Skip to content

aix: add required changes to build with clang#62656

Closed
abmusse wants to merge 6 commits into
nodejs:mainfrom
abmusse:clang-aix-2
Closed

aix: add required changes to build with clang#62656
abmusse wants to merge 6 commits into
nodejs:mainfrom
abmusse:clang-aix-2

Conversation

@abmusse

@abmusse abmusse commented Apr 9, 2026

Copy link
Copy Markdown
Contributor

This PR enables building Node.js on AIX with Clang by addressing several issues.

The game plan I have in mind to get AIX building with clang:

  1. Confirm the changes in this PR doesn't break gcc builds (Node.js 24, 22, 20 still use it), then merge this PR

  2. After this PR gets merged, update select compiler to use clang for Node.js 26+ builds
    (I have a draft PR for that here: aix: select clang for Node.26+ buildsΒ build#4286)

Changes

1. Add conditional flags for Clang builds

Some GCC flags don't work on Clang:

  • -mfprnd
  • -mno-popcntb
  • -fno-extern-tls-init

These are now conditionally added only when Clang is not enabled.

For Clang builds, we need additional flags:

  • -fno-integrated-as
  • -fno-xl-pragma-pack

These flags are discussed in: https://chromium-review.googlesource.com/c/chromium/src/+/7120638

2. Fix OpenSSL implicit declaration errors

AIX header files don't ship declarations for sendmmsg and related functions, despite documentation showing they should be included. This appears to be a bug in AIX header files.

GCC tolerates implicit function declarations, but Clang 16+ treats them as errors:
https://www.redhat.com/en/blog/new-warnings-and-errors-clang-16

example:

16:55:13 ../deps/openssl/openssl/crypto/bio/bss_dgram.c: In function 'dgram_sendmmsg':
16:55:13 ../deps/openssl/openssl/crypto/bio/bss_dgram.c:1416:11: warning: implicit declaration of function 'sendmmsg'; did you mean 'sendmsg'? [-Wimplicit-function-declaration]
16:55:14  1416 |     ret = sendmmsg(b->num, mh, num_msg, sysflags);
16:55:14       |           ^~~~~~~~
16:55:14       |           sendmsg
16:55:14 ../deps/openssl/openssl/crypto/bio/bss_dgram.c: In function 'dgram_recvmmsg':
16:55:14 ../deps/openssl/openssl/crypto/bio/bss_dgram.c:1609:11: warning: implicit declaration of function 'recvmmsg'; did you mean 'recvmsg'? [-Wimplicit-function-declaration]
16:55:14  1609 |     ret = recvmmsg(b->num, mh, num_msg, sysflags, NULL);
16:55:14       |           ^~~~~~~~
16:55:14       |           recvmsg

ref: https://ci.nodejs.org/job/node-test-commit-aix/nodes=aix72-power9/62022/consoleFull
For now, we claim to not have these functions. The actual functions are available in libc, so an alternative would be to declare them ourselves for AIX 7.2+.

Ref: https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine

3. Cherry-pick V8 commit for AIX Clang support

Cherry-picked V8 commit 7107287 which adds required changes to build V8 with Clang on AIX.

Original commit: https://chromium-review.googlesource.com/c/v8/v8/+/7107287

4. Filter hidden visibility symbols from export script

Without filtering HIDDEN symbols, AIX Clang builds fail with linker errors:

ld: 0711-407 ERROR: Symbol [SYMBOL_NAME]
        Visibility is not allowed on a reference to an imported symbol.

Not including hidden symbols in the export files matches the recommendation by XLC documentation:

When using export lists, it is not recommended to put symbols with hidden visibility in the lists.

Ref: https://www.ibm.com/docs/en/openxl-c-and-cpp-aix/17.1.4?topic=libraries-symbol-exports-visibilities

5. Add weak symbol detection in create_expfile.sh

AIX export files support the weak keyword to mark weak symbols. According to IBM documentation:

Each line within an import or export file contains the name of a symbol, optionally followed by an address or a keyword. Primary keywords are svc, svc32, svc3264, svc64, syscall, syscall32, syscall3264, syscall64, symbolic, nosymbolic, nosymbolic-, list, cm, bss, internal, hidden, protected, and export. A few more keywords are weak and required, which can be used along with another keyword.

ref: https://www.ibm.com/docs/en/aix/7.2.0?topic=l-ld-command#ld__a3119106d

This helps preserve C++ weak symbol semantics and preventing potential linker conflicts.

abmusse added 5 commits March 30, 2026 12:47
Some gcc flags dont work on clang:

-mfprnd
-mno-popcntb
-fno-extern-tls-init

So now we conditionally add them when clang is not enabled

Also for clang builds we need to pass some additonal flags:

-fno-integrated-as
-fno-xl-pragma-pack

These flags are discuessed in:
https://chromium-review.googlesource.com/c/chromium/src/+/7120638
to header files not shipping declarations.

This seems like a bug in AIX header files because the examples
show including the headers but upon inspecting these files there
are no declarations for sendmmsg and others:

https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine

For now we can claim to not have these functions.
Alternatively we can declare these ourselves if we are AIX 7.2 or newer.

The actual functions look to be available in libc.

GCC also has the same implicit function declaration but
it happily moves forward.

Clang started making this an explict error in clang 16:

https://www.redhat.com/en/blog/new-warnings-and-errors-clang-16
Original commit message:

aix: add required changes to build with clang

Change-Id: Icc78c58831306aa2f227843b0b4ec2321585fa64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7107287
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#104364}
visibility for symbols.

Without these changes we are getting back linker errors
AIX with clang builds:

```text
ld: 0711-407 ERROR: Symbol [SYMBOL_NAME]
        Visibility is not allowed on a reference to an imported symbol.
```

Not including hidden symbols in the export files matches the
recomendation by XLC documentation:

> When using export lists, it is not recommended to put symbols with
> hidden visibility in the lists.

ref: https://www.ibm.com/docs/en/openxl-c-and-cpp-aix/17.1.4?topic=libraries-symbol-exports-visibilities
in create_expfile.sh

AIX export files support the `weak` keyword to mark weak symbols.
ref: https://www.ibm.com/docs/en/aix/7.2.0?topic=l-ld-command#ld__a3119106d

This helps preserve C++ weak symbol semantics and preventing potential linker conflicts.
@abmusse abmusse requested a review from richardlau April 9, 2026 18:49
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/gyp
  • @nodejs/security-wg
  • @nodejs/v8-update

@nodejs-github-bot nodejs-github-bot added build Issues and PRs related to build files or the CI. dependencies Pull requests that update a dependency file. needs-ci PRs that need a full CI run. openssl Issues and PRs related to the OpenSSL dependency. tools Issues and PRs related to the tools directory. v8 engine Issues and PRs related to the V8 dependency. labels Apr 9, 2026
#if defined(_AIX) && !defined(_AIX72)
/* AIX >= 7.2 provides sendmmsg() and recvmmsg(). */
#if defined(_AIX)
/* Force fallback to sndmsg and recvmsg */

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs to be made upstream as otherwise it's going to get reverted every OpenSSL upgrade we take: https://github.com/openssl/openssl/blob/72d5e8dcd2977234e47e840d2173917daa8bb0fa/crypto/bio/bss_dgram.c#L71-L72

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I found a similar issue upstream: openssl/openssl#23751

Someone there mentioned that the headers for sendmmsg recvmmsg are in another location:

#include <net/proto_uipc.h>

I will open up a PR on upstream and see what maintainers say.

@abmusse abmusse Apr 15, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see that that documentation claims its available here: https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine
(Starting in AIX 7.2)

Following those docs you get back implicit function declaration for it.

You can re-recreate the behavior with this simple c program:

#include  <sys/types.h>
#include  <sys/socketvar.h>
#include  <sys/socket.h>
#include  <net/proto_uipc.h>

int main() {
    struct mmsghdr msgs[1];
    
    /* This causes implicit declaration warning - no header declares sendmmsg */
    sendmmsg(0, msgs, 1, 0);
    
    return 0;
}

Clang:

$ /opt/clang+llvm-20.1.7-powerpc64-ibm-aix-7.2/bin/clang -o aix-sendmmsg-issue.out aix-sendmmsg-issue.c 
aix-sendmmsg-issue.c:23:5: error: call to undeclared function 'sendmmsg'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
   23 |     sendmmsg(0, msgs, 1, 0);
      |     ^
aix-sendmmsg-issue.c:23:5: note: did you mean 'nsendmsg'?
/usr/include/sys/socket.h:645:9: note: 'nsendmsg' declared here
  645 | ssize_t sendmsg(int, const struct msghdr *, int);
      |         ^
/usr/include/sys/socket.h:174:25: note: expanded from macro 'sendmsg'
  174 | #define sendmsg         nsendmsg
      |                         ^
1 error generated.

GCC:

$ /opt/freeware/bin/gcc-12 -o aix-sendmmsg-issue.out aix-sendmmsg-issue.c 
aix-sendmmsg-issue.c: In function 'main':
aix-sendmmsg-issue.c:23:5: warning: implicit declaration of function 'sendmmsg'; did you mean 'sendmsg'? [-Wimplicit-function-declaration]
   23 |     sendmmsg(0, msgs, 1, 0);
      |     ^~~~~~~~
      |     sendmsg

Even including net/proto_uipc.h it fails too, upon further investigation looks like everything in that header is wrapped in #ifdef _KERNEL so it seems like sendmmsg / recvmmsg is not really usuable unless _KERNEL is defined.

With the above information, I'm now going forward with my changes in the PR on upstream openssl to just fall back to sendmsg and recvmsg.

I will try to open an issue with AIX team about sendmmsg not being available.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Opened Upstream PR: openssl/openssl#30832

@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

abmusse added a commit to abmusse/openssl that referenced this pull request Apr 15, 2026
AIX header files don't properly expose sendmmsg/recvmmsg function
declarations. Disable these functions to avoid implicit declaration
errors with clang 16+.

This issue was discovered when building Node.js with clang
ref: nodejs/node#62656

Fixes: openssl#30806
@richardlau richardlau added the commit-queue Add this label to land a pull request using GitHub Actions. label Apr 15, 2026
@nodejs-github-bot nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Apr 15, 2026
@richardlau richardlau added dont-land-on-v20.x dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. labels Apr 23, 2026
openssl-machine pushed a commit to openssl/openssl that referenced this pull request Apr 26, 2026
AIX header files don't properly expose sendmmsg/recvmmsg function
declarations. Disable these functions to avoid implicit declaration
errors with clang 16+.

This issue was discovered when building Node.js with clang.

CLA: trivial
Fixes: 52cd2a4 "Enable send-/recvmmsg for AIX >= 7.2 and disable SUPPORT_LOCAL_ADDR."
References: nodejs/node#62656
Resolves: #30806

Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Apr 26 12:02:58 2026
(Merged from #30832)
openssl-machine pushed a commit to openssl/openssl that referenced this pull request Apr 26, 2026
AIX header files don't properly expose sendmmsg/recvmmsg function
declarations. Disable these functions to avoid implicit declaration
errors with clang 16+.

This issue was discovered when building Node.js with clang.

CLA: trivial
Fixes: 52cd2a4 "Enable send-/recvmmsg for AIX >= 7.2 and disable SUPPORT_LOCAL_ADDR."
References: nodejs/node#62656
Resolves: #30806

Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Apr 26 12:02:58 2026
(Merged from #30832)

(cherry picked from commit 646aae6)
openssl-machine pushed a commit to openssl/openssl that referenced this pull request Apr 26, 2026
AIX header files don't properly expose sendmmsg/recvmmsg function
declarations. Disable these functions to avoid implicit declaration
errors with clang 16+.

This issue was discovered when building Node.js with clang.

CLA: trivial
Fixes: 52cd2a4 "Enable send-/recvmmsg for AIX >= 7.2 and disable SUPPORT_LOCAL_ADDR."
References: nodejs/node#62656
Resolves: #30806

Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Apr 26 12:02:58 2026
(Merged from #30832)

(cherry picked from commit 646aae6)
openssl-machine pushed a commit to openssl/openssl that referenced this pull request Apr 26, 2026
AIX header files don't properly expose sendmmsg/recvmmsg function
declarations. Disable these functions to avoid implicit declaration
errors with clang 16+.

This issue was discovered when building Node.js with clang.

CLA: trivial
Fixes: 52cd2a4 "Enable send-/recvmmsg for AIX >= 7.2 and disable SUPPORT_LOCAL_ADDR."
References: nodejs/node#62656
Resolves: #30806

Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Apr 26 12:02:58 2026
(Merged from #30832)

(cherry picked from commit 646aae6)
openssl-machine pushed a commit to openssl/openssl that referenced this pull request Apr 26, 2026
AIX header files don't properly expose sendmmsg/recvmmsg function
declarations. Disable these functions to avoid implicit declaration
errors with clang 16+.

This issue was discovered when building Node.js with clang.

CLA: trivial
Fixes: 52cd2a4 "Enable send-/recvmmsg for AIX >= 7.2 and disable SUPPORT_LOCAL_ADDR."
References: nodejs/node#62656
Resolves: #30806

Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Apr 26 12:02:58 2026
(Merged from #30832)

(cherry picked from commit 646aae6)
RafaelGSS pushed a commit that referenced this pull request Apr 27, 2026
Some gcc flags dont work on clang:

-mfprnd
-mno-popcntb
-fno-extern-tls-init

So now we conditionally add them when clang is not enabled

Also for clang builds we need to pass some additonal flags:

-fno-integrated-as
-fno-xl-pragma-pack

These flags are discuessed in:
https://chromium-review.googlesource.com/c/chromium/src/+/7120638

PR-URL: #62656
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
(cherry picked from commit 48a442b)
RafaelGSS pushed a commit that referenced this pull request Apr 27, 2026
This seems like a bug in AIX header files because the examples
show including the headers but upon inspecting these files there
are no declarations for sendmmsg and others:

https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine

For now we can claim to not have these functions.
Alternatively we can declare these ourselves if we are AIX 7.2 or newer.

The actual functions look to be available in libc.

GCC also has the same implicit function declaration but
it happily moves forward.

Clang started making this an explict error in clang 16:

https://www.redhat.com/en/blog/new-warnings-and-errors-clang-16

PR-URL: #62656
Refs: https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
(cherry picked from commit aba7a48)
RafaelGSS pushed a commit that referenced this pull request Apr 27, 2026
Original commit message:

    aix: add required changes to build with clang

    Change-Id: Icc78c58831306aa2f227843b0b4ec2321585fa64
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7107287
    Reviewed-by: Toon Verwaest <verwaest@chromium.org>
    Commit-Queue: Clemens Backes <clemensb@chromium.org>
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#104364}

PR-URL: #62656
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
(cherry picked from commit 142b593)
RafaelGSS pushed a commit that referenced this pull request Apr 27, 2026
Without these changes we are getting back linker errors
AIX with clang builds:

```text
ld: 0711-407 ERROR: Symbol [SYMBOL_NAME]
        Visibility is not allowed on a reference to an imported symbol.
```

Not including hidden symbols in the export files matches the
recomendation by XLC documentation:

> When using export lists, it is not recommended to put symbols with
> hidden visibility in the lists.

PR-URL: #62656
Refs: https://www.ibm.com/docs/en/openxl-c-and-cpp-aix/17.1.4?topic=libraries-symbol-exports-visibilities
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
(cherry picked from commit 263ebf0)
RafaelGSS pushed a commit that referenced this pull request Apr 27, 2026
AIX export files support the `weak` keyword to mark weak symbols.

This helps preserve C++ weak symbol semantics and preventing potential
linker conflicts.

PR-URL: #62656
Refs: https://www.ibm.com/docs/en/aix/7.2.0?topic=l-ld-command#ld__a3119106d
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
(cherry picked from commit db9da5d)
Sashan pushed a commit to Sashan/openssl that referenced this pull request Apr 28, 2026
AIX header files don't properly expose sendmmsg/recvmmsg function
declarations. Disable these functions to avoid implicit declaration
errors with clang 16+.

