chore(deps): update node.js to v24

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
node (source)	major	23.9.0 → 24.19.0

---

Release Notes

nodejs/node (node)

v24.19.0: 2026-08-03, Version 24.19.0 'Krypton' (LTS), @​aduh95

Compare Source

Notable Changes

• [d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #​64036
• [35222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #​62217
• [d6ab039f24] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #​63050
• [1da05fb79d] - doc: mark stream.compose stable (Matteo Collina) #​62562
• [3c1636dabf] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #​62300
• [e323e877be] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #​63634
• [c1248c9544] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #​61597
• [a534b65815] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #​63825
• [a23cdec683] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #​62935
• [7428b57a37] - (SEMVER-MINOR) src: allow empty --experimental-config-file (Marco Ippolito) #​61610
• [e57597173c] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #​64195
• [5396235993] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #​64119
• [5e901b5cd9] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #​62217

Commits

• [676467fa9f] - benchmark: trim down the argon2 sets (Filip Skokan) #​64218
• [a77a2000b7] - benchmark: add child_process async path baselines (Yagiz Nizipli) #​63929
• [dd4482e915] - buffer: remove unreachable overflow check in atob (haramjeong) #​60161
• [081c41eb86] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #​64169
• [d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #​64036
• [6e2f7e6013] - build: remove redundant intermediate node_aix_shared (Chengzhong Wu) #​63747
• [87e0675f51] - build: build codecache and snapshot with libnode (Chengzhong Wu) #​63626
• [32174a7bae] - build: support setting an emulator from configure script (Ivan Trubach) #​53899
• [69cfb2f240] - build: remove duplicated node_use_sqlite and node_use_ffi conditions (Chengzhong Wu) #​63629
• [37ac6e8cb5] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #​64118
• [2424207191] - build: suppress compiler warnings for histogram (Richard Lau) #​63980
• [63502b7404] - build,win: fix VS2022 arm64 PGO build (Stefan Stojanovic) #​63413
• [fe4e4055d0] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #​63972
• [aa2f3c066e] - child_process: pass spawn options to the binding positionally (Yagiz Nizipli) #​63930
• [fcf32cf77a] - child_process: serialize advanced IPC messages natively (Yagiz Nizipli) #​63933
• [7907134734] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #​64026
• [b505cd5465] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #​63988
• [0f54a872e2] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #​63975
• [824ec11c05] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #​63622
• [73aba92689] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #​63556
• [c83b79874e] - crypto: reject invalid raw key imports (Filip Skokan) #​63134
• [934fda64b9] - crypto: improve accuracy of SubtleCrypto.supports (Filip Skokan) #​63104
• [e392e1f791] - crypto: fix large DH generator validation (Tobias Nießen) #​64092
• [e75a363e70] - crypto: use EVP_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #​63942
• [adbaf7af9b] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #​63910
• [bb1aea8897] - crypto: fix unhandled error in Hash._transform (Haram Jeong) #​63261
• [12c87732c1] - crypto: handle cipher context allocation failures (Tian Teng) #​63542
• [858496b453] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #​63644
• [9a29cb0964] - crypto: fix warnings in test_node_crypto.cc (Maya Lekova) #​63490
• [8bb536066d] - crypto: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) #​62756
• [329e5496ff] - crypto,tls: do not ignore BN_get_word error (Tobias Nießen) #​63895
• [97b7a3f9c7] - debugger: add --max-hit option to probe mode (Joyee Cheung) #​63704
• [9098585c5e] - debugger: add more logs to probe mode (Joyee Cheung) #​63663
• [59cca26cd5] - debugger: surface inspector failures in probe mode (Joyee Cheung) #​63437
• [2922290eae] - debugger: disambiguate probe location binding (Joyee Cheung) #​63286
• [6fb2c2c7e2] - debugger: lazily wait for initial break output (Trivikram Kamat) #​63969
• [688e792551] - debugger: defer probe pause handling until startup (Trivikram Kamat) #​63608
• [1ac93cc05a] - debugger: await initialization after run and restart (Trivikram Kamat) #​63607
• [92a909cf72] - debugger,test: deflake resume failure test and add debug logs (Joyee Cheung) #​63524
• [8b37af8b11] - deps: V8: backport bef0d9c (Joyee Cheung) #​62132
• [8832126422] - deps: V8: cherry-pick 64b36b4 (Dan Carney) #​61712
• [75990c2cd6] - deps: update googletest to 8b53336 (Node.js GitHub Bot) #​64181
• [8500c7ba86] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #​64180
• [dc78091b45] - deps: c-ares: cherry-pick 8ba37af (René) #​64110
• [873cc72125] - deps: update googletest to 0b1e895 (Node.js GitHub Bot) #​64039
• [1d3d166538] - deps: update acorn to 8.17.0 (Node.js GitHub Bot) #​63901
• [35222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #​62217
• [e40cee5f79] - deps: upgrade npm to 11.17.0 (npm team) #​63857
• [85c6d46606] - deps: add ngtcp2_fmt.c to build configuration (ngtcp2.gyp) (沈鸿飞) #​63821
• [d2ea8b7a8c] - deps: update googletest to 7140cd4 (Node.js GitHub Bot) #​63775
• [25b4d57bb6] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #​63774
• [a96368e4c7] - deps: update zlib to 1.3.2.1-motley-3246f1b (Node.js GitHub Bot) #​63773
• [b59f1f5f37] - deps: update amaro to 1.1.10 (Node.js GitHub Bot) #​63670
• [0b3b56ee95] - deps: update googletest to 8736d2c (Node.js GitHub Bot) #​63669
• [aa67b5b9c4] - dgram: add synchronous Socket connectSync() (Guy Bedford) #​63932
• [ef38374875] - dgram: add synchronous Socket.prototype.bindSync() (Guy Bedford) #​63838
• [6edc3a9967] - dgram: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) #​64133
• [d4cfe2d8ac] - dns: coerce -0 to +0 in lookup and resolver inputs (Filip Skokan) #​63556
• [91c9ce5a45] - doc: improve fs.StatFs properties descriptions (aymanxdev) #​62578
• [54e21675fa] - doc: fix inconsistencies in CJS code snippets (Antoine du Hamel) #​63199
• [64c23daa76] - doc: remove typo comma from man page (Vas Sudanagunta) #​63080
• [bc943cd34a] - doc: update Http2SecureServer.on("timeout") default value (YuSheng Chen) #​64187
• [a46bc452a6] - doc: add note on visibility of CI failures to new contributor guide (Stewart X Addison) #​64256
• [c0fb52506c] - doc: clarify HTTP/1.1 response ordering (Matteo Collina) #​64213
• [d3073a7ba6] - doc: recommend node-stress-single-test for flaky tests (Trivikram Kamat) #​64223
• [bb9951ead0] - doc: fix typo in examples (Vas Sudanagunta) #​64184
• [fe674e96fc] - doc: clarify defense-in-depth issues (Matteo Collina) #​64215
• [faad042184] - doc: add guide and answers to FAQs for first-time contributors (Joyee Cheung) #​63685
• [79d685adf3] - doc: update Http2Server.close & Http2SecureServer.close (YuSheng Chen) #​63298
• [744e40e05e] - doc: update list of people in SECURITY.md (Richard Lau) #​64152
• [185f57c4a4] - doc: add missing option to man page (Richard Lau) #​64156
• [8933303568] - doc: fix callback example import in fs docs (Kamal Rawal) #​63912
• [3a0549dacb] - doc: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) #​63974
• [5a35e48d08] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #​64193
• [66e7f815f1] - doc: add aduh95 to last security release steward (Antoine du Hamel) #​63981
• [a7e35040dd] - doc: fix typo in util.md (Daijiro Wachi) #​63961
• [d74b3a7e90] - doc: clarify callback exceptions (Matteo Collina) #​63939
• [b7a8f8fabd] - doc: fix incorrect test runner mock examples (Kimaswa Emmanuel Yusufu) #​63656
• [f11aa690cd] - doc: fix typo in cli.md (Daijiro Wachi) #​63883
• [df85f50269] - doc: fix typo in vm.md (Daijiro Wachi) #​63881
• [a00a567175] - doc: fix typo in packages.md (Daijiro Wachi) #​63882
• [206c1b8437] - doc: fix a/an article typos in module, util, and dns (Daijiro Wachi) #​63766
• [e3e5ef1cff] - doc: update npm supported versions link (hojeong park) #​63672
• [e3c4852413] - doc: fix AES-OCB IV length in SubtleCrypto.supports example (Anshika Jain) #​63717
• [0b3fbc82d7] - doc: add webstreams to args for pipeline from stream/promises (David Sanders) #​63628
• [62078a8328] - doc: fix "used to sent" → "used to send" in http2 (Daijiro Wachi) #​63700
• [fd74eefb23] - doc: clarify tty raw mode applies to input processing only (Muhammad Zeeshan) #​63438
• [42cd7e47de] - doc: add worker_threads history entries (Bob Put) #​63545
• [d6ab039f24] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #​63050
• [56bdd87378] - doc: move hyperlinks outside of text blocks (Aviv Keller) #​63493
• [1da05fb79d] - doc: mark stream.compose stable (Matteo Collina) #​62562
• [7bb6dab70c] - doc,crypto: mark argon2 and encap/decap as stable (Filip Skokan) #​63924
• [1a4edb3c22] - doc,lib: align WebCrypto names with spec (Filip Skokan) #​63518
• [3c1636dabf] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #​62300
• [e0f211ca79] - events: improve addAbortListener perf by caching options object (Raz Luvaton) #​52367
• [a124429b36] - fs: do not treat EPERM as ENOTEMPTY on Windows (Kirill Saied) #​63709
• [e323e877be] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #​63634
• [a41b4824d7] - fs: prevent spurious recursive watch events on prefix siblings (Marco) #​63095
• [c63e00e3a5] - fs: ignore deleted dirs in recursive watch scan (Trivikram Kamat) #​63686
• [d3d7cd05e3] - fs: coerce -0 to +0 in mode flags and watch intervals (Filip Skokan) #​63556
• [6f6387ecb3] - gyp: update deps gypfiles (Nad Alaba) #​63117
• [592544af44] - http: document and validate options.path when it's in absolute-form (Joyee Cheung) #​64108
• [c1248c9544] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #​61597
• [85a223bf15] - http: fix drain event with cork/uncork (David Evans) #​64038
• [8b060a9628] - inspector: fix crash when writing to closed inspector socket (ympark2011) #​64209
• [e68a3d33ac] - inspector: fix inspector.close() documented behavior (Chengzhong Wu) #​63837
• [d3682930b7] - lib: fix missing lazyDOMException import (Filip Skokan) #​64033
• [af9ea9cfcf] - lib: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) #​64174
• [cd1ea26110] - lib: use __proto__: null when calling ObjectDefineProperty (Antoine du Hamel) #​64239
• [5b264398ce] - lib: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) #​63702
• [823efe8c71] - lib: improve control abstraction coverage in frozen intrinsics (Renegade334) #​63698
• [7f4af5568f] - lib: add Iterator global to primordials (Renegade334) #​63698
• [c8f3f5e5a5] - lib: make Navigator#language getter throw on invalid this (Mohamed Sayed) #​63601
• [1ebbbd59cf] - lib: optimize webidl conversion options (Filip Skokan) #​62756
• [88590d1bb7] - meta: bump actions/checkout from 6.0.2 to 6.0.3 (dependabot[bot]) #​63726
• [0ea9cb9630] - meta: bump actions/upload-artifact from 7.0.0 to 7.0.1 (dependabot[bot]) #​62850
• [f7275a0864] - meta: fix linter warning in stale.yml (Antoine du Hamel) #​64281
• [3a77d21d8c] - meta: bump actions/cache from 5.0.5 to 6.1.0 (dependabot[bot]) #​64248
• [84e2836c95] - meta: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot[bot]) #​64247
• [09f800eec6] - meta: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot[bot]) #​64246
• [6df1f97e64] - meta: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot[bot]) #​64244
• [737eb89651] - meta: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot[bot]) #​64243
• [dac3cd8b8f] - meta: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot[bot]) #​64242
• [108a6bc481] - meta: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot[bot]) #​64240
• [34d09a725d] - meta: clarify V8 flags are outside threat model (Matteo Collina) #​64224
• [944d9bc25f] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #​64057
• [cc22555402] - meta: update status of past strategic initiatives (Joyee Cheung) #​63480
• [da7a21931e] - meta: speed up stale bot (Aviv Keller) #​64075
• [7bfcf7ca56] - meta: bump github/codeql-action from 4.35.3 to 4.36.1 (dependabot[bot]) #​63724
• [db6c983cdd] - meta: bump actions/cache from 5.0.4 to 5.0.5 (dependabot[bot]) #​62847
• [9e4f1339d1] - meta: bump codecov/codecov-action from 6.0.0 to 6.0.1 (dependabot[bot]) #​63725
• [92c98d3ade] - meta: bump actions/stale from 10.2.0 to 10.3.0 (dependabot[bot]) #​63728
• [bbd3ffde89] - meta: bump step-security/harden-runner from 2.19.0 to 2.19.4 (dependabot[bot]) #​63727
• [a6dd675c82] - module: enable import support for addons by default (Chengzhong Wu) #​64221
• [fb2ccb15a1] - module: use file: URL as sourceURL for type-stripped CommonJS (Joyee Cheung) #​63705
• [b9e17dc424] - net: early TCP binding via synchronous net.BoundSocket (Guy Bedford) #​63951
• [a534b65815] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #​63825
• [c55dd030e6] - net: coerce -0 to +0 in BlockList prefixes (Filip Skokan) #​63556
• [a23cdec683] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #​62935
• [f08b83bc1d] - perf_hooks: add NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP constant (Attila Szegedi) #​63877
• [8d58e1b415] - process: fix finalization cleanup ref tracking (Trivikram Kamat) #​64087
• [c757e3ef59] - sqlite: do not leave database open after failed open (Yagiz Nizipli) #​63854
• [87064a096b] - sqlite: fix stack-use-after-scope with function callback (ndossche) #​63640
• [7428b57a37] - (SEMVER-MINOR) src: allow empty --experimental-config-file (Marco Ippolito) #​61610
• [d7946c9c07] - src: add test flag to config file (Marco Ippolito) #​60798
• [a642657d71] - src: rename config file testRunner to test (Marco Ippolito) #​60798
• [818b43d09e] - src: do not enable wasm trap handler if there's not enough vmem (Joyee Cheung) #​62132
• [af5e1a9729] - src: fix escaping of single quotes in task runner (Antoine du Hamel) #​64089
• [8a5d3bc168] - src: abstract tracing agent for both legacy and perfetto (Chengzhong Wu) #​64053
• [ce6f29e45b] - src: avoid redundant call to std::get_if<>() (Tobias Nießen) #​64094
• [96478050f2] - src: omit unconvertible names in cjs_lexer::Parse (Yagiz Nizipli) #​63943
• [0147ed746e] - src: guard OpenSSL compression header include (Filip Skokan) #​64009
• [8d2858a9c4] - src: handle empty MaybeLocal in cjs_lexer::Parse (Yagiz Nizipli) #​63885
• [e5289d180f] - src: do not track weak BaseObjects as childrens of Realms (Anna Henningsen) #​63842
• [e8352ff754] - src: allow tracking children in MemoryTracker with weak edges (Anna Henningsen) #​63842
• [a408f279c5] - src: use C++14 deprecated attribute for NODE_DEPRECATED (Anna Henningsen) #​63755
• [4b5eb7b72d] - src: add cleanup hooks to node::ObjectWrap (Anna Henningsen) #​63642
• [44976c6071] - src: fix edge case when deflateInit2() fails with Z_VERSION_ERROR (Nora Dossche) #​63476
• [5b3bb284f3] - src: add Latin1 fast path in StringBytes::Encode utf8 (Mert Can Altin) #​63385
• [7cdad636c4] - src: fix crash when reading length on Storage.prototype (Mohamed Sayed) #​63529
• [c438250c68] - stream: cut per-chunk overhead in WHATWG streams (Matteo Collina) #​64252
• [291c127947] - stream: reduce allocations on WHATWG streams hot paths (Matteo Collina) #​63876
• [3d91aeb434] - stream: optimize pipeTo promise handling (Matteo Collina) #​63572
• [fcbff00a44] - stream: preserve half-open duplexes in async iteration (Efe) #​64275
• [e57597173c] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #​64195
• [a48edf40e8] - stream: proxy first own method in Readable.wrap() (Daijiro Wachi) #​64048
• [f58c5bafcf] - stream: fix Writable.toWeb() desiredSize for non-object-mode (Matteo Collina) #​62986
• [7261276f45] - stream: fix Utf8Stream stall after full write of multi-byte data (Daijiro Wachi) #​63964
• [1558986b78] - stream: only pass the expected number of parameters to callbacks (Antoine du Hamel) #​63909
• [edef89ba6a] - stream: fix dropped first chunk in Utf8Stream buffer mode (Daijiro Wachi) #​63833
• [915e3e2f42] - stream: check done before backpressure in stream reader (Daijiro Wachi) #​63699
• [2d29628b5b] - test: update WPT for WebCryptoAPI to 03a1476 (Node.js GitHub Bot) #​63900
• [89e23b70c4] - test: deflake test-debugger-probe-timeout (Joyee Cheung) #​63547
• [54ca514414] - test: make blob desiredSize assertion robust (Trivikram Kamat) #​64106
• [01cbe530eb] - test: update WPT for urlpattern to 11a459a (Node.js GitHub Bot) #​64037
• [6fcd3cf516] - test: improve lcov reporter snapshot diagnostics (Trivikram Kamat) #​64049
• [f50a55d7e5] - test: keep finalization close fixture ref alive (Trivikram Kamat) #​64085
• [3085714530] - test: fix typo from overriden to overridden (parkhojeong) #​63403
• [9f5347e8df] - test: mark hr-time WPT flaky on macos15-x64 (Trivikram Kamat) #​64054
• [44b4fe4246] - test: use one-off agent in http consumed timeout test (Trivikram Kamat) #​64052
• [2f567edaca] - test: fix flaky test-runner coverage threshold test (Trivikram Kamat) #​64051
• [a56fbb2d36] - test: tolerate duplicate watch change events (Trivikram Kamat) #​63937
• [b636f4769c] - test: mark test-debugger-run-after-quit-restart as flaky on macOS (Matteo Collina) #​64006
• [ba23eb9717] - test: update WPT for url to d4598eb (Node.js GitHub Bot) #​63899
• [bc420f20d8] - test: update WPT for urlpattern to 23aac92 (Node.js GitHub Bot) #​63898
• [d2c9c07af8] - test: add tests for 3 methods in utils (Daijiro Wachi) #​63765
• [4e00c8ec2e] - test: mark SEA tests flaky on linux arm debug (Trivikram Kamat) #​63743
• [a17cf06d12] - test: validate ERR_INVALID_THIS for scheduler methods (Daijiro Wachi) #​63764
• [d59d7fdd16] - test: add coverage outside SEA (Daijiro Wachi) #​63744
• [71a32d31bf] - test: update WPT for urlpattern to 2f28df5 (Node.js GitHub Bot) #​63771
• [28c77ab174] - test: make Brotli 16GB test wait for backpressure (Trivikram Kamat) #​63389
• [9a81921d4a] - test: add regression test for using ObjectWrap in worker (Mohamed Akram) #​63642
• [88ab61f2f8] - test: accept SIGILL aborts in async-hooks tests (Trivikram Kamat) #​63687
• [b4f5c86463] - test: add more test cases for pathToFileURL (Rafael Gonzaga) #​63293
• [812a66f0ac] - test: update test426-fixtures to 2965987 (Node.js GitHub Bot) #​63668
• [2bf0de838d] - test: cover webcrypto prototype pollution systematically (Filip Skokan) #​63520
• [bec6856ae8] - test,debugger: add test for type stripping in debugger probe mode (Joyee Cheung) #​63748
• [a2b9095e03] - test_runner: avoid recompiling coverage globs for every file (sangwook) #​63675
• [02fbff446f] - test_runner: cache shouldSkipFileCoverage result per URL (sangwook) #​63675
• [094869354a] - test_runner: ignore erased TS lines in coverage (Matteo Collina) #​63510
• [68edc2b009] - test_runner: fix suite diagnostic chanel end (Moshe Atlow) #​63533
• [659d5bf068] - test_runner: add parentId to test events with testId (Moshe Atlow) #​63435
• [eaebeb8b88] - test_runner: fix hooks test context (Moshe Atlow) #​63285
• [d03d96889b] - test_runner: add tags option and tag-name filter (Chemi Atlow) #​63221
• [e8c3db1364] - test_runner: add getTestContext() (Moshe Atlow) #​62501
• [345c591d10] - test_runner: filter execArgv fallback for child tests (Trivikram Kamat) #​64056
• [2f47fb23bf] - test_runner: improve coverage failure diagnostics (Trivikram Kamat) #​64050
• [260cf1ac89] - test_runner: add timestamp to JUnit reporter testsuites (sangwook) #​64029
• [24140eafdf] - test_runner: remove unused shuffleArrayWithSeed (Daijiro Wachi) #​63847
• [b7fdb4891a] - test_runner: fix watch cwd with isolation none (Trivikram Kamat) #​63690
• [e48b307e09] - timers: reuse Timeout objects in setStreamTimeout (Matteo Collina) #​64254
• [5396235993] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #​64119
• [a653e9bb57] - tls: handle large RSA exponents in X.509 cert (Tobias Nießen) #​64093
• [5e901b5cd9] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #​62217
• [3abcfa723c] - tls: route event listener exceptions through error handlers (Antoine du Hamel) #​63822
• [eaba4cd59d] - tools: bump the eslint group in /tools/eslint with 8 updates (dependabot[bot]) #​64249
• [7d7ea1dbca] - tools: update c-ares updater script (Antoine du Hamel) #​64194
• [976827cd71] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #​64070
• [cc0c586b52] - tools: update sccache to v0.16.0 (Michaël Zasso) #​63078
• [f0a35fa56a] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/lint-md (dependabot[bot]) #​63948
• [dafbd23240] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/eslint (dependabot[bot]) #​63947
• [0ae1552650] - tools: update the llhttp updater script (Antoine du Hamel) #​63819
• [3623586d1f] - tools: align Bash snippets in GHA with lint-sh conventions (Antoine du Hamel) #​63829
• [64b130ce1d] - tools: bump the eslint group in /tools/eslint with 7 updates (dependabot[bot]) #​63730
• [4900cac251] - tools: fix zlib updater script (Antoine du Hamel) #​63707
• [8edf3abafc] - typings: add typing for crypto (Filip Skokan) #​64122
• [d5be94e820] - url: fix URLSearchParams(null) to prudce null= per spec (Marco) #​63782
• [ee66a3851c] - util: fix OOM in inspect color stack formatting (Ijtihed Kilani) #​64022
• [e26f183699] - util: fix scientific notation formatting (Daijiro Wachi) #​63823
• [7993e3e476] - util: fix -0 formatting when numericSeparator is enabled (Daijiro Wachi) #​63815
• [38758a7789] - util: remove style caches from styleText slow path (Guilherme Araújo) #​63706
• [46a0ca256a] - watch: print name of changed file that triggers restart (Marco) #​63781
• [e1582818ad] - watch: cancel pending restart on shutdown (Trivikram Kamat) #​63383
• [9a208668b0] - zlib: validate flush king for all streams (Ic3b3rg) #​63746
• [928981d803] - zlib: validate flush kind for brotli streams (Ic3b3rg) #​63746
• [fd0fb00164] - zlib: expose rejectGarbageAfterEnd option (Filip Skokan) #​64023
• [e334d30b4c] - zlib: reject trailing gzip members in web streams (Filip Skokan) #​64023
• [7433c3df2e] - zlib: coerce -0 to +0 for crc32 seeds (Filip Skokan) #​63556

v24.18.1: 2026-07-29, Version 24.18.1 'Krypton' (LTS), @​juanarbol

Compare Source

This is a security release.

Notable Changes

• (CVE-2026-56846) http2: retain he

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.