Skip to content

Update Node.js to v26 - #397

Open
renovate[bot] wants to merge 1 commit into
1.37.xfrom
renovate/node-26.x
Open

renovate[bot] wants to merge 1 commit into
1.37.xfrom
renovate/node-26.x

Conversation

@renovate

@renovate renovate Bot commented Aug 3, 2026 •

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Adoption Passing Confidence
node (source) engines major ^24.10.0 → ^26.0.0 age adoption passing confidence
@types/node (source) devDependencies major ^24.8.0 → ^26.0.0 age adoption passing confidence
node uses-with major 24 → 26 age adoption passing confidence
node (source) final major 24.22.2-alpine → 26.13.0-alpine age adoption passing confidence
node (source) stage major 24.22.2-alpine → 26.13.0-alpine age adoption passing confidence

Release Notes

nodejs/node (node)

v26.13.0: 2026-10-28, Version 26.13.0 'Lithium' (LTS), @​richardlau

Compare Source

Notable Changes

This release marks the transition of Node.js 26.x into Long Term Support (LTS)
with the codename 'Lithium'. It will continue to receive updates through to
the end of April 2029.

Other than updating metadata, such as the process.release object, to reflect
that the release is LTS, no further changes from Node.js 26.12.1 are included.

If you are updating from an earlier Long Term Support release (e.g. Node.js 24
or 22 or earlier) please note that since Node.js 25 the official binaries for
Linux are linked against libatomic, which may need to be installed separately
depending on your Linux distribution.

v26.12.1: 2026-10-21, Version 26.12.1 (Current), @​aduh95 prepared by @​RafaelGSS

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
  • (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
  • (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
  • (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High
  • (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268 (Evgenii Kliuchnikov) – High
  • (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
  • (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
  • (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
  • (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
  • (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
  • deps: V8: backport 93cd21e (Joyee Cheung)
  • crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
  • tls: reject chains containing blocked public keys (Ulises Gascon)
  • deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
  • tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
  • crypto: harden X.509 conversion and formatting (Filip Skokan)
Commits

v26.12.0: 2026-10-14, Version 26.12.0 (Current), @​richardlau

Compare Source

Notable Changes
  • [1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #​66533
  • [7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #​66335
Commits

v26.11.1: 2026-10-07, Version 26.11.1 (Current), @​aduh95

Compare Source

Commits
  • [2dc4638e85] - Revert "build: toggle doc-kit verbosity based on V" (Antoine du Hamel)
  • [3febbc54ec] - Revert "build, doc: move to redesign" (Antoine du Hamel)
  • [173250e2e7] - Revert "tools: bump the doc group in /tools/doc with 4 updates" (Antoine du Hamel)

v26.11.0: 2026-10-07, Version 26.11.0 (Current), @​aduh95

Compare Source

Notable Changes
  • [232f178825] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #​66298
  • [27778036de] - (SEMVER-MINOR) buffer: add Buffer.stringLength() (Matteo Collina) #​66064
  • [4f84c4bda2] - build, doc: move to redesign (Aviv Keller) #​62045
  • [6f6296fef9] - (SEMVER-MINOR) doc: promote Alpine Linux to tier 2 support (Stewart X Addison) #​63737
  • [e998d260d0] - (SEMVER-MINOR) http: add isValidHeaderName() and isValidHeaderValue() (James M Snell) #​66334
  • [7702a50e08] - (SEMVER-MINOR) http2: add connectionWindowSize option (Tim Perry) #​65619
  • [e06aa62cec] - (SEMVER-MINOR) perf_hooks: fix truncation of monitorEventLoopDelay() resolution (James M Snell) #​66115
  • [ee126e37e8] - (SEMVER-MINOR) perf_hooks: allow RecordableHistogram to record 0 (James M Snell) #​66114
  • [1fef8f54db] - (SEMVER-MINOR) perf_hooks: add histogram.diff() (James M Snell) #​66099
  • [f1b9758c4e] - (SEMVER-MINOR) perf_hooks: add histogram.snapshot() (James M Snell) #​66099
  • [291d56ea3e] - (SEMVER-MINOR) perf_hooks: harden histogram CBOR import validation (James M Snell) #​66098
  • [6299b09d5c] - (SEMVER-MINOR) process: graduate process.ref/unref to stable (James M Snell) #​66213
  • [41d6707b63] - (SEMVER-MINOR) sqlite: rename DatabaseSync and StatementSync (Guilherme Araújo) #​65988
  • [60d0aa0cd4] - (SEMVER-MINOR) src: add --process-timeout=N (James M Snell) #​66138
  • [f39916a7e3] - (SEMVER-MINOR) src: expose size and count in heap profile output (Ilyas Shabi) #​65737
  • [0b00d5ea59] - (SEMVER-MINOR) src: let embedders exempt linked bindings from the addon permission (Shelley Vohr) #​66067
Commits

[!IMPORTANT]
✂ PR body was truncated to here.


Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

Read more information about the use of Renovate Bot within Laminas.

@renovate renovate Bot added the renovate label Aug 3, 2026
@renovate
renovate Bot force-pushed the renovate/node-26.x branch 6 times, most recently from 7ba14be to 1d0fb2d Compare August 7, 2026 18:46
@renovate
renovate Bot force-pushed the renovate/node-26.x branch 2 times, most recently from 9b626e2 to eb2f629 Compare August 18, 2026 14:00
@renovate
renovate Bot force-pushed the renovate/node-26.x branch 5 times, most recently from 66ee38d to 59148b1 Compare August 27, 2026 12:25
@renovate
renovate Bot changed the base branch from 1.34.x to 1.35.x August 27, 2026 12:28
@renovate
renovate Bot force-pushed the renovate/node-26.x branch 7 times, most recently from 8ffe909 to 2b99f86 Compare September 1, 2026 22:06
@renovate
renovate Bot force-pushed the renovate/node-26.x branch 6 times, most recently from 5e94f1b to 69266b1 Compare September 11, 2026 08:59
@renovate
renovate Bot force-pushed the renovate/node-26.x branch 2 times, most recently from 982db86 to a77707f Compare September 15, 2026 21:17
@renovate
renovate Bot force-pushed the renovate/node-26.x branch 6 times, most recently from ca22939 to c278431 Compare September 23, 2026 02:37
@renovate
renovate Bot force-pushed the renovate/node-26.x branch 2 times, most recently from ca92f69 to b6fd1e0 Compare September 24, 2026 10:19
@renovate
renovate Bot changed the base branch from 1.36.x to 1.37.x September 24, 2026 10:19
@renovate
renovate Bot force-pushed the renovate/node-26.x branch 3 times, most recently from 6375c86 to be6dd88 Compare September 29, 2026 05:34
@renovate
renovate Bot force-pushed the renovate/node-26.x branch 4 times, most recently from 0abea12 to d7c0ed9 Compare October 8, 2026 07:02
@renovate
renovate Bot force-pushed the renovate/node-26.x branch 4 times, most recently from d652ec9 to 37d30fe Compare October 15, 2026 04:27
@renovate
renovate Bot force-pushed the renovate/node-26.x branch 4 times, most recently from 11b9998 to 262efea Compare October 23, 2026 04:17
@renovate
renovate Bot force-pushed the renovate/node-26.x branch from 262efea to 3b3fc82 Compare October 23, 2026 19:42
@renovate
renovate Bot force-pushed the renovate/node-26.x branch from 3b3fc82 to 4c1a5d5 Compare October 30, 2026 23:37
@renovate renovate Bot changed the title Update node Docker tag to v26 Update Node.js to v26 Oct 30, 2026
@renovate
renovate Bot force-pushed the renovate/node-26.x branch from 4c1a5d5 to 5ddf764 Compare October 31, 2026 02:46
| datasource      | package               | from     | to       |
| --------------- | --------------------- | -------- | -------- |
| node-version    | node                  | v24.22.2 | v26.13.0 |
| npm             | @types/node           | 24.19.2  | 26.6.6   |
| github-releases | actions/node-versions | 24.22.2  | 26.13.0  |
| docker          | node                  | 24.22.2  | 26.13.0  |


Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate
renovate Bot force-pushed the renovate/node-26.x branch from 5ddf764 to 038d2cb Compare November 1, 2026 14:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants