This is a security release, fixing a number of vulnerabilities in OpenSSL and Node.js. Refer to the August 2018 Security Releases announcement for full details.

• Version 10.9.0 Upgrade Pack
• Version 10.9.0 Upgrade Mod

Notable Changes

• buffer:
  • Fix out-of-bounds (OOB) write in Buffer.write() for UCS-2 encoding (CVE-2018-12115)
  • Fix unintentional exposure of uninitialized memory in Buffer.alloc() (CVE-2018-7166)
• deps:
  • Upgrade to OpenSSL 1.1.0i, fixing:
    • Client DoS due to large DH parameter (CVE-2018-0732)
    • ECDSA key extraction via local side-channel (CVE not assigned)
  • Upgrade V8 from 6.7 to 6.8 (Michaël Zasso) #21079
    • Memory reduction and performance improvements, details at: https://v8project.blogspot.com/2018/06/v8-release-68.html
• http: http.get() and http.request() (and https variants) can now accept three arguments to allow for a URLand an options object (Sam Ruby) #21616
• Added new collaborators
  • Sam Ruby (https://github.com/rubys)
  • George Adams (https://github.com/gdams)

Instead, you need to download OS X Mavericks from the Mac App Store. Although you see it is OS X 10.9.1, Apple updated that installer in order to upgrade your Mac to the most recent OS X Mavericks version, so you do not need to update OS X again after upgrading. See my first comment. Nov 13, 2017 Version 10.9.0 UpdateBETA - Fixed up a slight bug - Improved on some Code In the next version, bot will no longer be in BETA and it will have a few customization's that you will like.

Commits

• [58a9ae118e] - assert: fix loose assert with map and set (Ruben Bridgewater) #22145
• [1c577016b8] - benchmark: improve assert benchmarks (Ruben Bridgewater) #22211
• [734323d9eb] - buffer: stop alloc() uninitialized memory return (cjihrig) nodejs-private/node-private#137
• [2c4c17b708] - buffer: avoid overrun on UCS-2 string write (Rod Vagg) nodejs-private/node-private#138
• [6622ac798d] - buffer: use FastBuffer when fill is set to 0 (Сковорода Никита Андреевич) #21989
• [f506a5f46e] - build: make --shared-[...]-path work on Windows (Jeremy Apthorp) #21530
• [1be6fb93c8] - build: add CONFIG_FLAGS to with-code-cache target (Daniel Bevenius) #22207
• [4520bb8a73] - build: make tools/doc/node_modules non-phony (Daniel Bevenius) #22189
• [c42ff4ebd8] - build: add crypto check to build targets (Daniel Bevenius) #22148
• [cdb8c1b44d] - build: extract common parts from addon .buildstamp (Daniel Bevenius) #22171
• [1e7a8c3016] - build: reset embedder string to '-node.0' (Michaël Zasso) #21079
• [86ab2c041e] - crypto: remove unused SSLWrap handle methods (Jon Moss) #22216
• [9212875406] - crypto: simplify state failure handling (Tobias Nießen) #22131
• [916a1d59f0] - crypto: simplify Hmac::HmacUpdate (Tobias Nießen) #22132
• [2dc7f17e8b] - (SEMVER-MINOR)crypto: add better scrypt option aliases (Anna Henningsen) #21525
• [fcf422e921] - deps: backport c608122b from upstream (Ruben Bridgewater) #22210
• [a07ccaeb19] - deps: update archs files for OpenSSL-1.1.0i (Shigeki Ohtsu) #22318
• [473996c90f] - deps: add s390 asm rules for OpenSSL-1.1.0 (Shigeki Ohtsu) #19794
• [05e48fd018] - deps: upgrade openssl sources to 1.1.0i (Shigeki Ohtsu) #22318
• [f8bc5d6320] - deps: cherry-pick 09bca09 from upstream V8 (Matheus Marchini) #22068
• [c69fdc9d5f] - (SEMVER-MINOR)deps: remove thread_local to fix V8 compilation (Peter Marshall) #21668
• [981fff714e] - deps: refactor v8.gyp (Michaël Zasso) #22017
• [5fa3ffad20] - (SEMVER-MINOR)deps: patch the V8 API to be backwards compatible with 6.7 (Peter Marshall) #21668
• [6eed40acbb] - deps: cherry-pick 804a693 from upstream V8 (Matheus Marchini) #21855
• [7eccaf86d6] - deps: V8: Backport of 0dd3390 from upstream (James M Snell) #21899
• [328c89925a] - deps: cherry-pick 907d7bc from upstream V8 (Michaël Zasso) #21838
• [afacfd2992] - deps: cherry-pick 2075910 from upstream V8 (Michaël Zasso) #21838
• [4f24256274] - deps: cherry-pick 555c811 from upstream V8 (Anna Henningsen) #21741
• [7b4272a14d] - deps: cherry-pick 477df06 from upstream v8 (Gus Caplan) #21644
• [a0bf7aa07c] - deps: cherry-pick 70c4340 from upstream V8 (Matheus Marchini) #21126
• [4994ac65b0] - deps: cherry-pick acc336c from upstream V8 (Matheus Marchini) #21126
• [be569f82f1] - deps: cherry-pick b20faff from upstream V8 (Matheus Marchini) #21126
• [6df5feb13f] - deps: cherry-pick aa6ce3e from upstream V8 (Michaël Zasso) #21079
• [8b9a956f9e] - deps: cherry-pick 5dd3395 from upstream V8 (Matheus Marchini) #21386
• [548008a6f6] - deps: update v8.gyp and run Torque (Michaël Zasso) #21079
• [9c74271a96] - deps: update V8 to 6.8.275.24 (Michaël Zasso) #21079
• [a3f3c40966] - doc: simplify urlObject.hash text (Rich Trott) #22326
• [d2848697dc] - doc: simplify urlObject.hash description (Rich Trott) #22326
• [6d29986f4d] - doc: simplify format description of urlObject.auth (Rich Trott) #22324
• [a658a4df34] - doc: remove redundant explanation of format (Rich Trott) #22324
• [3236697c0b] - doc: use italics for words-as-words (Rich Trott) #22324
• [da76b61f59] - doc: bump ICU version to avoid confusion (Csaba Palfi) #22313
• [e04b0532bf] - doc: document 'inherit' option for stdio (non-shorthand) (James Bromwell) #22309
• [882c2c017a] - doc: clarify http2 docs around class exports (James M Snell) #22247
• [dd96ba5b89] - doc: add multiple issue templates for GitHub (Tobias Nießen) #22215
• [d95a22c304] - doc: declare all parameter types (Sam Ruby) #21782
• [9e25028981] - doc: add missing option for child_process.spawnSync() (James Bromwell) #22231
• [ef8d0fc490] - doc: list encodings supported by buffer.transcode (James M Snell) #22263
• [1b41cd44b5] - doc: discuss special protocol handling (James M Snell) #22261
• [cea8d4f4e9] - doc: replace _WG_ with _team_ (Rich Trott) #22183
• [fafdae4ce1] - doc: add subprocess.ref() and subprocess.unref() (Thomas Hunter II) #22220
• [d4f3615aaf] - doc: add gdams to collaborators (George Adams) #22236
• [e75885f2e6] - doc: specify options parameter type in zlib.md (Vse Mozhet Byt) #21920
• [40af9767a2] - doc: declare all parameter types (Sam Ruby) #21782
• [38dd407c83] - doc: remove unused error codes from errors.md (Сковорода Никита Андреевич) #21491
• [6c7733f58a] - doc: update recommendations for createCipher (Tobias Nießen) #22087
• [34300aaaa4] - doc: correct crypto.randomFill() and randomFillSync() (Gerhard Stoebich) #21550
• [28870a46ac] - doc: add rubys to collaborators (Sam Ruby) #22109
• [d2ad9a2c13] - doc: fix return type of server.address() (Weijia Wang) #22043
• [168abb5801] - doc: rename stackStartFunction in assert.md (Eugene Y. Q. Shen) #22077
• [d364f9c8e7] - doc: fix changelog for v10.8.0 (Michaël Zasso) #22072
• [abac0c56b8] - doc: mark DEP0004 and DEP0042 as End-of-Life (Jon Moss) #22033
• [c6a56ae23e] - doc: correct grammatical error in BUILDING.md (Brandon Lee) #22067
• [29bc55320c] - doc: fixup process.binding deprecation code (James M Snell) #22062
• [ec9d529a32] - doc: documentation deprecation of process.binding (James M Snell) #22004
• [37369eba38] - (SEMVER-MINOR)http: allow url and options to be passed to http*.request and http*.get (Sam Ruby) #21616
• [1ca46ab6f4] - http,tls: name anonymous callbacks (Marco Levrero) #21412
• [8d226c6a79] - http2: correcting the heading format (Anto Aravinth) #22262
• [7223a91a50] - http2: explicitly disallow nested push streams (James M Snell) #22245
• [cee78bf7a2] - http2: avoid race condition in OnHeaderCallback (James M Snell) #22256
• [fcca2f7e49] - http2: remove streamError from docs (James M Snell) #22246
• [2bf9a4a09e] - https: allow url and options to be passed to https.request (Sam Ruby) #22003
• [4c5dc6e012] - inspector: tie objects lifetime to the thread they belong to (Eugene Ostroukhov) #22242
• [1afcea107e] - inspector: unmark tests as flaky (Eugene Ostroukhov) #22253
• [39898695b6] - inspector: add inspector_protocol as a direct dependency (Andrey Lushnikov) #21975
• [311ec12702] - inspector: fixed V8InspectorClient::currentTimeMS (Aleksey Kozyatinskiy) #21917
• [8f7e37337f] - lib: remove unused filterInternalStackFrames param (MaleDong) #22267
• [3f729aac20] - lib: extract validateString validator (Jon Moss) #22101
• [f570c19c89] - perf_hooks: avoid memory leak on gc observer (James M Snell) #22241
• [76a65921d3] - readline,zlib: named anonymous functions (Anto Aravinth) #21792
• [e4f346892c] - repl: support mult-line string-keyed objects (Sam Ruby) #21805
• [d0b0ea971a] - src: remove unnecessary writes in tls_wrap.cc (Anna Henningsen) #21984
• [b2ac7a750f] - src: avoid possible race during NodeBIO initialization (Anna Henningsen) #21984
• [d85b0a3c10] - src: use smart pointers for NodeBIO (Anna Henningsen) #21984
• [82e71dd8bd] - src: fix integer overflow in GetNow (Anatoli Papirovski) #22214
• [2737b46e16] - src: add READONLY_STRING_PROPERTY and simplify config (Jon Moss) #22222
• [8b5485dcf5] - src: fix up doc comment for experimental-worker bool (Anna Henningsen) #22165
• [e90e56f4ca] - src: remove calls to deprecated v8 functions (NumberValue) (Ujjwal Sharma) #22094
• [c09872b749] - src: remove unused env->vm_parsing_context_symbol (Jon Moss) #22034
• [6ca00d7044] - src: remove unused env strings (Jon Moss) #22137
• [0ca831a0ed] - src: clean up PackageConfig pseudo-boolean fields (Anna Henningsen) #21987
• [00c33a5131] - src: clean up agent loop when exiting through destructor (Anna Henningsen) #21867
• [ba480d33ce] - src: use only one tracing write fs req at a time (Anna Henningsen) #21867
• [6b58746b2e] - src: use unique_ptr for internal JSON trace writer (Anna Henningsen) #21867
• [ce48936077] - src: plug trace file file descriptor leak (Anna Henningsen) #21867
• [89e23021fb] - src: initialize file trace writer on tracing thread (Anna Henningsen) #21867
• [56edd5fc5b] - src: close tracing event loop (Anna Henningsen) #21867
• [4c9c1bbc45] - src: fix tracing if cwd or file path is inaccessible (Anna Henningsen) #21867
• [c101b396aa] - src: refactor default trace writer out of agent (Anna Henningsen) #21867
• [daafe6c195] - src: refactor tracing agent code (Anna Henningsen) #21867
• [4379140dbf] - src: minor refactor of node_trace_events.cc (Anna Henningsen) #21867
• [cde0e5f396] - src: reduce unnecessary includes (Anna Henningsen) #21867
• [31e3e6f1f8] - stream: fix readable behavior for highWaterMark 0 (Denys Otrishko) #21690
• [9d89b3c7ec] - test: rename some allegories (Vse Mozhet Byt) #22307
• [1d15f33277] - test: call gc() explicitly to avoid OOM (Refael Ackermann) #22301
• [a7dad4565b] - test: move test-http-client-timeout-option-with-agent to sequential (Ouyang Yadong) #22083
• [a414b0757a] - test: add test-http2-large-file sequential test (James M Snell) #22254
• [01fe2cee5b] - test: fix error messages for OpenSSL-1.1.0i (Shigeki Ohtsu) #22318
• [c145690aad] - test: improve test coverage for comparisons (Ruben Bridgewater) #22212
• [bdc644f2ec] - test: remove common.fileExists() (Rich Trott) #22151
• [bc1cb7b7fc] - test: handle errors correctly in GC http test (Ouyang Yadong) #22185
• [cefc4a03cc] - test: remove second arg from assert.ifError() (Musa Hamwala) #22190
• [b1cbbbc7af] - test: move require of https to after crypto check (Daniel Bevenius) #22148
• [a6ab19a96a] - test: move require of http2 to after crypto check (Daniel Bevenius) #22148
• [7a4c7e6c82] - test: don't mask descriptor.enumerable (Thomas Leah) #22172
• [5018661a85] - test: remove common.fileExists() (Richard Lau) #22200
• [77ce40fa03] - test: remove unused argument in assertion (yahavfuchs) #22113
• [ca0fb3acce] - test: check arg type for dnsPromises.resolve (Masashi Hirano) #22000
• [6daa4f8797] - test: update postmortem metadata test (cjihrig) #21079
• [16a929b867] - test: fix scriptParsed event expectations (Ingvar Stepanyan) #21079
• [e58c17b849] - test: update certificates and private keys (Fedor Indutny) #22184
• [d38ccaa421] - test: fix n-api addon build warnings (Kyle Farnung) #21808
• [d66e52fb8e] - test: run ESM tests in parallel (Michaël Zasso) #21919
• [6cff57e98d] - test: fix incorrect file mode check (Timothy Gu) #22023
• [dafaff3a5e] - test: remove unused config (Benjamin Gruenbaum) #21985
• [a569ae4b44] - test: remove third argument from assert.strictEqual() (Rishabh Singh) #22051
• [a60060b499] - test: remove third argument from call to assert.strictEqual() (Michael Sommer) #22047
• [246a94f301] - test: see value of 'hadError' in tls test (Oryan Moshe) #22069
• [a40ee213b3] - test: improve reliability in http2-session-timeout (Rich Trott) #22026
• [e2d97eeb65] - test: remove outdated documentation (Jon Moss) #22009
• [94746d6a47] - test: remove outdated, non-functioning test (Anatoli Papirovski) #20894
• [0beffc0f3b] - test: remove test/gc, integrate into parallel (Anna Henningsen) #22001
• [c2372eac16] - test: add tracing crash regression test (Eugene Ostroukhov) #21867
• [7e23080d45] - test: pass through stderr in benchmark tests (Anna Henningsen) #21860
• [52020dc09a] - test: refactor test-http2-compat-serverresponse-finished.js (Anto Aravinth) #21929
• [88665b3cef] - test,doc: fix async-hooks coverage doc for md lint (Rod Vagg) #22296
• [d60b017135] - test,doc: adjust markdown table for linting (Rich Trott) #22221
• [8f56cc0321] - test,doc: adjust async-hooks coverage doc for lint (Rich Trott) #22221
• [5c41caa1cc] - test,doc: wrap common module md doc at 80 chars (Rich Trott) #22221
• [21883be05d] - test,doc: fix lint error in test fixtures (Rich Trott) #22221
• [ec2209dc8b] - tls: change var to const (Eugen Cazacu) #22219
• [2d1c1853e9] - tls: remove SLAB_BUFFER_SIZE (Anatoli Papirovski) #21199
• [f989681e34] - tls: preallocate SSL cipher array (Tobias Nießen) #22136
• [6cd2d1dddc] - tools: fix header escaping regression (Sam Ruby) #22084
• [80dd0445c6] - tools: add no-misleading-character-class ESLint rule (Vse Mozhet Byt) #22278
• [bc35f17b7b] - tools: do not autolink section to itself (Vse Mozhet Byt) #22138
• [950a4a9b91] - tools: update ESLint to 5.3.0 (Rich Trott) #22134
• [0c67d326dc] - tools: convert addon-verify to remark (Sam Ruby) #21978
• [c85d00b786] - tools: produce JSON documentation using unified/remark/rehype (Sam Ruby) #21697
• [f0c871b0c7] - tools: add make format-cpp to run clang-format on C++ diffs (Joyee Cheung) #21997
• [5a4abbadfe] - tools: update to using dmn 1.0.11 (Rich Trott) #22035
• [7a7c194f4e] - tools: fix docs and run known_issues by default (Jon Moss) #21910
• [4995b28a11] - tools,build: apply markdown linting to test dir (Rich Trott) #22221
• [ad46cca104] - trace_events: add node.promises category, rejection counter (James M Snell) #22124
• [b171fa2530] - util: improve display of iterators and weak entries (Ruben Bridgewater) #20961
• [f1c22eaa56] - util,assert: fix boxed primitives bug (Ruben Bridgewater) #22243
• [677d10cdd1] - worker: fix deadlock when calling terminate from exit handler (Anna Henningsen) #22073
• [4b0d2de5f4] - zlib: remove unused parameters (MaleDong) #22115

Windows 32-bit Installer: https://nodejs.org/dist/v10.9.0/node-v10.9.0-x86.msi
Windows 64-bit Installer: https://nodejs.org/dist/v10.9.0/node-v10.9.0-x64.msi
Windows 32-bit Binary: https://nodejs.org/dist/v10.9.0/win-x86/node.exe
Windows 64-bit Binary: https://nodejs.org/dist/v10.9.0/win-x64/node.exe
macOS 64-bit Installer: https://nodejs.org/dist/v10.9.0/node-v10.9.0.pkg
macOS 64-bit Binary: https://nodejs.org/dist/v10.9.0/node-v10.9.0-darwin-x64.tar.gz
Linux 64-bit Binary: https://nodejs.org/dist/v10.9.0/node-v10.9.0-linux-x64.tar.xz
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v10.9.0/node-v10.9.0-linux-ppc64le.tar.xz
Linux s390x 64-bit Binary: https://nodejs.org/dist/v10.9.0/node-v10.9.0-linux-s390x.tar.xz
AIX 64-bit Binary: https://nodejs.org/dist/v10.9.0/node-v10.9.0-aix-ppc64.tar.gz
SmartOS 64-bit Binary: https://nodejs.org/dist/v10.9.0/node-v10.9.0-sunos-x64.tar.xz
ARMv6 32-bit Binary: https://nodejs.org/dist/v10.9.0/node-v10.9.0-linux-armv6l.tar.xz
ARMv7 32-bit Binary: https://nodejs.org/dist/v10.9.0/node-v10.9.0-linux-armv7l.tar.xz
ARMv8 64-bit Binary: https://nodejs.org/dist/v10.9.0/node-v10.9.0-linux-arm64.tar.xz
Source Code: https://nodejs.org/dist/v10.9.0/node-v10.9.0.tar.gz
Other release files: https://nodejs.org/dist/v10.9.0/
Documentation: https://nodejs.org/docs/v10.9.0/api/

SHASUMS

On this page:

• Reinstall El Capitan on a computer alreadyrunning it

Upgrade from previous versions to OS X 10.11 (El Capitan)

1. From the Apple menu, select App Store....
2. When the App Store opens, search for and download El Capitan. If you don't already have an Apple ID, you'll need to create one. You can monitor the download process in the 'Purchased' section of the App Store.
3. Once the download is complete, the installer should automatically open.

   If it doesn't, or you don't want to complete the installation at this time, you can come back later and double-click Install OS X El Capitan in your Applications folder.

   Within the installer, click Continue, agree to the license agreement, and then choose the disk where you want to install El Capitan.

   After you begin the installation, your computer may need to restart more than once before finishing, and then you may be asked to enter basic information.

4. From the Apple menu, select App Store..., and then install any available updates.

Reinstall El Capitan on a computer already running it

Reinstall while keeping files, applications, and settings

Version 10.9.0 Upgrade Pack

1. Restart your computer, and immediately hold down command-r until the gray Apple logo appears.
2. If prompted, select your main language and then click the arrow.
3. Click Reinstall OS X, and then Continue. Follow the instructions on the screen, and then choose your hard disk. Click Install, and enter your Apple ID information if prompted.
4. When the installation is complete, select App Store... from the Apple menu, and install any available updates.

Version 10.9.0 Upgrade Mod

Reinstall while erasing everything on your computer

1. Restart your computer, and immediately hold down command-r until the gray Apple logo appears.

2. If you see a screen asking you to select your main language, choose it, and then click the arrow.
3. Click Disk Utility, and then Continue.
4. In Disk Utility:
   1. Click your hard disk in the left column, and then click the Erase tab.
   2. Next to 'Format:', make sure OS X Extended (Journaled) is selected. In the 'Name:' field, give your disk a name. Click Erase.
   3. Once it's completed, quit Disk Utility.
5. Click Reinstall OS X, and then Continue:
   1. Follow the instructions on the screen, and then choose your hard disk.
   2. Click Install. If prompted, enter your Apple ID information.
   3. Once the installation is complete, you'll be asked to enter basic information, and have the option to transfer data from another computer or backup.
6. From the Apple menu, select App Store, and then install any available updates.