2019-12-17, Version 13.4.0 (Current)

This is a security release.

For more details about the vulnerability please consult the npm blog:

https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli

Notable Changes:
* deps:
  * update npm to 6.13.4
    #30904
  * update uvwasi (Anna Henningsen)
    #30745
  * upgrade to libuv 1.34.0 (Colin Ihrig)
    #30783
* doc:
  * docs deprecate http finished (Robert Nagy)
    #28679
* events:
  * add captureRejection option (Matteo Collina)
    #27867
* http:
  * add captureRejection support (Matteo Collina)
    #27867
  * llhttp opt-in insecure HTTP header parsing (Sam Roberts)
    #30567
* http2:
  * implement capture rection for 'request' and 'stream' events (Matteo Collina)
    #27867
* net:
  * implement capture rejections for 'connection' event (Matteo Collina)
    #27867
* repl:
  * support previews by eager evaluating input (Ruben Bridgewater)
    #30811
* stream:
  * add support for captureRejection option (Matteo Collina)
    #27867
* tls:
  * implement capture rejections for 'secureConnection' event (Matteo Collina)
    #27867
  * expose IETF name for current cipher suite (Sam Roberts)
    #30637
* worker:
  * add argv constructor option (legendecas)
    #30559

PR-URL: #30937

CHANGELOG.md

@@ -30,7 +30,8 @@ release.
 </tr>
 <tr>
     <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V13.md#13.3.0">13.3.0</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V13.md#13.4.0">13.4.0</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V13.md#13.3.0">13.3.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V13.md#13.2.0">13.2.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V13.md#13.1.0">13.1.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V13.md#13.0.1">13.0.1</a><br/>

doc/api/cli.md

@@ -211,7 +211,7 @@ itself.
 
 ### `--experimental-specifier-resolution=mode`
 <!-- YAML
-added: REPLACEME
+added: v13.4.0
 -->
 
 Sets the resolution algorithm for resolving ES module specifiers. Valid options
@@ -421,7 +421,7 @@ Specify the `module` of a custom [experimental ECMAScript Module loader][].
 
 ### `--insecure-http-parser`
 <!-- YAML
-added: REPLACEME
+added: v13.4.0
 -->
 
 Use an insecure HTTP parser that accepts invalid HTTP headers. This may allow

doc/api/deprecations.md

@@ -2552,7 +2552,7 @@ and [`fs.createReadStream()`][]) or by passing a file descriptor in options.
 ### DEP0136: http finished
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v13.4.0
     pr-url: https://github.com/nodejs/node/pull/28679
     description: Documentation-only deprecation.
 -->

doc/api/events.md

@@ -212,7 +212,7 @@ recommendation is to **not use `async` functions as `'error'` event handlers**.
 <!-- YAML
 added: v0.1.26
 changes:
-  - version: REPLACEME
+  - version: v13.4.0
     pr-url: https://github.com/nodejs/node/pull/27867
     description: Added captureRejections option.
 -->
@@ -759,7 +759,7 @@ emitter.emit('log');
 
 ### emitter\[Symbol.for('nodejs.rejection')\](err, eventName\[, ...args\])
 <!-- YAML
-added: REPLACEME
+added: v13.4.0
 -->
 
 > Stability: 1 - captureRejections is experimental.
@@ -841,7 +841,7 @@ run();
 
 ## events.captureRejections
 <!-- YAML
-added: REPLACEME
+added: v13.4.0
 -->
 
 > Stability: 1 - captureRejections is experimental.
@@ -852,7 +852,7 @@ Change the default `captureRejections` option on all new `EventEmitter` objects.
 
 ## events.captureRejectionSymbol
 <!-- YAML
-added: REPLACEME
+added: v13.4.0
 -->
 
 > Stability: 1 - captureRejections is experimental.

doc/api/http.md

@@ -623,7 +623,7 @@ is finished.
 ### request.finished
 <!-- YAML
 added: v0.0.1
-deprecated: REPLACEME
+deprecated: v13.4.0
 -->
 
 > Stability: 0 - Deprecated. Use [`request.writableEnded`][].
@@ -1308,7 +1308,7 @@ is finished.
 ### response.finished
 <!-- YAML
 added: v0.0.2
-deprecated: REPLACEME
+deprecated: v13.4.0
 -->
 
 > Stability: 0 - Deprecated. Use [`response.writableEnded`][].

doc/api/http2.md

@@ -3075,7 +3075,7 @@ is finished.
 #### response.finished
 <!-- YAML
 added: v8.4.0
-deprecated: REPLACEME
+deprecated: v13.4.0
 -->
 
 > Stability: 0 - Deprecated. Use [`response.writableEnded`][].

doc/api/repl.md

@@ -510,7 +510,7 @@ with REPL instances programmatically.
 <!-- YAML
 added: v0.1.91
 changes:
-  - version: REPLACEME
+  - version: v13.4.0
     pr-url: https://github.com/nodejs/node/pull/30811
     description: The `preview` option is now available.
   - version: v12.0.0

doc/api/tls.md

@@ -827,7 +827,7 @@ changes:
     pr-url: https://github.com/nodejs/node/pull/26625
     description: Return the minimum cipher version, instead of a fixed string
       (`'TLSv1/SSLv3'`).
-  - version: REPLACEME
+  - version: v13.4.0
     pr-url: https://github.com/nodejs/node/pull/30637
     description: Return the IETF cipher name as `standardName`.
 -->

doc/api/worker_threads.md

@@ -510,7 +510,7 @@ changes:
   - version: v13.2.0
     pr-url: https://github.com/nodejs/node/pull/26628
     description: The `resourceLimits` option was introduced.
-  - version: REPLACEME
+  - version: v13.4.0
     pr-url: https://github.com/nodejs/node/pull/30559
     description: The `argv` option was introduced.
 -->