Skip to content

chore(deps): update node.js to v24.22.3 - #125

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/node.js
Nov 12, 2026
Merged

renovate[bot] merged 1 commit into
mainfrom
renovate/node.js

Conversation

@renovate

@renovate renovate Bot commented Nov 12, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
node (source) patch 24.22.2 → 24.22.3

Release Notes

nodejs/node (node)

v24.22.3: 2026-11-11, Version 24.22.3 'Krypton' (LTS), @​aduh95

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
  • (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
  • (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
  • (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
  • (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
  • (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
  • (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
  • (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
  • (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
  • (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
  • (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
  • (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
  • (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
  • (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
  • (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
  • (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
  • (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
  • (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
  • deps: update brotli to 1.2.1 (Node.js GitHub Bot)
  • deps: update llhttp to 9.4.4 (Antoine du Hamel)
  • deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
  • deps: update undici to 7.30.2 (Node.js GitHub Bot)
Commits

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added dependencies Pull requests that update a dependency file renovate wizexclude labels Nov 12, 2026
@renovate
renovate Bot enabled auto-merge (squash) November 12, 2026 02:47
@renovate
renovate Bot merged commit 62f8675 into main Nov 12, 2026
11 checks passed
@renovate
renovate Bot deleted the renovate/node.js branch November 12, 2026 02:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file renovate wizexclude

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants