chore(deps): update dependency node to v26 by renovate[bot] · Pull Request #41 · sourcegraph/codeprobe

This release marks the transition of Node.js 26.x into Long Term Support (LTS)
with the codename 'Lithium'. It will continue to receive updates through to
the end of April 2029.

Other than updating metadata, such as the process.release object, to reflect
that the release is LTS, no further changes from Node.js 26.12.1 are included.

If you are updating from an earlier Long Term Support release (e.g. Node.js 24
or 22 or earlier) please note that since Node.js 25 the official binaries for
Linux are linked against libatomic, which may need to be installed separately
depending on your Linux distribution.

`v26.12.1`: 2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS

Compare Source

This is a security release.

Notable Changes

(CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
(CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
(CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
(CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High
(CVE-2026-111497) deps: brotli: cherry-pick 0ed4268 (Evgenii Kliuchnikov) – High
(CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
(CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
(CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
(CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
(CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
deps: V8: backport 93cd21e (Joyee Cheung)
crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
tls: reject chains containing blocked public keys (Ulises Gascon)
deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
crypto: harden X.509 conversion and formatting (Filip Skokan)

Commits

[818e4ca061] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
[fd3c87ed43] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966
[acffa610db] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
[7895a5cd2d] - deps: update undici to 8.12.2 (Node.js GitHub Bot) #66721
[12daa54d2e] - deps: V8: backport 93cd21e (Joyee Cheung) nodejs-private/node-private#999
[6a8b3db7e2] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
[a6040b50d9] - deps: brotli: cherry-pick 0ed4268 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
[6b78ea171d] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
[0683ee5f7d] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
[e5cae10148] - Revert "module: synchronously load most ES modules" (Antoine du Hamel) #66786
[cc244131aa] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
[0392385841] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
[c273a408c9] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
[a2caddd20e] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871
[ad788ccd07] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
[cd4b05469c] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#985
[5fa440e0d7] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855
[745ad77156] - zlib: avoid caching invalid ZIP local headers (Matteo Collina) nodejs-private/node-private#981

`v26.12.0`: 2026-10-14, Version 26.12.0 (Current), @richardlau

Compare Source

Notable Changes

[1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533
[7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335

Commits

[30e76bb16a] - benchmark: fix input passed to subtle.digest in webcrypto-digest (Rafael Gonzaga) #66608
[adef72223a] - benchmark: fix buffer option in buffer read/write benchmarks (Rafael Gonzaga) #66604
[2f498f08fe] - benchmark: add util.parseArgs benchmark (Rafael Gonzaga) #66599
[4ce8412e18] - benchmark: fix url-searchparams-sort to sort a fresh list (RafaelGSS) #66535
[493bd6c66e] - benchmark,tools: fix napi benchmarks on GHA (Nigro Simone) #66423
[e4515552d6] - build: run QUIC CI for V8 changes (Yuya Inoue) #66602
[a888e51062] - build: support Python 3.15 (Mike McCready) #65750
[2afab9a63b] - build: do not include shared gtest in node link path (Antoine du Hamel) #66626
[f88c2f8ec6] - build,test: enable temporal support on no-ICU and system-ICU builds (Antoine du Hamel) #66697
[5fd03e6fdf] - child_process: propagate config-file permission flags to children (Rafael Gonzaga) #66559
[f771134b07] - crypto: isolate provider EC PKCS8 encoding (Filip Skokan) #66413
[4e00a293db] - crypto: remove key export and metadata locks (Filip Skokan) #66413
[bcd8018775] - crypto: remove verify setup key locking (Filip Skokan) #66413
[883250fee2] - crypto: remove KEM key locking (Filip Skokan) #66413
[9d98805071] - crypto: remove RSA-OAEP key locking (Filip Skokan) #66413
[d6293e7bb1] - crypto: skip secret key mutex allocation (Filip Skokan) #66413
[8d8af8003e] - crypto: keep the root cert store per Environment (Shelley Vohr) #66411
[c6f0614785] - crypto: remove select Web Crypto warnings (Filip Skokan) #66312
[e5360b5a08] - deps: update googletest to 988ea2c (Node.js GitHub Bot) #66652
[7eb230a2c1] - deps: update acorn to 8.19.0 (Node.js GitHub Bot) #66655
[af946ba8f3] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663
[007872a85d] - deps: V8: cherry-pick 8d14d49 (Antoine du Hamel) #66627
[f44aec4966] - deps: update simdjson to 5.0.3 (Daniel Lemire) #66620
[1a33e914e8] - deps: V8: cherry-pick 7d5eb1d (inoway46) #66566
[3294d51e5a] - diagnostics_channel: fix default callback context (Matteo Collina) #66481
[5c602a5824] - doc: list futimes among fd APIs disabled by the permission model (Rafael Gonzaga) #66649
[eaeb4736c8] - doc: add Test Runner to list of built-in diagnostic channels (Vas Sudanagunta) #66563
[0e1c99afae] - doc: document stream/iter behaviors and Node.js extensions (James M Snell) #66483
[846236367d] - doc: document URL and Uint8Array references in process.permission (Rafael Gonzaga) #66557
[fc3b067be7] - doc: clarify http Agent keepSocketAlive behavior (Efe Karasakal) #66252
[73a4e90ce2] - doc: document keepAliveTimeoutBuffer server option (Efe Karasakal) #66286
[bb816582af] - doc: fix request.reusedSocket timeout example (Efe Karasakal) #66286
[82223ab4d9] - doc: clarify revert PR label policy (Antoine du Hamel) #66529
[c6f59d4e8e] - doc: clarify node binary misuse after compromise (Rafael Gonzaga) #66530
[8904178498] - doc: document linux-x64-musl build toolchain (Issac) #66523
[1e8247a74e] - doc: run license-builder (github-actions[bot]) #66517
[b2773d5e4c] - doc: add missing return types in cluster.md (Daniel Pinto) #66453
[1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533
[c1073f31de] - ffi: fix exportArrayBuffer type check (Trivikram Kamat) #66455
[69148ee0ff] - fs: lock FileHandle on first read in pull() and pullSync() (James M Snell) #66483
[700c60a1cd] - fs: serialize FileHandle writer() async writes (James M Snell) #66483
[32833def1c] - http: reduce raw header name allocations (Roberto Bianchi) #66488
[7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335
[115731dda7] - http2: speed up response getHeaders (Roberto Bianchi) #66592
[447c36cb45] - lib: fix AbortSignal.any() nested composite leak (Darius) #66617
[1722ced4b4] - lib: add --allow-fs-vfs to permission available flags (Rafael Gonzaga) #66554
[062ece77fc] - lib: fix benchmark record acknowledgement race (Filip Skokan) #66430
[05d0b14438] - lib: set exit code on failed node:bench run() (RafaelGSS) #66534
[2cab299471] - lib: default node:bench warmup to 10 invocations (RafaelGSS) #66536
[83f507845d] - meta: bump nodejs/node-pr-labeler to dfe5eb3 (Soul Lee) #66606
[6fbffd5ee5] - meta: bump codecov/codecov-action from 7.1.0 to 7.1.1 (dependabot[bot]) #66448
[bd567f8bd6] - module: fix require of imports with package map (Lazizbek Ergashev) #66565
[c442f471a5] - module: synchronously load most ES modules (Geoffrey Booth) #62530
[51f66f0134] - permission: keep explicit fs grants when dropping a covering directory (Rafael Gonzaga) #66556
[1aa10d80e2] - process: mark process.finalization as release candidate (Matteo Collina) #66436
[dd4715a6ba] - querystring: fix value decoding after encoded keys (Ved Chaudhari) #66553
[9648a6ba8e] - quic: reject closed stream writer writes with a TypeError (James M Snell) #66483
[d6f566baf8] - quic: give each BindingData its own allocator state (Shelley Vohr) #66411
[c3204c15bd] - quic: validate session close error codes (Christian Aurich Zanettini Martins) #66302
[5b87354f5a] - quic: destroy stream on invalid promise body (Christian Aurich Zanettini Martins) #66260
[9ef698c781] - sqlite: validate aggregate() name and options (Guilherme Araújo) #66463
[bbf41f8cfb] - sqlite: persist enableDefensive() across reopen (Trivikram Kamat) #66404
[54867cd25e] - sqlite: throw on oversized strings instead of aborting (Trivikram Kamat) #66521
[4314cde48b] - src: release uv_fs_t in permission WildcardIfDir (Rafael Gonzaga) #66555
[0e58916f08] - src: stop including simdjson.h from env.h (Daniel Lemire) #66620
[06f56a55bb] - src: use native CopyArrayBufferBytes for webstream buffer copy (René) #66400
[2e3dd5bb63] - src: fix config file handling (Marco Ippolito) #66431
[cd86506bc2] - src: mark config file as stable (Marco Ippolito) #66431
[15ff9884e4] - stream: skip idle webstreams start and watchers (Matteo Collina) #66424
[3f75c89fb8] - stream: add pipeToSync() failOnIncompleteClose option (James M Snell) #66483
[6cecf140e7] - stream: do not fail the writer when pipeToSync() cannot close (James M Snell) #66483
[16833534b6] - stream: fix fromSync() async input error messages (James M Snell) #66483
[af41622ad8] - stream: reject closed fromWritable() writes with a TypeError (James M Snell) #66483
[4b83c6c38e] - stream: accept explicit stream/iter budgets below 16384 (James M Snell) [#66483](

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

chore(deps): update dependency node to v26

0b36abc

renovate Bot added the bot label Oct 30, 2026

Navigation Menu

Repository navigation

chore(deps): update dependency node to v26 - #41

chore(deps): update dependency node to v26#41
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/node-26.x

renovate Bot commented Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 30, 2026

Release Notes

v26.13.0: 26.13.0

v26.12.1: 26.12.1

v26.12.0: 26.12.0

v26.11.1: 26.11.1

v26.11.0: 26.11.0

v26.10.0: 26.10.0

v26.9.0: 26.9.0

v26.8.2: 26.8.2

v26.8.1: 26.8.1

v26.8.0: 26.8.0

v26.7.0: 26.7.0

v26.6.0: 26.6.0

v26.5.1: 26.5.1

v26.5.0: 26.5.0

v26.4.0: 26.4.0

v26.3.1: 26.3.1

v26.3.0: 26.3.0

v26.2.0: 26.2.0

v26.1.0: 26.1.0

v26.0.0: 26.0.0

v24.22.2: 24.22.2

v24.22.1: 24.22.1

v24.22.0: 24.22.0

v24.21.0: 24.21.0

v24.20.0: 24.20.0

v24.19.0: 24.19.0

v24.18.1: 24.18.1

v24.18.0: 24.18.0

v24.17.0: 24.17.0

v24.16.0: 24.16.0

v24.15.0: 24.15.0

v24.14.1: 24.14.1

v24.14.0: 24.14.0

v24.13.1: 24.13.1

v24.13.0: 24.13.0

v24.12.0: 24.12.0

v24.11.1: 24.11.1

v24.11.0: 24.11.0

v24.10.0: 24.10.0

v24.9.0: 24.9.0

v24.8.0: 24.8.0

v24.7.0: 24.7.0

v24.6.0: 24.6.0

v24.5.0: 24.5.0

v24.4.1: 24.4.1

v24.4.0: 24.4.0

v24.3.0: 24.3.0

v24.2.0: 24.2.0

v24.1.0: 24.1.0

v24.0.2: 24.0.2

v24.0.1: 24.0.1

v24.0.0: 24.0.0

v22.23.4: 22.23.4

v22.23.3: 22.23.3

v22.23.2: 22.23.2

v22.23.1: 22.23.1

v22.23.0: 22.23.0

v22.22.3: 22.22.3

v22.22.2: 22.22.2

v22.22.1: 22.22.1

v22.22.0: 22.22.0

v22.21.1: 22.21.1

v22.21.0: 22.21.0

v22.20.0: 22.20.0

v22.19.0: 22.19.0

v22.18.0: 22.18.0

v22.17.1: 22.17.1

v22.17.0: 22.17.0

v22.16.0: 22.16.0

v22.15.1: 22.15.1

v22.15.0: 22.15.0

v22.14.0: 22.14.0

v22.13.1: 22.13.1

v22.13.0: 22.13.0

v22.12.0: 22.12.0

v22.11.0: 22.11.0

v22.10.0: 22.10.0

`v26.13.0`: 26.13.0

`v26.12.1`: 26.12.1

`v26.12.0`: 26.12.0

`v26.11.1`: 26.11.1

`v26.11.0`: 26.11.0

`v26.10.0`: 26.10.0

`v26.9.0`: 26.9.0

`v26.8.2`: 26.8.2

`v26.8.1`: 26.8.1

`v26.8.0`: 26.8.0

`v26.7.0`: 26.7.0

`v26.6.0`: 26.6.0

`v26.5.1`: 26.5.1

`v26.5.0`: 26.5.0

`v26.4.0`: 26.4.0

`v26.3.1`: 26.3.1

`v26.3.0`: 26.3.0

`v26.2.0`: 26.2.0

`v26.1.0`: 26.1.0

`v26.0.0`: 26.0.0

`v24.22.2`: 24.22.2

`v24.22.1`: 24.22.1

`v24.22.0`: 24.22.0

`v24.21.0`: 24.21.0

`v24.20.0`: 24.20.0

`v24.19.0`: 24.19.0

`v24.18.1`: 24.18.1

`v24.18.0`: 24.18.0

`v24.17.0`: 24.17.0

`v24.16.0`: 24.16.0

`v24.15.0`: 24.15.0

`v24.14.1`: 24.14.1

`v24.14.0`: 24.14.0

`v24.13.1`: 24.13.1

`v24.13.0`: 24.13.0

`v24.12.0`: 24.12.0

`v24.11.1`: 24.11.1

`v24.11.0`: 24.11.0

`v24.10.0`: 24.10.0

`v24.9.0`: 24.9.0

`v24.8.0`: 24.8.0

`v24.7.0`: 24.7.0

`v24.6.0`: 24.6.0

`v24.5.0`: 24.5.0

`v24.4.1`: 24.4.1

`v24.4.0`: 24.4.0

`v24.3.0`: 24.3.0

`v24.2.0`: 24.2.0

`v24.1.0`: 24.1.0

`v24.0.2`: 24.0.2

`v24.0.1`: 24.0.1

`v24.0.0`: 24.0.0

`v22.23.4`: 22.23.4

`v22.23.3`: 22.23.3

`v22.23.2`: 22.23.2

`v22.23.1`: 22.23.1

`v22.23.0`: 22.23.0

`v22.22.3`: 22.22.3

`v22.22.2`: 22.22.2

`v22.22.1`: 22.22.1

`v22.22.0`: 22.22.0

`v22.21.1`: 22.21.1

`v22.21.0`: 22.21.0

`v22.20.0`: 22.20.0

`v22.19.0`: 22.19.0

`v22.18.0`: 22.18.0

`v22.17.1`: 22.17.1

`v22.17.0`: 22.17.0

`v22.16.0`: 22.16.0

`v22.15.1`: 22.15.1

`v22.15.0`: 22.15.0

`v22.14.0`: 22.14.0

`v22.13.1`: 22.13.1

`v22.13.0`: 22.13.0

`v22.12.0`: 22.12.0

`v22.11.0`: 22.11.0

`v22.10.0`: 22.10.0

`v22.9.0`: 22.9.0

`v22.8.0`: 22.8.0

`v22.7.0`: 22.7.0