Notable changes:

Node.js 16.4.1 introduced a regression in the Windows installer on
non-English locales that is being fixed in this release. There is no
need to download this release if you are not using the Windows
installer.

PR-URL: https://github.com/nodejs/node/pull/39270

Well known user account names are localized on Windows. Look up the
"Authenticated Users" user by its security identifier to get the
localized name.

PR-URL: https://github.com/nodejs/node/pull/39241
Fixes: https://github.com/nodejs/node/issues/39224
Refs: https://github.com/nodejs/node/commit/e817ba70f56c4bfd5d4a68dce8b165142312e7b6
Refs: https://hackerone.com/reports/1211160


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>

PR-URL: https://github.com/nodejs-private/node-private/pull/271

This is a security release.

Notable changes:

Vulnerabilities fixed:

- **CVE-2021-22918**: libuv upgrade - Out of bounds read (Medium)
- **CVE-2021-22921**: Windows installer - Node Installer Local Privilege Escalation (Medium)

PR-URL: https://github.com/nodejs-private/node-private/pull/271

Explicitly set permission for Windows install directory.

CVE-ID: CVE-2021-22921
Refs: https://hackerone.com/reports/1211160
PR-URL: https://github.com/nodejs-private/node-private/pull/269


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

Original commit message:

    idna: fix OOB read in punycode decoder

    Reported by Eric Sesterhenn in collaboration with
    Cure53 and ExpressVPN.

Reported-By: Eric Sesterhenn <eric.sesterhenn@x41-dsec.de>
    PR-URL: https://github.com/libuv/libuv-private/pull/1


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>

CVE-ID: CVE-2021-22918
Refs: https://hackerone.com/reports/1209681
PR-URL: https://github.com/nodejs-private/node-private/pull/267


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>

PR-URL: https://github.com/nodejs/node/pull/39031

Notable changes:

* async_hooks:
  * stabilize part of AsyncLocalStorage (Vladimir de Turckheim) https://github.com/nodejs/node/pull/37675
* deps:
  * upgrade npm to 7.18.1 (npm-robot) https://github.com/nodejs/node/pull/39065
  * update V8 to 9.1.269.36 (Michaël Zasso) https://github.com/nodejs/node/pull/38273
* dns:
  * allow `--dns-result-order` to change default dns verbatim (Ouyang Yadong) https://github.com/nodejs/node/pull/38099

PR-URL: https://github.com/nodejs/node/pull/39031

If an error is thrown before a module is loaded, we attempt to cache
source map against error object, rather than module object. We
can't do this if the error is a primitive type

Fixes #38945

PR-URL: https://github.com/nodejs/node/pull/39025


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

This way we don't end up attempting to SetPromiseHooks on contexts that
have already been collected.

Fixes: https://github.com/nodejs/node/issues/39019

PR-URL: https://github.com/nodejs/node/pull/39095


Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Andrey Pechkurov <apechkurov@gmail.com>
Reviewed-By: Danielle Adams <adamzdanielle@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39094


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

eslint-babel-plugin will complain about this semicolon when we update
to 7.14.15.

PR-URL: https://github.com/nodejs/node/pull/39094


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

This change allows all boolean flags to be negated using the `--no-`
prefix.
Flags that are `true` by default (for example `--deprecation`) are
still documented as negations.
With this change, it becomes possible to easily flip the default
value of a boolean flag and to override the value of a flag passed
in the NODE_OPTIONS environment variable.
`process.allowedNodeEnvironmentFlags` contains both the negated and
non-negated versions of boolean flags.

Co-authored-by: Anna Henningsen <anna@addaleax.net>

PR-URL: https://github.com/nodejs/node/pull/39023


Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

PR-URL: https://github.com/nodejs/node/pull/39083


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

This way, internal modules can still require the module
and cache the function getOptionValue() early (therefore
these code can be included in the snapshots), but the
options map won't be serialized from C++ land until the
option values are actually queried.

PR-URL: https://github.com/nodejs/node/pull/38993
Refs: https://github.com/nodejs/node/issues/35711
Refs: https://github.com/nodejs/node/pull/38905


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

This is only necessary for the snapshot builder (because we
have no way to resurrect the handles at the moment). In addition,
print the handles if the debug flag is set or if the queues
are not empty after snapshot is created.

PR-URL: https://github.com/nodejs/node/pull/39007
Refs: https://github.com/nodejs/node/issues/35711
Refs: https://github.com/nodejs/node/pull/38905


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

Split the running of the instance so that it can be reused
by the snapshot builder when we need to run the loop for
user code.

PR-URL: https://github.com/nodejs/node/pull/39007
Refs: https://github.com/nodejs/node/issues/35711
Refs: https://github.com/nodejs/node/pull/38905


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

Previously only changes to .gypi files trigger a reconfigure
on Windows.

PR-URL: https://github.com/nodejs/node/pull/39066


Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

When I moved these files from node-inspect to Node.js core, I put them
in lib/internal/inspector. That was a mistake. They should be in
lib/internal/debugger.

PR-URL: https://github.com/nodejs/node/pull/39080


Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

There's no reason to keep these tests separated from everything else.

PR-URL: https://github.com/nodejs/node/pull/39079


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39065


Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ruy Adorno <ruyadorno@github.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/38538


Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Khaidi Chu <i@2333.moe>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Added JSDoc typings for the `child_process` lib module.

PR-URL: https://github.com/nodejs/node/pull/38222


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>

PR-URL: https://github.com/nodejs/node/pull/39047


Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Mary Marchini <oss@mmarchini.me>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>
Reviewed-By: Khaidi Chu <i@2333.moe>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>

The purpose of separating is for readability and maintainability.

PR-URL: https://github.com/nodejs/node/pull/38988


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/38996


Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/38869


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39049


Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Khaidi Chu <i@2333.moe>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

compability -> compatibility

PR-URL: https://github.com/nodejs/node/pull/39044


Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39045


Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39024


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Jan Krems <jan.krems@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39024


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Jan Krems <jan.krems@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39024


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Jan Krems <jan.krems@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39024


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Jan Krems <jan.krems@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/39024


Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Jan Krems <jan.krems@gmail.com>

This reverts commit 3457130e.

Visual Studio v16.10.1 is out.

Closes: https://github.com/nodejs/node/issues/38872

PR-URL: https://github.com/nodejs/node/pull/38977
Fixes: https://github.com/nodejs/node/issues/38872


Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Fixes: https://github.com/nodejs/node/issues/38883

PR-URL: https://github.com/nodejs/node/pull/38914


Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/38999


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>

Psuedo -> Pseudo

PR-URL: https://github.com/nodejs/node/pull/39021


Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

- Migrated to ESM because some dependencies now require it.
- Did not update `highlight.js` to v11 because it has many breaking
  changes.
- Used non-deprecated `highlight.js` API.

Refs: https://github.com/highlightjs/highlight.js/issues/2277
Fixes: https://github.com/nodejs/node/issues/38938


Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/38966


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Anto Aravinth <anto.aravinth.cse@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>