v18.0.33

Update dependency npm to v11.4.1

Notable changes

• 3ed764a #​8308 Clarify script working directory behavior (fixes #​8305) (#​8308) (@​tarekwfa0110, @​owlstronaut)
• 2f30251 #​8314 remove references to skimdb.npmjs.com (#​8314) (@​shmam)
• 9cb9d50 #​8298 add contributor to changelog entry (#​8298) (@​wraithgar)
• workspace: @npmcli/[email protected]
• workspace: [email protected]
• workspace: [email protected]
• workspace: [email protected]
• workspace: [email protected]

npm/cli (npm)

v11.4.1

Compare Source

Documentation

• 3ed764a #​8308 Clarify script working directory behavior (fixes #​8305) (#​8308) (@​tarekwfa0110, @​owlstronaut)

Chores

• 2f30251 #​8314 remove references to skimdb.npmjs.com (#​8314) (@​shmam)
• 9cb9d50 #​8298 add contributor to changelog entry (#​8298) (@​wraithgar)

Dependencies

• workspace: @npmcli/[email protected]
• workspace: [email protected]
• workspace: [email protected]
• workspace: [email protected]
• workspace: [email protected]

List of commits

af16f2d (Update dependency npm to v11.4.1, 2025-05-21)

v18.0.32

Update Node.js to v22.16.0

Notable changes

• [c3ceaebb7a] - deps: update timezone to 2025b (Node.js GitHub Bot) #​57857
• [5059a746ec] - doc: add dario-piotrowicz to collaborators (Dario Piotrowicz) #​58102
• [c8ceaaf397] - (SEMVER-MINOR) doc: graduate multiple experimental apis (James M Snell) #​57765
• [e21b37d9df] - (SEMVER-MINOR) esm: graduate import.meta properties (James M Snell) #​58011
• [832640c35e] - (SEMVER-MINOR) esm: support top-level Wasm without package type (Guy Bedford) #​57610
• [c510391d2f] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.columns() (Colin Ihrig) #​57490
• [5d1230bec0] - (SEMVER-MINOR) src: set default config as node.config.json (Marco Ippolito) #​57171
• [30bb1ccbb0] - (SEMVER-MINOR) src: create THROW_ERR_OPTIONS_BEFORE_BOOTSTRAPPING (Marco Ippolito) #​57016
• [0350c6f478] - (SEMVER-MINOR) src: add config file support (Marco Ippolito) #​57016
• [e1d3a9e192] - (SEMVER-MINOR) src: add ExecutionAsyncId getter for any Context (Attila Szegedi) #​57820
• [0ec912f452] - (SEMVER-MINOR) stream: preserve AsyncLocalStorage context in finished() (Gürgün Dayıoğlu) #​57865
• [43490c8797] - (SEMVER-MINOR) util: add types.isFloat16Array() (Livia Medeiros) #​57879
• [dda6ca9172] - (SEMVER-MINOR) worker: add worker.getHeapStatistics() (Matteo Collina) #​57888
• [4252dc798c] - assert: support Float16Array in loose deep equality checks (Livia Medeiros) #​57881
• [1c7396b078] - assert,util: fix constructor lookup in deep equal comparison (Ruben Bridgewater) #​57876
• [1ded5f25c8] - assert,util: improve deep object comparison performance (Ruben Bridgewater) #​57648
• [696b5f85ca] - assert,util: improve unequal number comparison performance (Ruben Bridgewater) #​57619
• [775ee4d40f] - assert,util: improve array comparison (Ruben Bridgewater) #​57619
• [3766992ba4] - benchmark: add sqlite prepare select get (Vinícius Lourenço) #​58040
• [8390276be3] - benchmark: add sqlite prepare select all (Vinícius Lourenço) #​58040
• [6a9b79e5c1] - benchmark: add sqlite is transaction (Vinícius Lourenço) #​58040
• [f689f98344] - benchmark: add sqlite prepare insert (Vinícius Lourenço) #​58040
• [14a82804d7] - benchmark: disambiguate filename and dirname read perf (Antoine du Hamel) #​58056
• [e7e8256d35] - buffer: avoid creating unnecessary environment (Yagiz Nizipli) #​58053
• [d7d8e8e994] - buffer: define global v8::CFunction objects as const (Mert Can Altin) #​57676
• [f37633e85a] - build: use $(BUILDTYPE) when cleaning coverage files (Aviv Keller) #​57995
• [e5bf67fe77] - build: define python when generating out/Makefile (Aviv Keller) #​57970
• [718f874ae0] - build: fix zstd libname (Antoine du Hamel) #​57999
• [53c5fdcae1] - crypto: fix cross-realm SharedArrayBuffer validation (Antoine du Hamel) #​57974
• [78f4ffee5d] - crypto: fix cross-realm check of ArrayBuffer (Felipe Forbeck) #​57828
• [f606352b63] - crypto: forbid passing Float16Array to getRandomValues() (Livia Medeiros) #​57880
• [23c4e941c2] - crypto: remove BoringSSL dh-primes addition (Shelley Vohr) #​57023
• [8339d9bc14] - deps: V8: cherry-pick f915fa4 (Chengzhong Wu) #​55484
• [c2111dd126] - deps: V8: backport e5dbbba (Darshan Sen) #​58120
• [4cc49be951] - deps: update zstd to 1.5.7 (Node.js GitHub Bot) #​57940
• [c956d37c84] - deps: update zlib to 1.3.0.1-motley-780819f (Node.js GitHub Bot) #​57768
• [b5cd0eb590] - deps: update simdutf to 6.4.2 (Node.js GitHub Bot) #​57855
• [3eb6b814e9] - deps: update simdutf to 6.4.0 (Node.js GitHub Bot) #​56764
• [0be9fa3218] - deps: update icu to 77.1 (Node.js GitHub Bot) #​57455
• [d5cf4254fb] - doc: add HBSPS as triager (Wiyeong Seo) #​57980
• [ad0861dba0] - doc: add ambassaor message (Brian Muenzenmeyer) #​57600
• [0d3ec1aafe] - doc: fix misaligned options in vm.compileFunction() (Jimmy Leung) #​58145
• [1f70baf3b0] - doc: add missing options.signal to readlinePromises.createInterface() (Jimmy Leung) #​55456
• [ec6a48621f] - doc: fix typo of file zlib.md (yusheng chen) #​58093
• [37e360e386] - doc: make stability...

v18.0.31

Update dependency npm to v11.4.0

Notable changes

• a0e60fb #​8246 added init-private option (@​owlstronaut)
• 57aa89f #​8265 use run by default and run-script as the alias (#​8265) (@​owlstronaut)
• 0d4c023 #​8234 install: add package info to json output (#​8234) (@​wraithgar)
• 8794fd9 #​8297 powershell: support pipeline input with Invoke-Expression (#​8297) (@​alexsch01)
• b5173d1 #​8293 docs: corrected github_path (#​8293) (@​xaos7991)
• 2210d7a #​8278 powershell: use Invoke-Expression to pass args (#​8278) (@​alexsch01)
• 8669d09 #​8228 add otplease for enable-2fa, disable-2fa, access (#​8228) (@​reggi, @​wraithgar)
• 78b5a6f #​8269 correctly handle scenario where prefix is the cwd (#​8269) (@​owlstronaut, @​ficocelliguy)
• fdc3413 #​8221 exec: Fails to Execute Binaries Named After Shell Keywords (#​8221) (@​13sfaith)
• 4b08e2e #​8245 docs: prepare script runs for local package links (@​milaninfy)
• 1622ac4 #​8241 handle missing time in packument to prevent crash on npm view (@​owlstronaut)
• db8f5da #​8110 outdated: add dependent location in long output (#​8110) (@​milaninfy, @​wraithgar)
• d2498df #​8295 Remove CHANGELOG from never-ignored list (#​8295) (@​mrazauskas)
• 4d5c3c1 #​8283 fix overrides example in package-json.md (#​8283) (@​glasser)
• 96cc4f9 #​8226 format publish as code to highlight it (@​LiangYingC)
• 4990ea0 #​8226 clarify legacy token creation in npm login and adduser commands (@​LiangYingC)
• c97ef8a #​8246 [email protected]
• f48613d #​8292 @sigstore/[email protected]
• a4c5e74 #​8292 [email protected]
• b9156d2 #​8292 [email protected]
• 472a685 #​8292 [email protected]
• 988696e #​8292 @sigstore/[email protected]
• 569ac84 #​8292 [email protected]
• 2521c9b #​8233 @sigstore/[email protected]
• 3274d68 #​8233 @npmcli/[email protected]
• c263626 #​8233 [email protected]
• 78df711 #​8233 [email protected]
• e80e38e #​8292 dev dependency updates (@​wraithgar)
• 3231ee9 #​8244 update snapshots (@​owlstronaut)
• c561a33 #​8233 dev dependency updates (@​owlstronaut)
• 7eca19c #​8215 update workflow permissions for updating Node PR (@​owlstronaut)
• workspace: @npmcli/[email protected]
• workspace: @npmcli/[email protected]
• workspace: [email protected]
• workspace: [email protected]
• workspace: [email protected]
• workspace: [email protected]
• workspace: [email protected]
• workspace: [email protected]
• workspace: [email protected]

npm/cli (npm)

v11.4.0

Compare Source

Features

• a0e60fb #​8246 added init-private option (@​owlstronaut)
• 57aa89f #​8265 u...

v18.0.30

Update Node.js to v22.15.1

Notable changes

• (CVE-2025-23166) fix error handling on async crypto operation
• (CVE-2025-23165) add missing call to uv_fs_req_cleanup
• [edaf54da00] - fs: added test for missing call to uv_fs_req_cleanup (Justin Nietzel) #​57811
• [9f403e98ef] - (CVE-2025-23165) fs: add missing call to uv_fs_req_cleanup (Justin Nietzel) #​57811
• [f4494d38f1] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#709

nodejs/node (node)

v22.15.1: 2025-05-14, Version 22.15.1 'Jod' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

• (CVE-2025-23166) fix error handling on async crypto operation
• (CVE-2025-23165) add missing call to uv_fs_req_cleanup

Commits

• [edaf54da00] - fs: added test for missing call to uv_fs_req_cleanup (Justin Nietzel) #​57811
• [9f403e98ef] - (CVE-2025-23165) fs: add missing call to uv_fs_req_cleanup (Justin Nietzel) #​57811
• [f4494d38f1] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#709

List of commits

4411fa8 (Update Node.js to v22.15.1, 2025-05-14)

v18.0.29

Update Node.js to v22.15.0

Notable changes

nodejs/node (node)

v22.15.0

Compare Source

List of commits

3fe1e3e (Update Node.js to v22.15.0, 2025-04-23)

v18.0.28

Update dependency npm to v11.3.0

Notable changes

• b306d25 #​8129 add node-gyp as actual config (@​wraithgar)
• 2f5392a #​8135 make npm run autocomplete work with workspaces (#​8135) (@​terrainvidia)
• 26b6454 fix grammer in local path note (@​cgay)
• 1c0e83d #​7886 fix typo in package-json.md (#​7886) (@​stoneLeaf)
• 14efa57 #​8178 fix example package name in overrides explainer (#​8178) (@​G-Rath)
• 4183cba #​8162 logging: replace proceeding with preceding in loglevels details (#​8162) (@​tyleralbee)
• e57f112 #​8207 [email protected]
• 3daabb1 #​8207 [email protected]
• c7a7527 #​8207 [email protected]
• 20b09b6 #​8207 [email protected]
• 679bc4a #​8129 @npmcli/[email protected]
• 3fbed84 #​8207 install rimraf as a devdependency for smoke tests (@​owlstronaut)
• 43f0b41 #​8207 dev dependency updates (@​wraithgar)
• 26803bc #​8147 release integration node 23 yml (#​8147) (@​reggi)
• d679a1a #​8146 release integration node 23 (#​8146) (@​reggi)
• workspace: @npmcli/[email protected]
• workspace: @npmcli/[email protected]
• workspace: [email protected]
• workspace: [email protected]
• workspace: [email protected]
• workspace: [email protected]

npm/cli (npm)

v11.3.0

Compare Source

Features

• b306d25 #​8129 add node-gyp as actual config (@​wraithgar)

Bug Fixes

• 2f5392a #​8135 make npm run autocomplete work with workspaces (#​8135) (@​terrainvidia)

Documentation

• 26b6454 fix grammer in local path note (@​cgay)
• 1c0e83d #​7886 fix typo in package-json.md (#​7886) (@​stoneLeaf)
• 14efa57 #​8178 fix example package name in overrides explainer (#​8178) (@​G-Rath)
• 4183cba #​8162 logging: replace proceeding with preceding in loglevels details (#​8162) (@​tyleralbee)

Dependencies

• e57f112 #​8207 [email protected]
• 3daabb1 #​8207 [email protected]
• c7a7527 #​8207 [email protected]
• 20b09b6 #​8207 [email protected]
• 679bc4a #​8129 @npmcli/[email protected]

Chores

• 3fbed84 #​8207 install rimraf as a devdependency for smoke tests (@​owlstronaut)
• 43f0b41 #​8207 dev dependency updates (@​wraithgar)
• 26803bc #​8147 release integration node 23 yml (#​8147) (@​reggi)
• d679a1a #​8146 release integration node 23 (#​8146) (@​reggi)
• workspace: @npmcli/[email protected]
• workspace: @npmcli/[email protected]
• workspace: [email protected]
• workspace: [email protected]
• workspace: [email protected]
• workspace: [email protected]

List of commits

0944c76 (Update dependency npm to v11.3.0, 2025-04-08)

v18.0.27

Update dependency npm to v11.2.0

Notable changes

• 247ee1d #​8100 cache: add npx commands (@​wraithgar)
• 3a80a7b #​8081 add --init-type flag (#​8081) (@​reggi)
• 2a1e11f #​8071 move nerfDart list into @​npmcli/config (@​wraithgar)
• 8461186 #​8100 update npx cache if possible when spec is a range (@​wraithgar)
• e345cc5 #​8050 don't suggest npm update outside of valid engine range (#​8050) (@​milaninfy)
• 811ca29 #​8115 stop working around bug fixed in [email protected] (@​TrevorBurnham)
• 879303c #​8078 warn on invalid publishConfig (#​8078) (@​wraithgar)
• 41417de #​8080 warn when TUF fetching of keys fails (#​8080) (@​wraithgar)
• 593c849 #​8076 warn on invalid single-hyphen cli flags (#​8076) (@​wraithgar)
• 3d8b257 #​8100 @npmcli/[email protected]
• ab17523 #​8134 [email protected]
• 3cbe21a #​8134 [email protected]
• ee5e1aa #​8118 @npmcli/[email protected]
• 5df69b4 #​8118 [email protected]
• 80c3273 #​8118 [email protected]
• 7fd70fa #​8118 [email protected]
• 7aeffff #​8118 [email protected]
• b0c0490 #​8118 [email protected]
• ef49d6b #​8118 [email protected]
• 1399bfb #​8118 [email protected]
• 6b72107 #​8118 [email protected]
• c9ad0c4 #​8118 @npmcli/[email protected]
• b153927 #​8115 [email protected]
• f0f6265 #​8071 [email protected]
• cc72b89 #​8143 fix smoke tests to account for new release versions within a workspace (#​8143) (@​reggi)
• c3810bc #​8134 dev dependency updates (@​wraithgar)
• 9dc40e6 #​8118 dev dependency updates (@​wraithgar)
• 7ec0831 #​8118 update jsonpath-plus (@​wraithgar)
• ed85b01 #​8071 tests for config warnings/changes (@​wraithgar)
• workspace: @npmcli/[email protected]
• workspace: @npmcli/[email protected]
• workspace: [email protected]
• workspace: [email protected]
• workspace: [email protected]
• workspace: [email protected]

npm/cli (npm)

v11.2.0

Compare Source

Features

• 247ee1d #​8100 cache: add npx commands (@​wraithgar)
• 3a80a7b #​8081 add --init-type flag (#​8081) (@​reggi)
• 2a1e11f #​8071 move nerfDart list into @​npmcli/config (@​wraithgar)

Bug Fixes

• 8461186 #​8100 update npx cache if possible when spec is a range (@​wraithgar)
• e345cc5 #​8050 don't suggest npm update outside of valid engine range (#​8050) (@​milaninfy)
• 811ca29 #​8115 stop working around bug fixed in [email protected] (@​TrevorBurnham)
• 879303c #​8078 warn on invalid publishConfig (#​8078) (@​wraithgar)
• 41417de [#​8...

v18.0.26

Update Node.js to v22.14.0

Notable changes

• [82a9000e9e] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #​56566
• [b7fe54fc88] - (SEMVER-MINOR) fs: allow exclude option in globs to accept glob patterns (Daeyeon Jeong) #​56489
• [3ac92ef607] - (SEMVER-MINOR) lib: add typescript support to STDIN eval (Marco Ippolito) #​56359
• [1614e8e7bc] - (SEMVER-MINOR) module: add ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX (Marco Ippolito) #​56610
• [6d6cffa9cc] - (SEMVER-MINOR) module: add findPackageJSON util (Jacob Smith) #​55412
• [d35333ae18] - (SEMVER-MINOR) process: add process.ref() and process.unref() methods (James M Snell) #​56400
• [07ff3ddcb5] - (SEMVER-MINOR) sqlite: support TypedArray and DataView in StatementSync (Alex Yang) #​56385
• [94d3fe1b62] - (SEMVER-MINOR) src: add --disable-sigusr1 to prevent signal i/o thread (Rafael Gonzaga) #​56441
• [5afffb4415] - (SEMVER-MINOR) src,worker: add isInternalWorker (Carlos Espa) #​56469
• [697a851fb3] - (SEMVER-MINOR) test_runner: add TestContext.prototype.waitFor() (Colin Ihrig) #​56595
• [047537b48c] - (SEMVER-MINOR) test_runner: add t.assert.fileSnapshot() (Colin Ihrig) #​56459
• [926cf84e95] - (SEMVER-MINOR) test_runner: add assert.register() API (Colin Ihrig) #​56434
• [c658a8afdf] - (SEMVER-MINOR) worker: add eval ts input (Marco Ippolito) #​56394
• [bad1ad8650] - assert: make myers_diff function more performant (Giovanni Bucci) #​56303
• [e222e36f3b] - assert: make partialDeepStrictEqual work with urls and File prototypes (Giovanni Bucci) #​56231
• [e232789fe2] - assert: show diff when doing partial comparisons (Giovanni Bucci) #​56211
• [c99de1fdcf] - assert: make partialDeepStrictEqual throw when comparing [0] with [-0] (Giovanni) #​56237
• [2386fd5840] - benchmark: add validateStream to styleText bench (Rafael Gonzaga) #​56556
• [b197dfa7ec] - build: fix GN build for ngtcp2 (Cheng) #​56300
• [2a3cdd34ff] - build: test macos-13 on GitHub actions (Michaël Zasso) #​56307
• [12f716be0a] - build: build v8 with -fvisibility=hidden on macOS (Joyee Cheung) #​56275
• [c5ca15bd34] - child_process: fix parsing messages with splitted length field (Maksim Gorkov) #​56106
• [8346b8fc2c] - crypto: add missing return value check (Michael Dawson) #​56615
• [890eef20a1] - crypto: fix checkPrime crash with large buffers (Santiago Gimeno) #​56559
• [5edb7b5e87] - crypto: fix warning of ignoring return value (Cheng) #​56527
• [b89f123a0b] - crypto: make generatePrime/checkPrime interruptible (James M Snell) #​56460
• [63c1859e01] - deps: update corepack to 0.31.0 (Node.js GitHub Bot) #​56795
• [a48430d4d3] - deps: move inspector_protocol to deps (Chengzhong Wu) #​56649
• [74cccc824f] - deps: macro ENODATA is deprecated in libc++ (Cheng) #​56698
• [fa869ea0f2] - deps: fixup some minor coverity warnings (James M Snell) #​56612
• [1a4fa2b015] - deps: update amaro to 0.3.0 (Node.js GitHub Bot) #​56568
• [b47076fd82] - deps: update amaro to 0.2.2 (Node.js GitHub Bot) #​56568
• [46bd4b8731] - deps: update simdutf to 6.0.3 (Node.js GitHub Bot) #​56567
• [8ead9c693b] - deps: update simdutf to 5.7.2 (Node.js GitHub Bot) #​56388
• [18d4b502af] - deps: update amaro to 0.2.1 (Node.js GitHub Bot) #​56390
• [d938d7cc86] - deps: update googletest to 7d76a23 (Node.js GitHub Bot) #​56387
• [9761e7dccb] - deps: update googletest to e54519b (Node.js GitHub Bot) #​56370
• [8319dc6bc5] - deps: update ngtcp2 to 1.10.0 (Node.js GitHub Bot) #​56334
• [6eacd19d6a] - deps: update simdutf to 5.7.0 (Node.js GitHub Bot) #​56332
• [28bec2dda3] - diagnostics_channel: capture console messages (Stephen Belanger) #​56292
• [d519d33502] - doc: update macOS and Xcode versions for releases (Michaël Zasso) #​56337
• [fcfe650507] - doc: add note for features using InternalWorker with permission model (Antoine du Hamel) #​56706
• [efbba182b5] - doc: add entry to changelog about SQLite Session Extension (Bart Louwers) #​56318
• [31bf9c7dd9] - doc: move anatoli to emeritus (Michael Dawson) #​56592
• [6096e38c7c] - doc: fix styles of the expa...

v18.0.25

Update dependency npm to v11.1.0

Notable changes

• 7f6c997 #​8009 add dry-run to deprecate/undeprecate commands (@​wraithgar)
• 1764a37 #​8009 add npm undeprecate command (@​wraithgar)
• 31455b2 #​8054 publish: honor force for no dist tag and registry version check (#​8054) (@​reggi)
• dc31c1b #​8038 remove max-len linting bypasses (@​wraithgar)
• 8a911ff #​8038 publish: disregard deprecated versions when calculating highest version (@​wraithgar)
• 7f72944 #​8038 publish: accept publishConfig.tag to override highes semver check (@​wraithgar)
• ab9ddc0 #​7992 sbom: deduplicate sbom dependencies (#​7992) (@​bdehamer)
• f7da341 #​7980 search: properly display multiple search terms (#​7980) (@​wraithgar)
• 3644e79 #​8055 update readme for Node.js versions, remove badges (#​8055) (@​wraithgar)
• f1af61f #​8041 fix typos in "package-json" (#​8041) (@​maxkoryukov)
• e90c6fe #​8051 depth flag default value (#​8051) (@​milaninfy)
• 866b5ee #​8030 safer documentation urls, repos, packages (#​8030) (@​reggi)
• 7ddfbad #​8053 @npmcli/[email protected]
• 9473a86 #​8053 [email protected]
• a65e5ce #​8053 @sigstore/[email protected]
• 215ebe4 #​8053 [email protected]
• 61f00e3 #​8069 splits out smoke-tests from publish-dryrun tests (#​8069) (@​reggi)
• 6d0f46e #​8058 stop publish smoke from check git clean (#​8058) (@​reggi)
• 9281ebf #​8057 fix smoke tests prerelease needs separate string args (#​8057) (@​reggi)
• aa202e9 #​8056 smoke tests using a preid (#​8056) (@​reggi)
• 18e0449 #​8053 dev dependency updates (@​wraithgar)
• 859a71c #​8052 update node versions for release integration tests (#​8052) (@​wraithgar)
• 7e7961d #​8038 bump @​npmcli/eslint-config to 5.1.0 (@​wraithgar)
• workspace: @npmcli/[email protected]

npm/cli (npm)

v11.1.0

Compare Source

Features

• 7f6c997 #​8009 add dry-run to deprecate/undeprecate commands (@​wraithgar)
• 1764a37 #​8009 add npm undeprecate command (@​wraithgar)

Bug Fixes

• 31455b2 #​8054 publish: honor force for no dist tag and registry version check (#​8054) (@​reggi)
• dc31c1b #​8038 remove max-len linting bypasses (@​wraithgar)
• 8a911ff #​8038 publish: disregard deprecated versions when calculating highest version (@​wraithgar)
• 7f72944 #​8038 publish: accept publishConfig.tag to override highes semver check (@​wraithgar)
• ab9ddc0 #​7992 sbom: deduplicate sbom dependencies (#​7992) (@​bdehamer)
• f7da341 #​7980 search: properly display multiple search terms (#​7980) (@​wraithgar)

Documentation

• 3644e79 #​8055 update readme for Node.js versions, remove badges (#​8055) (@​wraithgar)
• f1af61f #​8041 fix typos in "package-json" ([#​8041](https://...

v18.0.24

Update dependency node to v22.13.1

Notable changes

• CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
• CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
• CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)
• CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)
• [520da342e0] - (CVE-2025-22150) deps: update undici to v6.21.1 (Matteo Collina) nodejs-private/node-private#662
• [99f217369f] - (CVE-2025-23084) path: fix path traversal in normalize() on Windows (Tobias Nießen) nodejs-private/node-private#555
• [984f735e35] - (CVE-2025-23085) src: fix HTTP2 mem leak on premature close and ERR_PROTO (RafaelGSS) nodejs-private/node-private#650
• [2446870618] - (CVE-2025-23083) src,loader,permission: throw on InternalWorker use (RafaelGSS) nodejs-private/node-private#651

nodejs/node (node)

v22.13.1: 2025-01-21, Version 22.13.1 'Jod' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

• CVE-2025-23083 - src,loader,permission: throw on InternalWorker use when permission model is enabled (High)
• CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
• CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)

Dependency update:

• CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Commits

• [520da342e0] - (CVE-2025-22150) deps: update undici to v6.21.1 (Matteo Collina) nodejs-private/node-private#662
• [99f217369f] - (CVE-2025-23084) path: fix path traversal in normalize() on Windows (Tobias Nießen) nodejs-private/node-private#555
• [984f735e35] - (CVE-2025-23085) src: fix HTTP2 mem leak on premature close and ERR_PROTO (RafaelGSS) nodejs-private/node-private#650
• [2446870618] - (CVE-2025-23083) src,loader,permission: throw on InternalWorker use (RafaelGSS) nodejs-private/node-private#651

List of commits

d416eb0 (Update dependency node to v22.13.1, 2025-01-21)