Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Dec 19, 2025

This PR contains the following updates:

Package Update Change
node (source) minor 24.9.024.13.0

Release Notes

nodejs/node (node)

v24.13.0: 2026-01-13, Version 24.13.0 'Krypton' (LTS), @​marco-ippolito

Compare Source

This is a security release.

Notable Changes

lib:

Commits

v24.12.0: 2025-12-10, Version 24.12.0 'Krypton' (LTS), @​targos

Compare Source

Notable Changes
  • [1a00b5f68a] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #​59778
  • [ff5754077d] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #​59982
  • [8987159234] - (SEMVER-MINOR) module: mark type stripping as stable (Marco Ippolito) #​60600
  • [92c484ebf4] - (SEMVER-MINOR) node-api: add napi_create_object_with_properties (Miguel Marcondes Filho) #​59953
  • [b11bc5984e] - (SEMVER-MINOR) sqlite: allow setting defensive flag (Bart Louwers) #​60217
  • [e7da5b4b7d] - (SEMVER-MINOR) src: add watch config namespace (Marco Ippolito) #​60178
  • [a7f7d10c06] - (SEMVER-MINOR) src: add an option to make compile cache portable (Aditi) #​58797
  • [92ea669240] - (SEMVER-MINOR) src,permission: add --allow-inspector ability (Rafael Gonzaga) #​59711
  • [05d7509bd2] - (SEMVER-MINOR) v8: add cpu profile (theanarkh) #​59807
Commits

v24.11.1

Compare Source

v24.11.0

Compare Source

v24.10.0: 2025-10-08, Version 24.10.0 (Current), @​RafaelGSS

Compare Source

Notable Changes
  • [31bb476895] - (SEMVER-MINOR) console: allow per-stream inspectOptions option (Anna Henningsen) #​60082
  • [3b92be2fb8] - (SEMVER-MINOR) lib: remove util.getCallSite (Rafael Gonzaga) #​59980
  • [18c79d9e1c] - (SEMVER-MINOR) sqlite: create authorization api (Guilherme Araújo) #​59928
Commits

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions
Copy link

github-actions bot commented Dec 19, 2025

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Node.js 24.13.0 is a Security Release with the following critical fixes:

  • CVE-2025-59465: TLSSocket default error handler added to prevent unhandled errors
  • CVE-2025-55132: Disabled futimes when permission model is enabled to prevent privilege escalation
  • CVE-2025-55130: Required full read/write permissions for symlink APIs to prevent unauthorized access
  • CVE-2025-59466: Fixed stack overflow exceptions in async_hooks preventing crashes
  • CVE-2025-55131: Refactored unsafe buffer creation to remove zero-fill toggle security issue
  • CVE-2026-21637: Routed TLS callback exceptions through proper error handlers

Dependencies Updated:

  • c-ares updated to v1.34.6
  • undici updated to 7.18.2

Impact: All fixes are backward-compatible and target security vulnerabilities without introducing breaking changes to the public API.

🎯 Impact Scope Investigation

Version Management:

  • Node.js version is managed via mise.toml (currently updating from 24.9.0 → 24.13.0)
  • No conflicts with CI/CD configuration (uses mise-action for runtime management)
  • Project uses Bun as primary runtime with Node.js as development tool only

Dependency Analysis:

  • package.json contains no Node.js engine constraints
  • Build scripts use Bun runtime (bun run, bun test)
  • CI workflows use mise for environment setup, automatically picking up new version
  • TypeScript and other dev dependencies compatible with Node.js 24.x LTS range

Configuration Impact:

  • No hardcoded Node.js versions in GitHub Actions
  • mise-action will automatically use updated version from mise.toml
  • No Docker or container configurations requiring updates

💡 Recommended Actions

Immediate Action: ✅ Safe to merge immediately

Reasoning:

  1. Security Priority: Contains 6 security fixes (CVEs) that should be applied promptly
  2. Backward Compatibility: Minor version update within LTS branch maintains compatibility
  3. No Breaking Changes: All security fixes maintain existing API surface
  4. Minimal Usage: Project primarily uses Bun, Node.js only for development tooling
  5. Automatic Integration: mise configuration ensures seamless version management

Post-Merge Verification:

  • CI workflows will automatically validate with new Node.js version
  • All build, lint, and test processes should continue working without modification

🔗 Reference Links

Generated by koki-develop/claude-renovate-review

@renovate renovate bot force-pushed the renovate/node-24.x branch from 53739e2 to 140e5fd Compare January 15, 2026 00:36
@renovate renovate bot changed the title chore(deps): update dependency node to v24.12.0 chore(deps): update dependency node to v24.13.0 Jan 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant