npm: Upgrade to 1.3.17
gyp: update to 78b26f7
uv: Upgrade v0.10.20
doc: "finish" event is on the writable stream
doc: mention `binary` as deafult for Hash strings
doc: fix typos in node.1
2013.12.12, Version 0.10.23 (Stable)

* uv: Upgrade to v0.10.20 (Timothy J Fontaine)

* npm: Upgrade to 1.3.17 (isaacs)

* gyp: update to 78b26f7 (Timothy J Fontaine)

* build: include postmortem symbols on linux (Timothy J Fontaine)

* crypto: Make Decipher._flush() emit errors. (Kai Groner)

* dgram: fix abort when getting `fd` of closed dgram (Fedor Indutny)

* events: do not accept NaN in setMaxListeners (Fedor Indutny)

* events: avoid calling `once` functions twice (Tim Wood)

* events: fix TypeError in removeAllListeners (Jeremy Martin)

* fs: report correct path when EEXIST (Fedor Indutny)

* process: enforce allowed signals for kill (Sam Roberts)

* tls: emit 'end' on .receivedShutdown (Fedor Indutny)

* tls: fix potential data corruption (Fedor Indutny)

* tls: handle `ssl.start()` errors appropriately (Fedor Indutny)

* tls: reset NPN callbacks after SNI (Fedor Indutny)
Merge branch 'v0.10.23-release' into v0.10
Now working on 0.10.24
blog: Post for v0.10.23
test: use s_client instead of curl

fixes #6647
module: only cache package main
Merge remote-tracking branch 'upstream/v0.10'

Conflicts:
	AUTHORS
	ChangeLog
	deps/uv/.mailmap
	deps/uv/ChangeLog
	deps/uv/build.mk
	deps/uv/src/unix/darwin.c
	deps/uv/src/unix/udp.c
	deps/uv/src/version.c
	deps/uv/test/test-list.h
	src/node_version.h
uv: Upgrade to v0.11.16
v8: backport fix for CVE-2013-{6639|6640}

Quoting CVE-2013-6639:

    The DehoistArrayIndex function in hydrogen-dehoist.cc in Google V8
    before 3.22.24.7, as used in Google Chrome before 31.0.1650.63,
    allows remote attackers to cause a denial of service (out-of-bounds
    write) or possibly have unspecified other impact via JavaScript code
    that sets the value of an array element with a crafted index.

Quoting CVE-2013-6640:

    The DehoistArrayIndex function in hydrogen-dehoist.cc in Google V8
    before 3.22.24.7, as used in Google Chrome before 31.0.1650.63,
    allows remote attackers to cause a denial of service (out-of-bounds
    read) via JavaScript code that sets a variable to the value of an
    array element with a crafted index.

Like 6b92a7, this is unlikely to affect node.js because it only runs
local, trusted code.  However, if there exists some module somewhere
that populates an array index with remotely provided data this could
very well be used to crash a remote server running node.  Defense in
depth and all.

This is a backport of upstream commit r17801. Original commit log:

    Limit size of dehoistable array indices

    LOG=Y
    BUG=chromium:319835,chromium:319860
    R=dslomov@chromium.org

    Review URL: https://codereview.chromium.org/74113002
Merge branch 'v0.10'

Conflicts:
	deps/v8/src/elements-kind.cc
	deps/v8/src/elements-kind.h
	deps/v8/src/hydrogen-instructions.h
	deps/v8/src/hydrogen.cc
	deps/v8/src/lithium.cc
	deps/v8/src/lithium.h
deps: update v8 to 3.22.24.9
crypto: comment change on disabling compression

This is a comment change, where it originally says disabling TLS
Compression protects against BEAST attack. But in fact, it is the
CRIME attack(Compression Ratio Info-leak Made Easy) that makes use
of TLS Compression and not BEAST.

BEAST(Browser Exploit Against SSL/TLS) is an entirely another variant
making use of the chosen boundary attack against CBC mode in
encryption.

Just making sure, that the exact reason for disabling TLS compression
must be made clear and not be misleading with some other attack.
npm: Upgrade to 1.3.19
npm: upgrade to 1.3.20

The 1.3.19 release had a critical bug: any packages published with it
could not be installed, because the shasum would be incorrect.

Thankfully, 1.3.19 was published using 1.3.19, so could not be installed
by any users!  However, if it goes out as part of a Node.js release,
then obviously that would be a problem.