Repository navigation
chore(deps): update dependency node to v22.23.4 - #982
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
added
auto-merge
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
renovate
Bot
force-pushed
the
renovate/node-22.x
branch
from
July 29, 2026 18:01
088a483 to
fc374d4
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/node-22.x
branch
from
July 30, 2026 18:40
fc374d4 to
f090c07
Compare
renovate
Bot
force-pushed
the
renovate/node-22.x
branch
from
August 26, 2026 18:40
f090c07 to
14ed0f2
Compare
renovate
Bot
force-pushed
the
renovate/node-22.x
branch
3 times, most recently
from
September 10, 2026 19:34
6feab25 to
2585940
Compare
renovate
Bot
force-pushed
the
renovate/node-22.x
branch
3 times, most recently
from
September 19, 2026 00:52
8d3908d to
3e9741a
Compare
renovate
Bot
force-pushed
the
renovate/node-22.x
branch
from
September 24, 2026 02:12
3e9741a to
976be8d
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/node-22.x
branch
2 times, most recently
from
October 1, 2026 11:54
22e2a1b to
f63991d
Compare
renovate
Bot
force-pushed
the
renovate/node-22.x
branch
2 times, most recently
from
October 5, 2026 20:06
d789cd2 to
58b051f
Compare
renovate
Bot
force-pushed
the
renovate/node-22.x
branch
2 times, most recently
from
October 20, 2026 11:49
116e2a2 to
65e587f
Compare
renovate
Bot
force-pushed
the
renovate/node-22.x
branch
from
October 21, 2026 17:01
65e587f to
2098eef
Compare
renovate
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
22.22.3→22.23.422.19.19→22.20.5Release Notes
nodejs/node (node)
v22.23.4: 2026-10-21, Version 22.23.4 'Jod' (LTS), @aduh95Compare Source
This is a security release.
Notable Changes
BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel)0ed4268(Evgenii Kliuchnikov)Commits
68fa0df6d6] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877dd6b47573b] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987a62b7d5362] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966ec9e5e4a3e] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496a538a9515d] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #6686867d294739f] - deps: brotli: cherry-pick0ed4268(Evgenii Kliuchnikov) nodejs-private/node-private#10021ab9db8a74] - deps: update timezone to 2026e (Node.js GitHub Bot) #6641952b4bcab03] - deps: update timezone to 2026d (Node.js GitHub Bot) #6633360f4833d41] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #6639605470dc308] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #6639647333fe4f4] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #6474598258b855f] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180a8349b6408] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774e9e295bcc1] - deps: cherry-picke807d4efrom SQLite (Junsu Han) #63525512a9b61f0] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217e708247254] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699857be5afa3] - deps: update undici to 6.29.1 (Node.js GitHub Bot) #6676519c5056002] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984e7b2985d59] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#98350ab804edc] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973a18ec92752] - src: exposeBROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) nodejs-private/node-private#10024342503fd8] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871d7663560ac] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982beb4cd4cd3] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) #641454b42e56aaf] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855v22.23.3: 2026-09-23, Version 22.23.3 'Jod' (LTS), @aduh95 prepared by @juanarbolCompare Source
Notable Changes
fe2a6b2be8] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746871167ddfd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #65653b816fc8958] - deps: upgrade npm to 10.9.9 (npm team) #64884e306521444] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324a9cb31129f] - deps: update OpenSSL 3.5.8 (Node.js GitHub Bot) #655422a3548e51c] - deps: update Undici to 6.28.1 (mcollina) #657903909ff2c4a] - node-api: supportSharedArrayBufferinnapi_create_typedarray(Yilong Li) #6271066de6349ad] - node-api: addnapi_create_external_sharedarraybuffer(Ben Noordhuis) #62623Commits
44cf27b8fa] - build: update binary-upload to use correct tarball name (Stewart X Addison) #65282fe2a6b2be8] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #6474671feba6b69] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527871167ddfd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #656532a3548e51c] - deps: update undici to 6.28.1 (mcollina) #6579059d853a4df] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #65542a9cb31129f] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #655423376e27de2] - deps: V8: cherry-picka6eaf75(Camillo Bruni) #65402b816fc8958] - deps: upgrade npm to 10.9.9 (npm team) #648844e4bd1b104] - deps: update timezone to 2026c (Node.js GitHub Bot) #645887d82841b4e] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #6433001855a19d3] - deps: c-ares: cherry-pick8ba37af(René) #6411023fb398c3d] - deps: update corepack to 0.35.0 (Node.js GitHub Bot) #633755286330365] - deps: update corepack to 0.34.7 (Node.js GitHub Bot) #628106d6c3c98b1] - deps: update timezone to 2026b (Node.js GitHub Bot) #62962e306521444] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324d9cb8468a3] - doc: clarifyfilteroption ofsqlite.database.applyChangeset(Antoine du Hamel) #63515c9c5662d91] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #6419337f21068c4] - fs: restore fs patchability in ESM loader (Joyee Cheung) #628357c2df5dd96] - http2: avoid uaf while receiving and sending rst_stream (esgor) #641663909ff2c4a] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #6271066de6349ad] - node-api: add napi_create_external_sharedarraybuffer (Ben Noordhuis) #62623ce9139107f] - src: escape Windows environment variables in task runner (Antoine du Hamel) #65217839480a471] - test: fix link-local dgram scope assertion (Filip Skokan) #6562940eac4a32f] - test: account for varied OpenSSL CCM final behaviours (Filip Skokan) #6554275098a9e8c] - tools: update gr2m/create-or-update-pull-request-action to v1.10.1 (Mike McCready) #6306508b6ac0416] - tools: revert OpenSSL update workflow to ubuntu-latest (Richard Lau) #6262702cafc479f] - tools: fix commit linter for semver-major release proposals (Antoine du Hamel) #629936f6cd3768d] - tools: sync mk-ca-bundle.pl with curl (Archkon) #64753bc5753d438] - tools: removeenvinfofrom our workflows (Antoine du Hamel) #64259d68ee9f8a5] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #6407038ee2e895f] - tools: avoid test/fixtures/wpt/README.md conflicts (Filip Skokan) #63938fdc65e489f] - tools: use different branch for tool updates on staging branches (Antoine du Hamel) #63110e5a6fde002] - tools: update gyp-next to 0.22.1 (Node.js GitHub Bot) #629615fbbad6e82] - url: handle unparsable serialized URLs in setters (Matteo Collina) #64651ed019e4854] - util: preserve function names without source map names (Hiroki Osame) #65108v22.23.2: 2026-07-29, Version 22.23.2 'Jod' (LTS), @marco-ippolitoCompare Source
This is a security release.
Notable Changes
Commits
4b12ac38a1] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#9353fd0aa51d0] - deps: update undici to 6.28.0 (Node.js GitHub Bot) #6471422efc051a3] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929c8525ac3a6] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#932daa6d25e3d] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921f14d78b9e0] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #6375251123159fe] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#934acaf4266b2] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930440329f624] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911ed18b9cc07] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#9260566c3cccd] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#9270d072480c3] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931v22.23.1: 2026-06-23, Version 22.23.1 'Jod' (LTS), @RafaelGSSCompare Source
This release includes a fix for an unexpected behavior introduced
by the recent security release (22.23.0).
Commits
41d2ee13be] - build: switch coverage-windows towindows-2022(Richard Lau) #63940eaa292549e] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004v22.23.0: 2026-06-18, Version 22.23.0 'Jod' (LTS), @aduh95Compare Source
This is a security release.
Notable Changes
Commits
38b4c5ed51] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878ad8a10c1bb] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890ca825a87cc] - deps: update undici to 6.27.0 (aduh95) #63711a1a5bb9683] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #628910f48583512] - (SEMVER-MAJOR) deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #6289138c869fc05] - deps: update nghttp2 to 1.68.0 (nodejs-github-bot) #61136290667c84f] - deps: update nghttp2 to 1.67.1 (nodejs-github-bot) #59790c9f3da76aa] - deps: update nghttp2 to 1.66.0 (Node.js GitHub Bot) #5878660890be563] - deps: update nghttp2 to 1.65.0 (Node.js GitHub Bot) #572695024c7d5d8] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #638207f4eb5af2e] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #63820ebb4ec78a8] - deps: fix aix implicit declaration in OpenSSL (Abdirahim Musse) #626565763d40826] - deps: update llhttp to 9.4.1 (Node.js GitHub Bot) #63045c551a51d0c] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#8680a22d40180] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846c79968e108] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#8550c37bff2ff] - http2: fix DEP0194 message (KaKa) #58669ea5dc6b529] - (SEMVER-MAJOR) http2: remove support for priority signaling (Matteo Collina) #582939b6af26132] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#86728dcd38864] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#8732f62693801] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#8701662a3ea09] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854718d5d0e2c] - test: skiptest-fs-utimes-y2K38on armv7 (Richard Lau) #63836041185b61f] - test: skip test-cluster-dgram-reuse on AIX 7.3 (Stewart X Addison) #62238fd890ba01d] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#85439d1d09684] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#8572197a47144] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869Configuration
📅 Schedule: (in timezone Europe/Oslo)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.