Skip to content

Update Node.js to >= 18.20.8 #115

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

Update Node.js to >= 18.20.8 #115

wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Feb 28, 2025 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
node (source) engines minor >= 18.19 -> >= 18.20.8

Release Notes

nodejs/node (node)

v18.20.8: 2025-03-27, Version 18.20.8 'Hydrogen' (LTS), @​richardlau

Compare Source

Notable Changes

This release updates OpenSSL to 3.0.16 and root certificates to NSS 3.108.

Commits

v18.20.7: 2025-02-20, Version 18.20.7 'Hydrogen' (LTS), @​aduh95

Compare Source

Notable Changes
Commits

v18.20.6: 2025-01-21, Version 18.20.6 'Hydrogen' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes
  • CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
  • CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)

Dependency update:

  • CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)
Commits

v18.20.5: 2024-11-12, Version 18.20.5 'Hydrogen' (LTS), @​aduh95

Compare Source

Notable Changes
  • [ac37e554a5] - esm: mark import attributes and JSON module as stable (Nicolò Ribaudo) #​55333
Commits

v18.20.4: 2024-07-08, Version 18.20.4 'Hydrogen' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes
Commits

v18.20.3: 2024-05-21, Version 18.20.3 'Hydrogen' (LTS), @​richardlau

Compare Source

Notable Changes

This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections.

A fix has also been included for compiling Node.js from source with newer versions of Clang.

The list of keys used to sign releases has been synchronized with the current list from the main branch.

Updated dependencies
  • acorn updated to 8.11.3.
  • acorn-walk updated to 8.3.2.
  • ada updated to 2.7.8.
  • c-ares updated to 1.28.1.
  • corepack updated to 0.28.0.
  • nghttp2 updated to 1.61.0.
  • ngtcp2 updated to 1.3.0.
  • npm updated to 10.7.0. Includes a fix from npm@​10.5.1 to limit the number of open connections npm/cli#7324.
  • simdutf updated to 5.2.4.
  • zlib updated to 1.3.0.1-motley-7d77fb7.
Commits

v18.20.2: 2024-04-10, Version 18.20.2 'Hydrogen' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes
  • CVE-2024-27980 - Command injection via args parameter of child_process.spawn without shell option enabled on Windows
Commits

v18.20.1: 2024-04-03, Version 18.20.1 'Hydrogen' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes
  • CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)
  • CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
  • llhttp version 9.2.1
  • undici version 5.28.4
Commits

v18.20.0: 2024-03-26, Version 18.20.0 'Hydrogen' (LTS), @​richardlau

Compare Source

Notable Changes
Added support for import attributes

Support has been added for import attributes, to replace the old import
assertions syntax. This will aid migration by making the new syntax available
across all currently supported Node.js release lines.

This adds the with keyword which should be used in place of the previous
assert keyword, which will be removed in a future semver-major Node.js
release.

For example,

import "foo" assert { ... }

should be replaced with

import "foo" with { ... }

For more details, see

Contributed by Nicolò Ribaudo in #​51136
and Antoine du Hamel in #​50140.

Doc deprecation for dirent.path

Please use newly added dirent.parentPath instead.

Contributed by Antoine du Hamel in #​50976
and #​51020.

Experimental node-api feature flags

Introduces an experimental feature to segregate finalizers that affect GC state.
A new type called node_api_nogc_env has been introduced as the const version
of napi_env and node_api_nogc_finalize as a variant of napi_finalize that
accepts a node_api_nogc_env as its first argument.

This feature can be turned off by defining
NODE_API_EXPERIMENTAL_NOGC_ENV_OPT_OUT.

Contributed by Gabriel Schulhof in #​50060.

Root certificates updated to NSS 3.98

Certificates added:

  • Telekom Security TLS ECC Root 2020
  • Telekom Security TLS RSA Root 2023

Certificates removed:

  • Security Communication Root CA
Updated dependencies
  • ada updated to 2.7.6.
  • base64 updated to 0.5.2.
  • c-ares updated to 1.27.0.
  • corepack updated to 0.25.2.
  • ICU updated to 74.2. Includes CLDR 44.1 and Unicode 15.1.
  • npm updated to 10.5.0. Fixes a regression in signals not being passed onto child processes.
  • simdutf8 updated to 4.0.8.
  • Timezone updated to 2024a.
  • zlib updated to 1.3.0.1-motley-40e35a7.
vm: fix V8 compilation cache support for vm.Script

Previously repeated compilation of the same source code using vm.Script
stopped hitting the V8 compilation cache after v16.x when support for
importModuleDynamically was added to vm.Script, resulting in a performance
regression that blocked users (in particular Jest users) from upgrading from
v16.x.

The recent fixes allow the compilation cache to be hit again
for vm.Script when --experimental-vm-modules is not used even in the
presence of the importModuleDynamically option, so that users affected by the
performance regression can now upgrade. Ongoing work is also being done to
enable compilation cache support for vm.CompileFunction.

Contributed by Joyee Cheung in #​49950
and #​50137.

Commits

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@changeset-bot
Copy link

changeset-bot bot commented Feb 28, 2025 •
edited
Loading

⚠️ No Changeset found

Latest commit: e301c94

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate renovate bot force-pushed the renovate/node-18.x branch from bcdf616 to 6a7f338 Compare March 3, 2025 15:40
@renovate renovate bot changed the title Update dependency @types/node to ^18.19.78 Update Node.js to >= 18.20.7 Mar 3, 2025
@renovate renovate bot force-pushed the renovate/node-18.x branch 2 times, most recently from 56c7ec5 to d3bc445 Compare March 8, 2025 10:38
@renovate renovate bot force-pushed the renovate/node-18.x branch 2 times, most recently from a520a2a to e641315 Compare March 24, 2025 07:33
@renovate renovate bot force-pushed the renovate/node-18.x branch from e641315 to 14851f5 Compare March 29, 2025 00:21
@renovate renovate bot changed the title Update Node.js to >= 18.20.7 Update Node.js to >= 18.20.8 Mar 29, 2025
@renovate renovate bot force-pushed the renovate/node-18.x branch 2 times, most recently from 1f2e732 to a255a6d Compare April 4, 2025 03:31
@renovate renovate bot force-pushed the renovate/node-18.x branch from a255a6d to 1e93211 Compare April 27, 2025 03:56
@renovate renovate bot force-pushed the renovate/node-18.x branch from 1e93211 to 65892df Compare May 10, 2025 00:09
@renovate renovate bot force-pushed the renovate/node-18.x branch 2 times, most recently from 961afa4 to 7523675 Compare May 24, 2025 23:50
@renovate renovate bot force-pushed the renovate/node-18.x branch 2 times, most recently from 0202a58 to ff93844 Compare June 6, 2025 17:18
@renovate renovate bot force-pushed the renovate/node-18.x branch from ff93844 to 4886601 Compare June 22, 2025 08:08
@renovate renovate bot force-pushed the renovate/node-18.x branch from 4886601 to 3e96067 Compare July 5, 2025 15:46
@renovate renovate bot force-pushed the renovate/node-18.x branch 2 times, most recently from dd842ba to bc5191a Compare July 15, 2025 14:51
@renovate renovate bot force-pushed the renovate/node-18.x branch from bc5191a to 88adfbe Compare July 27, 2025 16:01
@renovate renovate bot force-pushed the renovate/node-18.x branch 2 times, most recently from 2ae1a39 to 37f9067 Compare August 8, 2025 17:07
@renovate renovate bot force-pushed the renovate/node-18.x branch from 37f9067 to bc6ba0f Compare August 15, 2025 10:08
@renovate renovate bot force-pushed the renovate/node-18.x branch from bc6ba0f to b94274f Compare September 4, 2025 12:39
@renovate renovate bot force-pushed the renovate/node-18.x branch 3 times, most recently from 4cd8033 to 545130e Compare September 18, 2025 16:07
@renovate renovate bot force-pushed the renovate/node-18.x branch from 545130e to 2013d75 Compare September 30, 2025 08:02
@renovate renovate bot force-pushed the renovate/node-18.x branch from 2013d75 to 26da1ec Compare October 1, 2025 23:59
@renovate renovate bot force-pushed the renovate/node-18.x branch from 26da1ec to e1e409d Compare October 9, 2025 22:34
@renovate renovate bot force-pushed the renovate/node-18.x branch from e1e409d to e301c94 Compare October 13, 2025 15:56
@jakebailey jakebailey closed this Oct 13, 2025
@renovate
Copy link
Contributor Author

renovate bot commented Oct 13, 2025

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (>= 18.20.8). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate renovate bot deleted the renovate/node-18.x branch October 13, 2025 16:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jakebailey