Update Node.js to v24#2013
Open
renovate[bot] wants to merge 10 commits into
Open
Conversation
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
The Renovate update only bumped .nvmrc, which nothing in CI or production reads: the Cloud Run image and every test container come from the Dockerfile FROM line, and our docker:disableMajor preset means Renovate can never bump that base image major itself. Merged alone, the repo would declare Node 24 while everything that actually runs stayed on 22 — and a green build here would prove nothing, since the tests execute inside the Node 22 image. - Dockerfile base image → node:24.18.0-alpine, so tests and production genuinely move to 24 - @types/node → 24.13.3 and the renovate allowedVersions pin '<23' → '<25', per the lockstep rule documented in renovate.json5
setup-node's lts/* already resolves to a different Node major than the deployed runtime and would silently jump to Node 26 at the next LTS switch, so the frozen-lockfile install was being validated on a Node version nobody ships. Reading .nvmrc keeps the check on the same version as the Dockerfile.
sagzy
force-pushed
the
renovate/node-24.x
branch
from
July 16, 2026 16:06
9b99de0 to
46b382c
Compare
The flake's overlay claimed to be the central place to set the node version but just passed through the nixpkgs default, which the lock file (from June 2025) resolves to Node 22. With the rest of the repo on Node 24, direnv users would silently get a different major than CI and production for host-side tooling. Pinning nodejs_24 makes the shell track the deployed major regardless of what the locked nixpkgs defaults to.
This upgrade shipped as a Renovate commit that only bumped .nvmrc plus manual companion commits for everything else, because docker:disableMajor blocks the node base image major while the nvm manager is unconstrained. Left as-is, the next Node major would repeat that split — and worse: CI now installs from .nvmrc, so merging a lone .nvmrc bump would have CI validating a runtime production doesn't run. Grouping the docker node package with the node-version update makes Renovate open one PR that moves both, with automerge off since a runtime major always deserves review.
python3/g++/make were only ever needed for install-time compilation, which this image never does: pnpm install runs with --ignore-scripts, pnpm-workspace.yaml denies all build scripts, and every native dep (sharp, esbuild, mysql2) ships prebuilt binaries or is pure JS. The later apk del couldn't reclaim the bytes either — in a single-stage image the toolchain stays baked into the earlier layer, so the pushed image carried ~200MB of dead weight that Cloud Run pulls on every cold-start scale-out, and every cache-busted build (like this Node bump) reinstalled it for nothing.
The Node version was pinned in .nvmrc, the Dockerfile, and CI, but nothing surfaced a mismatch for local installs — a contributor still on Node 22 could pnpm install and run host-side tooling without any signal that the project had moved on. With engines set, pnpm warns on the mismatch at install time. Deliberately not enabling engine-strict: a hard failure would also apply to dependencies' engines ranges and risks breaking installs over third-party metadata.
The comment hardcoded the runtime major in prose, so every Node
upgrade had to edit the explanation as well as the allowedVersions
value — and a missed edit would leave it describing the wrong major.
It also lost precision in the last rewrite ('APIs that won't exist in
production' no longer said whose APIs). Now only allowedVersions needs
touching on a Node bump, and the rationale spells out the hazard:
typings newer than the runtime let code compile against APIs
production doesn't have.
# Conflicts: # package.json # pnpm-lock.yaml
# Conflicts: # pnpm-lock.yaml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
22.23.1→24.18.0Release Notes
nodejs/node (node)
v24.18.0: 2026-06-23, Version 24.18.0 'Krypton' (LTS), @richardlau prepared by @sxaCompare Source
Notable Changes
e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #6352744c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #621834c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #631558c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #630793f54c8ba32] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #63834Commits
d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #635979ff36e40f0] - build: add --enable-all-experimentals build flag (Paolo Insogna) #627557c22ee23aa] - build: defNODE_USE_NODE_CODE_CACHEonly used in node_mksnapshot (Chengzhong Wu) #635882551abdb4a] - build,win: enable x64 PGO (Stefan Stojanovic) #62761e8a55ce9b1] - crypto: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) #62763ae61cd68f3] - crypto: harden WebCrypto against prototype pollution (Filip Skokan) #633633d05a1d396] - crypto: pass CryptoKey handles to KDF jobs (Filip Skokan) #63363f9d10a3f6b] - crypto: remove async from WebCrypto methods (Filip Skokan) #63363e431d93e9e] - crypto: add WebCrypto CryptoJob mode (Filip Skokan) #6336356e2505e48] - crypto: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) #632553bac77f2a8] - crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) #632551bff901b09] - crypto: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) #632554433fca3df] - crypto: harden CryptoKey algorithm slots (Filip Skokan) #63111b5cf01217a] - crypto: harden KeyObject internal slots (Filip Skokan) #63111ce84aef37d] - crypto: add guards and adjust tests for BoringSSL (Filip Skokan) #6288326781689b0] - crypto: reject duplicate ML-KEM JWK key_ops (Filip Skokan) #62905aeea8f4970] - crypto: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) #62706407cf91656] - crypto: guard against size_t overflow on experimental 32-bit arch (Filip Skokan) #62626bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527b46d52b283] - crypto: unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) #62499ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #6352761826df455] - crypto: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) #6353116d2fd3c07] - crypto: align verifyOneShot accepted types (Anshika Jain) #632803b8330deda] - crypto: improve system certificate enumeration logic on macOS (Robo) #62576141de35399] - debugger: add --help tonode inspectand improve docs (Joyee Cheung) #63201b76bfcd4fa] - deps: upgrade npm to 11.16.0 (npm team) #636024ec142314c] - deps: SQLite: cherry-pickb869ed6(Junsu Han) #6352519e8ce1c36] - deps: upgrade npm to 11.15.0 (npm team) #634638a264260e2] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #6321750c8ff3f94] - deps: update simdjson to 4.6.4 (Node.js GitHub Bot) #628116e56f01c4b] - deps: V8: cherry-pick435a2cd(Matthias Liedtke) #631363ba813b242] - deps: cherry-pick libuv/libuv@a43e543(Ali Hassan) #632222390e3a5ac] - doc: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) #6365052a1c18374] - doc: updategit node landinstructions for security releases (Antoine du Hamel) #635863e6b4da037] - doc: drop --experimental from --permission (Rafael Gonzaga) #6358384d05163b9] - doc: explicitly ask for reproducible in JS (Rafael Gonzaga) #634797da2a4450e] - doc: fix URL postMessage example in worker_threads (Kit Dallege) #622033d79bd8b29] - doc: clarifyfilteroption ofsqlite.database.applyChangeset(Antoine du Hamel) #635154f4174aace] - doc: fix double spaces in ERR_TLS_INVALID_PROTOCOL_METHOD (Daijiro Wachi) #63511388323ca4b] - doc: fix double space in modules.md (Daijiro Wachi) #635125258ccc058] - doc: fix "options" to "option" in tls.createServer (Daijiro Wachi) #6345343e83e6507] - doc: fix typo in deprecations (Daijiro Wachi) #63434f05a61d54c] - doc: remove unsupported template type from v8.md (René) #63410c39d5fc820] - doc: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) #62696398261f911] - doc: remove the bi-monthly contributor spotlight section (Claudio Wunder) #62734fd9e14c405] - doc: update http2'spushandtrailersevents withrawHeadersparam (YuSheng Chen) #63259b943ce6933] - doc: remove inactive members from Triagers list (Antoine du Hamel) #633294b9cdfc022] - doc: reference correct function in Module docs (Robin Malfait) #63247bed84b6df2] - doc: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) #6321132ea70569b] - doc: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) #631874627bcfd82] - doc: run license-builder (github-actions[bot]) #6323228eba71845] - doc: add large pull requests contributing guide (Matteo Collina) #628292648efd438] - doc: remove unnecessary<!-- eslint-magic comments (Antoine du Hamel) #63200a95fc1f8fc] - doc: clarify SEA platform support excludes darwin-x64 (MJSHANG) #63181aaef29e2e1] - doc: update release steps when post-release fails (Rafael Gonzaga) #631317d81419cf2] - doc: add Hmac.digest() documentation-only deprecation (DEP0206) (Anshika Jain) #63121ececd80d81] - doc: document the latest-vX.x schema (Marco Ippolito) #6303327c1c1d842] - doc: remove list of versions inBUILDING.md(Antoine du Hamel) #63113e369886a65] - doc,sqlite: document entryPoint argument for loadExtension (Edy Silva) #63152e4e5137cbd] - errors: handle V8 warnings in DisallowJavascriptExecutionScope (Divyanshu Sharma) #634916d1f6048d2] - fs: makeDateproperties onStatsenumerable (LiviaMedeiros) #6332844c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #640044c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #6315539f61fb06c] - http2: emit session close before stream close (Matteo Collina) #634148a8f2127d1] - http2: validate non-link headers in writeEarlyHints (Matteo Collina) #620178c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079c05f38229b] - lib: cleanup stateless diffiehellman key handling (Filip Skokan) #626451c16b45d35] - lib: refactor internal webidl converters (Filip Skokan) #6297902f35d6dce] - lib: definekEnumerablePropertyatomically (Antoine du Hamel) #6360912c51547ba] - lib: fix typos in esm loader comments (RonGamzu) #634659b03b84262] - lib: fix typo idenity => identity (Daijiro Wachi) #63112a84e6b0567] - lib: fixes validator message (Daijiro Wachi) #6282311734166a8] - lib: narrow ReadableStreamBYOBRequest.view return type to Uint8Array (RoomWithOutRoof) #630177cead61d21] - meta: flip mcollina emails in .mailmap (Matteo Collina) #63621a08cfcfd35] - meta: label "source maps" PRs (Chengzhong Wu) #63591d56e8d2512] - meta: addvfssubsystem label (René) #623316201cfe488] - meta: skip scheduled workflows on forks (Jamie Magee) #63565f095e2bd31] - meta: add additional gitignore entries (James M Snell) #632671ea52c444c] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #63402b1b2327611] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #632357d88e130a9] - meta: ignore AI assistants files (Matteo Collina) #62612a53b51df38] - module: load ESM helpers eagerly in the snapshot (Joyee Cheung) #6355069df688fff] - module: fix sync hook short-circuit in require() in imported CJS (Joyee Cheung) #6292075d9a4ed47] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710c20aa4c47b] - quic: add reusePort option to QuicEndpoint (James M Snell) #6326726a30d8a7f] - quic: implement rate limiting for version nego and immediate close (James M Snell) #632670b534b5770] - quic: fixup linting issue after other changes (James M Snell) #632674b367cbe09] - quic: remove unused binding variable in session.cc (James M Snell) #631772574bef5a6] - repl: fix dedup comparing normalized line against raw history (Daijiro Wachi) #6288630e71c7e49] - sqlite: keep source database alive during backup (Matteo Collina) #62673677ca7e76c] - src: simplify OpenSSL feature gates (Filip Skokan) #63255c863c75c39] - src: add BoringSSL EVP enumeration fallback (Filip Skokan) #63206f6b2466921] - src: decouple KeyObject and CryptoKey and move CryptoKey to src (Filip Skokan) #6292492d4f07dd2] - src: remove license headers for new node_profiling files (Chengzhong Wu) #630668ac5d771c8] - src: split profiling helpers from util (Ilyas Shabi) #6300885d1639495] - src: remove TOCTOU race condition when encoding SAB-backedBuffers (Antoine du Hamel) #635179473c5f05c] - src: skip duplicate UTF-8 validation in TextDecoder fatal path (Mert Can Altin) #63231f35c91ee68] - src: improve token return value check (James M Snell) #6348326f677c1c5] - src: exposenode::RegisterContextto make a node managed context (Chengzhong Wu) #62322275cf909b6] - src,sqlite: only passxFilterwhen user provided a callback (Antoine du Hamel) #63516287e02303f] - src,sqlite: remove dead code (Edy Silva) #6320458fa2ee189] - stream: switch to internalsleepbinding (Antoine du Hamel) #63611f954ab3f1a] - stream: use data listener for compose forwarding (Trivikram Kamat) #63593dc57173003] - stream: fix Writable.toWeb() hang on synchronous drain (sangwook) #611973f54c8ba32] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #63834cee279c5d6] - stream: remove unnecessary check (Antoine du Hamel) #6303061b20f60a3] - test: update tls/crypto behaviour expectations when using BoringSSL (Filip Skokan) #63161a835363808] - test: update WPT for WebCryptoAPI to97bbc72(Node.js GitHub Bot) #63417a00297480b] - test: update WPT resources, interfaces and WebCryptoAPI (Node.js GitHub Bot) #623895a95a2b055] - test: shorten path in net pipe connect errors (Matteo Collina) #634055e8ff22d8f] - test: remove test-node-output-v8-warning (Joyee Cheung) #63469ee15380950] - test: update test426-fixtures to9b9e225(Node.js GitHub Bot) #633739e063d9bea] - test: update WPT for url toe4a4672(Node.js GitHub Bot) #63372503bee4b43] - test: deflake async-hooks statwatcher test (Trivikram Kamat) #63396cccc7c32d8] - test: avoid test_runner watch restart in spec snapshot (Trivikram Kamat) #63392c89489258c] - test: reduce watch mode restart flakiness (Trivikram Kamat) #63390e4d5e2578e] - test: isolate rerun-failures state file under tmpdir (Chemi Atlow) #63449362644a9ba] - test: wait for ok before initial break after restart (Yuya Inoue) #62807c4058d0e05] - test: disable Maglev in near-heap-limit worker test (Trivikram Kamat) #63398214da630a7] - test: deflake connection refused proxy tests (Trivikram Kamat) #633951d61a29876] - test: avoid repeated writes in watch helper (Trivikram Kamat) #633862004e25387] - test: deflake watch mode worker test (Trivikram Kamat) #63384d691cccfc1] - test: relax test-memory-usage arrayBuffers check (inoway46) #632440ff6bf853c] - test: reduce flakiness ofdifferent-registry-per-thread(Antoine du Hamel) #63244d9f4e8e503] - test: fix flaky test-watch-mode-inspect timeout (Matteo Collina) #633616d7cd50328] - test: relax min assertion in test-performance-eventloopdelay (Marco) #631009dafe1d2d8] - test: avoid flaky restart sync in debugger exceptions test (Yuya Inoue) #62055989b2de973] - test: avoid initial-break wait in restart-message (inoway46) #62060a072a25ee7] - test: move FFI tests toNATIVE_SUITES(Antoine du Hamel) #6316564efbfd878] - test: use ERM to destroy sqlite database handles after tests (René) #630767dee66cd94] - test_runner: dont buffer unordered events in process isolation mode (Moshe Atlow) #63432d257eec1e3] - test_runner: fix --test-rerun-failures swallowing failures on retry (Chemi Atlow) #63431288c320e2f] - test_runner: show replayed-from-attempt hint in spec reporter (Moshe Atlow) #63429904bdf5bb4] - test_runner: preserve run duration when using test-rerun (Moshe Atlow) #63429df183d7bfa] - test_runner: avoid hanging on incomplete v8 frames (Ali Hassan) #62704ec86c69726] - test_runner: fix diagnostics channel context tracking (Moshe Atlow) #6328394e5f63b83] - tls: add unsupported renegotiation error (Filip Skokan) #6316106d308fb61] - tools: prevent lib code from reading KeyObject and CryptoKey accessors (Filip Skokan) #631112e4a0d0c91] - tools: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint (dependabot[bot]) #634154c9666b366] - tools: skip commit-lint on backport pull requests (Marco) #6337867d0c490a8] - tools: fix skip oftest-interneton forks (Antoine du Hamel) #6349202f73c7cac] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #630755d016d3241] - tools: update gyp-next to 0.22.2 (Node.js GitHub Bot) #6337455af0f0edb] - tools: fix test426 updater (Antoine du Hamel) #63271d8475e167a] - tools: use different branch for tool updates on staging branches (Antoine du Hamel) #63110c605df9e50] - util: remove unused functions (Antoine du Hamel) #63612fe4540ebdb] - util: create hex style cache and fast path (Guilherme Araújo) #62999v24.17.0: 2026-06-18, Version 24.17.0 'Krypton' (LTS), @aduh95Compare Source
This is a security release.
Notable Changes
Commits
9e4dfc7bba] - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) nodejs-private/node-private#878cb2aed980c] - deps: update llhttp to 9.4.2 (Antoine du Hamel) nodejs-private/node-private#890a8a0d12875] - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 (Tim Perry) #6289166e6203c1c] - (SEMVER-MAJOR) deps: update nghttp2 to 1.69.0 (Node.js GitHub Bot) #62891dd627ced27] - deps: update archs files for openssl-3.5.7 (Node.js GitHub Bot) #63820684bae568f] - deps: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) #638203a631e7f83] - deps: fix aix implicit declaration in OpenSSL (Abdirahim Musse) #62656cf44df3996] - deps: update undici to 7.28.0 (Node.js GitHub Bot) #63703138c70294b] - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) nodejs-private/node-private#868be7e719c3f] - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) nodejs-private/node-private#846cc7c11b4d1] - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) nodejs-private/node-private#8559224427b92] - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) nodejs-private/node-private#867cf85d54839] - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) nodejs-private/node-private#873a1bbc24f96] - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) nodejs-private/node-private#870e3723ff2d6] - test: add session reuse host verification regressions (Matteo Collina) nodejs-private/node-private#854a77af4867b] - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) nodejs-private/node-private#85431beb4f707] - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) nodejs-private/node-private#8578e75c73f91] - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) nodejs-private/node-private#869v24.16.0: 2026-05-21, Version 24.16.0 'Krypton' (LTS), @aduh95Compare Source
Notable Changes
b267f6bca3] - (SEMVER-MINOR) crypto: implementrandomUUIDv7()(nabeel378) #62553ec2451b9cd] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes tonode inspect(Joyee Cheung) #627139705f628d9] - (SEMVER-MINOR) fs: add signal option tofs.stat()(Mert Can Altin) #5777540ccfdecf9] - (SEMVER-MINOR) fs: exposefrsizefield instatfs(Jinho Jang) #62277d7188af5c9] - (SEMVER-MINOR) http: hardenClientRequestoptions merge (Matteo Collina) #63082aa1d8a9afc] - (SEMVER-MINOR) http: addreq.signaltoIncomingMessage(Akshat) #625416f37f7e240] - (SEMVER-MINOR) stream: propagate destruction induplexPair(Ahmed Elhor) #61098d14029be7f] - (SEMVER-MINOR) test_runner: support test order randomization (Pietro Marchini) #61747d142c584cd] - (SEMVER-MINOR) test_runner: align mock timeout api (sangwook) #6282001a9552585] - (SEMVER-MINOR) test_runner: add mock-timers support forAbortSignal.timeout(DeveloperViraj) #6075100705a459a] - (SEMVER-MINOR) util: colorize text with hex colors (Guilherme Araújo) #61556Commits
dd72df060d] - assert,util: fix stale nested cycle memo entries (Ruben Bridgewater) #62509add94f4bc3] - build: track PDL files as inputs in inspector GN build (Robo) #628881b1eb9e334] - build: remove redundant -fuse-linker-plugin from GCC LTO flags (Daniel Lando) #626678752b604ec] - crypto: deduplicate and canonicalize CryptoKey usages (Filip Skokan) #62902341947e7fd] - crypto: reject unintended raw key format string input (Filip Skokan) #6297428a78747fc] - crypto: remove Argon2 KDF derivation from its job setup (Filip Skokan) #6286316e8c2b54d] - crypto: fix unsigned conversion of 4-byte RSA publicExponent (DeepView Autofix) #62839eeae754a87] - crypto: reject inherited key type names (Jonathan Lopes) #628759dd5540325] - crypto: add memory tracking for secureContext openssl objects (Mert Can Altin) #59051b267f6bca3] - (SEMVER-MINOR) crypto: implement randomUUIDv7() (nabeel378) #625537597d204c1] - crypto: add support forEd25519context parameter (Filip Skokan) #624744bf85845da] - debugger: move ProbeInspectorSession and helpers to separate files (Joyee Cheung) #63013ec2451b9cd] - (SEMVER-MINOR) debugger: add edit-free runtime expression probes tonode inspect(Joyee Cheung) #6271383e98f77b7] - deps: update corepack to 0.35.0 (Node.js GitHub Bot) #63375ec8c6b939a] - deps: V8: cherry-pick657d8de(Guy Bedford) #62784722c0c3274] - deps: update nghttp3 to 1.14.0 (Node.js GitHub Bot) #611875304db93d3] - deps: update nghttp3 to 1.13.1 (Node.js GitHub Bot) #60046e073b3811d] - deps: update nghttp3 to 1.11.0 (James M Snell) #592491d00313fb2] - deps: update ngtcp2 to 1.14.0 (James M Snell) #592498b3a4fc18f] - deps: update amaro to 1.1.9 (Node.js GitHub Bot) #6309062fe0cfcd1] - deps: update llhttp to 9.4.1 (Node.js GitHub Bot) #63045137e09c8e9] - deps: update corepack to 0.34.7 (Node.js GitHub Bot) #6281014a4cb8fbc] - deps: update timezone to 2026b (Node.js GitHub Bot) #629623e1036583a] - deps: upgrade npm to 11.13.0 (npm team) #6289801dfe5961c] - deps: cherry-pick libuv/libuv@439a54b(skooch) #628816cd368b10c] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699f218a4f553] - deps: update nbytes to 0.1.4 (Node.js GitHub Bot) #62698b47688524a] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #62629d202e2d343] - deps: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) #626292faba66341] - deps: update minimatch to 10.2.5 (Node.js GitHub Bot) #62594fa46c90c5d] - deps: update googletest tod72f9c8(Node.js GitHub Bot) #62593099ded5713] - deps: update simdjson to 4.6.1 (Node.js GitHub Bot) #625927ce95afe96] - deps: libuv: cherry-pickaabb765(Santiago Gimeno) #6256157ef845623] - deps: update icu to 78.3 (Node.js GitHub Bot) #62324493ac40e12] - deps: update libuv to 1.52.1 (Node.js GitHub Bot) #61829b39508b368] - deps: update undici to 7.25.0 (Node.js GitHub Bot) #63011cb67a925e9] - deps: use npm undici@seven tag inupdate-undici.sh(Matteo Collina) #62739aa1e0bc28b] - doc: fix typos and inconsistencies in crypto.md and webcrypto.md (Filip Skokan) #62828f2a1735ed9] - doc: fix duplicate word "to to" in util.styleText (Daijiro Wachi) #62917b6378e215c] - doc: fix node-config-schema (Сковорода Никита Андреевич) #61596233894a9ce] - doc: fix the TypeScript Execute (tsx) project link (David Thornton) #630935d97919f8f] - doc: correct diagnostics_channel built-in channel names (Bryan English) #629952a9ccc927e] - doc: use mjs/cjs blocks for callbackify null reason example (Daijiro Wachi) #62884ef413b5358] - doc: fix typo in test.md (Rich Trott) #6296076f21c5070] - doc: correct typo in PR contribution instructions (Mike McCready) #62738ca02af1f7d] - doc: fix duplicate word "of of" in postMessageToThread (Daijiro Wachi) #6291746c99ed526] - doc: fix duplicate word "for for" in compile cache (Daijiro Wachi) #629171a60851734] - doc: fix typo in dns.lookup options description (Daijiro Wachi) #62882169b5ea2ed] - doc: fix Argon2 parameter bounds (Tobias Nießen) #628689a3a190f4e] - doc: clarify diffieHellman.generateKeys recomputes same key (Kit Dallege) #622050fba9e87d6] - doc: remove Ayase-252 and meixg from triagger team (Antoine du Hamel) #628419c700f3446] - doc: clarify dns.lookup() callback signature when all is true (eungi) #628006b7280bc17] - doc: add experimental modules lifetime policy (Paolo Insogna) #62753ce47ea31c9] - doc: clarify process._debugProcess() in Permission Model (Fahad Khan) #62537ba01633757] - doc: fix typo in devcontainer guide (Rohan Santhosh Kumar) #6268770b4d5839b] - doc: clarify Backport-PR-URL metadata added automatically (Mike McCready) #626688126d1c3eb](https://redirect.github.com/nodejs/node/commit/8126d1c3ebConfiguration
📅 Schedule: (UTC)
* 7-16 * * 1,2,3,4)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.