[renovate]

This PR contains the following updates:

Package	Type	Update	New value	References	Sourcegraph	Change	Age	Confidence
node (source)	engines	patch	>=22.23.5	homepage, source		>=22.23.4 → >=22.23.5
node	uses-with	patch	24.22.3	source		24.22.2 → 24.22.3
node (source)	final	patch	24.22.3-slim	homepage, source		24.22.2-slim → 24.22.3-slim
node (source)		patch	24.22.3	homepage, source		24.22.2 → 24.22.3
prettier (source)	devDependencies	minor	3.10.1	homepage, source		3.9.10 → 3.10.1

Test plan: CI should pass with updated dependencies. No review required: this is an automated dependency update PR.

---

Release Notes

nodejs/node (node)

v22.23.5: 2026-11-11, Version 22.23.5 'Jod' (LTS), @​aduh95

Compare Source

This is a security release.

Notable Changes

• (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
• (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
• (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
• (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
• (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
• (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
• (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
• (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
• (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
• (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
• (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
• (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
• (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
• (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
• (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
• deps: update llhttp to 9.4.4 (Antoine du Hamel)
• deps: update sqlite to 3.54.1 (Node.js GitHub Bot)

Commits

• [554fff40f0] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038
• [6577cbf231] - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) #​66816
• [61d93c6086] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #​66663
• [cd18f6bdff] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001
• [6cd7e80d68] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017
• [9bce421783] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026
• [30fd852c0d] - http2: detect streams abandoned by nghttp2 (Matteo Collina) #​66641
• [21fb5d0348] - http2: guard against null write request on cancelled stream (Matteo Collina) #​67252
• [af6fbb6564] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036
• [5c9eed3b1e] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967
• [5e497aec89] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
• [06af164d09] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030
• [209c7e4d83] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030
• [05e452f075] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030
• [67da864a89] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020
• [c841c6c7f1] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021
• [ea159e84dd] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037

actions/node-versions (node)

v24.22.3: 24.22.3

Compare Source

Node.js 24.22.3

prettier/prettier (prettier)

v3.10.1

Compare Source

diff

GraphQL: Fix empty selection set with comments (#​20504 by @​fisker)

# Input
fragment F on Query {
  # x
}

# Prettier 3.10.0
Error: Comment "x" was not printed. Please report this error!

# Prettier 3.10.1
fragment F on Query {
  # x
}

v3.10.0

Compare Source

diff

🔗 Release Notes

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.