1# Node.js 0.12 ChangeLog 2 3<!--lint disable prohibited-strings--> 4<!--lint disable maximum-line-length--> 5<!--lint disable no-literal-urls--> 6 7<table> 8<tr> 9<th>Stable</th> 10</tr> 11<tr> 12<td> 13<a href="#0.12.18">0.12.18</a><br/> 14<a href="#0.12.17">0.12.17</a><br/> 15<a href="#0.12.16">0.12.16</a><br/> 16<a href="#0.12.15">0.12.15</a><br/> 17<a href="#0.12.14">0.12.14</a><br/> 18<a href="#0.12.13">0.12.13</a><br/> 19<a href="#0.12.12">0.12.12</a><br/> 20<a href="#0.12.11">0.12.11</a><br/> 21<a href="#0.12.10">0.12.10</a><br/> 22<a href="#0.12.9">0.12.9</a><br/> 23<a href="#0.12.8">0.12.8</a><br/> 24<a href="#0.12.7">0.12.7</a><br/> 25<a href="#0.12.6">0.12.6</a><br/> 26<a href="#0.12.5">0.12.5</a><br/> 27<a href="#0.12.4">0.12.4</a><br/> 28<a href="#0.12.3">0.12.3</a><br/> 29<a href="#0.12.2">0.12.2</a><br/> 30<a href="#0.12.1">0.12.1</a><br/> 31<a href="#0.12.0">0.12.0</a><br/> 32</td> 33</tr> 34</table> 35 36* Other Versions 37 * [12.x](CHANGELOG_V12.md) 38 * [11.x](CHANGELOG_V11.md) 39 * [10.x](CHANGELOG_V10.md) 40 * [9.x](CHANGELOG_V9.md) 41 * [8.x](CHANGELOG_V8.md) 42 * [7.x](CHANGELOG_V7.md) 43 * [6.x](CHANGELOG_V6.md) 44 * [5.x](CHANGELOG_V5.md) 45 * [4.x](CHANGELOG_V4.md) 46 * [0.10.x](CHANGELOG_V010.md) 47 * [io.js](CHANGELOG_IOJS.md) 48 * [Archive](CHANGELOG_ARCHIVE.md) 49 50*Note*: Node.js v0.12 is covered by the 51[Node.js Long Term Support Plan](https://github.com/nodejs/LTS) and 52will be maintained until December 31st, 2016. 53 54<a id="0.12.18"></a> 55## 2016-12-21, Version 0.12.18 (Maintenance), @rvagg 56 57### Notable changes: 58 59* npm: upgrade from v2.15.1 to v2.15.11, including accurate updated license (Jeremiah Senkpiel) 60* process: `process.versions.ares` now outputs the c-ares version (Johan Bergström) 61 62### Commits: 63 64* [[`a47fd4549d`](https://github.com/nodejs/node/commit/a47fd4549d) - build: add working lint-ci make target (Rod Vagg) https://github.com/nodejs/node/pull/9151 65* [[`830584ca59`](https://github.com/nodejs/node/commit/830584ca59) - deps: define missing operator delete functions (John Barboza) https://github.com/nodejs/node/pull/10356 66* [[`c130b31cba`](https://github.com/nodejs/node/commit/c130b31cba) - deps: upgrade npm to 2.15.11 (Jeremiah Senkpiel) https://github.com/nodejs/node/pull/9619 67* [[`bc6766d847`](https://github.com/nodejs/node/commit/bc6766d847) - doc: update npm license in main LICENSE file (Rod Vagg) https://github.com/nodejs/node/pull/10352 68* [[`0cdf344c80`](https://github.com/nodejs/node/commit/0cdf344c80) - (SEMVER-MINOR) process: reintroduce ares to versions (Johan Bergström) https://github.com/nodejs/node/pull/9191 69* [[`d8e27ec30a`](https://github.com/nodejs/node/commit/d8e27ec30a) - test: mark dgram-multicast-multi-process as flaky (Rod Vagg) https://github.com/nodejs/node/pull/9150 70* [[`c722335ead`](https://github.com/nodejs/node/commit/c722335ead) - tls: fix minor jslint failure (Rod Vagg) https://github.com/nodejs/node/pull/9107 71 72<a id="0.12.17"></a> 73## 2016-10-18, Version 0.12.17 (Maintenance), @rvagg 74 75This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/ for details on patched vulnerabilities. 76 77### Notable changes: 78 79* c-ares: fix for single-byte buffer overwrite, CVE-2016-5180, more information at https://c-ares.haxx.se/adv_20160929.html (Daniel Stenberg) 80 81### Commits: 82 83* [[`c5b095ecf8`](https://github.com/nodejs/node/commit/c5b095ecf8) - deps: avoid single-byte buffer overwrite (Daniel Stenberg) https://github.com/nodejs/node/pull/8849 84 85<a id="0.12.16"></a> 86## 2016-09-27, Version 0.12.16 (Maintenance), @rvagg 87 88This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ for details on patched vulnerabilities. 89 90### Notable changes: 91 92* buffer: Zero-fill excess bytes in new `Buffer` objects created with `Buffer.concat()` while providing a `totalLength` parameter that exceeds the total length of the original `Buffer` objects being concatenated. (Сковорода Никита Андреевич) 93* http: 94 * CVE-2016-5325 - Properly validate for allowable characters in the `reason` argument in `ServerResponse#writeHead()`. Fixes a possible response splitting attack vector. This introduces a new case where `throw` may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) 95 * Invalid status codes can no longer be sent. Limited to 3 digit numbers between 100 - 999. Lack of proper validation may also serve as a potential response splitting attack vector. Backported from v4.x. (Brian White) 96* openssl: 97 * Upgrade to 1.0.1u, fixes a number of defects impacting Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. 98 * Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis, Rod Vagg) 99* tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of `*.` in the wildcard string. Originally reported by Alexander Minozhenko and James Bunton (Atlassian). (Ben Noordhuis) 100 101### Commits: 102 103* [[`38d7258d89`](https://github.com/nodejs/node/commit/38d7258d89) - buffer: zero-fill uninitialized bytes in .concat() (Сковорода Никита Андреевич) https://github.com/nodejs/node-private/pull/66 104* [[`1ba6d16786`](https://github.com/nodejs/node/commit/1ba6d16786) - build: turn on -fno-delete-null-pointer-checks (Ben Noordhuis) https://github.com/nodejs/node/pull/6737 105* [[`71e4285e27`](https://github.com/nodejs/node/commit/71e4285e27) - crypto: don't build hardware engines (Rod Vagg) https://github.com/nodejs/node-private/pull/69 106* [[`b6e0105a66`](https://github.com/nodejs/node/commit/b6e0105a66) - deps: add -no_rand_screen to openssl s_client (Shigeki Ohtsu) https://github.com/nodejs/node-v0.x-archive/pull/25368 107* [[`1caec97eab`](https://github.com/nodejs/node/commit/1caec97eab) - deps: fix openssl assembly error on ia32 win32 (Fedor Indutny) https://github.com/nodejs/node-v0.x-archive/pull/25654 108* [[`734bc6938b`](https://github.com/nodejs/node/commit/734bc6938b) - deps: separate sha256/sha512-x86_64.pl for openssl (Shigeki Ohtsu) https://github.com/nodejs/node-v0.x-archive/pull/25654 109* [[`7cc6d4eb5c`](https://github.com/nodejs/node/commit/7cc6d4eb5c) - deps: copy all openssl header files to include dir (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8718 110* [[`4a9da21217`](https://github.com/nodejs/node/commit/4a9da21217) - deps: upgrade openssl sources to 1.0.1u (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8718 111* [[`6d977902bd`](https://github.com/nodejs/node/commit/6d977902bd) - http: check reason chars in writeHead (Evan Lucas) https://github.com/nodejs/node-private/pull/47 112* [[`ad470e496b`](https://github.com/nodejs/node/commit/ad470e496b) - http: disallow sending obviously invalid status codes (Evan Lucas) https://github.com/nodejs/node-private/pull/47 113* [[`9dbde2fc88`](https://github.com/nodejs/node/commit/9dbde2fc88) - lib: make tls.checkServerIdentity() more strict (Ben Noordhuis) https://github.com/nodejs/node-private/pull/61 114* [[`db80592071`](https://github.com/nodejs/node/commit/db80592071) - openssl: fix keypress requirement in apps on win32 (Shigeki Ohtsu) https://github.com/nodejs/node-v0.x-archive/pull/25654 115 116<a id="0.12.15"></a> 117## 2016-06-23, Version 0.12.15 (Maintenance), @rvagg 118 119### Notable changes: 120 121This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/ for details on patched vulnerabilities. 122 123* libuv: (CVE-2014-9748) Fixes a bug in the read/write locks implementation for Windows XP and Windows 2003 that can lead to undefined and potentially unsafe behaviour. More information can be found at https://github.com/libuv/libuv/issues/515 or at https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/. 124* V8: (CVE-2016-1669) Fixes a potential Buffer overflow vulnerability discovered in V8, more details can be found in the CVE at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1669 or at https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/. 125 126### Commits: 127 128* [[`da8501edf6`](https://github.com/nodejs/node/commit/da8501edf6) - deps: backport bd1777fd from libuv upstream (Rod Vagg) 129* [[`9207a00f8e`](https://github.com/nodejs/node/commit/9207a00f8e) - deps: backport 85adf43e from libuv upstream (Rod Vagg) 130* [[`9627f34230`](https://github.com/nodejs/node/commit/9627f34230) - deps: backport 98239224 from libuv upstream (Rod Vagg) 131* [[`5df21b2e36`](https://github.com/nodejs/node/commit/5df21b2e36) - deps: backport 9a4fd268 from libuv upstream (Rod Vagg) 132* [[`e75de35057`](https://github.com/nodejs/node/commit/e75de35057) - deps: backport 3eb6764a from libuv upstream (Rod Vagg) 133* [[`a113e02f16`](https://github.com/nodejs/node/commit/a113e02f16) - deps: backport 3a9bfec from v8 upstream (Ben Noordhuis) 134* [[`8138055c88`](https://github.com/nodejs/node/commit/8138055c88) - test: fix test failure due to expired certificates (Ben Noordhuis) https://github.com/nodejs/node/pull/7195 135 136<a id="0.12.14"></a> 137## 2016-05-06, Version 0.12.14 (Maintenance), @rvagg 138 139### Notable changes: 140 141* npm: Correct erroneous version number in v2.15.1 code (Forrest L Norvell) https://github.com/nodejs/node/pull/5988 142* openssl: Upgrade to v1.0.1t, addressing security vulnerabilities (Shigeki Ohtsu) https://github.com/nodejs/node/pull/6553 143 * Fixes CVE-2016-2107 "Padding oracle in AES-NI CBC MAC check" 144 * Fixes CVE-2016-2105 "EVP_EncodeUpdate overflow" 145 * See https://nodejs.org/en/blog/vulnerability/openssl-may-2016/ for full details 146 147### Commits: 148 149* [[`3e99ee1b47`](https://github.com/nodejs/node/commit/3e99ee1b47) - deps: completely upgrade npm in LTS to 2.15.1 (Forrest L Norvell) https://github.com/nodejs/node/pull/5988 150* [[`2b63396e1f`](https://github.com/nodejs/node/commit/2b63396e1f) - deps: add -no_rand_screen to openssl s_client (Shigeki Ohtsu) https://github.com/joyent/node/pull/25368 151* [[`f21705df58`](https://github.com/nodejs/node/commit/f21705df58) - deps: update openssl asm files (Shigeki Ohtsu) https://github.com/nodejs/node/pull/6553 152* [[`02b6a6bc27`](https://github.com/nodejs/node/commit/02b6a6bc27) - deps: fix openssl assembly error on ia32 win32 (Fedor Indutny) https://github.com/joyent/node/pull/25654 153* [[`1aecc668b0`](https://github.com/nodejs/node/commit/1aecc668b0) - deps: separate sha256/sha512-x86_64.pl for openssl (Shigeki Ohtsu) https://github.com/joyent/node/pull/25654 154* [[`39380836a0`](https://github.com/nodejs/node/commit/39380836a0) - deps: copy all openssl header files to include dir (Shigeki Ohtsu) https://github.com/nodejs/node/pull/6553 155* [[`08c8ae44a8`](https://github.com/nodejs/node/commit/08c8ae44a8) - deps: upgrade openssl sources to 1.0.1t (Shigeki Ohtsu) https://github.com/nodejs/node/pull/6553 156* [[`f5a961ab13`](https://github.com/nodejs/node/commit/f5a961ab13) - openssl: fix keypress requirement in apps on win32 (Shigeki Ohtsu) https://github.com/joyent/node/pull/25654 157* [[`810fb211a7`](https://github.com/nodejs/node/commit/810fb211a7) - tools: remove obsolete npm test-legacy command (Kat Marchán) https://github.com/nodejs/node/pull/5988 158 159<a id="0.12.13"></a> 160## 2016-03-31, Version 0.12.13 (LTS), @rvagg 161 162### Notable changes 163 164* npm: Upgrade to v2.15.1. (Forrest L Norvell) 165* openssl: OpenSSL v1.0.1s disables the EXPORT and LOW ciphers as they are obsolete and not considered safe. This release of Node.js turns on `OPENSSL_NO_WEAK_SSL_CIPHERS` to fully disable the 27 ciphers included in these lists which can be used in SSLv3 and higher. Full details can be found in our LTS discussion on the matter (https://github.com/nodejs/LTS/issues/85). (Shigeki Ohtsu) https://github.com/nodejs/node/pull/5712 166 167### Commits 168 169* [[`4041ea6bc5`](https://github.com/nodejs/node/commit/4041ea6bc5) - deps: upgrade npm in LTS to 2.15.1 (Forrest L Norvell) 170* [[`a115779026`](https://github.com/nodejs/node/commit/a115779026) - deps: Disable EXPORT and LOW ciphers in openssl (Shigeki Ohtsu) https://github.com/nodejs/node/pull/5712 171* [[`ab907eb5a8`](https://github.com/nodejs/node/commit/ab907eb5a8) - test: skip cluster-disconnect-race on Windows (Gibson Fahnestock) https://github.com/nodejs/node/pull/5621 172* [[`9c06db7444`](https://github.com/nodejs/node/commit/9c06db7444) - test: change tls tests not to use LOW cipher (Shigeki Ohtsu) https://github.com/nodejs/node/pull/5712 173* [[`154098a3dc`](https://github.com/nodejs/node/commit/154098a3dc) - test: bp fix for test-http-get-pipeline-problem.js (Michael Dawson) https://github.com/nodejs/node/pull/3013 174* [[`ff2bed6e86`](https://github.com/nodejs/node/commit/ff2bed6e86) - win,build: support Visual C++ Build Tools 2015 (João Reis) https://github.com/nodejs/node/pull/5627 175 176<a id="0.12.12"></a> 177## 2016-03-08, Version 0.12.12 (LTS), @rvagg 178 179### Notable changes: 180 181* openssl: Fully remove SSLv2 support, the `--enable-ssl2` command line argument will now produce an error. The DROWN Attack (https://drownattack.com/) creates a vulnerability where SSLv2 is enabled by a server, even if a client connection is not using SSLv2. The SSLv2 protocol is widely considered unacceptably broken and should not be supported. More information is available at https://www.openssl.org/news/vulnerabilities.html#2016-0800 182 183Note that the upgrade to OpenSSL 1.0.1s in Node.js v0.12.11 removed internal SSLv2 support. The change in this release was originally intended for v0.12.11. The `--enable-ssl2` command line argument now produces an error rather than being a no-op. 184 185### Commits: 186 187* [[`dbfc9d9241`](https://github.com/nodejs/node/commit/dbfc9d9241) - crypto,tls: remove SSLv2 support (Ben Noordhuis) https://github.com/nodejs/node/pull/5536 188 189<a id="0.12.11"></a> 190## 2016-03-03, Version 0.12.11 (LTS), @rvagg 191 192### Notable changes: 193 194* http_parser: Update to http-parser 2.3.2 to fix an unintentionally strict limitation of allowable header characters. (James M Snell) https://github.com/nodejs/node/pull/5241 195* domains: 196 * Prevent an exit due to an exception being thrown rather than emitting an 'uncaughtException' event on the `process` object when no error handler is set on the domain within which an error is thrown and an 'uncaughtException' event listener is set on `process`. (Julien Gilli) https://github.com/nodejs/node/pull/3885 197 * Fix an issue where the process would not abort in the proper function call if an error is thrown within a domain with no error handler and `--abort-on-uncaught-exception` is used. (Julien Gilli) https://github.com/nodejs/node/pull/3885 198* openssl: Upgrade from 1.0.1r to 1.0.1s (Ben Noordhuis) https://github.com/nodejs/node/pull/5509 199 * Fix a double-free defect in parsing malformed DSA keys that may potentially be used for DoS or memory corruption attacks. It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0705 200 * Fix a defect that can cause memory corruption in certain very rare cases relating to the internal `BN_hex2bn()` and `BN_dec2bn()` functions. It is believed that Node.js is not invoking the code paths that use these functions so practical attacks via Node.js using this defect are _unlikely_ to be possible. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0797 201 * Fix a defect that makes the CacheBleed Attack (https://ssrg.nicta.com.au/projects/TS/cachebleed/) possible. This defect enables attackers to execute side-channel attacks leading to the potential recovery of entire RSA private keys. It only affects the Intel Sandy Bridge (and possibly older) microarchitecture when using hyper-threading. Newer microarchitectures, including Haswell, are unaffected. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0702 202 203### Commits: 204 205* [[`1ab6653db9`](https://github.com/nodejs/node/commit/1ab6653db9) - build: update Node.js logo on OSX installer (Rod Vagg) https://github.com/nodejs/node/pull/5401 206* [[`fcc64792ae`](https://github.com/nodejs/node/commit/fcc64792ae) - child_process: guard against race condition (Rich Trott) https://github.com/nodejs/node/pull/5153 207* [[`6c468df9af`](https://github.com/nodejs/node/commit/6c468df9af) - child_process: fix data loss with readable event (Brian White) https://github.com/nodejs/node/pull/5037 208* [[`61a22019c2`](https://github.com/nodejs/node/commit/61a22019c2) - deps: upgrade openssl to 1.0.1s (Ben Noordhuis) https://github.com/nodejs/node/pull/5509 209* [[`fa26b13df7`](https://github.com/nodejs/node/commit/fa26b13df7) - deps: update to http-parser 2.3.2 (James M Snell) https://github.com/nodejs/node/pull/5241 210* [[`46c8e2165f`](https://github.com/nodejs/node/commit/46c8e2165f) - deps: backport 1f8555 from v8's upstream (Trevor Norris) https://github.com/nodejs/node/pull/3945 211* [[`ce58c2c31a`](https://github.com/nodejs/node/commit/ce58c2c31a) - doc: remove SSLv2 descriptions (Shigeki Ohtsu) https://github.com/nodejs/node/pull/5541 212* [[`018e4e0b1a`](https://github.com/nodejs/node/commit/018e4e0b1a) - domains: fix handling of uncaught exceptions (Julien Gilli) https://github.com/nodejs/node/pull/3885 213* [[`d421e85dc9`](https://github.com/nodejs/node/commit/d421e85dc9) - lib: fix cluster handle leak (Rich Trott) https://github.com/nodejs/node/pull/5152 214* [[`3a48f0022f`](https://github.com/nodejs/node/commit/3a48f0022f) - node: fix leaking Context handle (Trevor Norris) https://github.com/nodejs/node/pull/3945 215* [[`28dddabf6a`](https://github.com/nodejs/node/commit/28dddabf6a) - src: fix build error without OpenSSL support (Jörg Krause) https://github.com/nodejs/node/pull/4201 216* [[`a79baf03cd`](https://github.com/nodejs/node/commit/a79baf03cd) - src: use global SealHandleScope (Trevor Norris) https://github.com/nodejs/node/pull/3945 217* [[`be39f30447`](https://github.com/nodejs/node/commit/be39f30447) - test: add test-domain-exit-dispose-again back (Julien Gilli) https://github.com/nodejs/node/pull/4278 218* [[`da66166b9a`](https://github.com/nodejs/node/commit/da66166b9a) - test: fix test-domain-exit-dispose-again (Julien Gilli) https://github.com/nodejs/node/pull/3991 219 220<a id="0.12.10"></a> 221## 2016-02-09, Version 0.12.10 (LTS), @jasnell 222 223This is an important security release. All Node.js users should consult the security release summary at nodejs.org for details on patched vulnerabilities. 224 225### Notable changes 226 227* http: fix defects in HTTP header parsing for requests and responses that can allow request smuggling (CVE-2016-2086) or response splitting (CVE-2016-2216). HTTP header parsing now aligns more closely with the HTTP spec including restricting the acceptable characters. 228* http-parser: upgrade from 2.3.0 to 2.3.1 229* openssl: upgrade from 1.0.1q to 1.0.1r. To mitigate against the Logjam attack, TLS clients now reject Diffie-Hellman handshakes with parameters shorter than 1024-bits, up from the previous limit of 768-bits. 230* src: 231 * introduce new `--security-revert={cvenum}` command line flag for selective reversion of specific CVE fixes 232 * allow the fix for CVE-2016-2216 to be selectively reverted using `--security-revert=CVE-2016-2216` 233* build: 234 * xz compressed tar files will be made available from nodejs.org for v0.12 builds from v0.12.10 onward 235 * A headers.tar.gz file will be made available from nodejs.org for v0.12 builds from v0.12.10 onward, a future change to node-gyp will be required to make use of these 236 237### Commits 238 239* [[`4312848bff`](https://github.com/nodejs/node/commit/4312848bff) - build: enable xz compressed tarballs where possible (Rod Vagg) https://github.com/nodejs/node/pull/4894 240* [[`247626245c`](https://github.com/nodejs/node/commit/247626245c) - deps: upgrade openssl sources to 1.0.1r (Shigeki Ohtsu) https://github.com/joyent/node/pull/25368 241* [[`744c9749fc`](https://github.com/nodejs/node/commit/744c9749fc) - deps: update http-parser to version 2.3.1 (James M Snell) 242* [[`d1c56ec7d1`](https://github.com/nodejs/node/commit/d1c56ec7d1) - doc: clarify v0.12.9 notable items (Rod Vagg) https://github.com/nodejs/node/pull/4154 243* [[`e128d9a5b4`](https://github.com/nodejs/node/commit/e128d9a5b4) - http: strictly forbid invalid characters from headers (James M Snell) 244* [[`bdb9f2cf89`](https://github.com/nodejs/node/commit/bdb9f2cf89) - src: avoiding compiler warnings in node_revert.cc (James M Snell) 245* [[`23bced1fb3`](https://github.com/nodejs/node/commit/23bced1fb3) - src: add --security-revert command line flag (James M Snell) 246* [[`f41a3c73e7`](https://github.com/nodejs/node/commit/f41a3c73e7) - tools: backport tools/install.py for headers (Richard Lau) https://github.com/nodejs/node/pull/4149 247 248<a id="0.12.9"></a> 249## 2015-12-04, Version 0.12.9 (LTS), @rvagg 250 251Security Update 252 253### Notable changes 254 255* http: Fix CVE-2015-8027, a bug whereby an HTTP socket may no longer have a parser associated with it but a pipelined request attempts to trigger a pause or resume on the non-existent parser, a potential denial-of-service vulnerability. (Fedor Indutny) 256* openssl: Upgrade to 1.0.1q, fixes CVE-2015-3194 "Certificate verify crash with missing PSS parameter", a potential denial-of-service vector for Node.js TLS servers using client certificate authentication; TLS clients are also impacted. Details are available at <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis) https://github.com/nodejs/node/pull/4133 257 258### Commits 259 260* [[`8d24a14f2c`](https://github.com/nodejs/node/commit/8d24a14f2c) - deps: upgrade to openssl 1.0.1q (Ben Noordhuis) https://github.com/nodejs/node/pull/4133 261* [[`dfc6f4a9af`](https://github.com/nodejs/node/commit/dfc6f4a9af) - http: fix pipeline regression (Fedor Indutny) 262 263<a id="0.12.8"></a> 264## 2015.11.25, Version 0.12.8 (LTS), @rvagg 265 266* [[`d9399569bd`](https://github.com/nodejs/node/commit/d9399569bd) - build: backport tools/release.sh (Rod Vagg) https://github.com/nodejs/node/pull/3642 267* [[`78c5b4c8bd`](https://github.com/nodejs/node/commit/78c5b4c8bd) - build: backport config for new CI infrastructure (Rod Vagg) https://github.com/nodejs/node/pull/3642 268* [[`83441616a5`](https://github.com/nodejs/node/commit/83441616a5) - build: fix --without-ssl compile time error (Ben Noordhuis) https://github.com/nodejs/node/pull/3825 269* [[`8887666b0b`](https://github.com/nodejs/node/commit/8887666b0b) - build: update manifest to include Windows 10 (Lucien Greathouse) https://github.com/nodejs/node/pull/2843 270* [[`08afe4ec8e`](https://github.com/nodejs/node/commit/08afe4ec8e) - build: add MSVS 2015 support (Rod Vagg) https://github.com/nodejs/node/pull/2843 271* [[`4f2456369c`](https://github.com/nodejs/node/commit/4f2456369c) - build: work around VS2015 issue in ICU <56 (Steven R. Loomis) https://github.com/nodejs/node-v0.x-archive/pull/25804 272* [[`15030f26fd`](https://github.com/nodejs/node/commit/15030f26fd) - build: Intl: bump ICU4C from 54 to 55 (backport) (Steven R. Loomis) https://github.com/nodejs/node-v0.x-archive/pull/25856 273* [[`1083fa70f0`](https://github.com/nodejs/node/commit/1083fa70f0) - build: run-ci makefile rule (Alexis Campailla) https://github.com/nodejs/node-v0.x-archive/pull/25653 274* [[`2d2494cf14`](https://github.com/nodejs/node/commit/2d2494cf14) - build: support flaky tests in test-ci (Alexis Campailla) https://github.com/nodejs/node-v0.x-archive/pull/25653 275* [[`b25d26f2ef`](https://github.com/nodejs/node/commit/b25d26f2ef) - build: support Jenkins via test-ci (Alexis Campailla) https://github.com/nodejs/node-v0.x-archive/pull/25653 276* [[`7e4b47f38a`](https://github.com/nodejs/node/commit/7e4b47f38a) - build,win: fix node.exe resource version (João Reis) https://github.com/nodejs/node/pull/3053 277* [[`e07c86e240`](https://github.com/nodejs/node/commit/e07c86e240) - build,win: try next MSVS version on failure (João Reis) https://github.com/nodejs/node/pull/2843 278* [[`b5a0abcfdf`](https://github.com/nodejs/node/commit/b5a0abcfdf) - child_process: clone spawn options argument (cjihrig) https://github.com/nodejs/node-v0.x-archive/pull/9159 279* [[`8b81f98c41`](https://github.com/nodejs/node/commit/8b81f98c41) - configure: add --without-mdb flag (cgalibern) https://github.com/nodejs/node-v0.x-archive/pull/25707 280* [[`071c860c2b`](https://github.com/nodejs/node/commit/071c860c2b) - crypto: replace rwlocks with simple mutexes (Ben Noordhuis) https://github.com/nodejs/node/pull/2723 281* [[`ca97fb6be3`](https://github.com/nodejs/node/commit/ca97fb6be3) - deps: upgrade npm to 2.14.9 (Forrest L Norvell) https://github.com/nodejs/node/pull/3684 282* [[`583734342e`](https://github.com/nodejs/node/commit/583734342e) - deps: fix openssl for MSVS 2015 (Andy Polyakov) https://github.com/nodejs/node/pull/2843 283* [[`02c262a4c6`](https://github.com/nodejs/node/commit/02c262a4c6) - deps: fix gyp to work on MacOSX without XCode (Shigeki Ohtsu) https://github.com/nodejs/node/pull/2843 284* [[`f0fba0bce8`](https://github.com/nodejs/node/commit/f0fba0bce8) - deps: update gyp to 25ed9ac (João Reis) https://github.com/nodejs/node/pull/2843 285* [[`f693565813`](https://github.com/nodejs/node/commit/f693565813) - deps: upgrade to npm 2.13.4 (Kat Marchán) https://github.com/nodejs/node-v0.x-archive/pull/25825 286* [[`618b142679`](https://github.com/nodejs/node/commit/618b142679) - deps,v8: fix compilation in VS2015 (João Reis) https://github.com/nodejs/node/pull/2843 287* [[`49b4f0d54e`](https://github.com/nodejs/node/commit/49b4f0d54e) - doc: backport README.md (Rod Vagg) https://github.com/nodejs/node/pull/3642 288* [[`2860c53562`](https://github.com/nodejs/node/commit/2860c53562) - doc: fixed child_process.exec doc (Tyler Anton) https://github.com/nodejs/node-v0.x-archive/pull/14088 289* [[`4a91fa11a3`](https://github.com/nodejs/node/commit/4a91fa11a3) - doc: Update docs for os.platform() (George Kotchlamazashvili) https://github.com/nodejs/node-v0.x-archive/pull/25777 290* [[`b03ab02fe8`](https://github.com/nodejs/node/commit/b03ab02fe8) - doc: Change the link for v8 docs to v8dox.com (Chad Walker) https://github.com/nodejs/node-v0.x-archive/pull/25811 291* [[`1fd8f37efd`](https://github.com/nodejs/node/commit/1fd8f37efd) - doc: buffer, adding missing backtick (Dyana Rose) https://github.com/nodejs/node-v0.x-archive/pull/25811 292* [[`162d0db3bb`](https://github.com/nodejs/node/commit/162d0db3bb) - doc: tls.markdown, adjust version from v0.10.39 to v0.10.x (James M Snell) https://github.com/nodejs/node-v0.x-archive/pull/25591 293* [[`eda2560cdc`](https://github.com/nodejs/node/commit/eda2560cdc) - doc: additional refinement to readable event (James M Snell) https://github.com/nodejs/node-v0.x-archive/pull/25591 294* [[`881d9bea01`](https://github.com/nodejs/node/commit/881d9bea01) - doc: readable event clarification (James M Snell) https://github.com/nodejs/node-v0.x-archive/pull/25591 295* [[`b6378f0c75`](https://github.com/nodejs/node/commit/b6378f0c75) - doc: stream.unshift does not reset reading state (James M Snell) https://github.com/nodejs/node-v0.x-archive/pull/25591 296* [[`4952e2b4d2`](https://github.com/nodejs/node/commit/4952e2b4d2) - doc: clarify Readable._read and Readable.push (fresheneesz) https://github.com/nodejs/node-v0.x-archive/pull/25591 297* [[`14000b97d4`](https://github.com/nodejs/node/commit/14000b97d4) - doc: two minor stream doc improvements (James M Snell) https://github.com/nodejs/node-v0.x-archive/pull/25591 298* [[`6b6bd21497`](https://github.com/nodejs/node/commit/6b6bd21497) - doc: Clarified read method with specified size argument. (Philippe Laferriere) https://github.com/nodejs/node-v0.x-archive/pull/25591 299* [[`16f547600a`](https://github.com/nodejs/node/commit/16f547600a) - doc: Document http.request protocol option (Ville Skyttä) https://github.com/nodejs/node-v0.x-archive/pull/25591 300* [[`618e4ecda9`](https://github.com/nodejs/node/commit/618e4ecda9) - doc: add a note about readable in flowing mode (James M Snell) https://github.com/nodejs/node-v0.x-archive/pull/25591 301* [[`0b165be37b`](https://github.com/nodejs/node/commit/0b165be37b) - doc: fix line wrapping in buffer.markdown (James M Snell) https://github.com/nodejs/node-v0.x-archive/pull/25591 302* [[`70dd13f88d`](https://github.com/nodejs/node/commit/70dd13f88d) - doc: add CleartextStream deprecation notice (James M Snell) https://github.com/nodejs/node-v0.x-archive/pull/25591 303* [[`418cde0765`](https://github.com/nodejs/node/commit/418cde0765) - doc: mention that mode is ignored if file exists (James M Snell) https://github.com/nodejs/node-v0.x-archive/pull/25591 304* [[`85bcb281e4`](https://github.com/nodejs/node/commit/85bcb281e4) - doc: improve http.abort description (James M Snell) https://github.com/nodejs/node-v0.x-archive/pull/25591 305* [[`5ccb429ee8`](https://github.com/nodejs/node/commit/5ccb429ee8) - doc, comments: Grammar and spelling fixes (Ville Skyttä) https://github.com/nodejs/node-v0.x-archive/pull/25591 306* [[`a24db43101`](https://github.com/nodejs/node/commit/a24db43101) - docs: event emitter behavior notice (Samuel Mills (Henchman)) https://github.com/nodejs/node-v0.x-archive/pull/25467 307* [[`8cbf7cb021`](https://github.com/nodejs/node/commit/8cbf7cb021) - docs: events clarify emitter.listener() behavior (Benjamin Steephenson) https://github.com/nodejs/node-v0.x-archive/pull/25591 308* [[`b7229debbe`](https://github.com/nodejs/node/commit/b7229debbe) - docs: Fix default options for fs.createWriteStream() (Chris Neave) https://github.com/nodejs/node-v0.x-archive/pull/25591 309* [[`f0453caea2`](https://github.com/nodejs/node/commit/f0453caea2) - domains: port caeb677 from v0.10 to v0.12 (Jeremy Whitlock) https://github.com/nodejs/node-v0.x-archive/pull/25835 310* [[`261fa3620f`](https://github.com/nodejs/node/commit/261fa3620f) - src: fix intermittent SIGSEGV in resolveTxt (Evan Lucas) https://github.com/nodejs/node-v0.x-archive/pull/9300 311* [[`1f7257b02d`](https://github.com/nodejs/node/commit/1f7257b02d) - test: mark test-https-aws-ssl flaky on linux (João Reis) https://github.com/nodejs/node-v0.x-archive/pull/25893 312* [[`cf435d55db`](https://github.com/nodejs/node/commit/cf435d55db) - test: mark test-signal-unregister as flaky (Alexis Campailla) https://github.com/nodejs/node-v0.x-archive/pull/25750 313* [[`ceb6a8c131`](https://github.com/nodejs/node/commit/ceb6a8c131) - test: fix test-debug-port-from-cmdline (João Reis) https://github.com/nodejs/node-v0.x-archive/pull/25748 314* [[`22997731e6`](https://github.com/nodejs/node/commit/22997731e6) - test: add regression test for #25735 (Fedor Indutny) https://github.com/nodejs/node-v0.x-archive/pull/25739 315* [[`39e05639f4`](https://github.com/nodejs/node/commit/39e05639f4) - test: mark http-pipeline-flood flaky on win32 (Julien Gilli) https://github.com/nodejs/node-v0.x-archive/pull/25707 316* [[`78d256e7f5`](https://github.com/nodejs/node/commit/78d256e7f5) - test: unmark tests that are no longer flaky (João Reis) https://github.com/nodejs/node-v0.x-archive/pull/25676 317* [[`a9b642cf5b`](https://github.com/nodejs/node/commit/a9b642cf5b) - test: runner should return 0 on flaky tests (Alexis Campailla) https://github.com/nodejs/node-v0.x-archive/pull/25653 318* [[`b48639befd`](https://github.com/nodejs/node/commit/b48639befd) - test: support writing test output to file (Alexis Campailla) https://github.com/nodejs/node-v0.x-archive/pull/25653 319* [[`caa16b41d6`](https://github.com/nodejs/node/commit/caa16b41d6) - (SEMVER-MINOR) tls: prevent server from using dhe keys < 768 (Michael Dawson) https://github.com/nodejs/node/pull/3890 320* [[`0363cf4a80`](https://github.com/nodejs/node/commit/0363cf4a80) - tls: Closing parent socket also closes the tls sock (Devin Nakamura) https://github.com/nodejs/node-v0.x-archive/pull/25642 321* [[`75697112e8`](https://github.com/nodejs/node/commit/75697112e8) - tls: do not hang without `newSession` handler (Fedor Indutny) https://github.com/nodejs/node-v0.x-archive/pull/25739 322* [[`d998a65058`](https://github.com/nodejs/node/commit/d998a65058) - tools: pass constant to logger instead of string (Johan Bergström) https://github.com/nodejs/node-v0.x-archive/pull/25653 323* [[`1982ed6e63`](https://github.com/nodejs/node/commit/1982ed6e63) - v8: port fbff705 from v0.10 to v0.12 (Jeremy Whitlock) https://github.com/nodejs/node-v0.x-archive/pull/25835 324* [[`44d7054252`](https://github.com/nodejs/node/commit/44d7054252) - win: fix custom actions for WiX older than 3.9 (João Reis) https://github.com/nodejs/node/pull/2843 325* [[`586c4d8b8e`](https://github.com/nodejs/node/commit/586c4d8b8e) - win: fix custom actions on Visual Studio != 2013 (Julien Gilli) https://github.com/nodejs/node/pull/2843 326* [[`14db629497`](https://github.com/nodejs/node/commit/14db629497) - win,msi: correct installation path registry keys (João Reis) https://github.com/nodejs/node-v0.x-archive/pull/25640 327* [[`8e80528453`](https://github.com/nodejs/node/commit/8e80528453) - win,msi: change InstallScope to perMachine (João Reis) https://github.com/nodejs/node-v0.x-archive/pull/25640 328* [[`35bbe98401`](https://github.com/nodejs/node/commit/35bbe98401) - Update addons.markdown (Max Deepfield) https://github.com/nodejs/node-v0.x-archive/pull/25885 329* [[`9a6f1ce416`](https://github.com/nodejs/node/commit/9a6f1ce416) - comma (Julien Valéry) https://github.com/nodejs/node-v0.x-archive/pull/25811 330* [[`d384bf8f84`](https://github.com/nodejs/node/commit/d384bf8f84) - Update assert.markdown (daveboivin) https://github.com/nodejs/node-v0.x-archive/pull/25811 331* [[`89b22ccbe1`](https://github.com/nodejs/node/commit/89b22ccbe1) - Fixed typo (Andrew Murray) https://github.com/nodejs/node-v0.x-archive/pull/25811 332* [[`5ad05af380`](https://github.com/nodejs/node/commit/5ad05af380) - Update util.markdown (Daniel Rentz) https://github.com/nodejs/node-v0.x-archive/pull/25591 333* [[`cb660ab3d3`](https://github.com/nodejs/node/commit/cb660ab3d3) - Update child_process.markdown, spelling (Jared Fox) https://github.com/nodejs/node-v0.x-archive/pull/25591 334* [[`59c67fe3cd`](https://github.com/nodejs/node/commit/59c67fe3cd) - updated documentation for fs.createReadStream (Michele Caini) https://github.com/nodejs/node-v0.x-archive/pull/25591 335* [[`53b6a615a5`](https://github.com/nodejs/node/commit/53b6a615a5) - Documentation update about Buffer initialization (Sarath) https://github.com/nodejs/node-v0.x-archive/pull/25591 336* [[`b8d47a7b6f`](https://github.com/nodejs/node/commit/b8d47a7b6f) - fix (Fedor Indutny) https://github.com/nodejs/node-v0.x-archive/pull/25739 337 338<a id="0.12.7"></a> 339## 2015-07-09, Version 0.12.7 (Stable) 340 341### Commits 342 343* [[`0cf9f27703`](https://github.com/nodejs/node/commit/0cf9f27703)] - **deps**: upgrade openssl sources to 1.0.1p [#25654](https://github.com/joyent/node/pull/25654) 344* [[`8917e430b8`](https://github.com/nodejs/node/commit/8917e430b8)] - **deps**: upgrade to npm 2.11.3 [#25545](https://github.com/joyent/node/pull/25545) 345* [[`88a27a9621`](https://github.com/nodejs/node/commit/88a27a9621)] - **V8**: cherry-pick JitCodeEvent patch from upstream (Ben Noordhuis) [#25589](https://github.com/joyent/node/pull/25589) 346* [[`18d413d299`](https://github.com/nodejs/node/commit/18d413d299)] - **win,msi**: create npm folder in AppData directory (Steven Rockarts) [#8838](https://github.com/joyent/node/pull/8838) 347 348<a id="0.12.6"></a> 349## 2015-07-03, Version 0.12.6 (Stable) 350 351### Notable changes 352 353* **deps**: Fixed an out-of-band write in utf8 decoder. **This is an important security update** as it can be used to cause a denial of service attack. 354 355### Commits 356 357* [[`78b0e30954`](https://github.com/nodejs/node/commit/78b0e30954)] - **deps**: fix out-of-band write in utf8 decoder (Fedor Indutny) 358 359<a id="0.12.5"></a> 360## 2015-06-22, Version 0.12.5 (Stable) 361 362### Commits 363 364* [[`456c22f63f`](https://github.com/nodejs/node/commit/456c22f63f)] - **openssl**: upgrade to 1.0.1o (Addressing multiple CVEs) [#25523](https://github.com/joyent/node/pull/25523) 365* [[`20d8db1a42`](https://github.com/nodejs/node/commit/20d8db1a42)] - **npm**: upgrade to 2.11.2 [#25517](https://github.com/joyent/node/pull/25517) 366* [[`50f961596d`](https://github.com/nodejs/node/commit/50f961596d)] - **uv**: upgrade to 1.6.1 [#25475](https://github.com/joyent/node/pull/25475) 367* [[`b81a643f9a`](https://github.com/nodejs/node/commit/b81a643f9a)] - **V8**: avoid deadlock when profiling is active (Dmitri Melikyan) [#25309](https://github.com/joyent/node/pull/25309) 368* [[`9d19dfbfdb`](https://github.com/nodejs/node/commit/9d19dfbfdb)] - **install**: fix source path for openssl headers (Oguz Bastemur) [#14089](https://github.com/joyent/node/pull/14089) 369* [[`4028669531`](https://github.com/nodejs/node/commit/4028669531)] - **install**: make sure opensslconf.h is overwritten (Oguz Bastemur) [#14089](https://github.com/joyent/node/pull/14089) 370* [[`d38e865fce`](https://github.com/nodejs/node/commit/d38e865fce)] - **timers**: fix timeout when added in timer's callback (Julien Gilli) [#17203](https://github.com/joyent/node/pull/17203) 371* [[`e7c84f82c7`](https://github.com/nodejs/node/commit/e7c84f82c7)] - **windows**: broadcast WM_SETTINGCHANGE after install (Mathias Küsel) [#25100](https://github.com/joyent/node/pull/25100) 372 373<a id="0.12.4"></a> 374## 2015-05-22, Version 0.12.4 (Stable) 375 376### Commits 377 378* [[`202c18bbc3`](https://github.com/nodejs/node/commit/202c18bbc3)] - **npm**: upgrade to 2.10.1 [#25364](https://github.com/joyent/node/pull/25364) 379* [[`6157697bd5`](https://github.com/nodejs/node/commit/6157697bd5)] - **V8**: revert v8 Array.prototype.values() removal (cjihrig) [#25328](https://github.com/joyent/node/pull/25328) 380* [[`3122052890`](https://github.com/nodejs/node/commit/3122052890)] - **win**: bring back xp/2k3 support (Bert Belder) [#25367](https://github.com/joyent/node/pull/25367) 381 382<a id="0.12.3"></a> 383## 2015-05-13, Version 0.12.3 (Stable) 384 385### Commits 386 387* [[`32166a90cf`](https://github.com/nodejs/node/commit/32166a90cf)] - **V8**: update to 3.28.71.19 [#18206](https://github.com/joyent/node/pull/18206) 388* [[`84f1ab6114`](https://github.com/nodejs/node/commit/84f1ab6114)] - **uv**: upgrade to 1.5.0 [#25141](https://github.com/joyent/node/pull/25141) 389* [[`03cfbd65fb`](https://github.com/nodejs/node/commit/03cfbd65fb)] - **npm**: upgrade to 2.9.1 [#25289](https://github.com/joyent/node/pull/25289) 390* [[`80cdae855f`](https://github.com/nodejs/node/commit/80cdae855f)] - **V8**: don't busy loop in v8 cpu profiler thread (Mike Tunnicliffe) [#25268](https://github.com/joyent/node/pull/25268) 391* [[`2a5f4bd7ce`](https://github.com/nodejs/node/commit/2a5f4bd7ce)] - **V8**: fix issue with let bindings in for loops (adamk) [#23948](https://github.com/joyent/node/pull/23948) 392* [[`f0ef597e09`](https://github.com/nodejs/node/commit/f0ef597e09)] - **debugger**: don't spawn child process in remote mode (Jackson Tian) [#14172](https://github.com/joyent/node/pull/14172) 393* [[`0e392f3b68`](https://github.com/nodejs/node/commit/0e392f3b68)] - **net**: do not set V4MAPPED on FreeBSD (Julien Gilli) [#18204](https://github.com/joyent/node/pull/18204) 394* [[`101e103e3b`](https://github.com/nodejs/node/commit/101e103e3b)] - **repl**: make 'Unexpected token' errors recoverable (Julien Gilli) [#8875](https://github.com/joyent/node/pull/8875) 395* [[`d5b32246fb`](https://github.com/nodejs/node/commit/d5b32246fb)] - **src**: backport ignore ENOTCONN on shutdown race (Ben Noordhuis) [#14480](https://github.com/joyent/node/pull/14480) 396* [[`f99eaefe75`](https://github.com/nodejs/node/commit/f99eaefe75)] - **src**: fix backport of SIGINT crash fix on FreeBSD (Julien Gilli) [#14819](https://github.com/joyent/node/pull/14819) 397 398<a id="0.12.2"></a> 399## 2015-03-31, Version 0.12.2 (Stable) 400 401### Commits 402 403* [[`7a37910f25`](https://github.com/nodejs/node/commit/7a37910f25)] - **uv**: Upgrade to 1.4.2 [#9179](https://github.com/joyent/node/pull/9179) 404* [[`2704c62933`](https://github.com/nodejs/node/commit/2704c62933)] - **npm**: Upgrade to 2.7.4 [#14180](https://github.com/joyent/node/pull/14180) 405* [[`a103712a62`](https://github.com/nodejs/node/commit/a103712a62)] - **V8**: do not add extra newline in log file (Julien Gilli) 406* [[`2fc5eeb3da`](https://github.com/nodejs/node/commit/2fc5eeb3da)] - **V8**: Fix --max_old_space_size=4096 integer overflow (Andrei Sedoi) [#9200](https://github.com/joyent/node/pull/9200) 407* [[`605329d7f7`](https://github.com/nodejs/node/commit/605329d7f7)] - **asyncwrap**: fix constructor condition for early ret (Trevor Norris) [#9146](https://github.com/joyent/node/pull/9146) 408* [[`a33f23cbbc`](https://github.com/nodejs/node/commit/a33f23cbbc)] - **buffer**: align chunks on 8-byte boundary (Fedor Indutny) [#9375](https://github.com/joyent/node/pull/9375) 409* [[`a35ba2f67d`](https://github.com/nodejs/node/commit/a35ba2f67d)] - **buffer**: fix pool offset adjustment (Trevor Norris) 410* [[`c0766eb1a4`](https://github.com/nodejs/node/commit/c0766eb1a4)] - **build**: fix use of strict aliasing (Trevor Norris) [#9179](https://github.com/joyent/node/pull/9179) 411* [[`6c3647c38d`](https://github.com/nodejs/node/commit/6c3647c38d)] - **console**: allow Object.prototype fields as labels (Colin Ihrig) [#9116](https://github.com/joyent/node/pull/9116) 412* [[`4823afcbe2`](https://github.com/nodejs/node/commit/4823afcbe2)] - **fs**: make F_OK/R_OK/W_OK/X_OK not writable (Jackson Tian) [#9060](https://github.com/joyent/node/pull/9060) 413* [[`b3aa876f08`](https://github.com/nodejs/node/commit/b3aa876f08)] - **fs**: properly handle fd passed to truncate() (Bruno Jouhier) [#9161](https://github.com/joyent/node/pull/9161) 414* [[`d6484f3f7b`](https://github.com/nodejs/node/commit/d6484f3f7b)] - **http**: fix assert on data/end after socket error (Fedor Indutny) [#14087](https://github.com/joyent/node/pull/14087) 415* [[`04b63e022a`](https://github.com/nodejs/node/commit/04b63e022a)] - **lib**: fix max size check in Buffer constructor (Ben Noordhuis) [#657](https://github.com/iojs/io.js/pull/657) 416* [[`2411bea0df`](https://github.com/nodejs/node/commit/2411bea0df)] - **lib**: fix stdio/ipc sync i/o regression (Ben Noordhuis) [#9179](https://github.com/joyent/node/pull/9179) 417* [[`b8604fa480`](https://github.com/nodejs/node/commit/b8604fa480)] - **module**: replace NativeModule.require (Herbert Vojčík) [#9201](https://github.com/joyent/node/pull/9201) 418* [[`1a2a4dac23`](https://github.com/nodejs/node/commit/1a2a4dac23)] - **net**: allow port 0 in connect() (cjihrig) [#9268](https://github.com/joyent/node/pull/9268) 419* [[`bada87bd66`](https://github.com/nodejs/node/commit/bada87bd66)] - **net**: unref timer in parent sockets (Fedor Indutny) [#891](https://github.com/iojs/io.js/pull/891) 420* [[`c66f8c21f0`](https://github.com/nodejs/node/commit/c66f8c21f0)] - **path**: refactor for performance and consistency (Nathan Woltman) [#9289](https://github.com/joyent/node/pull/9289) 421* [[`9deade4322`](https://github.com/nodejs/node/commit/9deade4322)] - **smalloc**: extend user API (Trevor Norris) [#905](https://github.com/iojs/io.js/pull/905) 422* [[`61fe1fe21b`](https://github.com/nodejs/node/commit/61fe1fe21b)] - **src**: fix for SIGINT crash on FreeBSD (Fedor Indutny) [#14184](https://github.com/joyent/node/pull/14184) 423* [[`b233131901`](https://github.com/nodejs/node/commit/b233131901)] - **src**: fix builtin modules failing with --use-strict (Julien Gilli) [#9237](https://github.com/joyent/node/pull/9237) 424* [[`7e9d2f8de8`](https://github.com/nodejs/node/commit/7e9d2f8de8)] - **watchdog**: fix timeout for early polling return (Saúl Ibarra Corretgé) [#9410](https://github.com/joyent/node/pull/9410) 425 426<a id="0.12.1"></a> 427## 2015-03-23, Version 0.12.1 (Stable) 428 429### Commits 430 431* [[`3b511a8ccd`](https://github.com/nodejs/node/commit/3b511a8ccd)] - **openssl**: upgrade to 1.0.1m (Addressing multiple CVES) 432 433<a id="0.12.0"></a> 434## 2015-02-06, Version 0.12.0 (Stable) 435 436### Commits 437 438* [[`087a7519ce`](https://github.com/nodejs/node/commit/087a7519ce)] - **npm**: Upgrade to 2.5.1 439* [[`4312f8d760`](https://github.com/nodejs/node/commit/4312f8d760)] - **mdb_v8**: update for v0.12 (Dave Pacheco) 440