node.js-16.16.0

[Bruce Dubbs]

New minor version.

[ken@…]

List of CVEs is at ​https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/

I'm currently catching up with a backlog of security updates on my older systems, so I decided to take a look at this.

I only run the tests if editing, but I see that at the moment we say "To test the results, issue: make test-only. Three tests out of over 3500 are known to fail."

For my initial "does it build and look ok?" run I'm on 11.1. I've logged the the output from test-only, and I can see a breakdown of 136 tests from 21 test suites in the main run (all passed) and then at the end (make tooltest) it ran 6 tests in 0.001s. Am I missing something about the number of tests ?

[Douglas R. Reno]

2022-07-07, Version 16.16.0 'Gallium' (LTS), @danielleadams

This is a security release.
Notable changes

    deps:
        upgrade openssl sources to OpenSSL_1_1_1q
    src:
        add OpenSSL config appname

Commits

    [2303fd3fe5] - deps: update archs files for OpenSSL-1.1.1q
    [b219a63c28] - deps: upgrade openssl sources to OpenSSL_1_1_1q
    [c6553a4ef5] - deps: update archs files for OpenSSL-1.1.1p+quic
    [e9084a3e90] - deps: upgrade openssl sources to OpenSSL_1_1_1p+quic
    [1da22eb482] - http: stricter Transfer-Encoding and header separator parsing
    [754c9bfde0] - src: fix IPv4 validation in inspector_socket
    [447cf680b0] - (SEMVER-MAJOR) src,deps,build,test: add OpenSSL config appname 

[Douglas R. Reno]

Replying to ken@…:

List of CVEs is at ​https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/

I'm currently catching up with a backlog of security updates on my older systems, so I decided to take a look at this.

I only run the tests if editing, but I see that at the moment we say "To test the results, issue: make test-only. Three tests out of over 3500 are known to fail."

For my initial "does it build and look ok?" run I'm on 11.1. I've logged the the output from test-only, and I can see a breakdown of 136 tests from 21 test suites in the main run (all passed) and then at the end (make tooltest) it ran 6 tests in 0.001s. Am I missing something about the number of tests ?

Hi Ken,

Can you email me a copy of your test output?

For me, it seems to work as expected:

if [ ! -r node ]

[ ! -L node ]; then \

ln -fs out/Release/node node; fi

/usr/bin/python3.10 tools/test.py --mode=release \

\

--skip-tests= \ default \ addons js-native-api node-api

[04:27|% 100|+ 35120]: Done

make tooltest

For now I'm going to proceed with dropping this in because it's a security update and no tests failed for me, but let's re-examine this later

[ken@…]

Replying to Douglas R. Reno:

Replying to ken@…:

List of CVEs is at ​https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/

I'm currently catching up with a backlog of security updates on my older systems, so I decided to take a look at this.

I only run the tests if editing, but I see that at the moment we say "To test the results, issue: make test-only. Three tests out of over 3500 are known to fail."

For my initial "does it build and look ok?" run I'm on 11.1. I've logged the the output from test-only, and I can see a breakdown of 136 tests from 21 test suites in the main run (all passed) and then at the end (make tooltest) it ran 6 tests in 0.001s. Am I missing something about the number of tests ?

Hi Ken,

Can you email me a copy of your test output?

For me, it seems to work as expected:

if [ ! -r node ]

[ ! -L node ]; then \

ln -fs out/Release/node node; fi

/usr/bin/python3.10 tools/test.py --mode=release \

\

--skip-tests= \ default \ addons js-native-api node-api

[04:27|% 100|+ 35120]: Done

make tooltest

For now I'm going to proceed with dropping this in because it's a security update and no tests failed for me, but let's re-examine this later

I no-longer have the log. With no guidance about what to look for, I just looked at all the results and saw no reported failures. So I looked through the detail. That line you have quoted was, I think, offscreen when I looked at the end of the output and I had to go back to find that tooltest was being made for the 6 tests.

If I'd known to look for those details in the line above I'm sure I would have realised that over 3500 tests were run.

All testsuites tend to have their own weirdnesses. Maybe I knew this once, maybe it was more obvious when tests failed.

[Douglas R. Reno]

Fixed at c2051dbdc3e3503fa3faf7a9eae818f39ecabf8e