This issue was discovered when building Node.js with clang.

CLA: trivial
Fixes: 52cd2a4 "Enable send-/recvmmsg for AIX >= 7.2 and disable SUPPORT_LOCAL_ADDR."
References: nodejs/node#62656
Resolves: openssl#30806

Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Apr 26 12:02:58 2026
(Merged from openssl#30832)
RafaelGSS pushed a commit that referenced this pull request Apr 28, 2026
Some gcc flags dont work on clang:

-mfprnd
-mno-popcntb
-fno-extern-tls-init

So now we conditionally add them when clang is not enabled

Also for clang builds we need to pass some additonal flags:

-fno-integrated-as
-fno-xl-pragma-pack

These flags are discuessed in:
https://chromium-review.googlesource.com/c/chromium/src/+/7120638

PR-URL: #62656
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
(cherry picked from commit 48a442b)
RafaelGSS pushed a commit that referenced this pull request Apr 28, 2026
This seems like a bug in AIX header files because the examples
show including the headers but upon inspecting these files there
are no declarations for sendmmsg and others:

https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine

For now we can claim to not have these functions.
Alternatively we can declare these ourselves if we are AIX 7.2 or newer.

The actual functions look to be available in libc.

GCC also has the same implicit function declaration but
it happily moves forward.

Clang started making this an explict error in clang 16:

https://www.redhat.com/en/blog/new-warnings-and-errors-clang-16

PR-URL: #62656
Refs: https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
(cherry picked from commit aba7a48)
RafaelGSS pushed a commit that referenced this pull request Apr 28, 2026
Original commit message:

    aix: add required changes to build with clang

    Change-Id: Icc78c58831306aa2f227843b0b4ec2321585fa64
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7107287
    Reviewed-by: Toon Verwaest <verwaest@chromium.org>
    Commit-Queue: Clemens Backes <clemensb@chromium.org>
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#104364}

PR-URL: #62656
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
(cherry picked from commit 142b593)
RafaelGSS pushed a commit that referenced this pull request Apr 28, 2026
Without these changes we are getting back linker errors
AIX with clang builds:

```text
ld: 0711-407 ERROR: Symbol [SYMBOL_NAME]
        Visibility is not allowed on a reference to an imported symbol.
```

Not including hidden symbols in the export files matches the
recomendation by XLC documentation:

> When using export lists, it is not recommended to put symbols with
> hidden visibility in the lists.

PR-URL: #62656
Refs: https://www.ibm.com/docs/en/openxl-c-and-cpp-aix/17.1.4?topic=libraries-symbol-exports-visibilities
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
(cherry picked from commit 263ebf0)
RafaelGSS pushed a commit that referenced this pull request Apr 28, 2026
AIX export files support the `weak` keyword to mark weak symbols.

This helps preserve C++ weak symbol semantics and preventing potential
linker conflicts.

PR-URL: #62656
Refs: https://www.ibm.com/docs/en/aix/7.2.0?topic=l-ld-command#ld__a3119106d
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
(cherry picked from commit db9da5d)
araujogui pushed a commit to araujogui/node that referenced this pull request May 26, 2026
Some gcc flags dont work on clang:

-mfprnd
-mno-popcntb
-fno-extern-tls-init

So now we conditionally add them when clang is not enabled

Also for clang builds we need to pass some additonal flags:

-fno-integrated-as
-fno-xl-pragma-pack

These flags are discuessed in:
https://chromium-review.googlesource.com/c/chromium/src/+/7120638

PR-URL: nodejs#62656
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
araujogui pushed a commit to araujogui/node that referenced this pull request May 26, 2026
This seems like a bug in AIX header files because the examples
show including the headers but upon inspecting these files there
are no declarations for sendmmsg and others:

https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine

For now we can claim to not have these functions.
Alternatively we can declare these ourselves if we are AIX 7.2 or newer.

The actual functions look to be available in libc.

GCC also has the same implicit function declaration but
it happily moves forward.

Clang started making this an explict error in clang 16:

https://www.redhat.com/en/blog/new-warnings-and-errors-clang-16

PR-URL: nodejs#62656
Refs: https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
araujogui pushed a commit to araujogui/node that referenced this pull request May 26, 2026
Original commit message:

    aix: add required changes to build with clang

    Change-Id: Icc78c58831306aa2f227843b0b4ec2321585fa64
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7107287
    Reviewed-by: Toon Verwaest <verwaest@chromium.org>
    Commit-Queue: Clemens Backes <clemensb@chromium.org>
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#104364}

PR-URL: nodejs#62656
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
araujogui pushed a commit to araujogui/node that referenced this pull request May 26, 2026
Without these changes we are getting back linker errors
AIX with clang builds:

```text
ld: 0711-407 ERROR: Symbol [SYMBOL_NAME]
        Visibility is not allowed on a reference to an imported symbol.
```

Not including hidden symbols in the export files matches the
recomendation by XLC documentation:

> When using export lists, it is not recommended to put symbols with
> hidden visibility in the lists.

PR-URL: nodejs#62656
Refs: https://www.ibm.com/docs/en/openxl-c-and-cpp-aix/17.1.4?topic=libraries-symbol-exports-visibilities
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
araujogui pushed a commit to araujogui/node that referenced this pull request May 26, 2026
AIX export files support the `weak` keyword to mark weak symbols.

This helps preserve C++ weak symbol semantics and preventing potential
linker conflicts.

PR-URL: nodejs#62656
Refs: https://www.ibm.com/docs/en/aix/7.2.0?topic=l-ld-command#ld__a3119106d
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
aduh95 pushed a commit that referenced this pull request Jun 16, 2026
This seems like a bug in AIX header files because the examples
show including the headers but upon inspecting these files there
are no declarations for sendmmsg and others:

https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine

For now we can claim to not have these functions.
Alternatively we can declare these ourselves if we are AIX 7.2 or newer.

The actual functions look to be available in libc.

GCC also has the same implicit function declaration but
it happily moves forward.

Clang started making this an explict error in clang 16:

https://www.redhat.com/en/blog/new-warnings-and-errors-clang-16

PR-URL: #62656
Refs: https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
aduh95 pushed a commit that referenced this pull request Jun 16, 2026
This seems like a bug in AIX header files because the examples
show including the headers but upon inspecting these files there
are no declarations for sendmmsg and others:

https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine

For now we can claim to not have these functions.
Alternatively we can declare these ourselves if we are AIX 7.2 or newer.

The actual functions look to be available in libc.

GCC also has the same implicit function declaration but
it happily moves forward.

Clang started making this an explict error in clang 16:

https://www.redhat.com/en/blog/new-warnings-and-errors-clang-16

PR-URL: #62656
Refs: https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
panva pushed a commit to panva/node that referenced this pull request Jun 19, 2026
This seems like a bug in AIX header files because the examples
show including the headers but upon inspecting these files there
are no declarations for sendmmsg and others:

https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine

For now we can claim to not have these functions.
Alternatively we can declare these ourselves if we are AIX 7.2 or newer.

The actual functions look to be available in libc.

GCC also has the same implicit function declaration but
it happily moves forward.

Clang started making this an explict error in clang 16:

https://www.redhat.com/en/blog/new-warnings-and-errors-clang-16

PR-URL: nodejs#62656
Refs: https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: MichaΓ«l Zasso <targos@protonmail.com>
rohitkumarankam pushed a commit to rohitkumarankam/forgejo that referenced this pull request Jun 20, 2026
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | minor | `24.16.0` β†’ `24.17.0` |

---

### Release Notes

<details>
<summary>nodejs/node (node)</summary>

### [`v24.17.0`](https://github.com/nodejs/node/releases/tag/v24.17.0): 2026-06-18, Version 24.17.0 'Krypton' (LTS), @&#8203;aduh95

[Compare Source](nodejs/node@v24.16.0...v24.17.0)

This is a security release.

##### Notable Changes

- (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
- (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
- (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
- (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
- (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
- (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
- (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
- (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
- (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
- (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
- (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

##### Commits

- \[[`9e4dfc7bba`](nodejs/node@9e4dfc7bba)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878)
- \[[`cb2aed980c`](nodejs/node@cb2aed980c)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890)
- \[[`a8a0d12875`](nodejs/node@a8a0d12875)] - **(CVE-2026-48937)** **deps**: fix integration issues with the latest nghttp2 (Tim Perry) [#&#8203;62891](nodejs/node#62891)
- \[[`66e6203c1c`](nodejs/node@66e6203c1c)] - **(SEMVER-MAJOR)** **deps**: update nghttp2 to 1.69.0 (Node.js GitHub Bot) [#&#8203;62891](nodejs/node#62891)
- \[[`dd627ced27`](nodejs/node@dd627ced27)] - **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot) [#&#8203;63820](nodejs/node#63820)
- \[[`684bae568f`](nodejs/node@684bae568f)] - **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) [#&#8203;63820](nodejs/node#63820)
- \[[`3a631e7f83`](nodejs/node@3a631e7f83)] - **deps**: fix aix implicit declaration in OpenSSL (Abdirahim Musse) [#&#8203;62656](nodejs/node#62656)
- \[[`cf44df3996`](nodejs/node@cf44df3996)] - **deps**: update undici to 7.28.0 (Node.js GitHub Bot) [#&#8203;63703](nodejs/node#63703)
- \[[`138c70294b`](nodejs/node@138c70294b)] - **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL bytes (Matteo Collina) [nodejs-private/node-private#868](https://github.com/nodejs-private/node-private/pull/868)
- \[[`be7e719c3f`](nodejs/node@be7e719c3f)] - **(CVE-2026-48931)** **http**: fix response queue poisoning in http.Agent (Matteo Collina) [nodejs-private/node-private#846](https://github.com/nodejs-private/node-private/pull/846)
- \[[`cc7c11b4d1`](nodejs/node@cc7c11b4d1)] - **(CVE-2026-48619)** **http2**: cap originSet size to prevent unbounded memory growth (Matteo Collina) [nodejs-private/node-private#855](https://github.com/nodejs-private/node-private/pull/855)
- \[[`9224427b92`](nodejs/node@9224427b92)] - **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel errors (Matteo Collina) [nodejs-private/node-private#867](https://github.com/nodejs-private/node-private/pull/867)
- \[[`cf85d54839`](nodejs/node@cf85d54839)] - **(CVE-2026-48935)** **permission**: disable FileHandle utimes with permission model (RafaelGSS) [nodejs-private/node-private#873](https://github.com/nodejs-private/node-private/pull/873)
- \[[`a1bbc24f96`](nodejs/node@a1bbc24f96)] - **(CVE-2026-48617)** **permission**: handle process.chdir on writereport (RafaelGSS) [nodejs-private/node-private#870](https://github.com/nodejs-private/node-private/pull/870)
- \[[`e3723ff2d6`](nodejs/node@e3723ff2d6)] - **test**: add session reuse host verification regressions (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854)
- \[[`a77af4867b`](nodejs/node@a77af4867b)] - **(CVE-2026-48934)** **tls**: bind reusable sessions to authenticated host (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854)
- \[[`31beb4f707`](nodejs/node@31beb4f707)] - **(CVE-2026-48928)** **tls**: fix case-sensitive SNI context matching (Matteo Collina) [nodejs-private/node-private#857](https://github.com/nodejs-private/node-private/pull/857)
- \[[`8e75c73f91`](nodejs/node@8e75c73f91)] - **(CVE-2026-48618)** **tls**: normalize hostname for server identity checks (Matteo Collina) [nodejs-private/node-private#869](https://github.com/nodejs-private/node-private/pull/869)

</details>

---

### Configuration

πŸ“… **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)
- Automerge
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMjIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIyMi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13144
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
mwalbeck pushed a commit to mwalbeck/docker-cyberchef that referenced this pull request Jul 11, 2026
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [node](https://github.com/nodejs/node) | stage | minor | `24.16.0-trixie` β†’ `24.18.0-trixie` |

---

### Release Notes

<details>
<summary>nodejs/node (node)</summary>

### [`v24.18.0`](https://github.com/nodejs/node/releases/tag/v24.18.0): 2026-06-23, Version 24.18.0 'Krypton' (LTS), @&#8203;richardlau prepared by @&#8203;sxa

[Compare Source](nodejs/node@v24.17.0...v24.18.0)

##### Notable Changes

- \[[`e07e7a31e1`](nodejs/node@e07e7a31e1)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#&#8203;63527](nodejs/node#63527)
- \[[`44c8ebcbd6`](nodejs/node@44c8ebcbd6)] - **http**: avoid stream listeners on idle agent sockets (Matteo Collina) [#&#8203;64004](nodejs/node#64004)
- \[[`d3ef4122ee`](nodejs/node@d3ef4122ee)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#&#8203;63597](nodejs/node#63597)
- \[[`bb2857b85a`](nodejs/node@bb2857b85a)] - **(SEMVER-MINOR)** **crypto**: align key argument names in docs and error messages (Filip Skokan) [#&#8203;62527](nodejs/node#62527)
- \[[`b9d5e87880`](nodejs/node@b9d5e87880)] - **(SEMVER-MINOR)** **crypto**: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) [#&#8203;62527](nodejs/node#62527)
- \[[`ccd756d61e`](nodejs/node@ccd756d61e)] - **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) [#&#8203;62183](nodejs/node#62183)
- \[[`4c9251fc09`](nodejs/node@4c9251fc09)] - **(SEMVER-MINOR)** **http**: add writeInformation to send arbitrary 1xx status codes (Tim Perry) [#&#8203;63155](nodejs/node#63155)
- \[[`8c989ec4a3`](nodejs/node@8c989ec4a3)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#&#8203;63079](nodejs/node#63079)
- \[[`3f54c8ba32`](nodejs/node@3f54c8ba32)] - ***Revert*** "**stream**: noop pause/resume on destroyed streams" (Stewart X Addison) [#&#8203;63834](nodejs/node#63834)

##### Commits

- \[[`d3ef4122ee`](nodejs/node@d3ef4122ee)] - **(SEMVER-MINOR)** **buffer**: increase Buffer.poolSize default to 64 KiB (Matteo Collina) [#&#8203;63597](nodejs/node#63597)
- \[[`9ff36e40f0`](nodejs/node@9ff36e40f0)] - **build**: add --enable-all-experimentals build flag (Paolo Insogna) [#&#8203;62755](nodejs/node#62755)
- \[[`7c22ee23aa`](nodejs/node@7c22ee23aa)] - **build**: def `NODE_USE_NODE_CODE_CACHE` only used in node\_mksnapshot (Chengzhong Wu) [#&#8203;63588](nodejs/node#63588)
- \[[`2551abdb4a`](nodejs/node@2551abdb4a)] - **build,win**: enable x64 PGO (Stefan Stojanovic) [#&#8203;62761](nodejs/node#62761)
- \[[`e8a55ce9b1`](nodejs/node@e8a55ce9b1)] - **crypto**: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) [#&#8203;62763](nodejs/node#62763)
- \[[`ae61cd68f3`](nodejs/node@ae61cd68f3)] - **crypto**: harden WebCrypto against prototype pollution (Filip Skokan) [#&#8203;63363](nodejs/node#63363)
- \[[`3d05a1d396`](nodejs/node@3d05a1d396)] - **crypto**: pass CryptoKey handles to KDF jobs (Filip Skokan) [#&#8203;63363](nodejs/node#63363)
- \[[`f9d10a3f6b`](nodejs/node@f9d10a3f6b)] - **crypto**: remove async from WebCrypto methods (Filip Skokan) [#&#8203;63363](nodejs/node#63363)
- \[[`e431d93e9e`](nodejs/node@e431d93e9e)] - **crypto**: add WebCrypto CryptoJob mode (Filip Skokan) [#&#8203;63363](nodejs/node#63363)
- \[[`56e2505e48`](nodejs/node@56e2505e48)] - **crypto**: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) [#&#8203;63255](nodejs/node#63255)
- \[[`3bac77f2a8`](nodejs/node@3bac77f2a8)] - **crypto**: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) [#&#8203;63255](nodejs/node#63255)
- \[[`1bff901b09`](nodejs/node@1bff901b09)] - **crypto**: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) [#&#8203;63255](nodejs/node#63255)
- \[[`4433fca3df`](nodejs/node@4433fca3df)] - **crypto**: harden CryptoKey algorithm slots (Filip Skokan) [#&#8203;63111](nodejs/node#63111)
- \[[`b5cf01217a`](nodejs/node@b5cf01217a)] - **crypto**: harden KeyObject internal slots (Filip Skokan) [#&#8203;63111](nodejs/node#63111)
- \[[`ce84aef37d`](nodejs/node@ce84aef37d)] - **crypto**: add guards and adjust tests for BoringSSL (Filip Skokan) [#&#8203;62883](nodejs/node#62883)
- \[[`26781689b0`](nodejs/node@26781689b0)] - **crypto**: reject duplicate ML-KEM JWK key\_ops (Filip Skokan) [#&#8203;62905](nodejs/node#62905)
- \[[`aeea8f4970`](nodejs/node@aeea8f4970)] - **crypto**: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) [#&#8203;62706](nodejs/node#62706)
- \[[`407cf91656`](nodejs/node@407cf91656)] - **crypto**: guard against size\_t overflow on experimental 32-bit arch (Filip Skokan) [#&#8203;62626](nodejs/node#62626)
- \[[`bb2857b85a`](nodejs/node@bb2857b85a)] - **(SEMVER-MINOR)** **crypto**: align key argument names in docs and error messages (Filip Skokan) [#&#8203;62527](nodejs/node#62527)
- \[[`b9d5e87880`](nodejs/node@b9d5e87880)] - **(SEMVER-MINOR)** **crypto**: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) [#&#8203;62527](nodejs/node#62527)
- \[[`b46d52b283`](nodejs/node@b46d52b283)] - **crypto**: unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) [#&#8203;62499](nodejs/node#62499)
- \[[`ccd756d61e`](nodejs/node@ccd756d61e)] - **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) [#&#8203;62183](nodejs/node#62183)
- \[[`e07e7a31e1`](nodejs/node@e07e7a31e1)] - **crypto**: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) [#&#8203;63527](nodejs/node#63527)
- \[[`61826df455`](nodejs/node@61826df455)] - **crypto**: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) [#&#8203;63531](nodejs/node#63531)
- \[[`16d2fd3c07`](nodejs/node@16d2fd3c07)] - **crypto**: align verifyOneShot accepted types (Anshika Jain) [#&#8203;63280](nodejs/node#63280)
- \[[`3b8330deda`](nodejs/node@3b8330deda)] - **crypto**: improve system certificate enumeration logic on macOS (Robo) [#&#8203;62576](nodejs/node#62576)
- \[[`141de35399`](nodejs/node@141de35399)] - **debugger**: add --help to `node inspect` and improve docs (Joyee Cheung) [#&#8203;63201](nodejs/node#63201)
- \[[`b76bfcd4fa`](nodejs/node@b76bfcd4fa)] - **deps**: upgrade npm to 11.16.0 (npm team) [#&#8203;63602](nodejs/node#63602)
- \[[`4ec142314c`](nodejs/node@4ec142314c)] - **deps**: SQLite: cherry-pick [`b869ed6`](nodejs/node@b869ed6) (Junsu Han) [#&#8203;63525](nodejs/node#63525)
- \[[`19e8ce1c36`](nodejs/node@19e8ce1c36)] - **deps**: upgrade npm to 11.15.0 (npm team) [#&#8203;63463](nodejs/node#63463)
- \[[`8a264260e2`](nodejs/node@8a264260e2)] - **deps**: update sqlite to 3.53.1 (Node.js GitHub Bot) [#&#8203;63217](nodejs/node#63217)
- \[[`50c8ff3f94`](nodejs/node@50c8ff3f94)] - **deps**: update simdjson to 4.6.4 (Node.js GitHub Bot) [#&#8203;62811](nodejs/node#62811)
- \[[`6e56f01c4b`](nodejs/node@6e56f01c4b)] - **deps**: V8: cherry-pick [`435a2cd`](nodejs/node@435a2cdf664c) (Matthias Liedtke) [#&#8203;63136](nodejs/node#63136)
- \[[`3ba813b242`](nodejs/node@3ba813b242)] - **deps**: cherry-pick [libuv/libuv@`a43e543`](libuv/libuv@a43e543) (Ali Hassan) [#&#8203;63222](nodejs/node#63222)
- \[[`2390e3a5ac`](nodejs/node@2390e3a5ac)] - **doc**: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) [#&#8203;63650](nodejs/node#63650)
- \[[`52a1c18374`](nodejs/node@52a1c18374)] - **doc**: update `git node land` instructions for security releases (Antoine du Hamel) [#&#8203;63586](nodejs/node#63586)
- \[[`3e6b4da037`](nodejs/node@3e6b4da037)] - **doc**: drop --experimental from --permission (Rafael Gonzaga) [#&#8203;63583](nodejs/node#63583)
- \[[`84d05163b9`](nodejs/node@84d05163b9)] - **doc**: explicitly ask for reproducible in JS (Rafael Gonzaga) [#&#8203;63479](nodejs/node#63479)
- \[[`7da2a4450e`](nodejs/node@7da2a4450e)] - **doc**: fix URL postMessage example in worker\_threads (Kit Dallege) [#&#8203;62203](nodejs/node#62203)
- \[[`3d79bd8b29`](nodejs/node@3d79bd8b29)] - **doc**: clarify `filter` option of `sqlite.database.applyChangeset` (Antoine du Hamel) [#&#8203;63515](nodejs/node#63515)
- \[[`4f4174aace`](nodejs/node@4f4174aace)] - **doc**: fix double spaces in ERR\_TLS\_INVALID\_PROTOCOL\_METHOD (Daijiro Wachi) [#&#8203;63511](nodejs/node#63511)
- \[[`388323ca4b`](nodejs/node@388323ca4b)] - **doc**: fix double space in modules.md (Daijiro Wachi) [#&#8203;63512](nodejs/node#63512)
- \[[`5258ccc058`](nodejs/node@5258ccc058)] - **doc**: fix "options" to "option" in tls.createServer (Daijiro Wachi) [#&#8203;63453](nodejs/node#63453)
- \[[`43e83e6507`](nodejs/node@43e83e6507)] - **doc**: fix typo in deprecations (Daijiro Wachi) [#&#8203;63434](nodejs/node#63434)
- \[[`f05a61d54c`](nodejs/node@f05a61d54c)] - **doc**: remove unsupported template type from v8.md (RenΓ©) [#&#8203;63410](nodejs/node#63410)
- \[[`c39d5fc820`](nodejs/node@c39d5fc820)] - **doc**: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) [#&#8203;62696](nodejs/node#62696)
- \[[`398261f911`](nodejs/node@398261f911)] - **doc**: remove the bi-monthly contributor spotlight section (Claudio Wunder) [#&#8203;62734](nodejs/node#62734)
- \[[`fd9e14c405`](nodejs/node@fd9e14c405)] - **doc**: update http2's `push` and `trailers` events with `rawHeaders` param (YuSheng Chen) [#&#8203;63259](nodejs/node#63259)
- \[[`b943ce6933`](nodejs/node@b943ce6933)] - **doc**: remove inactive members from Triagers list (Antoine du Hamel) [#&#8203;63329](nodejs/node#63329)
- \[[`4b9cdfc022`](nodejs/node@4b9cdfc022)] - **doc**: reference correct function in Module docs (Robin Malfait) [#&#8203;63247](nodejs/node#63247)
- \[[`bed84b6df2`](nodejs/node@bed84b6df2)] - **doc**: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) [#&#8203;63211](nodejs/node#63211)
- \[[`32ea70569b`](nodejs/node@32ea70569b)] - **doc**: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) [#&#8203;63187](nodejs/node#63187)
- \[[`4627bcfd82`](nodejs/node@4627bcfd82)] - **doc**: run license-builder (github-actions\[bot]) [#&#8203;63232](nodejs/node#63232)
- \[[`28eba71845`](nodejs/node@28eba71845)] - **doc**: add large pull requests contributing guide (Matteo Collina) [#&#8203;62829](nodejs/node#62829)
- \[[`2648efd438`](nodejs/node@2648efd438)] - **doc**: remove unnecessary `<!-- eslint-` magic comments (Antoine du Hamel) [#&#8203;63200](nodejs/node#63200)
- \[[`a95fc1f8fc`](nodejs/node@a95fc1f8fc)] - **doc**: clarify SEA platform support excludes darwin-x64 (MJSHANG) [#&#8203;63181](nodejs/node#63181)
- \[[`aaef29e2e1`](nodejs/node@aaef29e2e1)] - **doc**: update release steps when post-release fails (Rafael Gonzaga) [#&#8203;63131](nodejs/node#63131)
- \[[`7d81419cf2`](nodejs/node@7d81419cf2)] - **doc**: add Hmac.digest() documentation-only deprecation (DEP0206) (Anshika Jain) [#&#8203;63121](nodejs/node#63121)
- \[[`ececd80d81`](nodejs/node@ececd80d81)] - **doc**: document the latest-vX.x schema (Marco Ippolito) [#&#8203;63033](nodejs/node#63033)
- \[[`27c1c1d842`](nodejs/node@27c1c1d842)] - **doc**: remove list of versions in `BUILDING.md` (Antoine du Hamel) [#&#8203;63113](nodejs/node#63113)
- \[[`e369886a65`](nodejs/node@e369886a65)] - **doc,sqlite**: document entryPoint argument for loadExtension (Edy Silva) [#&#8203;63152](nodejs/node#63152)
- \[[`e4e5137cbd`](nodejs/node@e4e5137cbd)] - **errors**: handle V8 warnings in DisallowJavascriptExecutionScope (Divyanshu Sharma) [#&#8203;63491](nodejs/node#63491)
- \[[`6d1f6048d2`](nodejs/node@6d1f6048d2)] - **fs**: make `Date` properties on `Stats` enumerable (LiviaMedeiros) [#&#8203;63328](nodejs/node#63328)
- \[[`44c8ebcbd6`](nodejs/node@44c8ebcbd6)] - **http**: avoid stream listeners on idle agent sockets (Matteo Collina) [#&#8203;64004](nodejs/node#64004)
- \[[`4c9251fc09`](nodejs/node@4c9251fc09)] - **(SEMVER-MINOR)** **http**: add writeInformation to send arbitrary 1xx status codes (Tim Perry) [#&#8203;63155](nodejs/node#63155)
- \[[`39f61fb06c`](nodejs/node@39f61fb06c)] - **http2**: emit session close before stream close (Matteo Collina) [#&#8203;63414](nodejs/node#63414)
- \[[`8a8f2127d1`](nodejs/node@8a8f2127d1)] - **http2**: validate non-link headers in writeEarlyHints (Matteo Collina) [#&#8203;62017](nodejs/node#62017)
- \[[`8c989ec4a3`](nodejs/node@8c989ec4a3)] - **(SEMVER-MINOR)** **inspector**: expose precise coverage start to JS runtime (sangwook) [#&#8203;63079](nodejs/node#63079)
- \[[`c05f38229b`](nodejs/node@c05f38229b)] - **lib**: cleanup stateless diffiehellman key handling (Filip Skokan) [#&#8203;62645](nodejs/node#62645)
- \[[`1c16b45d35`](nodejs/node@1c16b45d35)] - **lib**: refactor internal webidl converters (Filip Skokan) [#&#8203;62979](nodejs/node#62979)
- \[[`02f35d6dce`](nodejs/node@02f35d6dce)] - **lib**: define `kEnumerableProperty` atomically (Antoine du Hamel) [#&#8203;63609](nodejs/node#63609)
- \[[`12c51547ba`](nodejs/node@12c51547ba)] - **lib**: fix typos in esm loader comments (RonGamzu) [#&#8203;63465](nodejs/node#63465)
- \[[`9b03b84262`](nodejs/node@9b03b84262)] - **lib**: fix typo idenity => identity (Daijiro Wachi) [#&#8203;63112](nodejs/node#63112)
- \[[`a84e6b0567`](nodejs/node@a84e6b0567)] - **lib**: fixes validator message (Daijiro Wachi) [#&#8203;62823](nodejs/node#62823)
- \[[`11734166a8`](nodejs/node@11734166a8)] - **lib**: narrow ReadableStreamBYOBRequest.view return type to Uint8Array (RoomWithOutRoof) [#&#8203;63017](nodejs/node#63017)
- \[[`7cead61d21`](nodejs/node@7cead61d21)] - **meta**: flip mcollina emails in .mailmap (Matteo Collina) [#&#8203;63621](nodejs/node#63621)
- \[[`a08cfcfd35`](nodejs/node@a08cfcfd35)] - **meta**: label "source maps" PRs (Chengzhong Wu) [#&#8203;63591](nodejs/node#63591)
- \[[`d56e8d2512`](nodejs/node@d56e8d2512)] - **meta**: add `vfs` subsystem label (RenΓ©) [#&#8203;62331](nodejs/node#62331)
- \[[`6201cfe488`](nodejs/node@6201cfe488)] - **meta**: skip scheduled workflows on forks (Jamie Magee) [#&#8203;63565](nodejs/node#63565)
- \[[`f095e2bd31`](nodejs/node@f095e2bd31)] - **meta**: add additional gitignore entries (James M Snell) [#&#8203;63267](nodejs/node#63267)
- \[[`1ea52c444c`](nodejs/node@1ea52c444c)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#&#8203;63402](nodejs/node#63402)
- \[[`b1b2327611`](nodejs/node@b1b2327611)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#&#8203;63235](nodejs/node#63235)
- \[[`7d88e130a9`](nodejs/node@7d88e130a9)] - **meta**: ignore AI assistants files (Matteo Collina) [#&#8203;62612](nodejs/node#62612)
- \[[`a53b51df38`](nodejs/node@a53b51df38)] - **module**: load ESM helpers eagerly in the snapshot (Joyee Cheung) [#&#8203;63550](nodejs/node#63550)
- \[[`69df688fff`](nodejs/node@69df688fff)] - **module**: fix sync hook short-circuit in require() in imported CJS (Joyee Cheung) [#&#8203;62920](nodejs/node#62920)
- \[[`75d9a4ed47`](nodejs/node@75d9a4ed47)] - **node-api**: support SharedArrayBuffer in napi\_create\_typedarray (Yilong Li) [#&#8203;62710](nodejs/node#62710)
- \[[`c20aa4c47b`](nodejs/node@c20aa4c47b)] - **quic**: add reusePort option to QuicEndpoint (James M Snell) [#&#8203;63267](nodejs/node#63267)
- \[[`26a30d8a7f`](nodejs/node@26a30d8a7f)] - **quic**: implement rate limiting for version nego and immediate close (James M Snell) [#&#8203;63267](nodejs/node#63267)
- \[[`0b534b5770`](nodejs/node@0b534b5770)] - **quic**: fixup linting issue after other changes (James M Snell) [#&#8203;63267](nodejs/node#63267)
- \[[`4b367cbe09`](nodejs/node@4b367cbe09)] - **quic**: remove unused binding variable in session.cc (James M Snell) [#&#8203;63177](nodejs/node#63177)
- \[[`2574bef5a6`](nodejs/node@2574bef5a6)] - **repl**: fix dedup comparing normalized line against raw history (Daijiro Wachi) [#&#8203;62886](nodejs/node#62886)
- \[[`30e71c7e49`](nodejs/node@30e71c7e49)] - **sqlite**: keep source database alive during backup (Matteo Collina) [#&#8203;62673](nodejs/node#62673)
- \[[`677ca7e76c`](nodejs/node@677ca7e76c)] - **src**: simplify OpenSSL feature gates (Filip Skokan) [#&#8203;63255](nodejs/node#63255)
- \[[`c863c75c39`](nodejs/node@c863c75c39)] - **src**: add BoringSSL EVP enumeration fallback (Filip Skokan) [#&#8203;63206](nodejs/node#63206)
- \[[`f6b2466921`](nodejs/node@f6b2466921)] - **src**: decouple KeyObject and CryptoKey and move CryptoKey to src (Filip Skokan) [#&#8203;62924](nodejs/node#62924)
- \[[`92d4f07dd2`](nodejs/node@92d4f07dd2)] - **src**: remove license headers for new node\_profiling files (Chengzhong Wu) [#&#8203;63066](nodejs/node#63066)
- \[[`8ac5d771c8`](nodejs/node@8ac5d771c8)] - **src**: split profiling helpers from util (Ilyas Shabi) [#&#8203;63008](nodejs/node#63008)
- \[[`85d1639495`](nodejs/node@85d1639495)] - **src**: remove TOCTOU race condition when encoding SAB-backed `Buffer`s (Antoine du Hamel) [#&#8203;63517](nodejs/node#63517)
- \[[`9473c5f05c`](nodejs/node@9473c5f05c)] - **src**: skip duplicate UTF-8 validation in TextDecoder fatal path (Mert Can Altin) [#&#8203;63231](nodejs/node#63231)
- \[[`f35c91ee68`](nodejs/node@f35c91ee68)] - **src**: improve token return value check (James M Snell) [#&#8203;63483](nodejs/node#63483)
- \[[`26f677c1c5`](nodejs/node@26f677c1c5)] - **src**: expose `node::RegisterContext` to make a node managed context (Chengzhong Wu) [#&#8203;62322](nodejs/node#62322)
- \[[`275cf909b6`](nodejs/node@275cf909b6)] - **src,sqlite**: only pass `xFilter` when user provided a callback (Antoine du Hamel) [#&#8203;63516](nodejs/node#63516)
- \[[`287e02303f`](nodejs/node@287e02303f)] - **src,sqlite**: remove dead code (Edy Silva) [#&#8203;63204](nodejs/node#63204)
- \[[`58fa2ee189`](nodejs/node@58fa2ee189)] - **stream**: switch to internal `sleep` binding (Antoine du Hamel) [#&#8203;63611](nodejs/node#63611)
- \[[`f954ab3f1a`](nodejs/node@f954ab3f1a)] - **stream**: use data listener for compose forwarding (Trivikram Kamat) [#&#8203;63593](nodejs/node#63593)
- \[[`dc57173003`](nodejs/node@dc57173003)] - **stream**: fix Writable.toWeb() hang on synchronous drain (sangwook) [#&#8203;61197](nodejs/node#61197)
- \[[`3f54c8ba32`](nodejs/node@3f54c8ba32)] - ***Revert*** "**stream**: noop pause/resume on destroyed streams" (Stewart X Addison) [#&#8203;63834](nodejs/node#63834)
- \[[`cee279c5d6`](nodejs/node@cee279c5d6)] - **stream**: remove unnecessary check (Antoine du Hamel) [#&#8203;63030](nodejs/node#63030)
- \[[`61b20f60a3`](nodejs/node@61b20f60a3)] - **test**: update tls/crypto behaviour expectations when using BoringSSL (Filip Skokan) [#&#8203;63161](nodejs/node#63161)
- \[[`a835363808`](nodejs/node@a835363808)] - **test**: update WPT for WebCryptoAPI to [`97bbc72`](nodejs/node@97bbc7247a) (Node.js GitHub Bot) [#&#8203;63417](nodejs/node#63417)
- \[[`a00297480b`](nodejs/node@a00297480b)] - **test**: update WPT resources, interfaces and WebCryptoAPI (Node.js GitHub Bot) [#&#8203;62389](nodejs/node#62389)
- \[[`5a95a2b055`](nodejs/node@5a95a2b055)] - **test**: shorten path in net pipe connect errors (Matteo Collina) [#&#8203;63405](nodejs/node#63405)
- \[[`5e8ff22d8f`](nodejs/node@5e8ff22d8f)] - **test**: remove test-node-output-v8-warning (Joyee Cheung) [#&#8203;63469](nodejs/node#63469)
- \[[`ee15380950`](nodejs/node@ee15380950)] - **test**: update test426-fixtures to [`9b9e225`](nodejs/node@9b9e225) (Node.js GitHub Bot) [#&#8203;63373](nodejs/node#63373)
- \[[`9e063d9bea`](nodejs/node@9e063d9bea)] - **test**: update WPT for url to [`e4a4672`](nodejs/node@e4a4672e9e) (Node.js GitHub Bot) [#&#8203;63372](nodejs/node#63372)
- \[[`503bee4b43`](nodejs/node@503bee4b43)] - **test**: deflake async-hooks statwatcher test (Trivikram Kamat) [#&#8203;63396](nodejs/node#63396)
- \[[`cccc7c32d8`](nodejs/node@cccc7c32d8)] - **test**: avoid test\_runner watch restart in spec snapshot (Trivikram Kamat) [#&#8203;63392](nodejs/node#63392)
- \[[`c89489258c`](nodejs/node@c89489258c)] - **test**: reduce watch mode restart flakiness (Trivikram Kamat) [#&#8203;63390](nodejs/node#63390)
- \[[`e4d5e2578e`](nodejs/node@e4d5e2578e)] - **test**: isolate rerun-failures state file under tmpdir (Chemi Atlow) [#&#8203;63449](nodejs/node#63449)
- \[[`362644a9ba`](nodejs/node@362644a9ba)] - **test**: wait for ok before initial break after restart (Yuya Inoue) [#&#8203;62807](nodejs/node#62807)
- \[[`c4058d0e05`](nodejs/node@c4058d0e05)] - **test**: disable Maglev in near-heap-limit worker test (Trivikram Kamat) [#&#8203;63398](nodejs/node#63398)
- \[[`214da630a7`](nodejs/node@214da630a7)] - **test**: deflake connection refused proxy tests (Trivikram Kamat) [#&#8203;63395](nodejs/node#63395)
- \[[`1d61a29876`](nodejs/node@1d61a29876)] - **test**: avoid repeated writes in watch helper (Trivikram Kamat) [#&#8203;63386](nodejs/node#63386)
- \[[`2004e25387`](nodejs/node@2004e25387)] - **test**: deflake watch mode worker test (Trivikram Kamat) [#&#8203;63384](nodejs/node#63384)
- \[[`d691cccfc1`](nodejs/node@d691cccfc1)] - **test**: relax test-memory-usage arrayBuffers check (inoway46) [#&#8203;63244](nodejs/node#63244)
- \[[`0ff6bf853c`](nodejs/node@0ff6bf853c)] - **test**: reduce flakiness of `different-registry-per-thread` (Antoine du Hamel) [#&#8203;63244](nodejs/node#63244)
- \[[`d9f4e8e503`](nodejs/node@d9f4e8e503)] - **test**: fix flaky test-watch-mode-inspect timeout (Matteo Collina) [#&#8203;63361](nodejs/node#63361)
- \[[`6d7cd50328`](nodejs/node@6d7cd50328)] - **test**: relax min assertion in test-performance-eventloopdelay (Marco) [#&#8203;63100](nodejs/node#63100)
- \[[`9dafe1d2d8`](nodejs/node@9dafe1d2d8)] - **test**: avoid flaky restart sync in debugger exceptions test (Yuya Inoue) [#&#8203;62055](nodejs/node#62055)
- \[[`989b2de973`](nodejs/node@989b2de973)] - **test**: avoid initial-break wait in restart-message (inoway46) [#&#8203;62060](nodejs/node#62060)
- \[[`a072a25ee7`](nodejs/node@a072a25ee7)] - **test**: move FFI tests to `NATIVE_SUITES` (Antoine du Hamel) [#&#8203;63165](nodejs/node#63165)
- \[[`64efbfd878`](nodejs/node@64efbfd878)] - **test**: use ERM to destroy sqlite database handles after tests (RenΓ©) [#&#8203;63076](nodejs/node#63076)
- \[[`7dee66cd94`](nodejs/node@7dee66cd94)] - **test\_runner**: dont buffer unordered events in process isolation mode (Moshe Atlow) [#&#8203;63432](nodejs/node#63432)
- \[[`d257eec1e3`](nodejs/node@d257eec1e3)] - **test\_runner**: fix --test-rerun-failures swallowing failures on retry (Chemi Atlow) [#&#8203;63431](nodejs/node#63431)
- \[[`288c320e2f`](nodejs/node@288c320e2f)] - **test\_runner**: show replayed-from-attempt hint in spec reporter (Moshe Atlow) [#&#8203;63429](nodejs/node#63429)
- \[[`904bdf5bb4`](nodejs/node@904bdf5bb4)] - **test\_runner**: preserve run duration when using test-rerun (Moshe Atlow) [#&#8203;63429](nodejs/node#63429)
- \[[`df183d7bfa`](nodejs/node@df183d7bfa)] - **test\_runner**: avoid hanging on incomplete v8 frames (Ali Hassan) [#&#8203;62704](nodejs/node#62704)
- \[[`ec86c69726`](nodejs/node@ec86c69726)] - **test\_runner**: fix diagnostics channel context tracking (Moshe Atlow) [#&#8203;63283](nodejs/node#63283)
- \[[`94e5f63b83`](nodejs/node@94e5f63b83)] - **tls**: add unsupported renegotiation error (Filip Skokan) [#&#8203;63161](nodejs/node#63161)
- \[[`06d308fb61`](nodejs/node@06d308fb61)] - **tools**: prevent lib code from reading KeyObject and CryptoKey accessors (Filip Skokan) [#&#8203;63111](nodejs/node#63111)
- \[[`2e4a0d0c91`](nodejs/node@2e4a0d0c91)] - **tools**: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint (dependabot\[bot]) [#&#8203;63415](nodejs/node#63415)
- \[[`4c9666b366`](nodejs/node@4c9666b366)] - **tools**: skip commit-lint on backport pull requests (Marco) [#&#8203;63378](nodejs/node#63378)
- \[[`67d0c490a8`](nodejs/node@67d0c490a8)] - **tools**: fix skip of `test-internet` on forks (Antoine du Hamel) [#&#8203;63492](nodejs/node#63492)
- \[[`02f73c7cac`](nodejs/node@02f73c7cac)] - **tools**: bump the eslint group in /tools/eslint with 4 updates (dependabot\[bot]) [#&#8203;63075](nodejs/node#63075)
- \[[`5d016d3241`](nodejs/node@5d016d3241)] - **tools**: update gyp-next to 0.22.2 (Node.js GitHub Bot) [#&#8203;63374](nodejs/node#63374)
- \[[`55af0f0edb`](nodejs/node@55af0f0edb)] - **tools**: fix test426 updater (Antoine du Hamel) [#&#8203;63271](nodejs/node#63271)
- \[[`d8475e167a`](nodejs/node@d8475e167a)] - **tools**: use different branch for tool updates on staging branches (Antoine du Hamel) [#&#8203;63110](nodejs/node#63110)
- \[[`c605df9e50`](nodejs/node@c605df9e50)] - **util**: remove unused functions (Antoine du Hamel) [#&#8203;63612](nodejs/node#63612)
- \[[`fe4540ebdb`](nodejs/node@fe4540ebdb)] - **util**: create hex style cache and fast path (Guilherme AraΓΊjo) [#&#8203;62999](nodejs/node#62999)

