2018-08-15, Version 10.9.0 (Current)

Notable changes:

* buffer:
  * Fix out-of-bounds (OOB) write in `Buffer.write()` for UCS-2 encoding
    (CVE-2018-12115)
  * Fix unintentional exposure of uninitialized memory in `Buffer.alloc()`
    (CVE-2018-7166)
* deps:
  * Upgrade to OpenSSL 1.1.0i, fixing:
    - Client DoS due to large DH parameter (CVE-2018-0732)
    - ECDSA key extraction via local side-channel (CVE not assigned)
  * Upgrade V8 from 6.7 to 6.8 (Michaël Zasso) #21079
    - Memory reduction and performance improvements, details at:
      https://v8project.blogspot.com/2018/06/v8-release-68.html
* http: `http.get()` and `http.request()` (and `https` variants) can now accept
  three arguments to allow for a `URL` _and_ an `options` object
  (Sam Ruby) #21616
* Added new collaborators
  * Sam Ruby (https://github.com/rubys)
  * George Adams (https://github.com/gdams)

Author: rvagg

CHANGELOG.md

@@ -31,7 +31,8 @@ release.
 </tr>
 <tr>
     <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V10.md#10.8.0">10.8.0</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V10.md#10.9.0">10.9.0</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V10.md#10.8.0">10.8.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V10.md#10.7.0">10.7.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V10.md#10.6.0">10.6.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V10.md#10.5.0">10.5.0</a><br/>

doc/api/crypto.md

@@ -2144,8 +2144,8 @@ request.
 <!-- YAML
 added: v10.5.0
 changes:
-  - version: REPLACEME
-    pr-url: https://github.com/nodejs/node/pull/XXX
+  - version: v10.9.0
+    pr-url: https://github.com/nodejs/node/pull/21525
     description: The `cost`, `blockSize` and `parallelization` option names
                  have been added.
 -->
@@ -2198,8 +2198,8 @@ crypto.scrypt('secret', 'salt', 64, { N: 1024 }, (err, derivedKey) => {
 <!-- YAML
 added: v10.5.0
 changes:
-  - version: REPLACEME
-    pr-url: https://github.com/nodejs/node/pull/XXX
+  - version: v10.9.0
+    pr-url: https://github.com/nodejs/node/pull/21525
     description: The `cost`, `blockSize` and `parallelization` option names
                  have been added.
 -->

doc/api/http.md

@@ -1802,7 +1802,7 @@ added to the [`'request'`][] event.
 <!-- YAML
 added: v0.3.6
 changes:
-  - version: REPLACEME
+  - version: v10.9.0
     pr-url: https://github.com/nodejs/node/pull/21616
     description: allow both url and options to be passed to `http.get()`
   - version: v7.5.0
@@ -1879,7 +1879,7 @@ requests.
 <!-- YAML
 added: v0.3.6
 changes:
-  - version: REPLACEME
+  - version: v10.9.0
     pr-url: https://github.com/nodejs/node/pull/21616
     description: allow both url and options to be passed to `http.request()`
   - version: v7.5.0

doc/api/https.md

@@ -116,7 +116,7 @@ https.createServer(options, (req, res) => {
 <!-- YAML
 added: v0.3.6
 changes:
-  - version: REPLACEME
+  - version: v10.9.0
     pr-url: https://github.com/nodejs/node/pull/21616
     description: allow both url and options to be passed to `https.get()`
   - version: v7.5.0
@@ -164,7 +164,7 @@ Global instance of [`https.Agent`][] for all HTTPS client requests.
 <!-- YAML
 added: v0.3.6
 changes:
-  - version: REPLACEME
+  - version: v10.9.0
     pr-url: https://github.com/nodejs/node/pull/21616
     description: allow both url and options to be passed to `https.request()`
   - version: v9.3.0