The release of Node.js 17.0 has taken place, a platform for running network applications in JavaScript. Node.js 17.0 is part of the regular support branch, with updates scheduled until June 2022. The stabilization of the Node.js 16 branch will be completed in the coming days, which will receive LTS status and be supported until April 2024. Support for the previous LTS branch Node.js 14.0 will continue until April 2023, while the older LTS branch 12.0 will be supported until April 2022.
Key Improvements:
- The V8 engine has been updated to version 9.5.
- Продолжена реализация вариантов базового API, основанных на использовании интерфейса асинхронных вычислений Promise. В дополнение к ранее предложенным API Timers Promises и Streams Promises в Node.js 17.0 представлен API Readline Promise для построчного чтения данных с использованием модуля readline. import * as readline from ‘node:readline/promises’; import { stdin as input, stdout as output } from ‘process’; const rl = readline.createInterface({ input, output }); const answer = await rl.question(‘What do you think of Node.js?’); console.log(‘Thank you for your valuable feedback: ${answer}’); rl.close();
- The included OpenSSL library has been updated to version 3.0 (using the quictls/openssl fork with QUIC protocol support enabled).
- Version output for Node.js has been ensured in stack traces generated in the event of fatal errors that lead to application termination.
Additionally, it is worth mentioning the resolution of two vulnerabilities (CVE-2021-22959, CVE-2021-22960) in the current Node.js branches, which enable HTTP Request Smuggling (HRS) attacks, allowing specially crafted client requests to inject into the content of other users' requests processed in the same thread between the front end and back end (for instance, this can lead to malicious JavaScript code being injected into another user's session). Details will be disclosed later, but it is known that the issues are caused by improper handling of spaces between the HTTP header name and the colon, as well as differing handling of carriage return and line feed characters in the parameter block used for sending the body of the request in
Note that the Node.js platform can be used for both server-side maintenance of web applications and for creating standard client and server network programs. A large collection of modules has been prepared to extend the functionality of Node.js applications, which includes modules with implementations servers and clients for HTTP, SMTP, XMPP, DNS, FTP, IMAP, POP3, modules for integration with various web frameworks, WebSocket and Ajax handlers, connectors to databases (MySQL, PostgreSQL, SQLite, MongoDB), templating engines, CSS engines, implementations of cryptographic algorithms and authorization systems (OAuth), XML parsers.
To handle a large number of parallel requests, Node.js utilizes an asynchronous code execution model based on event-driven non-blocking I/O and the definition of callback handlers. Multiplexing methods such as epoll, kqueue, /dev/poll, and select are supported for connection multiplexing. The libuv library is used for connection multiplexing, which is a wrapper around libev on Unix systems and IOCP on Windows. The libeio library is employed to create a thread pool, while c-ares is integrated for non-blocking DNS requests. All blocking system calls are executed within the thread pool, and like signal handlers, they pass their results back through an unnamed pipe. JavaScript code execution is ensured through the use of the V8 engine developed by Google (additionally, Microsoft develops a version of Node.js with the Chakra-Core engine).
Essentially, Node.js is similar to the Perl AnyEvent, Ruby Event Machine, Python Twisted frameworks, and the event handling implementation in Tcl, but the event loop in Node.js is abstracted away from the developer and resembles the event processing in a web application running in a browser. When developing applications for Node.js, it is crucial to consider the specifics of event-driven programming. For example, instead of executing "var result = db.query('select...');" and waiting for its completion before processing the results, Node.js employs asynchronous execution, meaning the code is transformed into "db.query('select...', function (result) {process result});" allowing control to pass immediately to the subsequent code, with the query results processed as data arrives.
Source: opennet.ru
