chore(deps): update dependency node to v24 #385

(CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797
(CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748
lib,permission:
(CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
src:
(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
src,lib:
(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
tls:
(CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#796

Commits

[2092785d01] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #60997
[3e58b7f2af] - deps: update undici to 7.18.2 (Node.js GitHub Bot) #61283
[4ba536a5a6] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797
[89adaa21fd] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748
[7302b4dae1] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
[ac030753c4] - (CVE-2025-59466) src: rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
[20075692fe] - (CVE-2025-55131) src,lib: refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
[20591b0618] - (CVE-2026-21637) tls: route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#796

`v24.12.0`: 2025-12-10, Version 24.12.0 'Krypton' (LTS), @targos

Compare Source

Notable Changes

[1a00b5f68a] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #59778
[ff5754077d] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #59982
[8987159234] - (SEMVER-MINOR) module: mark type stripping as stable (Marco Ippolito) #60600
[92c484ebf4] - (SEMVER-MINOR) node-api: add napi_create_object_with_properties (Miguel Marcondes Filho) #59953
[b11bc5984e] - (SEMVER-MINOR) sqlite: allow setting defensive flag (Bart Louwers) #60217
[e7da5b4b7d] - (SEMVER-MINOR) src: add watch config namespace (Marco Ippolito) #60178
[a7f7d10c06] - (SEMVER-MINOR) src: add an option to make compile cache portable (Aditi) #58797
[92ea669240] - (SEMVER-MINOR) src,permission: add --allow-inspector ability (Rafael Gonzaga) #59711
[05d7509bd2] - (SEMVER-MINOR) v8: add cpu profile (theanarkh) #59807

Commits

[e4a23a35ac] - benchmark: focus on import.meta intialization in import-meta benchmark (Joyee Cheung) #60603
[b6114ae5c9] - benchmark: add per-suite setup option (Joyee Cheung) #60574
[ac8e90af7c] - buffer: speed up concat via TypedArray#set (Gürgün Dayıoğlu) #60399
[acbc8ca13e] - build: upgrade Python linter ruff, add rules ASYNC,PERF (Christian Clauss) #59984
[f97a609a07] - console: optimize single-string logging (Gürgün Dayıoğlu) #60422
[6cd9bdc580] - crypto: ensure documented RSA-PSS saltLength default is used (Filip Skokan) #60662
[0fafe24d9b] - crypto: fix argument validation in crypto.timingSafeEqual fast path (Joyee Cheung) #60538
[54421e0419] - debugger: fix event listener leak in the run command (Joyee Cheung) #60464
[c361a628b4] - deps: V8: cherry-pick 72b0e27 (pthier) #60732
[c70f4588dd] - deps: V8: cherry-pick 6bb32bd (Erik Corry) #60732
[881fe784c5] - deps: V8: cherry-pick 0dd2318 (Erik Corry) #60732
[457c33efcc] - deps: V8: cherry-pick df20105 (Erik Corry) #60732
[0bf45a829c] - deps: V8: backport e5dbbba (Darshan Sen) #60524
[4993bdc476] - deps: V8: cherry-pick 5ba9200 (Juan José Arboleda) #60620
[1e9abe0078] - deps: update corepack to 0.34.5 (Node.js GitHub Bot) #60842
[3f704ed08f] - deps: update corepack to 0.34.4 (Node.js GitHub Bot) #60643
[04e360fdb1] - deps: V8: cherry-pick 06bf293, 146962d and e0fb10b (Michaël Zasso) #60713
[fcbd8dbbde] - deps: patch V8 to 13.6.233.17 (Michaël Zasso) #60712
[28e9433f39] - deps: V8: cherry-pick 8735658 (Joyee Cheung) #60069
[3cac85b243] - deps: V8: backport 2e4c5cf (Michaël Zasso) #60654
[1daece1970] - deps: call OPENSSL_free after ANS1_STRING_to_UTF8 (Rafael Gonzaga) #60609
[5f55a9c9ea] - deps: nghttp2: revert 7784fa9 (Antoine du Hamel) #59790
[1d9e7c1f4d] - deps: update nghttp2 to 1.67.1 (nodejs-github-bot) #59790
[3140415068] - deps: update simdjson to 4.1.0 (Node.js GitHub Bot) #60542
[d911f9f1b8] - deps: update amaro to 1.1.5 (Node.js GitHub Bot) #60541
[daaaf04a32] - deps: V8: cherry-pick 2abc613 (Richard Lau) #60177
[b4f63ee5f8] - doc: update Collaborators list to reflect hybrist handle change (Antoine du Hamel) #60650
[effcf7a8ab] - doc: fix link in --env-file=file section (N. Bighetti) #60563
[7011736703] - doc: fix linter issues (Antoine du Hamel) #60636
[5cc79d8945] - doc: add missing history entry for sqlite.md (Antoine du Hamel) #60607
[bbc649057c] - doc: correct values/references for buffer.kMaxLength (René) #60305
[ea7ecb517b] - doc: recommend events.once to manage 'close' event (Dan Fabulich) #60017
[58bff04cc2] - doc: highlight module loading difference between import and require (Ajay A) #59815
[bbcbff9b4d] - doc: add CJS code snippets in sqlite.md (Allon Murienik) #60395
[f8af33d5a7] - doc: fix typo in process.unref documentation (우혁) #59698
[df105dc351] - doc: add some entries to glossary.md (Mohataseem Khan) #59277
[4955cb2b5b] - doc: improve agent.createConnection docs for http and https agents (JaeHo Jang) #58205
[6283bb5cc9] - doc: fix pseudo code in modules.md (chirsz) #57677
[d5059ea537] - doc: add missing variable in code snippet (Koushil Mankali) #55478
[900de373ae] - doc: add missing word in single-executable-applications.md (Konstantin Tsabolov) #53864
[5735044c8b] - doc: fix typo in http.md (Michael Solomon) #59354
[2dee6df831] - doc: update devcontainer.json and add documentation (Joyee Cheung) #60472
[8f2d98d7d2] - doc: add haramj as triager (Haram Jeong) #60348
[bbd7fdfff4] - doc: clarify require(esm) description (dynst) #60520
[33ad11a764] - doc: instantiate resolver object (Donghoon Nam) #60476
[81a61274f3] - doc: correct module loading descriptions (Joyee Cheung) #60346
[77911185fe] - doc: clarify --use-system-ca support status (Joyee Cheung) #60340
[185f6e95d9] - doc,crypto: link keygen to supported types (Filip Skokan) #60585
[772d6c6608] - doc,src,lib: clarify experimental status of Web Storage support (Antoine du Hamel) #60708
[ad98e11ac2] - esm: use sync loading/resolving on non-loader-hook thread (Joyee Cheung) #60380
[1a00b5f68a] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #59778
[5703ce68bc] - http: replace startsWith with strict equality (btea) #59394
[2b696ffad8] - http2: add diagnostics channels for client stream request body (Darshan Sen) #60480
[dbdf4cb5a5] - inspector: inspect HTTP response body (Chengzhong Wu) #60572
[9dc9a7d33d] - inspector: support inspecting HTTP/2 request and response bodies (Darshan Sen) #60483
[89fa2befe4] - inspector: fix crash when receiving non json message (Shima Ryuhei) #60388
[ff5754077d] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #59982
[33baaf42c8] - lib: replace global SharedArrayBuffer constructor with bound method (Renegade334) #60497
[b047586a08] - meta: bump actions/download-artifact from 5.0.0 to 6.0.0 (dependabot[bot]) #60532
[64192176d7] - meta: bump actions/upload-artifact from 4.6.2 to 5.0.0 (dependabot[bot]) #60531
[af6d4a6b9b] - meta: bump github/codeql-action from 3.30.5 to 4.31.2 (dependabot[bot]) #60533
[c17276fd24] - meta: bump actions/setup-node from 5.0.0 to 6.0.0 (dependabot[bot]) #60529
[6e8b52a7dc] - meta: bump actions/stale from 10.0.0 to 10.1.0 (dependabot[bot]) #60528
[a12658595b] - meta: call create-release-post.yml post release (Aviv Keller) #60366
[8987159234] - (SEMVER-MINOR) module: mark type stripping as stable (Marco Ippolito) #60600
[36da413663] - module: fix directory option in the enableCompileCache() API (Joyee Cheung) #59931
[92c484ebf4] - (SEMVER-MINOR) node-api: add napi_create_object_with_properties (Miguel Marcondes Filho) #59953
[545162b0d4] - node-api: use local files for instanceof test (Vladimir Morozov) #60190
[526c011d89] - perf_hooks: fix stack overflow error (Antoine du Hamel) #60084
[1de0476939] - perf_hooks: move non-standard performance properties to perf_hooks (Chengzhong Wu) #60370
[07ec1239ef] - repl: fix pasting after moving the cursor to the left (Ruben Bridgewater) #60470
[b11bc5984e] - (SEMVER-MINOR) sqlite: allow setting defensive flag (Bart Louwers) #60217
[273c9661fd] - sqlite,doc: fix StatementSync section (Edy Silva) #60474
[d92ec21a4c] - src: use CP_UTF8 for wide file names on win32 (Fedor Indutny) #60575
[baef0468ed] - src: move Node-API version detection to where it is used (Anna Henningsen) #60512
[e7da5b4b7d] - (SEMVER-MINOR) src: add watch config namespace (Marco Ippolito) #60178
[a7f7d10c06] - (SEMVER-MINOR) src: add an option to make compile cache portable (Aditi) #58797
[566add0b19] - src: avoid C strings in more C++ exception throws (Anna Henningsen) #60592
[9b796347c1] - src: add internal binding for constructing SharedArrayBuffers (Renegade334) #60497
[3b01cbb411] - src: move napi_addon_register_func to node_api_types.h (Anna Henningsen) #60512
[02fb7f4ecb] - src: remove unconditional NAPI_EXPERIMENTAL in node.h (Chengzhong Wu) #60345
[bd09ae24e4] - src: clean up generic counter implementation (Anna Henningsen) #60447
[cd6bf51dbd] - src: add enum handle for ToStringHelper + formatting (Burkov Egor) #56829
[92ea669240] - (SEMVER-MINOR) src,permission: add --allow-inspector ability (Rafael Gonzaga) #59711
[ac3dbe48f7] - stream: don't try to read more if reading (Robert Nagy) #60454
[790288a93b] - test: ensure assertions are reachable in test/internet (Antoine du Hamel) #60513
[0a85132989] - test: fix status when compiled without inspector (Antoine du Hamel) #60289
[2f57673172] - test: deflake test-perf-hooks-timerify-histogram-sync (Joyee Cheung) #60639
[09726269de] - test: apply a delay to watch-mode-kill-signal tests (Joyee Cheung) #60610
[45537b9562] - test: async iife in repl (Tony Gorez) #44878
[4ca81f101d] - test: parallelize sea tests when there's enough disk space (Joyee Cheung) #60604
[ea71e96191] - test: only show overridden env in child process failures (Joyee Cheung) #60556
[06b2e348c7] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60498
[de9c8cb670] - test: ensure assertions are reachable in test/es-module (Antoine du Hamel) #60501
[75bc40fced] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60485
[1a6084cfd3] - test: ensure assertions are reached on more tests (Antoine du Hamel) #60500
[2c651c90cf] - test: split test-perf-hooks-timerify (Joyee Cheung) #60568
[6e8b5f7345] - test: add more logs to test-esm-loader-hooks-inspect-wait (Joyee Cheung) #60466
[9dea7ffa30] - test: mark stringbytes-external-exceed-max tests as flaky on AIX (Joyee Cheung) #60565
[0b3c3b710a] - test: split test-esm-wasm.js (Joyee Cheung) #60491
[a15b795b34] - test: correct conditional secure heap flags test (Shelley Vohr) #60385
[38b77b3a44] - test: fix flaky test-watch-mode-kill-signal-* (Joyee Cheung) #60443
[e8d7598057] - test: capture stack trace in debugger timeout errors (Joyee Cheung) #60457
[674befeb81] - test: ensure assertions are reachable in test/sequential (Antoine du Hamel) #60412
[952c08a735] - test: ensure assertions are reachable in more folders (Antoine du Hamel) #60411
[bbca57584b] - test: split test-runner-watch-mode (Joyee Cheung) #60391
[e78e0cf6e7] - test: move test-runner-watch-mode helper into common (Joyee Cheung) #60391
[84576ef021] - test: ensure assertions are reachable in test/addons (Antoine du Hamel) #60142
[1659078c11] - test: ignore EPIPE errors in https proxy invalid URL test (Joyee Cheung) #60269
[79ffee80ec] - test: ensure assertions are reachable in test/client-proxy (Antoine du Hamel) #60175
[e5a812243a] - test: ensure assertions are reachable in test/async-hooks (Antoine du Hamel) #60150
[e924fd72e3] - test,crypto: handle a few more BoringSSL tests (Shelley Vohr) #59030
[a55ac11611] - test,crypto: update x448 and ed448 expectation when on boringssl (Shelley Vohr) #60387
[55d5e9ec73] - tls: fix leak on invalid protocol method (Shelley Vohr) #60427
[5763c96e7c] - tools: replace invalid expression in dependabot config (Riddhi) #60649
[b6e21b47d7] - tools: skip unaffected GHA jobs for changes in test/internet (Antoine du Hamel) #60517
[999664c76d] - tools: do not use short hashes for deps versioning to avoid collision (Antoine du Hamel) #60407
[ada856d0fb] - tools: only add test reporter args when node:test is used (Joyee Cheung) #60551
[1812c56bb3] - tools: fix update-icu script (Michaël Zasso) #60521
[747040438a] - tools: fix linter for semver-major release proposals (Antoine du Hamel) #60481
[f170551e40] - tools: fix failing release-proposal linter for LTS transitions (Antoine du Hamel) #60465
[2db4ea0ce4] - tools: remove undici from daily wpt.fyi job (Filip Skokan) #60444
[2a85aa4e7b] - tools: add lint rule to ensure assertions are reached (Antoine du Hamel) #60125
[48299ef5fb] - tools,doc: update JavaScript primitive types to match MDN Web Docs (JustApple) #60581
[7ec04cf936] - util: fix stylize of special properties in inspect (Ge Gao) #60479
[05d7509bd2] - (SEMVER-MINOR) v8: add cpu profile (theanarkh) #59807
[884fe884a1] - vm: hint module identifier in instantiate errors (Chengzhong Wu) #60199
[a2caf19f70] - watch: fix interaction with multiple env files (Marco Ippolito) #60605

`v24.11.1`: 2025-11-11, Version 24.11.1 'Krypton' (LTS), @aduh95

Compare Source

Notable Changes

The known issue relating to Buffer.allocUnsafe incorrectly zero-filling buffers
has now been addressed and now returns uninitialized memory as documented in the
Buffer.allocUnsafe
documentation.

Commits

[0a15ccf3f4] - benchmark: improve cpu.sh for safety and usability (Nam Yooseong) #60162
[a1c7d1dac9] - benchmark: add benchmark for leaf source text modules (Joyee Cheung) #60205
[99e2acf46b] - benchmark: add vm.SourceTextModule benchmark (Joyee Cheung) [#59396

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2025-10-28T16:14:02Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

renovate bot force-pushed the renovate/node-24.x branch from 0d8342a to e88e573 Compare October 29, 2025 01:51

renovate bot force-pushed the renovate/node-24.x branch from e88e573 to 91d11bf Compare November 13, 2025 00:05

renovate bot force-pushed the renovate/node-24.x branch from 91d11bf to 62310fe Compare November 21, 2025 06:31

renovate bot force-pushed the renovate/node-24.x branch 2 times, most recently from f7f78c6 to a49c94b Compare December 11, 2025 20:33

chore(deps): update dependency node to v24

5cf627c

renovate bot force-pushed the renovate/node-24.x branch from a49c94b to 5cf627c Compare January 15, 2026 01:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency node to v24 #385

chore(deps): update dependency node to v24 #385

Uh oh!

renovate bot commented Oct 28, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Oct 28, 2025

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chore(deps): update dependency node to v24 #385

Are you sure you want to change the base?

chore(deps): update dependency node to v24 #385

Uh oh!

Conversation

renovate bot commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v24.13.0: 24.13.0

v24.12.0: 24.12.0

v24.11.1: 24.11.1

v24.11.0: 24.11.0

v24.10.0: 24.10.0

v24.9.0: 24.9.0

v24.8.0: 24.8.0

v24.7.0: 24.7.0

v24.6.0: 24.6.0

v24.5.0: 24.5.0

v24.4.1: 24.4.1

v24.4.0: 24.4.0

v24.3.0: 24.3.0

v24.2.0: 24.2.0

v24.1.0: 24.1.0

v24.0.2: 24.0.2

v24.0.1: 24.0.1

v24.0.0: 24.0.0

v22.22.0: 22.22.0

v22.21.1: 22.21.1

v22.21.0: 22.21.0

v22.20.0: 22.20.0

v22.19.0: 22.19.0

v22.18.0: 22.18.0

v22.17.1: 22.17.1

v22.17.0: 22.17.0

v22.16.0: 22.16.0

v22.15.1: 22.15.1

v22.15.0: 22.15.0

v22.14.0: 22.14.0

v22.13.1: 22.13.1

v22.13.0: 22.13.0

v22.12.0: 22.12.0

v22.11.0: 22.11.0

v22.10.0: 22.10.0

v22.9.0: 22.9.0

v22.8.0: 22.8.0

v22.7.0: 22.7.0

v22.6.0: 22.6.0

v22.5.1: 22.5.1

v22.5.0: 22.5.0

v22.4.1: 22.4.1

v22.4.0: 22.4.0

v22.3.0: 22.3.0

v22.2.0: 22.2.0

v22.1.0: 22.1.0

v22.0.0: 22.0.0

v20.20.0: 20.20.0

v20.19.6: 20.19.6

v20.19.5: 20.19.5

v20.19.4: 20.19.4

v20.19.3: 20.19.3

v20.19.2: 20.19.2

v20.19.1: 20.19.1

v20.19.0: 20.19.0

v20.18.3: 20.18.3

v20.18.2: 20.18.2

v20.18.1: 20.18.1

v20.18.0: 20.18.0

v20.17.0: 20.17.0

v20.16.0: 20.16.0

v20.15.1: 20.15.1

v20.15.0: 20.15.0

v20.14.0: 20.14.0

v20.13.1: 20.13.1

v20.13.0: 20.13.0

v20.12.2: 20.12.2

v20.12.1: 20.12.1

v20.12.0: 20.12.0

v20.11.1: 20.11.1

v20.11.0: 20.11.0

v20.10.0: 20.10.0

renovate bot commented Oct 28, 2025 •

edited

Loading

`v24.13.0`: 24.13.0

`v24.12.0`: 24.12.0

`v24.11.1`: 24.11.1

`v24.11.0`: 24.11.0

`v24.10.0`: 24.10.0

`v24.9.0`: 24.9.0

`v24.8.0`: 24.8.0

`v24.7.0`: 24.7.0

`v24.6.0`: 24.6.0

`v24.5.0`: 24.5.0

`v24.4.1`: 24.4.1

`v24.4.0`: 24.4.0

`v24.3.0`: 24.3.0

`v24.2.0`: 24.2.0

`v24.1.0`: 24.1.0

`v24.0.2`: 24.0.2

`v24.0.1`: 24.0.1

`v24.0.0`: 24.0.0

`v22.22.0`: 22.22.0

`v22.21.1`: 22.21.1

`v22.21.0`: 22.21.0

`v22.20.0`: 22.20.0

`v22.19.0`: 22.19.0

`v22.18.0`: 22.18.0

`v22.17.1`: 22.17.1

`v22.17.0`: 22.17.0

`v22.16.0`: 22.16.0

`v22.15.1`: 22.15.1

`v22.15.0`: 22.15.0

`v22.14.0`: 22.14.0

`v22.13.1`: 22.13.1

`v22.13.0`: 22.13.0

`v22.12.0`: 22.12.0

`v22.11.0`: 22.11.0

`v22.10.0`: 22.10.0

`v22.9.0`: 22.9.0

`v22.8.0`: 22.8.0

`v22.7.0`: 22.7.0

`v22.6.0`: 22.6.0

`v22.5.1`: 22.5.1

`v22.5.0`: 22.5.0

`v22.4.1`: 22.4.1

`v22.4.0`: 22.4.0

`v22.3.0`: 22.3.0

`v22.2.0`: 22.2.0

`v22.1.0`: 22.1.0

`v22.0.0`: 22.0.0

`v20.20.0`: 20.20.0

`v20.19.6`: 20.19.6

`v20.19.5`: 20.19.5

`v20.19.4`: 20.19.4

`v20.19.3`: 20.19.3

`v20.19.2`: 20.19.2

`v20.19.1`: 20.19.1

`v20.19.0`: 20.19.0

`v20.18.3`: 20.18.3

`v20.18.2`: 20.18.2

`v20.18.1`: 20.18.1

`v20.18.0`: 20.18.0

`v20.17.0`: 20.17.0

`v20.16.0`: 20.16.0

`v20.15.1`: 20.15.1

`v20.15.0`: 20.15.0

`v20.14.0`: 20.14.0

`v20.13.1`: 20.13.1

`v20.13.0`: 20.13.0

`v20.12.2`: 20.12.2

`v20.12.1`: 20.12.1

`v20.12.0`: 20.12.0

`v20.11.1`: 20.11.1

`v20.11.0`: 20.11.0

`v20.10.0`: 20.10.0

`v20.9.0`: 20.9.0

`v20.8.1`: 20.8.1

`v20.8.0`: 20.8.0

`v20.7.0`: 20.7.0

`v20.6.1`: 20.6.1

`v20.6.0`: 20.6.0

`v20.5.1`: 20.5.1