Skip to content

chore(deps): update node.js to v22.23.2 - #299

Open
ZxBot wants to merge 1 commit into
mainfrom
renovate/node-22.x
Open

ZxBot wants to merge 1 commit into
mainfrom
renovate/node-22.x

Conversation

@ZxBot

@ZxBot ZxBot commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
node (source) engines minor v2222.23.2

Release Notes

nodejs/node (node)

v22.23.2: 2026-07-29, Version 22.23.2 'Jod' (LTS), @​marco-ippolito

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
  • (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
  • (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
  • (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
  • deps: update llhttp to 9.4.3 (Paolo Insogna)
  • deps: update undici to 6.28.0 (Node.js GitHub Bot)
Commits

v22.23.1: 2026-06-23, Version 22.23.1 'Jod' (LTS), @​RafaelGSS

Compare Source

This release includes a fix for an unexpected behavior introduced
by the recent security release (22.23.0).

Commits

v22.23.0: 2026-06-18, Version 22.23.0 'Jod' (LTS), @​aduh95

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
  • (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
  • (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
  • (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
  • (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
  • (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
  • (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
  • (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
  • (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
  • (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
  • (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
Commits

v22.22.3: 2026-05-13, Version 22.22.3 'Jod' (LTS), @​marco-ippolito

Compare Source

Commits

v22.22.2: 2026-03-24, Version 22.22.2 'Jod' (LTS), @​RafaelGSS prepared by @​aduh95

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina) - High
  • (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina) - High
  • (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC (Filip Skokan) - Medium
  • (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS) - Medium
  • (CVE-2026-21717) test array index hash collision (Joyee Cheung) - Medium
  • (CVE-2026-21715) add permission check to realpath.native (RafaelGSS) - Low
  • (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS) - Low
Commits

v22.22.1: 2026-03-05, Version 22.22.1 'Jod' (LTS)

Compare Source

Notable Changes
Commits

Note

PR body was truncated to here.


Configuration

📅 Schedule: (in timezone Europe/Rome)

  • Branch creation
    • "after 9am and before 6pm every weekday except after 12pm and before 2pm"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@ZxBot
ZxBot force-pushed the renovate/node-22.x branch 9 times, most recently from 24726be to fef0380 Compare June 18, 2026 14:57
@ZxBot ZxBot changed the title chore(deps): update node.js to v22.22.3 chore(deps): update node.js to v22.23.0 Jun 18, 2026
@ZxBot
ZxBot force-pushed the renovate/node-22.x branch 3 times, most recently from 86bcd97 to 3ed1324 Compare June 24, 2026 01:17
@ZxBot ZxBot changed the title chore(deps): update node.js to v22.23.0 chore(deps): update node.js to v22.23.1 Jun 24, 2026
@ZxBot
ZxBot force-pushed the renovate/node-22.x branch from 3ed1324 to 483b8e9 Compare July 22, 2026 00:57
@ZxBot
ZxBot force-pushed the renovate/node-22.x branch from 483b8e9 to db43a21 Compare July 30, 2026 00:53
@ZxBot ZxBot changed the title chore(deps): update node.js to v22.23.1 chore(deps): update node.js to v22.23.2 Jul 30, 2026
@ZxBot
ZxBot force-pushed the renovate/node-22.x branch from db43a21 to e4df470 Compare July 31, 2026 03:20
@ZxBot
ZxBot force-pushed the renovate/node-22.x branch from e4df470 to 2d1da02 Compare August 17, 2026 03:27
@ZxBot
ZxBot force-pushed the renovate/node-22.x branch from 2d1da02 to c049e86 Compare August 26, 2026 03:53
@ZxBot

ZxBot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant