[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
node (source)	stage	patch	26.12.0-alpine3.24 → 26.12.1-alpine3.24

---

Release Notes

nodejs/node (node)

v26.12.1: 2026-10-21, Version 26.12.1 (Current), @​aduh95 prepared by @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

• (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
• (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
• (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
• (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High
• (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268 (Evgenii Kliuchnikov) – High
• (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
• (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
• (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
• (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
• (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
• deps: V8: backport 93cd21e (Joyee Cheung)
• crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
• tls: reject chains containing blocked public keys (Ulises Gascon)
• deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
• tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
• crypto: harden X.509 conversion and formatting (Filip Skokan)

Commits

• [818e4ca061] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #​66877
• [fd3c87ed43] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966
• [acffa610db] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
• [7895a5cd2d] - deps: update undici to 8.12.2 (Node.js GitHub Bot) #​66721
• [12daa54d2e] - deps: V8: backport 93cd21e (Joyee Cheung) nodejs-private/node-private#999
• [6a8b3db7e2] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #​66868
• [a6040b50d9] - deps: brotli: cherry-pick 0ed4268 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
• [6b78ea171d] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
• [0683ee5f7d] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
• [e5cae10148] - Revert "module: synchronously load most ES modules" (Antoine du Hamel) #​66786
• [cc244131aa] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
• [0392385841] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
• [c273a408c9] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
• [a2caddd20e] - tls: reject chains containing blocked public keys (Ulises Gascon) #​66871
• [ad788ccd07] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
• [cd4b05469c] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#985
• [5fa440e0d7] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #​66855
• [745ad77156] - zlib: avoid caching invalid ZIP local headers (Matteo Collina) nodejs-private/node-private#981

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

➖ Are we earthbuild yet?

No change in "earthly" occurrences

📈 Overall Progress

Branch	Total Count
main	22
This PR	22
Difference	+0

---

Keep up the great work migrating from Earthly to Earthbuild! 🚀

💡 Tips for finding more occurrences

Run locally to see detailed breakdown:

./.github/scripts/count-earthly.sh

Note that the goal is not to reach 0.
There is anticipated to be at least some occurences of earthly in the source code due to backwards compatibility with config files and language constructs.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 11a7c431-f332-4a5c-9e94-61e19a6348e2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}