Skip to content

chore(deps): update node.js to v26 - #345

Open
ferrlabs-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-docker-images
Open

ferrlabs-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-docker-images

Conversation

@ferrlabs-renovate

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
node (source) final major 24-alpine → 26-alpine
node (source) stage major 24-alpine → 26-alpine

Release Notes

nodejs/node (node)

v26.13.0: 2026-10-28, Version 26.13.0 'Lithium' (LTS), @​richardlau

Compare Source

Notable Changes

This release marks the transition of Node.js 26.x into Long Term Support (LTS)
with the codename 'Lithium'. It will continue to receive updates through to
the end of April 2029.

Other than updating metadata, such as the process.release object, to reflect
that the release is LTS, no further changes from Node.js 26.12.1 are included.

If you are updating from an earlier Long Term Support release (e.g. Node.js 24
or 22 or earlier) please note that since Node.js 25 the official binaries for
Linux are linked against libatomic, which may need to be installed separately
depending on your Linux distribution.

v26.12.1: 2026-10-21, Version 26.12.1 (Current), @​aduh95 prepared by @​RafaelGSS

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
  • (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
  • (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
  • (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High
  • (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268 (Evgenii Kliuchnikov) – High
  • (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
  • (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
  • (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
  • (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
  • (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
  • deps: V8: backport 93cd21e (Joyee Cheung)
  • crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
  • tls: reject chains containing blocked public keys (Ulises Gascon)
  • deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
  • tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
  • crypto: harden X.509 conversion and formatting (Filip Skokan)
Commits

v26.12.0: 2026-10-14, Version 26.12.0 (Current), @​richardlau

Compare Source

Notable Changes
  • [1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #​66533
  • [7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #​66335
Commits

v26.11.1: 2026-10-07, Version 26.11.1 (Current), @​aduh95

Compare Source

Commits
  • [2dc4638e85] - Revert "build: toggle doc-kit verbosity based on V" (Antoine du Hamel)
  • [3febbc54ec] - Revert "build, doc: move to redesign" (Antoine du Hamel)
  • [173250e2e7] - Revert "tools: bump the doc group in /tools/doc with 4 updates" (Antoine du Hamel)

v26.10.0: 2026-09-22, Version 26.10.0 (Current), @​aduh95

Compare Source

Notable Changes
Commits

❗ Important

✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

Signed-off-by: ferrlabs-renovate[bot] <282300760+ferrlabs-renovate[bot]@users.noreply.github.com>

@ferrfleet-interne ferrfleet-interne Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What changed: mcp/Dockerfile moves both stages from node:24-alpine to node:26-alpine. From the Node 26.0.0 notes, the removals are http.Server.prototype.writeHeader() and the legacy _stream_* modules. V8 is 14.6, undici is 8, and NODE_MODULE_VERSION is 147. The repo's engines field is >=22 in both mcp/package.json and mcp/packages/ferrvault-mcp/package.json, so 26 satisfies it. I did not search the MCP sources for the removed APIs. The only runtime dependencies are @ferrlabs/mcp-core and zod, so @ferrlabs/mcp-core is the one place they could show up.

What may break here: mcp/Dockerfile:8 runs RUN corepack enable, and pnpm is only reachable through it. I could not confirm that Node 26 images still ship Corepack. The 26 notes only mention removing the Corepack docs page. The official node:26-alpine Dockerfile (docker-node, 26/alpine3.24) does not install Corepack separately. It extracts the upstream tarball, so Corepack would have to come from there. My recollection is that Node 25 stopped bundling it, but I have not verified that. If that is right, the build stage fails at corepack enable with "not found".

CI: Test / Test & Build, kind smoke test, CI / Test and CI / Lint were still running when I looked. Check whichever of them builds this image. If it fails at corepack enable, add RUN npm install -g corepack before it, since npm is still bundled. Alternatively, install pnpm directly with npm install -g pnpm@12.16.1, the version pinned in packageManager. I would pick the first, because it keeps the packageManager pin in control.

Nothing else in the Dockerfile depends on Node 26 behaviour. Alpine base wget for the healthcheck and uid 1000 (the node user) are unchanged in the 26 image.

Not approving yet, because the Corepack question is open. If CI goes green, this is a safe merge.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants