c129f] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #47251 * [6f5655a] - (SEMVER-MAJOR) deps: always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #47251 * [f226350] - (SEMVER-MAJOR) deps: update V8 to 11.3.244.4 (Michaël Zasso) #47251 * [d6dae74] - (SEMVER-MAJOR) deps: V8: cherry-pick f1c888e7093e (Michaël Zasso) #45579 * [56c4365] - (SEMVER-MAJOR) deps: fix V8 build on Windows with MSVC (Michaël Zasso) #45579 * [51ab98c] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #45579 * [9f84d3e] - (SEMVER-MAJOR) deps: V8: fix v8-cppgc.h for MSVC (Jiawen Geng) #45579 * [f2318cd] - (SEMVER-MAJOR) deps: fix V8 build issue with inline methods (Jiawen Geng) #45579 * [16e03e7] - (SEMVER-MAJOR) deps: update V8 to 10.9.194.4 (Yagiz Nizipli) #45579 * [6473f5e] - (SEMVER-MAJOR) doc: update toolchains used for Node.js 20 releases (Richard Lau) #47352 * [cc18fd9] - (SEMVER-MAJOR) events: refactor to use `validateNumber` (Deokjin Kim) #45770 * [ff92b40] - (SEMVER-MAJOR) http: close the connection after sending a body without declared length (Tim Perry) #46333 * [2a29df6] - (SEMVER-MAJOR) http: keep HTTP/1.1 conns alive even if the Connection header is removed (Tim Perry) #46331 * [391dc74] - (SEMVER-MAJOR) http: throw error if options of http.Server is array (Deokjin Kim) #46283 * [ed3604c] - (SEMVER-MAJOR) http: server check Host header, to meet RFC 7230 5.4 requirement (Marco Ippolito) #45597 * [4b08c4c] - (SEMVER-MAJOR) lib: runtime deprecate punycode (Yagiz Nizipli) #47202 * [88d71dc] - (SEMVER-MAJOR) lib: refactor to use min/max of `validateNumber` (Deokjin Kim) #45772 * [e4d641f] - (SEMVER-MAJOR) lib: refactor to use validators in http2 (Debadree Chatterjee) #46174 * [0f3e531] - (SEMVER-MAJOR) lib: performance improvement on readline async iterator (Thiago Oliveira Santos) #41276 * [5b5898a] - (SEMVER-MAJOR) lib,src: update exit codes as per todos (Debadree Chatterjee) #45841 * [8b51c1a] - (SEMVER-MAJOR) net: enable autoSelectFamily by default (Paolo Insogna) #46790 * [2d0d997] - (SEMVER-MAJOR) process: remove `process.exit()`, `process.exitCode` coercion to integer (Daeyeon Jeong) #43716 * [dc06df3] - (SEMVER-MAJOR) readline: refactor to use `validateNumber` (Deokjin Kim) #45801 * [295b2f3] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 115 (Michaël Zasso) #47251 * [3803b02] - (SEMVER-MAJOR) src: share common code paths for SEA and embedder script (Anna Henningsen) #46825 * [e8bddac] - (SEMVER-MAJOR) src: apply ABI-breaking API simplifications (Anna Henningsen) #46705 * [f84de0a] - (SEMVER-MAJOR) src: use uint32_t for process initialization flags enum (Anna Henningsen) #46427 * [a624277] - (SEMVER-MAJOR) src: fix ArrayBuffer::Detach deprecation (Michaël Zasso) #45579 * [dd5c39a] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 112 (Yagiz Nizipli) #45579 * [63eca7f] - (SEMVER-MAJOR) stream: validate readable defaultEncoding (Marco Ippolito) #46430 * [9e7093f] - (SEMVER-MAJOR) stream: validate writable defaultEncoding (Marco Ippolito) #46322 * [fb91ee4] - (SEMVER-MAJOR) test: make trace-gc-flag tests less strict (Yagiz Nizipli) #45579 * [eca6180] - (SEMVER-MAJOR) test: adapt test-v8-stats for V8 update (Michaël Zasso) #45579 * [c03354d] - (SEMVER-MAJOR) test: test case for multiple res.writeHead and res.getHeader (Marco Ippolito) #45508 * [c733cc0] - (SEMVER-MAJOR) test_runner: mark module as stable (Colin Ihrig) #46983 * [7ce2232] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.1 (Michaël Zasso) #47251 * [ca4bd30] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.0 (Michaël Zasso) #47251 * [58b06a2] - (SEMVER-MAJOR) tools: update V8 gypfiles (Michaël Zasso) #45579 * [027841c] - (SEMVER-MAJOR) url: use private properties for brand check (Yagiz Nizipli) #46904 * [3bed5f1] - (SEMVER-MAJOR) url: runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 * [7c76fdd] - (SEMVER-MAJOR) util,doc: mark parseArgs() as stable (Colin Ihrig) #46718 * [7efae93] - (SEMVER-MAJOR) wasi: make version non-optional (Michael Dawson) #47391 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #47441

Notable Changes: crypto: * (SEMVER-MAJOR) use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 deps: * update ada to 2.0.0 (Node.js GitHub Bot) #47339 sea: * use JSON configuration and blob content for SEA (Joyee Cheung) #47125 src,process: * (SEMVER-MINOR) add permission model (Rafael Gonzaga) #44004 url: * drop ICU requirement for parsing hostnames (Yagiz Nizipli) #47339 * use ada::url_aggregator for parsing urls (Yagiz Nizipli) #47339 * (SEMVER-MAJOR) runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 Semver-Major Commits: * [9fafb0a] - (SEMVER-MAJOR) async_hooks: deprecate the AsyncResource.bind asyncResource property (James M Snell) #46432 * [1948d37] - (SEMVER-MAJOR) buffer: check INSPECT_MAX_BYTES with validateNumber (Umuoy) #46599 * [7bc0e6a] - (SEMVER-MAJOR) buffer: graduate File from experimental and expose as global (Khafra) #47153 * [671ffd7] - (SEMVER-MAJOR) buffer: use min/max of `validateNumber` (Deokjin Kim) #45796 * [ab1614d] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #47251 * [c1bcdbc] - (SEMVER-MAJOR) build: warn for gcc versions earlier than 10.1 (Richard Lau) #46806 * [649f68f] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Yagiz Nizipli) #45579 * [9374700] - (SEMVER-MAJOR) crypto: remove DEFAULT_ENCODING (Tobias Nießen) #47182 * [1640aeb] - (SEMVER-MAJOR) crypto: remove obsolete SSL_OP_* constants (Tobias Nießen) #47073 * [c2e4b1f] - (SEMVER-MAJOR) crypto: remove ALPN_ENABLED (Tobias Nießen) #47028 * [3ef38c4] - (SEMVER-MAJOR) crypto: use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 * [08af023] - (SEMVER-MAJOR) crypto: runtime deprecate replaced rsa-pss keygen parameters (Filip Skokan) #45653 * [7eb0ac3] - (SEMVER-MAJOR) deps: patch V8 to support compilation on win-arm64 (Michaël Zasso) #47251 * [a7c129f] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #47251 * [6f5655a] - (SEMVER-MAJOR) deps: always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #47251 * [f226350] - (SEMVER-MAJOR) deps: update V8 to 11.3.244.4 (Michaël Zasso) #47251 * [d6dae74] - (SEMVER-MAJOR) deps: V8: cherry-pick f1c888e7093e (Michaël Zasso) #45579 * [56c4365] - (SEMVER-MAJOR) deps: fix V8 build on Windows with MSVC (Michaël Zasso) #45579 * [51ab98c] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #45579 * [9f84d3e] - (SEMVER-MAJOR) deps: V8: fix v8-cppgc.h for MSVC (Jiawen Geng) #45579 * [f2318cd] - (SEMVER-MAJOR) deps: fix V8 build issue with inline methods (Jiawen Geng) #45579 * [16e03e7] - (SEMVER-MAJOR) deps: update V8 to 10.9.194.4 (Yagiz Nizipli) #45579 * [6473f5e] - (SEMVER-MAJOR) doc: update toolchains used for Node.js 20 releases (Richard Lau) #47352 * [cc18fd9] - (SEMVER-MAJOR) events: refactor to use `validateNumber` (Deokjin Kim) #45770 * [ff92b40] - (SEMVER-MAJOR) http: close the connection after sending a body without declared length (Tim Perry) #46333 * [2a29df6] - (SEMVER-MAJOR) http: keep HTTP/1.1 conns alive even if the Connection header is removed (Tim Perry) #46331 * [391dc74] - (SEMVER-MAJOR) http: throw error if options of http.Server is array (Deokjin Kim) #46283 * [ed3604c] - (SEMVER-MAJOR) http: server check Host header, to meet RFC 7230 5.4 requirement (Marco Ippolito) #45597 * [4b08c4c] - (SEMVER-MAJOR) lib: runtime deprecate punycode (Yagiz Nizipli) #47202 * [88d71dc] - (SEMVER-MAJOR) lib: refactor to use min/max of `validateNumber` (Deokjin Kim) #45772 * [e4d641f] - (SEMVER-MAJOR) lib: refactor to use validators in http2 (Debadree Chatterjee) #46174 * [0f3e531] - (SEMVER-MAJOR) lib: performance improvement on readline async iterator (Thiago Oliveira Santos) #41276 * [5b5898a] - (SEMVER-MAJOR) lib,src: update exit codes as per todos (Debadree Chatterjee) #45841 * [8b51c1a] - (SEMVER-MAJOR) net: enable autoSelectFamily by default (Paolo Insogna) #46790 * [2d0d997] - (SEMVER-MAJOR) process: remove `process.exit()`, `process.exitCode` coercion to integer (Daeyeon Jeong) #43716 * [dc06df3] - (SEMVER-MAJOR) readline: refactor to use `validateNumber` (Deokjin Kim) #45801 * [295b2f3] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 115 (Michaël Zasso) #47251 * [3803b02] - (SEMVER-MAJOR) src: share common code paths for SEA and embedder script (Anna Henningsen) #46825 * [e8bddac] - (SEMVER-MAJOR) src: apply ABI-breaking API simplifications (Anna Henningsen) #46705 * [f84de0a] - (SEMVER-MAJOR) src: use uint32_t for process initialization flags enum (Anna Henningsen) #46427 * [a624277] - (SEMVER-MAJOR) src: fix ArrayBuffer::Detach deprecation (Michaël Zasso) #45579 * [dd5c39a] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 112 (Yagiz Nizipli) #45579 * [63eca7f] - (SEMVER-MAJOR) stream: validate readable defaultEncoding (Marco Ippolito) #46430 * [9e7093f] - (SEMVER-MAJOR) stream: validate writable defaultEncoding (Marco Ippolito) #46322 * [fb91ee4] - (SEMVER-MAJOR) test: make trace-gc-flag tests less strict (Yagiz Nizipli) #45579 * [eca6180] - (SEMVER-MAJOR) test: adapt test-v8-stats for V8 update (Michaël Zasso) #45579 * [c03354d] - (SEMVER-MAJOR) test: test case for multiple res.writeHead and res.getHeader (Marco Ippolito) #45508 * [c733cc0] - (SEMVER-MAJOR) test_runner: mark module as stable (Colin Ihrig) #46983 * [7ce2232] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.1 (Michaël Zasso) #47251 * [ca4bd30] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.0 (Michaël Zasso) #47251 * [58b06a2] - (SEMVER-MAJOR) tools: update V8 gypfiles (Michaël Zasso) #45579 * [027841c] - (SEMVER-MAJOR) url: use private properties for brand check (Yagiz Nizipli) #46904 * [3bed5f1] - (SEMVER-MAJOR) url: runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 * [7c76fdd] - (SEMVER-MAJOR) util,doc: mark parseArgs() as stable (Colin Ihrig) #46718 * [7efae93] - (SEMVER-MAJOR) wasi: make version non-optional (Michael Dawson) #47391 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #47441 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

Notable Changes: crypto: * (SEMVER-MAJOR) use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 deps: * update ada to 2.0.0 (Node.js GitHub Bot) #47339 esm: * move hook execution to separate thread (Jacob Smith) #44710 sea: * use JSON configuration and blob content for SEA (Joyee Cheung) #47125 src,process: * (SEMVER-MINOR) add permission model (Rafael Gonzaga) #44004 url: * drop ICU requirement for parsing hostnames (Yagiz Nizipli) #47339 * use ada::url_aggregator for parsing urls (Yagiz Nizipli) #47339 * (SEMVER-MAJOR) runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 Semver-Major Commits: * [9fafb0a] - (SEMVER-MAJOR) async_hooks: deprecate the AsyncResource.bind asyncResource property (James M Snell) #46432 * [1948d37] - (SEMVER-MAJOR) buffer: check INSPECT_MAX_BYTES with validateNumber (Umuoy) #46599 * [7bc0e6a] - (SEMVER-MAJOR) buffer: graduate File from experimental and expose as global (Khafra) #47153 * [671ffd7] - (SEMVER-MAJOR) buffer: use min/max of `validateNumber` (Deokjin Kim) #45796 * [ab1614d] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #47251 * [c1bcdbc] - (SEMVER-MAJOR) build: warn for gcc versions earlier than 10.1 (Richard Lau) #46806 * [649f68f] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Yagiz Nizipli) #45579 * [9374700] - (SEMVER-MAJOR) crypto: remove DEFAULT_ENCODING (Tobias Nießen) #47182 * [1640aeb] - (SEMVER-MAJOR) crypto: remove obsolete SSL_OP_* constants (Tobias Nießen) #47073 * [c2e4b1f] - (SEMVER-MAJOR) crypto: remove ALPN_ENABLED (Tobias Nießen) #47028 * [3ef38c4] - (SEMVER-MAJOR) crypto: use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 * [08af023] - (SEMVER-MAJOR) crypto: runtime deprecate replaced rsa-pss keygen parameters (Filip Skokan) #45653 * [7eb0ac3] - (SEMVER-MAJOR) deps: patch V8 to support compilation on win-arm64 (Michaël Zasso) #47251 * [a7c129f] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #47251 * [6f5655a] - (SEMVER-MAJOR) deps: always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #47251 * [f226350] - (SEMVER-MAJOR) deps: update V8 to 11.3.244.4 (Michaël Zasso) #47251 * [d6dae74] - (SEMVER-MAJOR) deps: V8: cherry-pick f1c888e7093e (Michaël Zasso) #45579 * [56c4365] - (SEMVER-MAJOR) deps: fix V8 build on Windows with MSVC (Michaël Zasso) #45579 * [51ab98c] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #45579 * [9f84d3e] - (SEMVER-MAJOR) deps: V8: fix v8-cppgc.h for MSVC (Jiawen Geng) #45579 * [f2318cd] - (SEMVER-MAJOR) deps: fix V8 build issue with inline methods (Jiawen Geng) #45579 * [16e03e7] - (SEMVER-MAJOR) deps: update V8 to 10.9.194.4 (Yagiz Nizipli) #45579 * [6473f5e] - (SEMVER-MAJOR) doc: update toolchains used for Node.js 20 releases (Richard Lau) #47352 * [cc18fd9] - (SEMVER-MAJOR) events: refactor to use `validateNumber` (Deokjin Kim) #45770 * [ff92b40] - (SEMVER-MAJOR) http: close the connection after sending a body without declared length (Tim Perry) #46333 * [2a29df6] - (SEMVER-MAJOR) http: keep HTTP/1.1 conns alive even if the Connection header is removed (Tim Perry) #46331 * [391dc74] - (SEMVER-MAJOR) http: throw error if options of http.Server is array (Deokjin Kim) #46283 * [ed3604c] - (SEMVER-MAJOR) http: server check Host header, to meet RFC 7230 5.4 requirement (Marco Ippolito) #45597 * [4b08c4c] - (SEMVER-MAJOR) lib: runtime deprecate punycode (Yagiz Nizipli) #47202 * [88d71dc] - (SEMVER-MAJOR) lib: refactor to use min/max of `validateNumber` (Deokjin Kim) #45772 * [e4d641f] - (SEMVER-MAJOR) lib: refactor to use validators in http2 (Debadree Chatterjee) #46174 * [0f3e531] - (SEMVER-MAJOR) lib: performance improvement on readline async iterator (Thiago Oliveira Santos) #41276 * [5b5898a] - (SEMVER-MAJOR) lib,src: update exit codes as per todos (Debadree Chatterjee) #45841 * [8b51c1a] - (SEMVER-MAJOR) net: enable autoSelectFamily by default (Paolo Insogna) #46790 * [2d0d997] - (SEMVER-MAJOR) process: remove `process.exit()`, `process.exitCode` coercion to integer (Daeyeon Jeong) #43716 * [dc06df3] - (SEMVER-MAJOR) readline: refactor to use `validateNumber` (Deokjin Kim) #45801 * [295b2f3] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 115 (Michaël Zasso) #47251 * [3803b02] - (SEMVER-MAJOR) src: share common code paths for SEA and embedder script (Anna Henningsen) #46825 * [e8bddac] - (SEMVER-MAJOR) src: apply ABI-breaking API simplifications (Anna Henningsen) #46705 * [f84de0a] - (SEMVER-MAJOR) src: use uint32_t for process initialization flags enum (Anna Henningsen) #46427 * [a624277] - (SEMVER-MAJOR) src: fix ArrayBuffer::Detach deprecation (Michaël Zasso) #45579 * [dd5c39a] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 112 (Yagiz Nizipli) #45579 * [63eca7f] - (SEMVER-MAJOR) stream: validate readable defaultEncoding (Marco Ippolito) #46430 * [9e7093f] - (SEMVER-MAJOR) stream: validate writable defaultEncoding (Marco Ippolito) #46322 * [fb91ee4] - (SEMVER-MAJOR) test: make trace-gc-flag tests less strict (Yagiz Nizipli) #45579 * [eca6180] - (SEMVER-MAJOR) test: adapt test-v8-stats for V8 update (Michaël Zasso) #45579 * [c03354d] - (SEMVER-MAJOR) test: test case for multiple res.writeHead and res.getHeader (Marco Ippolito) #45508 * [c733cc0] - (SEMVER-MAJOR) test_runner: mark module as stable (Colin Ihrig) #46983 * [7ce2232] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.1 (Michaël Zasso) #47251 * [ca4bd30] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.0 (Michaël Zasso) #47251 * [58b06a2] - (SEMVER-MAJOR) tools: update V8 gypfiles (Michaël Zasso) #45579 * [027841c] - (SEMVER-MAJOR) url: use private properties for brand check (Yagiz Nizipli) #46904 * [3bed5f1] - (SEMVER-MAJOR) url: runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 * [7c76fdd] - (SEMVER-MAJOR) util,doc: mark parseArgs() as stable (Colin Ihrig) #46718 * [7efae93] - (SEMVER-MAJOR) wasi: make version non-optional (Michael Dawson) #47391 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #47441 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

Notable Changes: crypto: * (SEMVER-MAJOR) use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 deps: * update ada to 2.0.0 (Node.js GitHub Bot) #47339 esm: * move hook execution to separate thread (Jacob Smith) #44710 sea: * use JSON configuration and blob content for SEA (Joyee Cheung) #47125 src,process: * (SEMVER-MINOR) add permission model (Rafael Gonzaga) #44004 url: * drop ICU requirement for parsing hostnames (Yagiz Nizipli) #47339 * use ada::url_aggregator for parsing urls (Yagiz Nizipli) #47339 * (SEMVER-MAJOR) runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 Semver-Major Commits: * [9fafb0a] - (SEMVER-MAJOR) async_hooks: deprecate the AsyncResource.bind asyncResource property (James M Snell) #46432 * [1948d37] - (SEMVER-MAJOR) buffer: check INSPECT_MAX_BYTES with validateNumber (Umuoy) #46599 * [7bc0e6a] - (SEMVER-MAJOR) buffer: graduate File from experimental and expose as global (Khafra) #47153 * [671ffd7] - (SEMVER-MAJOR) buffer: use min/max of `validateNumber` (Deokjin Kim) #45796 * [ab1614d] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #47251 * [c1bcdbc] - (SEMVER-MAJOR) build: warn for gcc versions earlier than 10.1 (Richard Lau) #46806 * [649f68f] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Yagiz Nizipli) #45579 * [9374700] - (SEMVER-MAJOR) crypto: remove DEFAULT_ENCODING (Tobias Nießen) #47182 * [1640aeb] - (SEMVER-MAJOR) crypto: remove obsolete SSL_OP_* constants (Tobias Nießen) #47073 * [c2e4b1f] - (SEMVER-MAJOR) crypto: remove ALPN_ENABLED (Tobias Nießen) #47028 * [3ef38c4] - (SEMVER-MAJOR) crypto: use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 * [08af023] - (SEMVER-MAJOR) crypto: runtime deprecate replaced rsa-pss keygen parameters (Filip Skokan) #45653 * [7eb0ac3] - (SEMVER-MAJOR) deps: patch V8 to support compilation on win-arm64 (Michaël Zasso) #47251 * [a7c129f] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #47251 * [6f5655a] - (SEMVER-MAJOR) deps: always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #47251 * [f226350] - (SEMVER-MAJOR) deps: update V8 to 11.3.244.4 (Michaël Zasso) #47251 * [d6dae74] - (SEMVER-MAJOR) deps: V8: cherry-pick f1c888e7093e (Michaël Zasso) #45579 * [56c4365] - (SEMVER-MAJOR) deps: fix V8 build on Windows with MSVC (Michaël Zasso) #45579 * [51ab98c] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #45579 * [9f84d3e] - (SEMVER-MAJOR) deps: V8: fix v8-cppgc.h for MSVC (Jiawen Geng) #45579 * [f2318cd] - (SEMVER-MAJOR) deps: fix V8 build issue with inline methods (Jiawen Geng) #45579 * [16e03e7] - (SEMVER-MAJOR) deps: update V8 to 10.9.194.4 (Yagiz Nizipli) #45579 * [6473f5e] - (SEMVER-MAJOR) doc: update toolchains used for Node.js 20 releases (Richard Lau) #47352 * [cc18fd9] - (SEMVER-MAJOR) events: refactor to use `validateNumber` (Deokjin Kim) #45770 * [ff92b40] - (SEMVER-MAJOR) http: close the connection after sending a body without declared length (Tim Perry) #46333 * [2a29df6] - (SEMVER-MAJOR) http: keep HTTP/1.1 conns alive even if the Connection header is removed (Tim Perry) #46331 * [391dc74] - (SEMVER-MAJOR) http: throw error if options of http.Server is array (Deokjin Kim) #46283 * [ed3604c] - (SEMVER-MAJOR) http: server check Host header, to meet RFC 7230 5.4 requirement (wwwzbwcom) #45597 * [88d71dc] - (SEMVER-MAJOR) lib: refactor to use min/max of `validateNumber` (Deokjin Kim) #45772 * [e4d641f] - (SEMVER-MAJOR) lib: refactor to use validators in http2 (Debadree Chatterjee) #46174 * [0f3e531] - (SEMVER-MAJOR) lib: performance improvement on readline async iterator (Thiago Oliveira Santos) #41276 * [5b5898a] - (SEMVER-MAJOR) lib,src: update exit codes as per todos (Debadree Chatterjee) #45841 * [55321ba] - (SEMVER-MAJOR) net: enable autoSelectFamily by default (Paolo Insogna) #46790 * [2d0d997] - (SEMVER-MAJOR) process: remove `process.exit()`, `process.exitCode` coercion to integer (Daeyeon Jeong) #43716 * [dc06df3] - (SEMVER-MAJOR) readline: refactor to use `validateNumber` (Deokjin Kim) #45801 * [295b2f3] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 115 (Michaël Zasso) #47251 * [3803b02] - (SEMVER-MAJOR) src: share common code paths for SEA and embedder script (Anna Henningsen) #46825 * [e8bddac] - (SEMVER-MAJOR) src: apply ABI-breaking API simplifications (Anna Henningsen) #46705 * [f84de0a] - (SEMVER-MAJOR) src: use uint32_t for process initialization flags enum (Anna Henningsen) #46427 * [a624277] - (SEMVER-MAJOR) src: fix ArrayBuffer::Detach deprecation (Michaël Zasso) #45579 * [dd5c39a] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 112 (Yagiz Nizipli) #45579 * [63eca7f] - (SEMVER-MAJOR) stream: validate readable defaultEncoding (Marco Ippolito) #46430 * [9e7093f] - (SEMVER-MAJOR) stream: validate writable defaultEncoding (Marco Ippolito) #46322 * [fb91ee4] - (SEMVER-MAJOR) test: make trace-gc-flag tests less strict (Yagiz Nizipli) #45579 * [eca6180] - (SEMVER-MAJOR) test: adapt test-v8-stats for V8 update (Michaël Zasso) #45579 * [c03354d] - (SEMVER-MAJOR) test: test case for multiple res.writeHead and res.getHeader (Marco Ippolito) #45508 * [c733cc0] - (SEMVER-MAJOR) test_runner: mark module as stable (Colin Ihrig) #46983 * [7ce2232] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.1 (Michaël Zasso) #47251 * [ca4bd30] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.0 (Michaël Zasso) #47251 * [58b06a2] - (SEMVER-MAJOR) tools: update V8 gypfiles (Michaël Zasso) #45579 * [027841c] - (SEMVER-MAJOR) url: use private properties for brand check (Yagiz Nizipli) #46904 * [3bed5f1] - (SEMVER-MAJOR) url: runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 * [7c76fdd] - (SEMVER-MAJOR) util,doc: mark parseArgs() as stable (Colin Ihrig) #46718 * [4b52727] - (SEMVER-MAJOR) wasi: make version non-optional (Michael Dawson) #47391 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #47441 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

nodejs-github-bot added needs-ci PRs that need a full CI run. url Issues and PRs related to the legacy built-in url module. labels Nov 19, 2022

anonrig approved these changes Nov 19, 2022

View reviewed changes

anonrig added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. request-ci Add this label to start a Jenkins CI on a PR. labels Nov 20, 2022

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Nov 20, 2022

This comment was marked as outdated.

Sign in to view

aduh95 reviewed Nov 20, 2022

View reviewed changes

lib/url.js Outdated Show resolved Hide resolved

aduh95 added semver-major PRs that contain breaking changes and should be released in the next major version. and removed author ready PRs that have at least one approval, no pending requests for changes, and a CI started. labels Nov 20, 2022

Trott added the notable-change PRs with changes that should be highlighted in changelogs. label Nov 21, 2022

github-actions bot mentioned this pull request Nov 21, 2022

CI Reliability 2022-11-21 nodejs/reliability#435

Open

15 tasks

Trott force-pushed the warning branch from 6b9535c to daf9370 Compare November 21, 2022 00:30

mcollina approved these changes Nov 21, 2022

View reviewed changes

Trott added the request-ci Add this label to start a Jenkins CI on a PR. label Nov 21, 2022

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Nov 21, 2022

This comment was marked as outdated.

Sign in to view

ronag approved these changes Nov 21, 2022

View reviewed changes

github-actions bot mentioned this pull request Nov 22, 2022

CI Reliability 2022-11-22 nodejs/reliability#436

Open

15 tasks

Trott mentioned this pull request Nov 22, 2022

Should parse-github-url be added to citgm? nodejs/citgm#933

Open

aduh95 requested changes Nov 22, 2022

View reviewed changes

aduh95 added a commit to aduh95/node that referenced this pull request Nov 22, 2022

doc: deprecate use of invalid ports in url.parse

a0c64c5

Refs: nodejs#45526 Co-authored-by: Rich Trott <rtrott@gmail.com>

aduh95 mentioned this pull request Nov 22, 2022

doc: deprecate use of invalid ports in url.parse #45576

Merged

github-actions bot mentioned this pull request Nov 23, 2022

CI Reliability 2022-11-23 nodejs/reliability#437

Open

13 tasks

Trott force-pushed the warning branch from e6abf3d to 3bed5f1 Compare November 30, 2022 21:41

Trott merged commit 3bed5f1 into nodejs:main Nov 30, 2022

Trott deleted the warning branch November 30, 2022 21:42

RafaelGSS mentioned this pull request Apr 3, 2023

2023-04-18, Version 20.0.0 (Current) #47381

Merged

samanthagottlieb mentioned this pull request Oct 23, 2023

Bump Webpack to v5 and node to 18 guardian/atom-workshop#343

Merged

soartec-lab mentioned this pull request Dec 29, 2023

chore: bump Node.js version to 20 anymaniax/orval#1126

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

url: emit warning in url.parse() for URLs with invalid ports #45526

url: emit warning in url.parse() for URLs with invalid ports #45526

Trott commented Nov 19, 2022

This comment was marked as outdated.

This comment was marked as outdated.

Trott commented Nov 21, 2022

mcollina left a comment

This comment was marked as outdated.

Trott commented Nov 22, 2022

ljharb commented Nov 22, 2022

Trott commented Nov 22, 2022 •

edited

aduh95 left a comment •

edited

aduh95 commented Nov 22, 2022

Trott commented Nov 30, 2022

url: emit warning in url.parse() for URLs with invalid ports #45526

url: emit warning in url.parse() for URLs with invalid ports #45526

Conversation

Trott commented Nov 19, 2022

This comment was marked as outdated.

This comment was marked as outdated.

Trott commented Nov 21, 2022

mcollina left a comment

Choose a reason for hiding this comment

This comment was marked as outdated.

Trott commented Nov 22, 2022

ljharb commented Nov 22, 2022

Trott commented Nov 22, 2022 • edited

aduh95 left a comment • edited

Choose a reason for hiding this comment

aduh95 commented Nov 22, 2022

Trott commented Nov 30, 2022

Trott commented Nov 22, 2022 •

edited

aduh95 left a comment •

edited