Skip to content

Update Node.js to v26.13.1 - #274

Merged
chrissearle merged 1 commit into
mainfrom
renovate/node-26.x
Nov 12, 2026
Merged

Update Node.js to v26.13.1#274
chrissearle merged 1 commit into
mainfrom
renovate/node-26.x

Conversation

@renovate

@renovate renovate Bot commented Nov 12, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
node (source) tools patch 26.13.0 → 26.13.1

Release Notes

nodejs/node (node)

v26.13.1: 2026-11-11, Version 26.13.1 'Lithium' (LTS), @​aduh95

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
  • (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
  • (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
  • (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
  • (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
  • (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
  • (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
  • (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
  • (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
  • (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
  • (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
  • (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
  • (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
  • (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
  • (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
  • (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
  • (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
  • (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
  • deps: update brotli to 1.2.1 (Node.js GitHub Bot)
  • deps: update llhttp to 9.4.4 (Antoine du Hamel)
  • deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
  • deps: update undici to 8.12.4 (Node.js GitHub Bot)
Commits

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

github-actions Bot commented Nov 12, 2026

Copy link
Copy Markdown

Terraform Plan

🚧 Changes detected — Plan: 1 to add, 0 to change, 1 to destroy.

Plan output 

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.ecr.aws_ecr_lifecycle_policy.this must be replaced
-/+ resource "aws_ecr_lifecycle_policy" "this" {
      ~ id          = "cupcake-cupcake" -> (known after apply)
      ~ policy      = jsonencode(
          ~ {
              ~ rules = [
                    {
                        action       = {
                            type = "expire"
                        }
                        description  = "Keep last 5 semver releases"
                        rulePriority = 1
                        selection    = {
                            countNumber   = 5
                            countType     = "imageCountMoreThan"
                            tagPrefixList = [
                                "v",
                            ]
                            tagStatus     = "tagged"
                        }
                    },
                  ~ {
                      ~ selection    = {
                          ~ tagPrefixList = [
                                "main-",
                              - "master-",
                            ]
                            # (3 unchanged attributes hidden)
                        }
                        # (3 unchanged attributes hidden)
                    },
                    {
                        action       = {
                            type = "expire"
                        }
                        description  = "Expire untagged images after 1 day(s)"
                        rulePriority = 3
                        selection    = {
                            countNumber = 1
                            countType   = "sinceImagePushed"
                            countUnit   = "days"
                            tagStatus   = "untagged"
                        }
                    },
                    # (1 unchanged element hidden)
                ]
            } # forces replacement
        )
      ~ registry_id = "553637109631" -> (known after apply)
        # (1 unchanged attribute hidden)
    }

Plan: 1 to add, 0 to change, 1 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

LLM Review

Risk: 🟢 LOW

Plan replaces a single ECR lifecycle policy (1 add, 1 destroy, 0 changes) to remove the "master-" tag prefix from the image-retention rule; no data-loss or security-impacting resources are affected.

  • 💥 [destruction] aws_ecr_lifecycle_policy.this is destroyed and recreated because the policy JSON changed (the 'forces replacement' marker). The resource is only a lifecycle policy, not the repository or images, so no images are deleted by this replacement. There is a brief window between destroy and create where the lifecycle rule is absent.
  • ✅ [routine] Rule priority 2 drops the 'master-' tagPrefixList entry, leaving only 'main-'. Images tagged with 'master-' will no longer be protected by the keep-last-N retention rule and will become eligible for expiry under that rule's logic. Confirm no active images use the 'master-' prefix before applying.
  • 💰 [cost] No new billable resources. Storage cost may change slightly depending on how many 'master-' tagged images are now expired by the lifecycle rule.
  • 🔒 [security] No IAM, security group, or public access changes in this plan.

@chrissearle
chrissearle merged commit 7403536 into main Nov 12, 2026
10 checks passed
@renovate
renovate Bot deleted the renovate/node-26.x branch November 12, 2026 10:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chrissearle