Repository navigation
chore(deps): update node.js to v22.23.4 - #50
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
|
commit: |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #50 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 5 5
Lines 113 113
Branches 26 26
=========================================
Hits 113 113 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
June 29, 2026 00:07
15bc284 to
cc88111
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
August 4, 2026 02:13
cc88111 to
d802bdc
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
September 30, 2026 02:03
d802bdc to
c22ee04
Compare
renovate
Bot
changed the title
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
October 27, 2026 01:53
c22ee04 to
8fbeb17
Compare
renovate
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
22.22.3→22.23.4Release Notes
nodejs/node (node)
v22.23.4: 2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95Compare Source
This is a security release.
Notable Changes
BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel)0ed4268(Evgenii Kliuchnikov)Commits
68fa0df6d6] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877dd6b47573b] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987a62b7d5362] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966ec9e5e4a3e] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496a538a9515d] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #6686867d294739f] - deps: brotli: cherry-pick0ed4268(Evgenii Kliuchnikov) nodejs-private/node-private#10021ab9db8a74] - deps: update timezone to 2026e (Node.js GitHub Bot) #6641952b4bcab03] - deps: update timezone to 2026d (Node.js GitHub Bot) #6633360f4833d41] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #6639605470dc308] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #6639647333fe4f4] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #6474598258b855f] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180a8349b6408] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774e9e295bcc1] - deps: cherry-picke807d4efrom SQLite (Junsu Han) #63525512a9b61f0] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217e708247254] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699857be5afa3] - deps: update undici to 6.29.1 (Node.js GitHub Bot) #6676519c5056002] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984e7b2985d59] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#98350ab804edc] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973a18ec92752] - src: exposeBROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) nodejs-private/node-private#10024342503fd8] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871d7663560ac] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982beb4cd4cd3] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) #641454b42e56aaf] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855v22.23.3: 2026-09-23, Version 22.23.3 'Jod' (LTS), @aduh95 prepared by @juanarbolCompare Source
Notable Changes
fe2a6b2be8] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746871167ddfd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #65653b816fc8958] - deps: upgrade npm to 10.9.9 (npm team) #64884e306521444] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324a9cb31129f] - deps: update OpenSSL 3.5.8 (Node.js GitHub Bot) #655422a3548e51c] - deps: update Undici to 6.28.1 (mcollina) #657903909ff2c4a] - node-api: supportSharedArrayBufferinnapi_create_typedarray(Yilong Li) #6271066de6349ad] - node-api: addnapi_create_external_sharedarraybuffer(Ben Noordhuis) #62623Commits
44cf27b8fa] - build: update binary-upload to use correct tarball name (Stewart X Addison) #65282fe2a6b2be8] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #6474671feba6b69] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527871167ddfd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #656532a3548e51c] - deps: update undici to 6.28.1 (mcollina) #6579059d853a4df] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #65542a9cb31129f] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #655423376e27de2] - deps: V8: cherry-picka6eaf75(Camillo Bruni) #65402b816fc8958] - deps: upgrade npm to 10.9.9 (npm team) #648844e4bd1b104] - deps: update timezone to 2026c (Node.js GitHub Bot) #645887d82841b4e] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #6433001855a19d3] - deps: c-ares: cherry-pick8ba37af(René) #6411023fb398c3d] - deps: update corepack to 0.35.0 (Node.js GitHub Bot) #633755286330365] - deps: update corepack to 0.34.7 (Node.js GitHub Bot) #628106d6c3c98b1] - deps: update timezone to 2026b (Node.js GitHub Bot) #62962e306521444] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324d9cb8468a3] - doc: clarifyfilteroption ofsqlite.database.applyChangeset(Antoine du Hamel) #63515c9c5662d91] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #6419337f21068c4] - fs: restore fs patchability in ESM loader (Joyee Cheung) #628357c2df5dd96] - http2: avoid uaf while receiving and sending rst_stream (esgor) #641663909ff2c4a] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #6271066de6349ad] - node-api: add napi_create_external_sharedarraybuffer (Ben Noordhuis) #62623ce9139107f] - src: escape Windows environment variables in task runner (Antoine du Hamel) #65217839480a471] - test: fix link-local dgram scope assertion (Filip Skokan) #6562940eac4a32f] - test: account for varied OpenSSL CCM final behaviours (Filip Skokan) #6554275098a9e8c] - tools: update gr2m/create-or-update-pull-request-action to v1.10.1 (Mike McCready) #6306508b6ac0416] - tools: revert OpenSSL update workflow to ubuntu-latest (Richard Lau) #6262702cafc479f] - tools: fix commit linter for semver-major release proposals (Antoine du Hamel) #629936f6cd3768d] - tools: sync mk-ca-bundle.pl with curl (Archkon) #64753bc5753d438] - tools: removeenvinfofrom our workflows (Antoine du Hamel) #64259d68ee9f8a5] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #6407038ee2e895f] - tools: avoid test/fixtures/wpt/README.md conflicts (Filip Skokan) #63938fdc65e489f] - tools: use different branch for tool updates on staging branches (Antoine du Hamel) #63110e5a6fde002] - tools: update gyp-next to 0.22.1 (Node.js GitHub Bot) #629615fbbad6e82] - url: handle unparsable serialized URLs in setters (Matteo Collina) #64651ed019e4854] - util: preserve function names without source map names (Hiroki Osame) #65108v22.23.2: 2026-07-29, Version 22.23.2 'Jod' (LTS), @marco-ippolitoCompare Source
This is a security release.
Notable Changes
Commits
4b12ac38a1] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#9353fd0aa51d0] - deps: update undici to 6.28.0 (Node.js GitHub Bot) #6471422efc051a3] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929c8525ac3a6] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#932daa6d25e3d] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921f14d78b9e0] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #6375251123159fe] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#934acaf4266b2] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930440329f624] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911ed18b9cc07] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#9260566c3cccd] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#9270d072480c3] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931v22.23.1: 2026-06-23, Version 22.23.1 'Jod' (LTS), @RafaelGSSCompare Source
This release includes a fix for an unexpected behavior introduced
by the recent security release (22.23.0).
Commits
41d2ee13be] - build: switch coverage-windows towindows-2022(Richard Lau) #63940eaa292549e] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004v22.23.0: 2026-06-18, Version 22.23.0 'Jod' (LTS), @aduh95Compare Source
This is a security release.
Notable Changes
Commits
38b4c5ed51] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878ad8a10c1bb] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890ca825a87cc] - deps: update undici to 6.27.0 (aduh95) #63711a1a5bb9683] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #628910f48583512] - (SEMVER-MAJOR) deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #6289138c869fc05] - deps: update nghttp2 to 1.68.0 (nodejs-github-bot) #61136290667c84f] - deps: update nghttp2 to 1.67.1 (nodejs-github-bot) #59790c9f3da76aa] - deps: update nghttp2 to 1.66.0 (Node.js GitHub Bot) #5878660890be563] - deps: update nghttp2 to 1.65.0 (Node.js GitHub Bot) #572695024c7d5d8] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #638207f4eb5af2e] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #63820ebb4ec78a8] - deps: fix aix implicit declaration in OpenSSL (Abdirahim Musse) #626565763d40826] - deps: update llhttp to 9.4.1 (Node.js GitHub Bot) #63045c551a51d0c] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#8680a22d40180] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846c79968e108] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#8550c37bff2ff] - http2: fix DEP0194 message (KaKa) #58669ea5dc6b529] - (SEMVER-MAJOR) http2: remove support for priority signaling (Matteo Collina) #582939b6af26132] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#86728dcd38864] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#8732f62693801] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#8701662a3ea09] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854718d5d0e2c] - test: skiptest-fs-utimes-y2K38on armv7 (Richard Lau) #63836041185b61f] - test: skip test-cluster-dgram-reuse on AIX 7.3 (Stewart X Addison) #62238fd890ba01d] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#85439d1d09684] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#8572197a47144] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.