### [`v24.17.0`](https://github.com/nodejs/node/releases/tag/v24.17.0): 2026-06-18, Version 24.17.0 'Krypton' (LTS), @&#8203;aduh95

[Compare Source](nodejs/node@v24.16.0...v24.17.0)

This is a security release.

##### Notable Changes

- (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
- (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
- (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
- (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
- (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
- (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
- (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
- (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
- (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
- (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
- (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

##### Commits

- \[[`9e4dfc7bba`](nodejs/node@9e4dfc7bba)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://github.com/nodejs-private/node-private/pull/878)
- \[[`cb2aed980c`](nodejs/node@cb2aed980c)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://github.com/nodejs-private/node-private/pull/890)
- \[[`a8a0d12875`](nodejs/node@a8a0d12875)] - **(CVE-2026-48937)** **deps**: fix integration issues with the latest nghttp2 (Tim Perry) [#&#8203;62891](nodejs/node#62891)
- \[[`66e6203c1c`](nodejs/node@66e6203c1c)] - **(SEMVER-MAJOR)** **deps**: update nghttp2 to 1.69.0 (Node.js GitHub Bot) [#&#8203;62891](nodejs/node#62891)
- \[[`dd627ced27`](nodejs/node@dd627ced27)] - **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot) [#&#8203;63820](nodejs/node#63820)
- \[[`684bae568f`](nodejs/node@684bae568f)] - **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) [#&#8203;63820](nodejs/node#63820)
- \[[`3a631e7f83`](nodejs/node@3a631e7f83)] - **deps**: fix aix implicit declaration in OpenSSL (Abdirahim Musse) [#&#8203;62656](nodejs/node#62656)
- \[[`cf44df3996`](nodejs/node@cf44df3996)] - **deps**: update undici to 7.28.0 (Node.js GitHub Bot) [#&#8203;63703](nodejs/node#63703)
- \[[`138c70294b`](nodejs/node@138c70294b)] - **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL bytes (Matteo Collina) [nodejs-private/node-private#868](https://github.com/nodejs-private/node-private/pull/868)
- \[[`be7e719c3f`](nodejs/node@be7e719c3f)] - **(CVE-2026-48931)** **http**: fix response queue poisoning in http.Agent (Matteo Collina) [nodejs-private/node-private#846](https://github.com/nodejs-private/node-private/pull/846)
- \[[`cc7c11b4d1`](nodejs/node@cc7c11b4d1)] - **(CVE-2026-48619)** **http2**: cap originSet size to prevent unbounded memory growth (Matteo Collina) [nodejs-private/node-private#855](https://github.com/nodejs-private/node-private/pull/855)
- \[[`9224427b92`](nodejs/node@9224427b92)] - **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel errors (Matteo Collina) [nodejs-private/node-private#867](https://github.com/nodejs-private/node-private/pull/867)
- \[[`cf85d54839`](nodejs/node@cf85d54839)] - **(CVE-2026-48935)** **permission**: disable FileHandle utimes with permission model (RafaelGSS) [nodejs-private/node-private#873](https://github.com/nodejs-private/node-private/pull/873)
- \[[`a1bbc24f96`](nodejs/node@a1bbc24f96)] - **(CVE-2026-48617)** **permission**: handle process.chdir on writereport (RafaelGSS) [nodejs-private/node-private#870](https://github.com/nodejs-private/node-private/pull/870)
- \[[`e3723ff2d6`](nodejs/node@e3723ff2d6)] - **test**: add session reuse host verification regressions (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854)
- \[[`a77af4867b`](nodejs/node@a77af4867b)] - **(CVE-2026-48934)** **tls**: bind reusable sessions to authenticated host (Matteo Collina) [nodejs-private/node-private#854](https://github.com/nodejs-private/node-private/pull/854)
- \[[`31beb4f707`](nodejs/node@31beb4f707)] - **(CVE-2026-48928)** **tls**: fix case-sensitive SNI context matching (Matteo Collina) [nodejs-private/node-private#857](https://github.com/nodejs-private/node-private/pull/857)
- \[[`8e75c73f91`](nodejs/node@8e75c73f91)] - **(CVE-2026-48618)** **tls**: normalize hostname for server identity checks (Matteo Collina) [nodejs-private/node-private#869](https://github.com/nodejs-private/node-private/pull/869)

</details>

---

### Configuration

πŸ“… **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

β™» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

πŸ”• **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzAuMTkiLCJ1cGRhdGVkSW5WZXIiOiI0My4xNzAuMTkiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Reviewed-on: https://git.walbeck.it/mwalbeck/docker-cyberchef/pulls/488
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

build Issues and PRs related to build files or the CI. commit-queue-failed An error occurred while landing this pull request using GitHub Actions. dependencies Pull requests that update a dependency file. dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. needs-ci PRs that need a full CI run. openssl Issues and PRs related to the OpenSSL dependency. tools Issues and PRs related to the tools directory. v8 engine Issues and PRs related to the V8 dependency.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants