From 0b427d5eca9398d4ba09bc490f559dbde0ce16f6 Mon Sep 17 00:00:00 2001
From: Mitar <mitar.git@tnode.com>
Date: Thu, 19 Sep 2019 10:45:34 -0700
Subject: [PATCH 01/20] A small optimization when updating documents.

---
 packages/mongo/collection.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/mongo/collection.js b/packages/mongo/collection.js
index e1f497c861..a610481ba6 100644
--- a/packages/mongo/collection.js
+++ b/packages/mongo/collection.js
@@ -176,7 +176,7 @@ Object.assign(Mongo.Collection.prototype, {
       // XXX better specify this interface (not in terms of a wire message)?
       update(msg) {
         var mongoId = MongoID.idParse(msg.id);
-        var doc = self._collection.findOne(mongoId);
+        var doc = self._collection._docs.get(mongoId);
 
         // Is this a "replace the whole doc" message coming from the quiescence
         // of method writes to an object? (Note that 'undefined' is a valid

From 9f6e358ed5bba1c2c1b98067bfcb36fa5cec40a3 Mon Sep 17 00:00:00 2001
From: Sergei Osminushkin <os@csgo.com>
Date: Mon, 7 Oct 2019 14:31:17 +0300
Subject: [PATCH 02/20] change sparse and unique index options values from 1 to
 true

---
 packages/accounts-base/accounts_server.js        | 14 +++++++-------
 packages/accounts-oauth/oauth_common.js          |  2 +-
 packages/accounts-password/password_server.js    | 12 ++++++------
 packages/oauth/pending_credentials.js            |  2 +-
 packages/oauth1/oauth1_pending_request_tokens.js |  2 +-
 5 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/packages/accounts-base/accounts_server.js b/packages/accounts-base/accounts_server.js
index fc2a89dd2f..4ff12049d2 100644
--- a/packages/accounts-base/accounts_server.js
+++ b/packages/accounts-base/accounts_server.js
@@ -1560,18 +1560,18 @@ const setupUsersCollection = users => {
   });
 
   /// DEFAULT INDEXES ON USERS
-  users._ensureIndex('username', {unique: 1, sparse: 1});
-  users._ensureIndex('emails.address', {unique: 1, sparse: 1});
+  users._ensureIndex('username', { unique: true, sparse: true });
+  users._ensureIndex('emails.address', { unique: true, sparse: true });
   users._ensureIndex('services.resume.loginTokens.hashedToken',
-    {unique: 1, sparse: 1});
+    { unique: true, sparse: true });
   users._ensureIndex('services.resume.loginTokens.token',
-    {unique: 1, sparse: 1});
+    { unique: true, sparse: true });
   // For taking care of logoutOtherClients calls that crashed before the
   // tokens were deleted.
   users._ensureIndex('services.resume.haveLoginTokensToDelete',
-    { sparse: 1 });
+    { sparse: true });
   // For expiring login tokens
-  users._ensureIndex("services.resume.loginTokens.when", { sparse: 1 });
+  users._ensureIndex("services.resume.loginTokens.when", { sparse: true });
   // For expiring password tokens
-  users._ensureIndex('services.password.reset.when', { sparse: 1 });
+  users._ensureIndex('services.password.reset.when', { sparse: true });
 };
diff --git a/packages/accounts-oauth/oauth_common.js b/packages/accounts-oauth/oauth_common.js
index 05f6307331..cbf1273525 100644
--- a/packages/accounts-oauth/oauth_common.js
+++ b/packages/accounts-oauth/oauth_common.js
@@ -15,7 +15,7 @@ Accounts.oauth.registerService = name => {
     // so this should be a unique index. You might want to add indexes for other
     // fields returned by your service (eg services.github.login) but you can do
     // that in your app.
-    Meteor.users._ensureIndex(`services.${name}.id`, {unique: 1, sparse: 1});
+    Meteor.users._ensureIndex(`services.${name}.id`, {unique: true, sparse: true});
   }
 };
 
diff --git a/packages/accounts-password/password_server.js b/packages/accounts-password/password_server.js
index dcb8258dc1..9b0b708365 100644
--- a/packages/accounts-password/password_server.js
+++ b/packages/accounts-password/password_server.js
@@ -164,7 +164,7 @@ Accounts._findUserByQuery = query => {
  * @returns {Object} A user if found, else null
  * @importFromPackage accounts-base
  */
-Accounts.findUserByUsername = 
+Accounts.findUserByUsername =
   username => Accounts._findUserByQuery({ username });
 
 /**
@@ -592,7 +592,7 @@ Accounts.generateResetToken = (userId, email, reason, extraTokenData) => {
   }
 
   // make sure we have a valid email
-  if (!email || 
+  if (!email ||
     !(pluckAddresses(user.emails).includes(email))) {
     handleError("No such email for user.");
   }
@@ -654,7 +654,7 @@ Accounts.generateVerificationToken = (userId, email, extraTokenData) => {
   }
 
   // make sure we have a valid email
-  if (!email || 
+  if (!email ||
     !(pluckAddresses(user.emails).includes(email))) {
     handleError("No such email for user.");
   }
@@ -977,7 +977,7 @@ Accounts.addEmail = (userId, newEmail, verified) => {
       } else {
         return prev;
       }
-    }, 
+    },
     false
   );
 
@@ -1151,6 +1151,6 @@ Accounts.createUser = (options, callback) => {
 /// PASSWORD-SPECIFIC INDEXES ON USERS
 ///
 Meteor.users._ensureIndex('services.email.verificationTokens.token',
-                          {unique: 1, sparse: 1});
+                          { unique: true, sparse: true });
 Meteor.users._ensureIndex('services.password.reset.token',
-                          {unique: 1, sparse: 1});
+                          { unique: true, sparse: true });
diff --git a/packages/oauth/pending_credentials.js b/packages/oauth/pending_credentials.js
index bf29fb1d24..0d04785c50 100644
--- a/packages/oauth/pending_credentials.js
+++ b/packages/oauth/pending_credentials.js
@@ -16,7 +16,7 @@ OAuth._pendingCredentials = new Mongo.Collection(
     _preventAutopublish: true
   });
 
-OAuth._pendingCredentials._ensureIndex('key', {unique: 1});
+OAuth._pendingCredentials._ensureIndex('key', { unique: true });
 OAuth._pendingCredentials._ensureIndex('credentialSecret');
 OAuth._pendingCredentials._ensureIndex('createdAt');
 
diff --git a/packages/oauth1/oauth1_pending_request_tokens.js b/packages/oauth1/oauth1_pending_request_tokens.js
index 57663fdabb..c4552748fb 100644
--- a/packages/oauth1/oauth1_pending_request_tokens.js
+++ b/packages/oauth1/oauth1_pending_request_tokens.js
@@ -25,7 +25,7 @@ OAuth._pendingRequestTokens = new Mongo.Collection(
     _preventAutopublish: true
   });
 
-OAuth._pendingRequestTokens._ensureIndex('key', {unique: 1});
+OAuth._pendingRequestTokens._ensureIndex('key', { unique: true });
 OAuth._pendingRequestTokens._ensureIndex('createdAt');
 
 

From 19a8f94bafc4a96b8c95331054f1c175b4b1c01b Mon Sep 17 00:00:00 2001
From: Jan Dvorak <storyteller@freedombase.net>
Date: Mon, 14 Oct 2019 18:10:28 +0900
Subject: [PATCH 03/20] Update Facebook API calls to v4

---
 History.md                                 | 1 +
 packages/facebook-oauth/facebook_client.js | 2 +-
 packages/facebook-oauth/facebook_server.js | 4 ++--
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/History.md b/History.md
index 601f174a4e..a9877c5d33 100644
--- a/History.md
+++ b/History.md
@@ -12,6 +12,7 @@ N/A
   serve static resources, which is useful when multiple Cordova apps are built
   from the same application source code, since by default the port is generated
   using the ID from the application's `.meteor/.id` file.
+* Facebook OAuth has been updated to call v4 API endpoints.
 
 ## v1.8.1, 2019-04-03
 
diff --git a/packages/facebook-oauth/facebook_client.js b/packages/facebook-oauth/facebook_client.js
index bf2c68a609..2bed38e77f 100644
--- a/packages/facebook-oauth/facebook_client.js
+++ b/packages/facebook-oauth/facebook_client.js
@@ -31,7 +31,7 @@ Facebook.requestCredential = (options, credentialRequestCompleteCallback) => {
   const loginStyle = OAuth._loginStyle('facebook', config, options);
 
   let loginUrl =
-      `https://www.facebook.com/v3.0/dialog/oauth?client_id=${config.appId}` +
+      `https://www.facebook.com/v4.0/dialog/oauth?client_id=${config.appId}` +
       `&redirect_uri=${OAuth._redirectUri('facebook', config)}` +
       `&display=${display}&scope=${scope}` +
       `&state=${OAuth._stateParam(loginStyle, credentialToken, options && options.redirectUrl)}`;
diff --git a/packages/facebook-oauth/facebook_server.js b/packages/facebook-oauth/facebook_server.js
index db0493e980..9d3d6ec872 100644
--- a/packages/facebook-oauth/facebook_server.js
+++ b/packages/facebook-oauth/facebook_server.js
@@ -53,7 +53,7 @@ const getTokenResponse = query => {
   try {
     // Request an access token
     responseContent = HTTP.get(
-      "https://graph.facebook.com/v3.0/oauth/access_token", {
+      "https://graph.facebook.com/v4.0/oauth/access_token", {
         params: {
           client_id: config.appId,
           redirect_uri: OAuth._redirectUri('facebook', config),
@@ -92,7 +92,7 @@ const getIdentity = (accessToken, fields) => {
   hmac.update(accessToken);
 
   try {
-    return HTTP.get("https://graph.facebook.com/v3.0/me", {
+    return HTTP.get("https://graph.facebook.com/v4.0/me", {
       params: {
         access_token: accessToken,
         appsecret_proof: hmac.digest('hex'),

From f83354a39984518f9749fd5671f421a1ddbe7e1d Mon Sep 17 00:00:00 2001
From: Jan Dvorak <storyteller@freedombase.net>
Date: Wed, 20 Nov 2019 02:42:44 +0900
Subject: [PATCH 04/20] Update history

---
 History.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index f55a8130a6..3826c1bb86 100644
--- a/History.md
+++ b/History.md
@@ -1,5 +1,8 @@
 ## v.NEXT
 
+### Changes
+* Facebook OAuth has been updated to call v4 API endpoints.
+
 ## v1.8.2, 2019-11-14
 
 ### Breaking changes
@@ -132,7 +135,6 @@
   serve static resources, which is useful when multiple Cordova apps are built
   from the same application source code, since by default the port is generated
   using the ID from the application's `.meteor/.id` file.
-* Facebook OAuth has been updated to call v4 API endpoints.
 
 * The `--test-app-path <directory>` option for `meteor test-packages` and
   `meteor test` now accepts relative paths as well as absolute paths.

From 80892e59653f980f51c90628543abea9cf7f099d Mon Sep 17 00:00:00 2001
From: seke <seba.kerckhof@gmail.com>
Date: Mon, 13 Jan 2020 15:23:23 +0100
Subject: [PATCH 05/20] Add hash to runtime config file url

Although Meteor doesn't send cache headers to the runtime config file, a reverse proxy might still cache it.
Some reverse proxies will treat this case similar to cache-control: private.
So adding the hash can prevent reverse proxies from serving stale versions.
Furthermore, by adding the hash, it can actually be cached correctly by reverse proxies.

For more context: https://github.com/meteor/meteor/issues/10733
---
 .../boilerplate-generator/template-web.browser.js    |  4 +++-
 packages/webapp/webapp_server.js                     | 12 +++++++-----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/packages/boilerplate-generator/template-web.browser.js b/packages/boilerplate-generator/template-web.browser.js
index 63694f0498..413151385d 100644
--- a/packages/boilerplate-generator/template-web.browser.js
+++ b/packages/boilerplate-generator/template-web.browser.js
@@ -42,6 +42,7 @@ export const headTemplate = ({
 // Template function for rendering the boilerplate html for browsers
 export const closeTemplate = ({
   meteorRuntimeConfig,
+  meteorRuntimeHash,
   rootUrlPathPrefix,
   inlineScriptsAllowed,
   js,
@@ -54,8 +55,9 @@ export const closeTemplate = ({
     ? template('  <script type="text/javascript">__meteor_runtime_config__ = JSON.parse(decodeURIComponent(<%= conf %>))</script>')({
       conf: meteorRuntimeConfig,
     })
-    : template('  <script type="text/javascript" src="<%- src %>/meteor_runtime_config.js"></script>')({
+    : template('  <script type="text/javascript" src="<%- src %>/meteor_runtime_config.js?hash=<%- hash %>"></script>')({
       src: rootUrlPathPrefix,
+      hash: meteorRuntimeHash,
     }),
   '',
 
diff --git a/packages/webapp/webapp_server.js b/packages/webapp/webapp_server.js
index 6bde057331..12ba0cf505 100644
--- a/packages/webapp/webapp_server.js
+++ b/packages/webapp/webapp_server.js
@@ -317,9 +317,11 @@ WebAppInternals.generateBoilerplateInstance = function (arch,
                                                         additionalOptions) {
   additionalOptions = additionalOptions || {};
 
-  var runtimeConfig = _.extend(
-    _.clone(__meteor_runtime_config__),
-    additionalOptions.runtimeConfigOverrides || {}
+  const meteorRuntimeConfig = JSON.stringify(
+    encodeURIComponent(JSON.stringify({
+      ...__meteor_runtime_config__,
+      ...(additionalOptions.runtimeConfigOverrides || {})
+    }))
   );
 
   return new Boilerplate(arch, manifest, _.extend({
@@ -342,8 +344,8 @@ WebAppInternals.generateBoilerplateInstance = function (arch,
       // end up inside a <script> tag so we need to be careful to not include
       // "</script>", but normal {{spacebars}} escaping escapes too much! See
       // https://github.com/meteor/meteor/issues/3730
-      meteorRuntimeConfig: JSON.stringify(
-        encodeURIComponent(JSON.stringify(runtimeConfig))),
+      meteorRuntimeConfig,
+      meteorRuntimeHash: sha1(meteorRuntimeConfig),
       rootUrlPathPrefix: __meteor_runtime_config__.ROOT_URL_PATH_PREFIX || '',
       bundledJsCssUrlRewriteHook: bundledJsCssUrlRewriteHook,
       sriMode: sriMode,

From 2e013c62b10c6895e6d3f95c429a0b9b958bea7c Mon Sep 17 00:00:00 2001
From: Jan Dvorak <storyteller@freedombase.net>
Date: Sun, 26 Jan 2020 10:34:32 +0900
Subject: [PATCH 06/20] Update Facebook API calls to v5

---
 History.md                                 | 5 ++---
 packages/facebook-oauth/facebook_client.js | 2 +-
 packages/facebook-oauth/facebook_server.js | 4 ++--
 packages/facebook-oauth/package.js         | 2 +-
 4 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/History.md b/History.md
index ac8c718689..6e6426898f 100644
--- a/History.md
+++ b/History.md
@@ -89,6 +89,8 @@ N/A
   [Feature #335](https://github.com/meteor/meteor-feature-requests/issues/335)
   [PR #10345](https://github.com/meteor/meteor/pull/10345)
 
+* Facebook OAuth has been updated to call v5 API endpoints. [PR #10738](https://github.com/meteor/meteor/pull/10738)
+
 ## v1.8.3, 2019-12-19
 
 ### Migration Steps
@@ -131,9 +133,6 @@ N/A
 
 * The `typescript` npm package has been updated to version 3.7.3.
 
-### Changes
-* Facebook OAuth has been updated to call v4 API endpoints.
-
 ## v1.8.2, 2019-11-14
 
 ### Breaking changes
diff --git a/packages/facebook-oauth/facebook_client.js b/packages/facebook-oauth/facebook_client.js
index 2bed38e77f..de6241dd0f 100644
--- a/packages/facebook-oauth/facebook_client.js
+++ b/packages/facebook-oauth/facebook_client.js
@@ -31,7 +31,7 @@ Facebook.requestCredential = (options, credentialRequestCompleteCallback) => {
   const loginStyle = OAuth._loginStyle('facebook', config, options);
 
   let loginUrl =
-      `https://www.facebook.com/v4.0/dialog/oauth?client_id=${config.appId}` +
+      `https://www.facebook.com/v5.0/dialog/oauth?client_id=${config.appId}` +
       `&redirect_uri=${OAuth._redirectUri('facebook', config)}` +
       `&display=${display}&scope=${scope}` +
       `&state=${OAuth._stateParam(loginStyle, credentialToken, options && options.redirectUrl)}`;
diff --git a/packages/facebook-oauth/facebook_server.js b/packages/facebook-oauth/facebook_server.js
index 9d3d6ec872..f761bf52b4 100644
--- a/packages/facebook-oauth/facebook_server.js
+++ b/packages/facebook-oauth/facebook_server.js
@@ -53,7 +53,7 @@ const getTokenResponse = query => {
   try {
     // Request an access token
     responseContent = HTTP.get(
-      "https://graph.facebook.com/v4.0/oauth/access_token", {
+      "https://graph.facebook.com/v5.0/oauth/access_token", {
         params: {
           client_id: config.appId,
           redirect_uri: OAuth._redirectUri('facebook', config),
@@ -92,7 +92,7 @@ const getIdentity = (accessToken, fields) => {
   hmac.update(accessToken);
 
   try {
-    return HTTP.get("https://graph.facebook.com/v4.0/me", {
+    return HTTP.get("https://graph.facebook.com/v5.0/me", {
       params: {
         access_token: accessToken,
         appsecret_proof: hmac.digest('hex'),
diff --git a/packages/facebook-oauth/package.js b/packages/facebook-oauth/package.js
index 295bb04f5f..0ed950e060 100644
--- a/packages/facebook-oauth/package.js
+++ b/packages/facebook-oauth/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Facebook OAuth flow",
-  version: "1.6.0"
+  version: "1.7.0"
 });
 
 Package.onUse(api => {

From 61deae506821efe3513b7cfa8474b3119815bc88 Mon Sep 17 00:00:00 2001
From: Ruben Sainiuc <ruben.sainiuc@gmail.com>
Date: Wed, 5 Feb 2020 15:21:27 +0200
Subject: [PATCH 07/20] Add enableCallback option for appcache

---
 packages/appcache/appcache-server.js | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/packages/appcache/appcache-server.js b/packages/appcache/appcache-server.js
index 0120c7e9ea..ca4f97eded 100755
--- a/packages/appcache/appcache-server.js
+++ b/packages/appcache/appcache-server.js
@@ -7,6 +7,7 @@ import path from 'path';
 
 let _disableSizeCheck = false;
 let disabledBrowsers = {};
+let enableCallback = null;
 
 Meteor.AppCache = {
   config: options => {
@@ -21,6 +22,9 @@ Meteor.AppCache = {
           RoutePolicy.declare(urlPrefix, 'static-online')
         );
       }
+      else if (option === 'enableCallback') {
+        enableCallback = value;
+      }
       // option to suppress warnings for tests.
       else if (option === '_disableSizeCheck') {
         _disableSizeCheck = value;
@@ -37,7 +41,13 @@ Meteor.AppCache = {
   }
 };
 
-const browserDisabled = request => disabledBrowsers[request.browser.name];
+const browserDisabled = request => {
+  if (enableCallback) {
+    return !enableCallback(request);
+  }
+
+  return disabledBrowsers[request.browser.name];
+}
 
 // Cache of previously computed app.manifest files.
 const manifestCache = new Map;

From 4228dcbd03877ae4c67e0c58135080977aaee2e7 Mon Sep 17 00:00:00 2001
From: Jan Dvorak <storyteller@freedombase.net>
Date: Thu, 6 Feb 2020 01:21:14 +0900
Subject: [PATCH 08/20] Switch `google-oauth` to pass token in headers.
 (#10899)

Update API calls for authentication due to depracation: https://developer.github.com/changes/2019-11-05-deprecated-passwords-and-authorizations-api/
https://developer.github.com/v3/auth/#basic-authentication
---
 packages/github-oauth/github_server.js | 6 ++----
 packages/github-oauth/package.js       | 2 +-
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/packages/github-oauth/github_server.js b/packages/github-oauth/github_server.js
index b9d45ae59a..e86940eb8d 100644
--- a/packages/github-oauth/github_server.js
+++ b/packages/github-oauth/github_server.js
@@ -62,8 +62,7 @@ const getIdentity = accessToken => {
   try {
     return HTTP.get(
       "https://api.github.com/user", {
-        headers: {"User-Agent": userAgent}, // http://developer.github.com/v3/#user-agent-required
-        params: {access_token: accessToken}
+        headers: {"User-Agent": userAgent, "Authorization": `token ${accessToken}`}, // http://developer.github.com/v3/#user-agent-required
       }).data;
   } catch (err) {
     throw Object.assign(
@@ -77,8 +76,7 @@ const getEmails = accessToken => {
   try {
     return HTTP.get(
       "https://api.github.com/user/emails", {
-        headers: {"User-Agent": userAgent}, // http://developer.github.com/v3/#user-agent-required
-        params: {access_token: accessToken}
+        headers: {"User-Agent": userAgent, "Authorization": `token ${accessToken}`}, // http://developer.github.com/v3/#user-agent-required
       }).data;
   } catch (err) {
     return [];
diff --git a/packages/github-oauth/package.js b/packages/github-oauth/package.js
index abe6b6b038..da15f43032 100644
--- a/packages/github-oauth/package.js
+++ b/packages/github-oauth/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: 'GitHub OAuth flow',
-  version: '1.2.2'
+  version: '1.2.3'
 });
 
 Package.onUse(api => {

From fd0bd1ec59e66d2145d21a41d403c192a655128d Mon Sep 17 00:00:00 2001
From: Jesse Rosenberger <git@jro.cc>
Date: Wed, 5 Feb 2020 18:53:18 +0200
Subject: [PATCH 09/20] Bump package version of `accounts-github` in
 preparation for publishing.

Bumping this to make sure it brings in the correct dependency of
`github-oauth` and the fix included in the references below.

Ref: 4228dcbd03877ae4c67e0c58135080977aaee2e7
Ref: https://github.com/meteor/meteor/pull/10899
---
 packages/accounts-github/package.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/accounts-github/package.js b/packages/accounts-github/package.js
index d2a25333a5..969d33e692 100644
--- a/packages/accounts-github/package.js
+++ b/packages/accounts-github/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: 'Login service for Github accounts',
-  version: '1.4.2',
+  version: '1.4.3',
 });
 
 Package.onUse(api => {

From 924b5e8c3c5ffb9c2e8b54b402eda3f8a4d28457 Mon Sep 17 00:00:00 2001
From: claudiosdc <claudio@hiades.com.br>
Date: Fri, 7 Feb 2020 19:45:20 -0300
Subject: [PATCH 10/20] Improve Node.js built-in modules detection to fix
 #10892 (#10896)

---
 tools/isobuild/resolver.ts                    | 12 +-----
 .../apps/link-config-npm-package/.gitignore   |  1 +
 .../.meteor/.finished-upgraders               | 19 +++++++++
 .../.meteor/.gitignore                        |  1 +
 .../apps/link-config-npm-package/.meteor/.id  |  7 ++++
 .../link-config-npm-package/.meteor/packages  | 15 +++++++
 .../link-config-npm-package/.meteor/platforms |  2 +
 .../link-config-npm-package/.meteor/release   |  1 +
 .../link-config-npm-package/.meteor/versions  | 39 ++++++++++++++++++
 .../apps/link-config-npm-package/main.js      |  1 +
 .../apps/link-config-npm-package/package.json | 21 ++++++++++
 tools/tests/bundle.js                         | 41 +++++++++++++++++++
 12 files changed, 150 insertions(+), 10 deletions(-)
 create mode 100644 tools/tests/apps/link-config-npm-package/.gitignore
 create mode 100644 tools/tests/apps/link-config-npm-package/.meteor/.finished-upgraders
 create mode 100644 tools/tests/apps/link-config-npm-package/.meteor/.gitignore
 create mode 100644 tools/tests/apps/link-config-npm-package/.meteor/.id
 create mode 100644 tools/tests/apps/link-config-npm-package/.meteor/packages
 create mode 100644 tools/tests/apps/link-config-npm-package/.meteor/platforms
 create mode 100644 tools/tests/apps/link-config-npm-package/.meteor/release
 create mode 100644 tools/tests/apps/link-config-npm-package/.meteor/versions
 create mode 100644 tools/tests/apps/link-config-npm-package/main.js
 create mode 100644 tools/tests/apps/link-config-npm-package/package.json

diff --git a/tools/isobuild/resolver.ts b/tools/isobuild/resolver.ts
index 38e237740e..0092f20fb4 100644
--- a/tools/isobuild/resolver.ts
+++ b/tools/isobuild/resolver.ts
@@ -22,17 +22,9 @@ import {
 } from "../fs/optimistic";
 
 const nativeModulesMap: Record<string, string> = Object.create(null);
-const nativeNames = Object.keys((process as any).binding("natives"));
-
-// Node 0.10 does not include process as a built-in module, but later
-// versions of Node do, and we provide a stub for it on the client.
-nativeNames.push("process");
-
-nativeNames.forEach(id => {
-  if (id.startsWith("internal/")) {
-    return;
-  }
+const nativeNames = require('module').builtinModules;
 
+nativeNames.forEach((id: string) => {
   // When a native Node module is imported, we register a dependency on a
   // meteor-node-stubs/deps/* module of the same name, so that the
   // necessary stub modules will be included in the bundle. This alternate
diff --git a/tools/tests/apps/link-config-npm-package/.gitignore b/tools/tests/apps/link-config-npm-package/.gitignore
new file mode 100644
index 0000000000..40b878db5b
--- /dev/null
+++ b/tools/tests/apps/link-config-npm-package/.gitignore
@@ -0,0 +1 @@
+node_modules/
\ No newline at end of file
diff --git a/tools/tests/apps/link-config-npm-package/.meteor/.finished-upgraders b/tools/tests/apps/link-config-npm-package/.meteor/.finished-upgraders
new file mode 100644
index 0000000000..c07b6ff75a
--- /dev/null
+++ b/tools/tests/apps/link-config-npm-package/.meteor/.finished-upgraders
@@ -0,0 +1,19 @@
+# This file contains information which helps Meteor properly upgrade your
+# app when you run 'meteor update'. You should check it into version control
+# with your project.
+
+notices-for-0.9.0
+notices-for-0.9.1
+0.9.4-platform-file
+notices-for-facebook-graph-api-2
+1.2.0-standard-minifiers-package
+1.2.0-meteor-platform-split
+1.2.0-cordova-changes
+1.2.0-breaking-changes
+1.3.0-split-minifiers-package
+1.4.0-remove-old-dev-bundle-link
+1.4.1-add-shell-server-package
+1.4.3-split-account-service-packages
+1.5-add-dynamic-import-package
+1.7-split-underscore-from-meteor-base
+1.8.3-split-jquery-from-blaze
diff --git a/tools/tests/apps/link-config-npm-package/.meteor/.gitignore b/tools/tests/apps/link-config-npm-package/.meteor/.gitignore
new file mode 100644
index 0000000000..4083037423
--- /dev/null
+++ b/tools/tests/apps/link-config-npm-package/.meteor/.gitignore
@@ -0,0 +1 @@
+local
diff --git a/tools/tests/apps/link-config-npm-package/.meteor/.id b/tools/tests/apps/link-config-npm-package/.meteor/.id
new file mode 100644
index 0000000000..f5afcb55c2
--- /dev/null
+++ b/tools/tests/apps/link-config-npm-package/.meteor/.id
@@ -0,0 +1,7 @@
+# This file contains a token that is unique to your project.
+# Check it into your repository along with the rest of this directory.
+# It can be used for purposes such as:
+#   - ensuring you don't accidentally deploy one app on top of another
+#   - providing package authors with aggregated statistics
+
+j09yfxg8pwz74.sw6lv8bt1n0m
diff --git a/tools/tests/apps/link-config-npm-package/.meteor/packages b/tools/tests/apps/link-config-npm-package/.meteor/packages
new file mode 100644
index 0000000000..341bbfc93a
--- /dev/null
+++ b/tools/tests/apps/link-config-npm-package/.meteor/packages
@@ -0,0 +1,15 @@
+# Meteor packages used by this project, one per line.
+# Check this file (and the other files in this directory) into your repository.
+#
+# 'meteor add' and 'meteor remove' will edit this file for you,
+# but you can also edit it by hand.
+
+meteor                  # Shared foundation for all Meteor packages
+static-html             # Define static page content in .html files
+standard-minifier-css   # CSS minifier run for production mode
+standard-minifier-js    # JS minifier run for production mode
+es5-shim                # ECMAScript 5 compatibility for older browsers
+ecmascript              # Enable ECMAScript2015+ syntax in app code
+shell-server            # Server-side component of the `meteor shell` command
+webapp                  # Serves a Meteor app over HTTP
+server-render           # Support for server-side rendering
diff --git a/tools/tests/apps/link-config-npm-package/.meteor/platforms b/tools/tests/apps/link-config-npm-package/.meteor/platforms
new file mode 100644
index 0000000000..efeba1b50c
--- /dev/null
+++ b/tools/tests/apps/link-config-npm-package/.meteor/platforms
@@ -0,0 +1,2 @@
+server
+browser
diff --git a/tools/tests/apps/link-config-npm-package/.meteor/release b/tools/tests/apps/link-config-npm-package/.meteor/release
new file mode 100644
index 0000000000..621e94f0ec
--- /dev/null
+++ b/tools/tests/apps/link-config-npm-package/.meteor/release
@@ -0,0 +1 @@
+none
diff --git a/tools/tests/apps/link-config-npm-package/.meteor/versions b/tools/tests/apps/link-config-npm-package/.meteor/versions
new file mode 100644
index 0000000000..91816ff622
--- /dev/null
+++ b/tools/tests/apps/link-config-npm-package/.meteor/versions
@@ -0,0 +1,39 @@
+babel-compiler@7.2.0-rc171.6
+babel-runtime@1.3.0-rc171.6
+base64@1.0.11
+blaze-tools@1.0.10
+boilerplate-generator@1.6.0-rc171.6
+caching-compiler@1.2.0-rc171.6
+caching-html-compiler@1.1.3
+dynamic-import@0.5.0-rc171.6
+ecmascript@0.12.0-rc171.6
+ecmascript-runtime@0.7.0
+ecmascript-runtime-client@0.8.0-rc171.6
+ecmascript-runtime-server@0.7.1
+ejson@1.1.0
+es5-shim@4.8.0
+fetch@0.1.0
+html-tools@1.0.11
+htmljs@1.0.11
+inter-process-messaging@0.1.0-rc171.6
+logging@1.1.20
+meteor@1.9.2
+minifier-css@1.3.1
+minifier-js@2.4.0-rc171.6
+modern-browsers@0.1.2
+modules@0.13.0-rc171.6
+modules-runtime@0.10.2
+promise@0.11.1
+random@1.1.0
+routepolicy@1.1.0-rc171.6
+server-render@0.3.1
+shell-server@0.4.0
+spacebars-compiler@1.1.3
+standard-minifier-css@1.4.1
+standard-minifier-js@2.4.0-rc171.6
+static-html@1.2.2
+templating-tools@1.1.2
+tracker@1.2.0
+underscore@1.0.10
+webapp@1.7.0-rc171.6
+webapp-hashing@1.0.9
diff --git a/tools/tests/apps/link-config-npm-package/main.js b/tools/tests/apps/link-config-npm-package/main.js
new file mode 100644
index 0000000000..a2b1d76e5d
--- /dev/null
+++ b/tools/tests/apps/link-config-npm-package/main.js
@@ -0,0 +1 @@
+console.log("main", require("config").id);
diff --git a/tools/tests/apps/link-config-npm-package/package.json b/tools/tests/apps/link-config-npm-package/package.json
new file mode 100644
index 0000000000..cd7573338d
--- /dev/null
+++ b/tools/tests/apps/link-config-npm-package/package.json
@@ -0,0 +1,21 @@
+{
+  "name": "link-config-npm-package",
+  "private": true,
+  "scripts": {
+    "start": "meteor run",
+    "test": "meteor test --once --driver-package meteortesting:mocha",
+    "test-app": "TEST_WATCH=1 meteor test --full-app --driver-package meteortesting:mocha",
+    "visualize": "meteor --production --extra-packages bundle-visualizer"
+  },
+  "dependencies": {
+    "@babel/runtime": "^7.5.0",
+    "config": "file:../config-package",
+    "meteor-node-stubs": "^1.0.0"
+  },
+  "meteor": {
+    "mainModule": {
+      "client": false,
+      "server": "main.js"
+    }
+  }
+}
diff --git a/tools/tests/bundle.js b/tools/tests/bundle.js
index 7eae29f62a..043045e7d9 100644
--- a/tools/tests/bundle.js
+++ b/tools/tests/bundle.js
@@ -81,3 +81,44 @@ selftest.define("build - linked external npm package (#10177)", function () {
     "bundle/programs/server/npm/node_modules/external-package/package.json"
   ));
 });
+
+selftest.define("build - link npm package named 'config' (#10892)", function () {
+  const s = new Sandbox();
+
+  s.mkdir("config-package");
+  s.cd("config-package");
+
+  s.write(
+      "package.json",
+      JSON.stringify({
+        name: "config",
+        version: "1.0.0",
+        private: true,
+        main: "index.js"
+      }, null, 2) + "\n"
+  );
+
+  s.write(
+      "index.js",
+      "exports.id = module.id;\n"
+  );
+
+  s.cd(s.home);
+
+  s.createApp("app", "link-config-npm-package");
+  s.cd("app");
+
+  const run = s.run();
+  run.waitSecs(30);
+  run.match("config-package/index.js");
+  run.stop();
+
+  const build = s.run("build", "../build");
+  build.waitSecs(60);
+  build.expectExit(0);
+
+  const command = "cd " + files.pathJoin(s.home, "build") + " && tar -xzf app.tar.gz bundle/programs/server/packages/modules.js && grep -c \"meteorInstall({\\\"node_modules\\\":{\\\"config\\\":\" bundle/programs/server/packages/modules.js";
+  const commandResult = execSync(command,{ maxBuffer }).toString("utf8");
+
+  selftest.expectTrue(commandResult === "1\n");
+});

From 462929564312d689ab0ed53381d5afe1d62a66cc Mon Sep 17 00:00:00 2001
From: filipenevola <filipenevola@gmail.com>
Date: Wed, 12 Feb 2020 11:33:21 -0400
Subject: [PATCH 11/20] bump appcache version to 1.2.5 (1.2.4 was published
 without publishing the version here)

---
 packages/appcache/package.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/appcache/package.js b/packages/appcache/package.js
index ad4e9663c2..5716bbc802 100644
--- a/packages/appcache/package.js
+++ b/packages/appcache/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Enable the application cache in the browser",
-  version: "1.2.3",
+  version: "1.2.5",
 });
 
 Package.onUse(api => {

From 31923642171aabb1bdc95b30c1f0a5ee16af4c6e Mon Sep 17 00:00:00 2001
From: Manuel Saelices <msaelices@gmail.com>
Date: Mon, 28 Oct 2019 16:33:44 +0100
Subject: [PATCH 12/20] Fix race condition in the facts-base package tests as
 the Facts list may not be resetted between tests Fixes #10749

---
 packages/facts-base/facts_base.tests.js  | 2 ++
 packages/facts-base/facts_base_server.js | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/packages/facts-base/facts_base.tests.js b/packages/facts-base/facts_base.tests.js
index 454b663142..660049218f 100644
--- a/packages/facts-base/facts_base.tests.js
+++ b/packages/facts-base/facts_base.tests.js
@@ -1,4 +1,6 @@
 Tinytest.add('facts-base - increments server facts', test => {
+  Facts.resetServerFacts()
+
   Facts.incrementServerFact('newPackage', 'skyIsBlue', 42);
   test.equal(Facts._factsByPackage.newPackage, { skyIsBlue: 42 });
 
diff --git a/packages/facts-base/facts_base_server.js b/packages/facts-base/facts_base_server.js
index 03a5ffc374..f23e87b789 100644
--- a/packages/facts-base/facts_base_server.js
+++ b/packages/facts-base/facts_base_server.js
@@ -45,6 +45,12 @@ Facts.incrementServerFact = function (pkg, fact, increment) {
   });
 };
 
+Facts.resetServerFacts = function () {
+  for (let pkg in factsByPackage) {
+    delete factsByPackage[pkg];
+  }
+};
+
 // Deferred, because we have an unordered dependency on livedata.
 // XXX is this safe? could somebody try to connect before Meteor.publish is
 // called?

From 68a85d78e7190a689a8921389c32dd90f33fbb68 Mon Sep 17 00:00:00 2001
From: filipenevola <filipenevola@gmail.com>
Date: Tue, 18 Feb 2020 09:04:24 -0400
Subject: [PATCH 13/20] Bump package versions for 1.9.1-rc.0 release

---
 History.md                                    | 19 ++++++++++++++++++-
 packages/meteor-tool/package.js               |  2 +-
 .../admin/meteor-release-experimental.json    |  2 +-
 scripts/build-dev-bundle-common.sh            |  2 +-
 4 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/History.md b/History.md
index 9e899844ea..c52f41365e 100644
--- a/History.md
+++ b/History.md
@@ -1,4 +1,21 @@
-## v1.9, 2020-01-09
+## v1.9.1, 2020-02-18
+
+### Breaking changes
+
+N/A
+
+### Migration Steps
+N/A
+
+### Changes
+
+* Node.js has been updated to version
+  12.16.0 from 12.14.0, which includes
+  security updates and small changes:
+  * [12.16.0](https://nodejs.org/en/blog/release/v12.16.0/)
+  * [12.15.0](https://nodejs.org/en/blog/release/v12.15.0/)
+
+## v1.9, 2020-01-08
 
 ### Breaking changes
 
diff --git a/packages/meteor-tool/package.js b/packages/meteor-tool/package.js
index 4c7d1aeb8b..acdfcf3416 100644
--- a/packages/meteor-tool/package.js
+++ b/packages/meteor-tool/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "The Meteor command-line tool",
-  version: '1.9.0'
+  version: '1.9.1-rc.0'
 });
 
 Package.includeTool();
diff --git a/scripts/admin/meteor-release-experimental.json b/scripts/admin/meteor-release-experimental.json
index 21702bbbbd..c6cf4b5fa8 100644
--- a/scripts/admin/meteor-release-experimental.json
+++ b/scripts/admin/meteor-release-experimental.json
@@ -1,6 +1,6 @@
 {
   "track": "METEOR",
-  "version": "1.9-rc.3",
+  "version": "1.9.1-rc.0",
   "recommended": false,
   "official": false,
   "description": "Meteor"
diff --git a/scripts/build-dev-bundle-common.sh b/scripts/build-dev-bundle-common.sh
index 0042c34005..68b742b9dd 100644
--- a/scripts/build-dev-bundle-common.sh
+++ b/scripts/build-dev-bundle-common.sh
@@ -5,7 +5,7 @@ set -u
 
 UNAME=$(uname)
 ARCH=$(uname -m)
-NODE_VERSION=12.14.0
+NODE_VERSION=12.16.0
 MONGO_VERSION_64BIT=4.0.6
 MONGO_VERSION_32BIT=3.2.22
 NPM_VERSION=6.13.4

From 268d8ff7f6f7d54f32d934ed28a4d79b0067b251 Mon Sep 17 00:00:00 2001
From: filipenevola <filipenevola@gmail.com>
Date: Tue, 18 Feb 2020 09:26:27 -0400
Subject: [PATCH 14/20] Adjusts 1.9 release date in History

---
 History.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/History.md b/History.md
index c52f41365e..789a69f855 100644
--- a/History.md
+++ b/History.md
@@ -15,7 +15,7 @@ N/A
   * [12.16.0](https://nodejs.org/en/blog/release/v12.16.0/)
   * [12.15.0](https://nodejs.org/en/blog/release/v12.15.0/)
 
-## v1.9, 2020-01-08
+## v1.9, 2020-01-09
 
 ### Breaking changes
 

From 29c243fb6db6f5f1bcbd6a8658204e0fe148c0ae Mon Sep 17 00:00:00 2001
From: filipenevola <filipenevola@gmail.com>
Date: Tue, 18 Feb 2020 10:15:26 -0400
Subject: [PATCH 15/20] V8 updated to v7.8 in History

---
 History.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/History.md b/History.md
index 789a69f855..4d605c9d7d 100644
--- a/History.md
+++ b/History.md
@@ -13,6 +13,7 @@ N/A
   12.16.0 from 12.14.0, which includes
   security updates and small changes:
   * [12.16.0](https://nodejs.org/en/blog/release/v12.16.0/)
+    * Updated V8 to [release v7.8](https://v8.dev/blog/v8-release-78) which includes improvements in performance, for example, object destructuring now is as fast as the equivalent variable assignment.
   * [12.15.0](https://nodejs.org/en/blog/release/v12.15.0/)
 
 ## v1.9, 2020-01-09

From eb527fded2a47ad645b59528bc58fb18a328de24 Mon Sep 17 00:00:00 2001
From: filipenevola <filipenevola@gmail.com>
Date: Tue, 18 Feb 2020 14:22:17 -0400
Subject: [PATCH 16/20] Bump $BUNDLE_VERSION to 12.16.0.0 before rebuilding dev
 bundle.

---
 meteor | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meteor b/meteor
index abf7245965..d128a0b2b2 100755
--- a/meteor
+++ b/meteor
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-BUNDLE_VERSION=12.14.0.4
+BUNDLE_VERSION=12.16.0.0
 
 # OS Check. Put here because here is where we download the precompiled
 # bundles that are arch specific.

From 1b1e9cd4affb24e31466324daf4c9e0d3eb97d7a Mon Sep 17 00:00:00 2001
From: filipenevola <filipenevola@gmail.com>
Date: Tue, 18 Feb 2020 14:40:27 -0400
Subject: [PATCH 17/20] Bump package versions for 1.9.1-rc.1 release

---
 packages/meteor-tool/package.js                | 2 +-
 scripts/admin/meteor-release-experimental.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/meteor-tool/package.js b/packages/meteor-tool/package.js
index acdfcf3416..740f3e4957 100644
--- a/packages/meteor-tool/package.js
+++ b/packages/meteor-tool/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "The Meteor command-line tool",
-  version: '1.9.1-rc.0'
+  version: '1.9.1-rc.1'
 });
 
 Package.includeTool();
diff --git a/scripts/admin/meteor-release-experimental.json b/scripts/admin/meteor-release-experimental.json
index c6cf4b5fa8..eed13972cb 100644
--- a/scripts/admin/meteor-release-experimental.json
+++ b/scripts/admin/meteor-release-experimental.json
@@ -1,6 +1,6 @@
 {
   "track": "METEOR",
-  "version": "1.9.1-rc.0",
+  "version": "1.9.1-rc.1",
   "recommended": false,
   "official": false,
   "description": "Meteor"

From 2a8f8d3c8015759eea5cc9a3eee25fde428fa735 Mon Sep 17 00:00:00 2001
From: filipenevola <filipenevola@gmail.com>
Date: Tue, 18 Feb 2020 21:06:07 -0400
Subject: [PATCH 18/20] Bump package versions for 1.9.1 release

---
 packages/meteor-tool/package.js            | 2 +-
 scripts/admin/meteor-release-official.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/meteor-tool/package.js b/packages/meteor-tool/package.js
index 740f3e4957..f436ae0bea 100644
--- a/packages/meteor-tool/package.js
+++ b/packages/meteor-tool/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "The Meteor command-line tool",
-  version: '1.9.1-rc.1'
+  version: '1.9.1'
 });
 
 Package.includeTool();
diff --git a/scripts/admin/meteor-release-official.json b/scripts/admin/meteor-release-official.json
index 81a96b0240..f5557fb279 100644
--- a/scripts/admin/meteor-release-official.json
+++ b/scripts/admin/meteor-release-official.json
@@ -1,6 +1,6 @@
 {
   "track": "METEOR",
-  "version": "1.9",
+  "version": "1.9.1",
   "recommended": false,
   "official": true,
   "description": "The Official Meteor Distribution"

From d3dd0a1756eb42240d32a09b035ca71957c3e9d2 Mon Sep 17 00:00:00 2001
From: Tsegaselassie Tadesse <tsegaselassi@gmail.com>
Date: Tue, 4 Feb 2020 05:07:23 +0300
Subject: [PATCH 19/20] Update Roadmap to nominate lead for Vue.js

---
 Roadmap.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Roadmap.md b/Roadmap.md
index 714bfbffb4..a5a1f9268d 100644
--- a/Roadmap.md
+++ b/Roadmap.md
@@ -164,8 +164,8 @@ Provide a skeleton with SSR configurations already in place.
 Provide samples on how to run tests in Meteor these samples should include unit tests and also cypress tests.
 
 ## First-class citizen Technologies
-Consider Vue.js, Svelte, React Native, and Apollo as first-class citizen, for 
-each technology we would like to have:  
+Consider Vue.js, Svelte, React Native, and Apollo as first-class citizen, for
+each technology we would like to have:
 - skeleton (meteor create)
 - tutorial
 - documentation (how to use)
@@ -174,7 +174,7 @@ each technology we would like to have:
 as we already have for Blaze, React and Angular.
 
 ### Vue.js
-- Leaders: <you?>
+- Leaders: [Tsega](https://github.com/tsega)
 - Status: -
 - PRs: -
 

From fca6c62d432eff1afd4a67280b7c90af23399511 Mon Sep 17 00:00:00 2001
From: filipenevola <filipenevola@gmail.com>
Date: Wed, 19 Feb 2020 07:38:29 -0400
Subject: [PATCH 20/20] Bump $BUNDLE_VERSION to 12.16.0.1 before rebuilding dev
 bundle.

---
 meteor | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meteor b/meteor
index d128a0b2b2..aa10f80335 100755
--- a/meteor
+++ b/meteor
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-BUNDLE_VERSION=12.16.0.0
+BUNDLE_VERSION=12.16.0.1
 
 # OS Check. Put here because here is where we download the precompiled
 # bundles that are arch specific.