chore(deps): update node.js to v26.12.1 by renovate[bot] · Pull Request #114 · rstackjs/rstack-editor

renovate · 2026-10-26T01:03:50Z

This PR contains the following updates:

Package	Type	Update	Change	Pending
node (source)		minor	`26.11.1` → `26.12.1`	`v26.13.0`
@types/node (source)	devDependencies	major	`^22.20.5` → `^26.6.5`	`26.6.6`
node	uses-with	major	`22` → `26.12.1`

Release Notes

nodejs/node (node)

`v26.12.1`: 2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSS

Compare Source

This is a security release.

Notable Changes

(CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
(CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
(CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
(CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High
(CVE-2026-111497) deps: brotli: cherry-pick 0ed4268 (Evgenii Kliuchnikov) – High
(CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
(CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
(CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
(CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
(CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
deps: V8: backport 93cd21e (Joyee Cheung)
crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
tls: reject chains containing blocked public keys (Ulises Gascon)
deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
crypto: harden X.509 conversion and formatting (Filip Skokan)

Commits

[818e4ca061] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
[fd3c87ed43] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966
[acffa610db] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
[7895a5cd2d] - deps: update undici to 8.12.2 (Node.js GitHub Bot) #66721
[12daa54d2e] - deps: V8: backport 93cd21e (Joyee Cheung) nodejs-private/node-private#999
[6a8b3db7e2] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
[a6040b50d9] - deps: brotli: cherry-pick 0ed4268 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
[6b78ea171d] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
[0683ee5f7d] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
[e5cae10148] - Revert "module: synchronously load most ES modules" (Antoine du Hamel) #66786
[cc244131aa] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
[0392385841] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
[c273a408c9] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
[a2caddd20e] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871
[ad788ccd07] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
[cd4b05469c] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#985
[5fa440e0d7] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855
[745ad77156] - zlib: avoid caching invalid ZIP local headers (Matteo Collina) nodejs-private/node-private#981

`v26.12.0`: 2026-10-14, Version 26.12.0 (Current), @richardlau

Compare Source

Notable Changes

[1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533
[7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335

Commits

[30e76bb16a] - benchmark: fix input passed to subtle.digest in webcrypto-digest (Rafael Gonzaga) #66608
[adef72223a] - benchmark: fix buffer option in buffer read/write benchmarks (Rafael Gonzaga) #66604
[2f498f08fe] - benchmark: add util.parseArgs benchmark (Rafael Gonzaga) #66599
[4ce8412e18] - benchmark: fix url-searchparams-sort to sort a fresh list (RafaelGSS) #66535
[493bd6c66e] - benchmark,tools: fix napi benchmarks on GHA (Nigro Simone) #66423
[e4515552d6] - build: run QUIC CI for V8 changes (Yuya Inoue) #66602
[a888e51062] - build: support Python 3.15 (Mike McCready) #65750
[2afab9a63b] - build: do not include shared gtest in node link path (Antoine du Hamel) #66626
[f88c2f8ec6] - build,test: enable temporal support on no-ICU and system-ICU builds (Antoine du Hamel) #66697
[5fd03e6fdf] - child_process: propagate config-file permission flags to children (Rafael Gonzaga) #66559
[f771134b07] - crypto: isolate provider EC PKCS8 encoding (Filip Skokan) #66413
[4e00a293db] - crypto: remove key export and metadata locks (Filip Skokan) #66413
[bcd8018775] - crypto: remove verify setup key locking (Filip Skokan) #66413
[883250fee2] - crypto: remove KEM key locking (Filip Skokan) #66413
[9d98805071] - crypto: remove RSA-OAEP key locking (Filip Skokan) #66413
[d6293e7bb1] - crypto: skip secret key mutex allocation (Filip Skokan) #66413
[8d8af8003e] - crypto: keep the root cert store per Environment (Shelley Vohr) #66411
[c6f0614785] - crypto: remove select Web Crypto warnings (Filip Skokan) #66312
[e5360b5a08] - deps: update googletest to 988ea2c (Node.js GitHub Bot) #66652
[7eb230a2c1] - deps: update acorn to 8.19.0 (Node.js GitHub Bot) #66655
[af946ba8f3] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663
[007872a85d] - deps: V8: cherry-pick 8d14d49 (Antoine du Hamel) #66627
[f44aec4966] - deps: update simdjson to 5.0.3 (Daniel Lemire) #66620
[1a33e914e8] - deps: V8: cherry-pick 7d5eb1d (inoway46) #66566
[3294d51e5a] - diagnostics_channel: fix default callback context (Matteo Collina) #66481
[5c602a5824] - doc: list futimes among fd APIs disabled by the permission model (Rafael Gonzaga) #66649
[eaeb4736c8] - doc: add Test Runner to list of built-in diagnostic channels (Vas Sudanagunta) #66563
[0e1c99afae] - doc: document stream/iter behaviors and Node.js extensions (James M Snell) #66483
[846236367d] - doc: document URL and Uint8Array references in process.permission (Rafael Gonzaga) #66557
[fc3b067be7] - doc: clarify http Agent keepSocketAlive behavior (Efe Karasakal) #66252
[73a4e90ce2] - doc: document keepAliveTimeoutBuffer server option (Efe Karasakal) #66286
[bb816582af] - doc: fix request.reusedSocket timeout example (Efe Karasakal) #66286
[82223ab4d9] - doc: clarify revert PR label policy (Antoine du Hamel) #66529
[c6f59d4e8e] - doc: clarify node binary misuse after compromise (Rafael Gonzaga) #66530
[8904178498] - doc: document linux-x64-musl build toolchain (Issac) #66523
[1e8247a74e] - doc: run license-builder (github-actions[bot]) #66517
[b2773d5e4c] - doc: add missing return types in cluster.md (Daniel Pinto) #66453
[1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533
[c1073f31de] - ffi: fix exportArrayBuffer type check (Trivikram Kamat) #66455
[69148ee0ff] - fs: lock FileHandle on first read in pull() and pullSync() (James M Snell) #66483
[700c60a1cd] - fs: serialize FileHandle writer() async writes (James M Snell) #66483
[32833def1c] - http: reduce raw header name allocations (Roberto Bianchi) #66488
[7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335
[115731dda7] - http2: speed up response getHeaders (Roberto Bianchi) #66592
[447c36cb45] - lib: fix AbortSignal.any() nested composite leak (Darius) #66617
[1722ced4b4] - lib: add --allow-fs-vfs to permission available flags (Rafael Gonzaga) #66554
[062ece77fc] - lib: fix benchmark record acknowledgement race (Filip Skokan) #66430
[05d0b14438] - lib: set exit code on failed node:bench run() (RafaelGSS) #66534
[2cab299471] - lib: default node:bench warmup to 10 invocations (RafaelGSS) #66536
[83f507845d] - meta: bump nodejs/node-pr-labeler to dfe5eb3 (Soul Lee) #66606
[6fbffd5ee5] - meta: bump codecov/codecov-action from 7.1.0 to 7.1.1 (dependabot[bot]) #66448
[bd567f8bd6] - module: fix require of imports with package map (Lazizbek Ergashev) #66565
[c442f471a5] - module: synchronously load most ES modules (Geoffrey Booth) #62530
[51f66f0134] - permission: keep explicit fs grants when dropping a covering directory (Rafael Gonzaga) #66556
[1aa10d80e2] - process: mark process.finalization as release candidate (Matteo Collina) #66436
[dd4715a6ba] - querystring: fix value decoding after encoded keys (Ved Chaudhari) #66553
[9648a6ba8e] - quic: reject closed stream writer writes with a TypeError (James M Snell) #66483
[d6f566baf8] - quic: give each BindingData its own allocator state (Shelley Vohr) #66411
[c3204c15bd] - quic: validate session close error codes (Christian Aurich Zanettini Martins) #66302
[5b87354f5a] - quic: destroy stream on invalid promise body (Christian Aurich Zanettini Martins) #66260
[9ef698c781] - sqlite: validate aggregate() name and options (Guilherme Araújo) #66463
[bbf41f8cfb] - sqlite: persist enableDefensive() across reopen (Trivikram Kamat) #66404
[54867cd25e] - sqlite: throw on oversized strings instead of aborting (Trivikram Kamat) #66521
[4314cde48b] - src: release uv_fs_t in permission WildcardIfDir (Rafael Gonzaga) #66555
[0e58916f08] - src: stop including simdjson.h from env.h (Daniel Lemire) #66620
[06f56a55bb] - src: use native CopyArrayBufferBytes for webstream buffer copy (René) #66400
[2e3dd5bb63] - src: fix config file handling (Marco Ippolito) #66431
[cd86506bc2] - src: mark config file as stable (Marco Ippolito) #66431
[15ff9884e4] - stream: skip idle webstreams start and watchers (Matteo Collina) #66424
[3f75c89fb8] - stream: add pipeToSync() failOnIncompleteClose option (James M Snell) #66483
[6cecf140e7] - stream: do not fail the writer when pipeToSync() cannot close (James M Snell) #66483
[16833534b6] - stream: fix fromSync() async input error messages (James M Snell) #66483
[af41622ad8] - stream: reject closed fromWritable() writes with a TypeError (James M Snell) #66483
[4b83c6c38e] - stream: accept explicit stream/iter budgets below 16384 (James M Snell) #66483
[f302fbd04a] - stream: reduce per-chunk overhead in stream/iter consumers (James M Snell) #66483
[7ba60dcdbe] - stream: keep the original error when writer.fail() throws (James M Snell) #66483
[dcac51a7db] - stream: align pull() abort handling with the spec (James M Snell) #66483
[995dee6b6b] - stream: honor stream/iter protocols on function objects (James M Snell) #66483
[6eaf91353a] - stream: do not hold back nested async data in from() (James M Snell) #66483
[69d44aedb4] - stream: bound pre-batched async values in from() (James M Snell) #66483
[6b1e7c4cf1] - stream: guard shareSync() against re-entrant source reads (James M Snell) #66483
[8a47365425] - stream: split oversized share batches under drop-oldest (James M Snell) #66483
[30cbc4e643] - stream: reject drop-newest backpressure in shareSync() (James M Snell) #66483
[42ae08594e] - stream: detach shareSync consumers on strict budget errors (James M Snell) #66483
[fa49de9ba6] - stream: keep share buffer when all consumers detach (James M Snell) #66483
[e6662cb904] - stream: fix Utf8Stream flush handling (James M Snell) #66473
[93596b1a9e] - stream: add dump()/dumpSync() for stream/iter (Ethan Arrowood) #65598
[4ba6ce1b0c] - stream: port remaining SonicBoom tests for Utf8Stream (Matteo Collina) #66275
[cd8b5fa5b0] - test: tolerate async block count updates in test-fs-stat-bigint (Rafael Gonzaga) #66576
[30814ce991] - test: replace discard loops with dump() (Ethan Arrowood) #65598
[20441b8fc0] - test: run node-bench tools test sequentially (Filip Skokan) #66338
[9618da6fe3] - test: remove duplicated cases in permission fs-read fixture (Rafael Gonzaga) #66450
[c348a4cb46] - test: run instantiateStreaming-bad-imports WPT (Filip Skokan) #66322
[7d4fda6ba7] - test: honor allowed WPT promise rejections (Filip Skokan) #66322
[d4c87eb086] - test: scope Blob WPT failures to big-endian (Filip Skokan) #66322
[7309ddf204] - test_runner: rerun failing todo tests in suites (Barak) #66605
[da908b3072] - test_runner: report load errors with --test-isolation=none (Lazizbek Ergashev) #66550
[b18e121625] - test_runner: add mock call assertions to t.assert (Guilherme Araújo) #66476
[3d691ab75e] - tools: restore Python 3.14 for daily WPT (Filip Skokan) #66699
[714aca1ef6] - tools: switch to PGP and SHA256 in ICU updater (Antoine du Hamel) #66469
[fa9fca45e4] - tools: lint thread_local in src (Shelley Vohr) #66411
[dbc3e97847] - tools: copy hdr_histogram_internal.h in update-histogram.sh (Filipe Oliveira (Redis)) #66528
[4760c27904] - tools: bump the eslint group in /tools/eslint with 5 updates (dependabot[bot]) #66445
[63c20ee58e] - vfs: add ComposableProvider for layered mounts (Matteo Collina) #66235
[ab057989af] - watch: strip underscore aliases of watch flags (Trivikram Kamat) #66365