Skip to content

chore(deps): update group node - #2

Open
anaconda-renovate[bot] wants to merge 1 commit into
masterfrom
renovate/group-node
Open

chore(deps): update group node#2
anaconda-renovate[bot] wants to merge 1 commit into
masterfrom
renovate/group-node

Conversation

@anaconda-renovate

@anaconda-renovate anaconda-renovate Bot commented Jun 6, 2025

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Adoption Passing Confidence OpenSSF
docker.io/library/node stage minor 23.0.023.11.1 age adoption passing confidence
node (source) minor 22.9.022.23.2 age adoption passing confidence OpenSSF Scorecard

Release Notes

nodejs/node (node)

v22.23.2: 2026-07-29, Version 22.23.2 'Jod' (LTS), @​marco-ippolito

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
  • (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
  • (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
  • (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
  • deps: update llhttp to 9.4.3 (Paolo Insogna)
  • deps: update undici to 6.28.0 (Node.js GitHub Bot)
Commits

v22.23.1: 2026-06-23, Version 22.23.1 'Jod' (LTS), @​RafaelGSS

Compare Source

This release includes a fix for an unexpected behavior introduced
by the recent security release (22.23.0).

Commits

v22.23.0: 2026-06-18, Version 22.23.0 'Jod' (LTS), @​aduh95

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
  • (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
  • (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
  • (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
  • (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
  • (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
  • (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
  • (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
  • (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
  • (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
  • (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
Commits

v22.22.3: 2026-05-13, Version 22.22.3 'Jod' (LTS), @​marco-ippolito

Compare Source

Commits

v22.22.2: 2026-03-24, Version 22.22.2 'Jod' (LTS), @​RafaelGSS prepared by @​aduh95

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High
  • (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High
  • (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium
  • (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium
  • (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
  • (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low
  • (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low
Commits

v22.22.1: 2026-03-05, Version 22.22.1 'Jod' (LTS)

Compare Source

Notable Changes
Commits

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@anaconda-renovate
anaconda-renovate Bot force-pushed the renovate/group-node branch from 373362a to ee288e1 Compare June 26, 2025 02:25
@anaconda-renovate
anaconda-renovate Bot force-pushed the renovate/group-node branch from ee288e1 to b168665 Compare July 17, 2025 10:54
@anaconda-renovate
anaconda-renovate Bot force-pushed the renovate/group-node branch from b168665 to 014c1cf Compare August 2, 2025 06:35
@anaconda-renovate
anaconda-renovate Bot force-pushed the renovate/group-node branch from 69df046 to 84595c5 Compare March 9, 2026 18:02
@anaconda-renovate
anaconda-renovate Bot force-pushed the renovate/group-node branch from 84595c5 to b0f62f5 Compare March 29, 2026 14:12
@anaconda-renovate
anaconda-renovate Bot force-pushed the renovate/group-node branch from b0f62f5 to e46ed0b Compare May 17, 2026 18:12
@anaconda-renovate
anaconda-renovate Bot force-pushed the renovate/group-node branch 2 times, most recently from b59179e to eee97ae Compare June 23, 2026 17:06
Signed-off-by: anaconda-renovate[bot] <117830771+anaconda-renovate[bot]@users.noreply.github.com>
@anaconda-renovate
anaconda-renovate Bot force-pushed the renovate/group-node branch from eee97ae to 60a93de Compare August 2, 2026 04:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants