unboundsoftware/schemas
6
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 33 Activity

chore(deps): update node.js to v24.18.1 #906

Merged
renovate merged 1 commits from renovate/node-24.x into main 2026-08-02 22:22:41 +00:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
renovate commented 2026-08-02 22:11:34 +00:00
Owner
Copy Link
Copy Source

This PR contains the following updates:

Package Type Update Change
node (source) final patch 24.18.0-alpine → 24.18.1-alpine

Release Notes

nodejs/node (node)

v24.18.1: 2026-07-29, Version 24.18.1 'Krypton' (LTS), @​juanarbol

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
  • (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
  • (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
  • (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
  • (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
  • (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
  • (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
  • (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
  • (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
  • (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
  • (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
  • deps: update llhttp to 9.4.3 (Paolo Insogna)
  • deps: update undici to 7.29.0 (Node.js GitHub Bot)
Commits

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [node](https://hub.docker.com/_/node) ([source](https://github.com/nodejs/node)) | final | patch | `24.18.0-alpine` → `24.18.1-alpine` | --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v24.18.1`](https://github.com/nodejs/node/releases/tag/v24.18.1): 2026-07-29, Version 24.18.1 'Krypton' (LTS), @&#8203;juanarbol [Compare Source](https://github.com/nodejs/node/compare/v24.18.0...v24.18.1) This is a security release. ##### Notable Changes - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low - (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low - deps: update llhttp to 9.4.3 (Paolo Insogna) - deps: update undici to 7.29.0 (Node.js GitHub Bot) ##### Commits - \[[`6cb0475751`](https://github.com/nodejs/node/commit/6cb0475751)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://github.com/nodejs-private/node-private/pull/935) - \[[`bcfe21d3dc`](https://github.com/nodejs/node/commit/bcfe21d3dc)] - **deps**: update undici to 7.29.0 (Node.js GitHub Bot) [#&#8203;64713](https://github.com/nodejs/node/pull/64713) - \[[`9d0d36cffd`](https://github.com/nodejs/node/commit/9d0d36cffd)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://github.com/nodejs-private/node-private/pull/929) - \[[`8a008fb523`](https://github.com/nodejs/node/commit/8a008fb523)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#922](https://github.com/nodejs-private/node-private/pull/922) - \[[`a77c7f7354`](https://github.com/nodejs/node/commit/a77c7f7354)] - **(CVE-2026-56848)** **http2**: defer rst stream while in scope (Matteo Collina) [nodejs-private/node-private#921](https://github.com/nodejs-private/node-private/pull/921) - \[[`34ed88a069`](https://github.com/nodejs/node/commit/34ed88a069)] - **(CVE-2026-56846)** **http2**: retain header memory in session accounting (Matteo Collina) [#&#8203;63752](https://github.com/nodejs/node/pull/63752) - \[[`95ba2cfde7`](https://github.com/nodejs/node/commit/95ba2cfde7)] - **(CVE-2026-58040)** **https**: bind identity checks to session reuse (Matteo Collina) [nodejs-private/node-private#904](https://github.com/nodejs-private/node-private/pull/904) - \[[`fcbdbe47ea`](https://github.com/nodejs/node/commit/fcbdbe47ea)] - **(CVE-2026-56850)** **https**: distinguish PFX object-array agent keys (RafaelGSS) [nodejs-private/node-private#930](https://github.com/nodejs-private/node-private/pull/930) - \[[`ea26c12b56`](https://github.com/nodejs/node/commit/ea26c12b56)] - **(CVE-2026-58043)** **permission**: avoid granting radix split nodes (RafaelGSS) [nodejs-private/node-private#911](https://github.com/nodejs-private/node-private/pull/911) - \[[`9a6b7e343a`](https://github.com/nodejs/node/commit/9a6b7e343a)] - **(CVE-2026-58039)** **permission**: check final report output path (RafaelGSS) [nodejs-private/node-private#926](https://github.com/nodejs-private/node-private/pull/926) - \[[`6c0c990880`](https://github.com/nodejs/node/commit/6c0c990880)] - **(CVE-2026-56847)** **permission**: enforce fs write permission for trace events (RafaelGSS) [nodejs-private/node-private#927](https://github.com/nodejs-private/node-private/pull/927) - \[[`af9ff0490c`](https://github.com/nodejs/node/commit/af9ff0490c)] - **(CVE-2026-58041)** **sqlite**: invalidate tag store iterators on statement reset (Matteo Collina) [nodejs-private/node-private#896](https://github.com/nodejs-private/node-private/pull/896) - \[[`05f541b5c0`](https://github.com/nodejs/node/commit/05f541b5c0)] - **(CVE-2026-58045)** **zlib**: throw on out-of-bounds write buffers (RafaelGSS) [nodejs-private/node-private#931](https://github.com/nodejs-private/node-private/pull/931) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC41LjMiLCJ1cGRhdGVkSW5WZXIiOiI0NC41LjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->
renovate added 1 commit 2026-08-02 22:11:37 +00:00
chore(deps): update node.js to v24.18.1
schemas / check (push) Skipped
schemas / vulnerabilities (push) Skipped
schemas / check-release (push) Skipped
schemas / build (push) Skipped
pre-commit / pre-commit (push) Skipped
renovate/stability-days Updates have met minimum release age requirement
Details
pre-commit / pre-commit (pull_request) Successful in 2m54s
Details
schemas / vulnerabilities (pull_request) Successful in 1m22s
Details
schemas / check (pull_request) Successful in 2m30s
Details
schemas / check-release (pull_request) Successful in 1m49s
Details
schemas / build (pull_request) Successful in 5m52s
Details
schemas / deploy-prod (pull_request) Skipped
Details
e07b2e48c2
renovate scheduled this pull request to auto merge when all checks succeed 2026-08-02 22:11:39 +00:00
renovate merged commit b1c4f41f55 into main 2026-08-02 22:22:41 +00:00
renovate deleted branch renovate/node-24.x 2026-08-02 22:22:43 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
dependencies
Pull requests that update a dependency file
 docker
go
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
acctest (Shiny Acctest) argoyle (Joakim Olsson) buildtools (Buildtools) kubernetes (Kubernetes) releaser (Unbound Releaser) renovate (Renovate Bot)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unboundsoftware/schemas#906