The Node.js project maintains multiple types of releases:
- Current: Released from active development branches of this repository, versioned by SemVer and signed by a member of the Release Team. Code for Current releases is organized in this repository by major version number. For example v4.x. The major version number of Current releases will increment every 6 months allowing for breaking changes to be introduced. This happens in April and October every year. Current release lines beginning in October each year have a maximum support life of 8 months. Current release lines beginning in April each year will convert to LTS (see below) after 6 months and receive further support for 30 months.
- LTS: Releases that receive Long-term Support, with a focus on stability and security. Every second Current release line (major version) will become an LTS line and receive 18 months of Active LTS support and a further 12 months of Maintenance. LTS release lines are given alphabetically ordered codenames, beginning with v4 Argon. LTS releases are less frequent and will attempt to maintain consistent major and minor version numbers, only incrementing patch version numbers. There are no breaking changes or feature additions, except in some special circumstances.
- Nightly: Versions of code in this repository on the current Current branch, automatically built every 24-hours where changes exist. Use with caution.
Node.js v8.11.3 Carton LTS was released, and the changelog is as follows:
- buffer (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang
- (CVE-2018-7161): Fixes Denial of Service vulnerability by updating the http2 implementation to not crash under certain circumstances during cleanup
- (CVE-2018-1000168): Fixes Denial of Service vulnerability by upgrading nghttp2 to 1.32.0
e1ff7c3cbc] – deps: update to nghttp2 1.32.0 (James M Snell) nodejs-private/node-private#125
c5a2748d8f] – doc: buffer.fill() can zero-fill on invalid input (Сковорода Никита Андреевич) nodejs-private/node-private#119
354f2d97ff] – http2: fixup http2stream cleanup and other nits (James M Snell) nodejs-private/node-private#123
25c5111ca4] – src: avoid hanging on Buffer#fill 0-length input (Сковорода Никита Андреевич) nodejs-private/node-private#119
10c5adf19b] – test: add
Realloc()shrink after reading stream data test (Anna Henningsen) nodejs-private/node-private#132
bc91220ca2] – test: add tls write error regression test (Shigeki Ohtsu) nodejs-private/node-private#131
acd11b01c4] – test: add regression test for nghttp2 CVE-2018-1000168 (James M Snell) nodejs-private/node-private#125