Skip to content

chore(deps): update node.js to v26 - #269

Merged
danielroe merged 1 commit into
mainfrom
renovate/node-26.x
Nov 2, 2026
Merged

danielroe merged 1 commit into
mainfrom
renovate/node-26.x

Conversation

@renovate

@renovate renovate Bot commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Confidence
node (source) devEngines.runtime major 24.22.1 → 26.13.0 age confidence
@types/node (source) devDependencies major 24.19.2 → 26.6.6 age confidence

Release Notes

nodejs/node (node)

v26.13.0: 2026-10-28, Version 26.13.0 'Lithium' (LTS), @​richardlau

Compare Source

Notable Changes

This release marks the transition of Node.js 26.x into Long Term Support (LTS)
with the codename 'Lithium'. It will continue to receive updates through to
the end of April 2029.

Other than updating metadata, such as the process.release object, to reflect
that the release is LTS, no further changes from Node.js 26.12.1 are included.

If you are updating from an earlier Long Term Support release (e.g. Node.js 24
or 22 or earlier) please note that since Node.js 25 the official binaries for
Linux are linked against libatomic, which may need to be installed separately
depending on your Linux distribution.

v26.12.1: 2026-10-21, Version 26.12.1 (Current), @​aduh95 prepared by @​RafaelGSS

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
  • (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
  • (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
  • (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High
  • (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268 (Evgenii Kliuchnikov) – High
  • (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
  • (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
  • (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
  • (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
  • (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
  • deps: V8: backport 93cd21e (Joyee Cheung)
  • crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
  • tls: reject chains containing blocked public keys (Ulises Gascon)
  • deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
  • tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
  • crypto: harden X.509 conversion and formatting (Filip Skokan)
Commits

v26.12.0: 2026-10-14, Version 26.12.0 (Current), @​richardlau

Compare Source

Notable Changes
  • [1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #​66533
  • [7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #​66335
Commits

v26.11.1: 2026-10-07, Version 26.11.1 (Current), @​aduh95

Compare Source

Commits
  • [2dc4638e85] - Revert "build: toggle doc-kit verbosity based on V" (Antoine du Hamel)
  • [3febbc54ec] - Revert "build, doc: move to redesign" (Antoine du Hamel)
  • [173250e2e7] - Revert "tools: bump the doc group in /tools/doc with 4 updates" (Antoine du Hamel)

v26.11.0: 2026-10-07, Version 26.11.0 (Current), @​aduh95

Compare Source

Notable Changes
  • [232f178825] - (SEMVER-MINOR) buffer: add isLatin1 (James M Snell) #​66298
  • [27778036de] - (SEMVER-MINOR) buffer: add Buffer.stringLength() (Matteo Collina) #​66064
  • [4f84c4bda2] - build, doc: move to redesign (Aviv Keller) #​62045
  • [6f6296fef9] - (SEMVER-MINOR) doc: promote Alpine Linux to tier 2 support (Stewart X Addison) #​63737
  • [e998d260d0] - (SEMVER-MINOR) http: add isValidHeaderName() and isValidHeaderValue() (James M Snell) #​66334
  • [7702a50e08] - (SEMVER-MINOR) http2: add connectionWindowSize option (Tim Perry) #​65619
  • [e06aa62cec] - (SEMVER-MINOR) perf_hooks: fix truncation of monitorEventLoopDelay() resolution (James M Snell) #​66115
  • [ee126e37e8] - (SEMVER-MINOR) perf_hooks: allow RecordableHistogram to record 0 (James M Snell) #​66114
  • [1fef8f54db] - (SEMVER-MINOR) perf_hooks: add histogram.diff() (James M Snell) #​66099
  • [f1b9758c4e] - (SEMVER-MINOR) perf_hooks: add histogram.snapshot() (James M Snell) #​66099
  • [291d56ea3e] - (SEMVER-MINOR) perf_hooks: harden histogram CBOR import validation (James M Snell) #​66098
  • [6299b09d5c] - (SEMVER-MINOR) process: graduate process.ref/unref to stable (James M Snell) #​66213
  • [41d6707b63] - (SEMVER-MINOR) sqlite: rename DatabaseSync and StatementSync (Guilherme Araújo) #​65988
  • [60d0aa0cd4] - (SEMVER-MINOR) src: add --process-timeout=N (James M Snell) #​66138
  • [f39916a7e3] - (SEMVER-MINOR) src: expose size and count in heap profile output (Ilyas Shabi) #​65737
  • [0b00d5ea59] - (SEMVER-MINOR) src: let embedders exempt linked bindings from the addon permission (Shelley Vohr) #​66067
Commits

[!IMPORTANT]
✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coldtea-pr-lens

Copy link
Copy Markdown

Note

renovate[bot] opened this pull request, so PR Lens left it undrawn. Comment @pr-lens draw to draw it

github.comment.notice: false in .github/pr-lens.yml turns this note off

@vercel

vercel Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
forges.link Ready Ready Preview Nov 2, 2026 7:00am UTC

Request Review

@coderabbitai

coderabbitai Bot commented Nov 2, 2026

Copy link
Copy Markdown

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords: 1
  • chore(deps)

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 46eb535f-ddfb-44d8-bf6b-a39c8aa37cde

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​types/​node@​26.6.61001008196100
Updatednuxt-nightly@​5.0.0-2610242044-194b1fe ⏵ 5.0.0-2611010234-c709ec897 +4100100 +196100

View full report

@pkg-pr-new

pkg-pr-new Bot commented Nov 2, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/danielroe/forges@269

commit: 154a918

@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bundle size

Browser entry bundles compared with the PR base. All sizes are in bytes. Lazy totals the minified chunks besides the entry, which load on demand or never.

Bundle Minified Gzip Lazy
forges 4,065 1,793 49,285
forges/github 139,706 42,263 30,067
forges/gitlab 100,703 31,241 10,042
forges/tangled 95,724 31,260 11,766
forges/gitea 97,604 30,074 8,414
forges/bitbucket 76,014 24,249 3,936
forges/web 8,148 3,481 0

Size changes are informational. pnpm test:size checks entry chunks for webhook translation, and the provider-free bundle against its budget.

Measured for 154a9184b662caeb47ca2bc168945f1a0728d46e.

@danielroe
danielroe merged commit a289177 into main Nov 2, 2026
20 checks passed
@danielroe
danielroe deleted the renovate/node-26.x branch November 2, 2026 13:38

This branch was successfully deployed

1 active deployment
Preview — 154a9184 Deployed Nov 2, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant