Update Node.js to v26.13.1 #87

Open
teckids_renovate_bot wants to merge 1 commit from renovate/node-26.x into main

This PR contains the following updates:

Package Type Update Change
node (source) stage minor 26.12.1 → 26.13.1

Release Notes

nodejs/node (node)

v26.13.1: 2026-11-11, Version 26.13.1 'Lithium' (LTS), @​aduh95

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
  • (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
  • (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
  • (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
  • (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
  • (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
  • (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
  • (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
  • (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
  • (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
  • (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
  • (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
  • (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
  • (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
  • (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
  • (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
  • (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
  • (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
  • deps: update brotli to 1.2.1 (Node.js GitHub Bot)
  • deps: update llhttp to 9.4.4 (Antoine du Hamel)
  • deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
  • deps: update undici to 8.12.4 (Node.js GitHub Bot)
Commits

v26.13.0: 2026-10-28, Version 26.13.0 'Lithium' (LTS), @​richardlau

Compare Source

Notable Changes

This release marks the transition of Node.js 26.x into Long Term Support (LTS)
with the codename 'Lithium'. It will continue to receive updates through to
the end of April 2029.

Other than updating metadata, such as the process.release object, to reflect
that the release is LTS, no further changes from Node.js 26.12.1 are included.

If you are updating from an earlier Long Term Support release (e.g. Node.js 24
or 22 or earlier) please note that since Node.js 25 the official binaries for
Linux are linked against libatomic, which may need to be installed separately
depending on your Linux distribution.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [node](https://hub.docker.com/_/node) ([source](https://github.com/nodejs/node)) | stage | minor | `26.12.1` → `26.13.1` | --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v26.13.1`](https://github.com/nodejs/node/releases/tag/v26.13.1): 2026-11-11, Version 26.13.1 'Lithium' (LTS), @&#8203;aduh95 [Compare Source](https://github.com/nodejs/node/compare/v26.13.0...v26.13.1) This is a security release. ##### Notable Changes - (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High - (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High - (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High - (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High - (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High - (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High - (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High - (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High - (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High - (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium - (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium - (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium - (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium - (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium - (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium - (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low - (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low - (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low - deps: update brotli to 1.2.1 (Node.js GitHub Bot) - deps: update llhttp to 9.4.4 (Antoine du Hamel) - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) - deps: update undici to 8.12.4 (Node.js GitHub Bot) ##### Commits - \[[`7b777661f5`](https://github.com/nodejs/node/commit/7b777661f5)] - **build**: respect OpenSSL's configured API level (Filip Skokan) [#&#8203;66953](https://github.com/nodejs/node/pull/66953) - \[[`4518c7501f`](https://github.com/nodejs/node/commit/4518c7501f)] - **crypto**: fix builds with older OpenSSL 3.0 (Filip Skokan) [#&#8203;66931](https://github.com/nodejs/node/pull/66931) - \[[`94b73673b8`](https://github.com/nodejs/node/commit/94b73673b8)] - **deps**: brotli: cherry-pick [`e230f47`](https://github.com/nodejs/node/commit/e230f474b87) (liujiahui) [#&#8203;61003](https://github.com/nodejs/node/pull/61003) - \[[`e315236158`](https://github.com/nodejs/node/commit/e315236158)] - **deps**: update llhttp to 9.4.4 (Antoine du Hamel) [nodejs-private/node-private#1038](https://github.com/nodejs-private/node-private/pull/1038) - \[[`8e714f7daa`](https://github.com/nodejs/node/commit/8e714f7daa)] - **deps**: update undici to 8.12.4 (Node.js GitHub Bot) [#&#8203;67272](https://github.com/nodejs/node/pull/67272) - \[[`af48b1a4d5`](https://github.com/nodejs/node/commit/af48b1a4d5)] - **deps**: update brotli to 1.2.1 (Node.js GitHub Bot) [#&#8203;66990](https://github.com/nodejs/node/pull/66990) - \[[`60316405bb`](https://github.com/nodejs/node/commit/60316405bb)] - **deps**: update undici to 8.12.3 (Node.js GitHub Bot) [#&#8203;66993](https://github.com/nodejs/node/pull/66993) - \[[`89b17baef4`](https://github.com/nodejs/node/commit/89b17baef4)] - **deps**: update sqlite to 3.54.1 (Node.js GitHub Bot) [#&#8203;66816](https://github.com/nodejs/node/pull/66816) - \[[`d14db811c7`](https://github.com/nodejs/node/commit/d14db811c7)] - **http**: redact proxy credentials in invalid proxy URL errors (Matteo Collina) [nodejs-private/node-private#1001](https://github.com/nodejs-private/node-private/pull/1001) - \[[`9183db64fe`](https://github.com/nodejs/node/commit/9183db64fe)] - **http2**: retain streams during pending writes (Matteo Collina) [nodejs-private/node-private#1040](https://github.com/nodejs-private/node-private/pull/1040) - \[[`62ae278a23`](https://github.com/nodejs/node/commit/62ae278a23)] - **http2**: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) [nodejs-private/node-private#1000](https://github.com/nodejs-private/node-private/pull/1000) - \[[`7df134e2ce`](https://github.com/nodejs/node/commit/7df134e2ce)] - **http2**: retain buffers until socket writes finish (Matteo Collina) [nodejs-private/node-private#1017](https://github.com/nodejs-private/node-private/pull/1017) - \[[`0ff0cf6749`](https://github.com/nodejs/node/commit/0ff0cf6749)] - **http2**: release headers when a stream is removed (Matteo Collina) [nodejs-private/node-private#1026](https://github.com/nodejs-private/node-private/pull/1026) - \[[`a84a01ddb8`](https://github.com/nodejs/node/commit/a84a01ddb8)] - **http2**: avoid overflowing ALTSVC buffers (Matteo Collina) [nodejs-private/node-private#1035](https://github.com/nodejs-private/node-private/pull/1035) - \[[`3fc67dc056`](https://github.com/nodejs/node/commit/3fc67dc056)] - **http2**: detect streams abandoned by nghttp2 (Matteo Collina) [#&#8203;66641](https://github.com/nodejs/node/pull/66641) - \[[`df4011dafe`](https://github.com/nodejs/node/commit/df4011dafe)] - **http2**: guard against null write request on cancelled stream (Matteo Collina) [#&#8203;67252](https://github.com/nodejs/node/pull/67252) - \[[`fa61009dc1`](https://github.com/nodejs/node/commit/fa61009dc1)] - **https**: isolate Agent TLS policy keys (Matteo Collina) [nodejs-private/node-private#1036](https://github.com/nodejs-private/node-private/pull/1036) - \[[`40d3d8ddca`](https://github.com/nodejs/node/commit/40d3d8ddca)] - **permission**: do not leak denied descendants in recursive fs.watch (RafaelGSS) [nodejs-private/node-private#967](https://github.com/nodejs-private/node-private/pull/967) - \[[`6c85b8e371`](https://github.com/nodejs/node/commit/6c85b8e371)] - **tls**: fix remotely reachable TLS server crash (Tim Perry) [nodejs-private/node-private#1018](https://github.com/nodejs-private/node-private/pull/1018) - \[[`a8d6286949`](https://github.com/nodejs/node/commit/a8d6286949)] - **tls**: disable resumption for mTLS with no session id context (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030) - \[[`e750e1fa02`](https://github.com/nodejs/node/commit/e750e1fa02)] - **tls**: don't allow renegotiation or HRR to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030) - \[[`97b1357f08`](https://github.com/nodejs/node/commit/97b1357f08)] - **tls**: don't allow TLS resumption to change SNI (Tim Perry) [nodejs-private/node-private#1030](https://github.com/nodejs-private/node-private/pull/1030) - \[[`66e72ec604`](https://github.com/nodejs/node/commit/66e72ec604)] - **tls**: apply the CA of SNI contexts without a certificate (Matteo Collina) [nodejs-private/node-private#1020](https://github.com/nodejs-private/node-private/pull/1020) - \[[`940cae5c33`](https://github.com/nodejs/node/commit/940cae5c33)] - **tls,http**: prevent nested parser execution from empty writes (Matteo Collina) [nodejs-private/node-private#1021](https://github.com/nodejs-private/node-private/pull/1021) - \[[`8232390dd8`](https://github.com/nodejs/node/commit/8232390dd8)] - **tools**: use vendored trust store in `shell.nix` (Antoine du Hamel) [#&#8203;67318](https://github.com/nodejs/node/pull/67318) - \[[`6c223db6e2`](https://github.com/nodejs/node/commit/6c223db6e2)] - **zlib**: handle params callback after destroy (Matteo Collina) [nodejs-private/node-private#1037](https://github.com/nodejs-private/node-private/pull/1037) ### [`v26.13.0`](https://github.com/nodejs/node/releases/tag/v26.13.0): 2026-10-28, Version 26.13.0 'Lithium' (LTS), @&#8203;richardlau [Compare Source](https://github.com/nodejs/node/compare/v26.12.1...v26.13.0) ##### Notable Changes This release marks the transition of Node.js 26.x into Long Term Support (LTS) with the codename 'Lithium'. It will continue to receive updates through to the end of April 2029. Other than updating metadata, such as the `process.release` object, to reflect that the release is LTS, no further changes from Node.js 26.12.1 are included. If you are updating from an earlier Long Term Support release (e.g. Node.js 24 or 22 or earlier) please note that since Node.js 25 the official binaries for Linux are linked against libatomic, which may need to be installed separately depending on your Linux distribution. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODIuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjIyMi41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
teckids_renovate_bot changed title from Update Node.js to v26.13.0 to Update Node.js to v26.13.1 2026-11-11 21:22:01 +01:00
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/node-26.x:renovate/node-26.x
git switch renovate/node-26.x

Merge

Merge the changes and update on Forgejo.
git switch main
git merge --no-ff renovate/node-26.x
git switch renovate/node-26.x
git rebase main
git switch main
git merge --ff-only renovate/node-26.x
git switch renovate/node-26.x
git rebase main
git switch main
git merge --no-ff renovate/node-26.x
git switch main
git merge --squash renovate/node-26.x
git switch main
git merge --ff-only renovate/node-26.x
git switch main
git merge renovate/node-26.x
git push origin main
Sign in to join this conversation.
No reviewers
No labels
Doing
To Do
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
teckids/kalle-ui!87
No description provided.